[dependabot]

Bumps the minor-and-patch group with 7 updates in the / directory:

Package	From	To
@supabase/supabase-js	2.116.0	2.117.2
@oxlint/plugins	1.83.0	1.86.0
@types/node	26.6.1	26.6.3
jsdom	30.0.1	30.1.1
oxlint	1.83.0	1.86.0
prettier	3.9.7	3.9.9
vite	8.3.0	8.3.1

Updates @supabase/supabase-js from 2.116.0 to 2.117.2

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.117.2

2.117.2 (2026-09-25)

🩹 Fixes

• postgrest: avoid instantiation depth errors for large relationship unions (#2701)

❤️ Thank You

• Han Qiao @​sweatybridge

v2.117.2-canary.0

2.117.2-canary.0 (2026-09-24)

🩹 Fixes

• postgrest: avoid instantiation depth errors for large relationship unions (#2701)

❤️ Thank You

• Han Qiao @​sweatybridge

v2.117.1

2.117.1 (2026-09-23)

🩹 Fixes

• auth: return stored session when a refresh loses to another tab (#2698)

❤️ Thank You

• Katerina Skroumpelou @​mandarini

v2.117.1-canary.0

2.117.1-canary.0 (2026-09-23)

🩹 Fixes

• auth: return stored session when a refresh loses to another tab (#2698)

❤️ Thank You

• Katerina Skroumpelou @​mandarini

v2.117.0

2.117.0 (2026-09-22)

🚀 Features

• auth: forward options.mediation to navigator.credentials.get in signInWithPasskey (#2675)

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.117.2 (2026-09-25)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.117.1 (2026-09-23)

🩹 Fixes

• auth: return stored session when a refresh loses to another tab (#2698)

❤️ Thank You

• Katerina Skroumpelou @​mandarini

2.117.0 (2026-09-22)

🚀 Features

• auth: enable passkey API by default and deprecate experimental passkey opt-in (#2695)

❤️ Thank You

• fadymak

Commits

• 54c225d chore(release): version 2.117.1 changelogs (#2700)
• 739b351 fix(auth): return stored session when a refresh loses to another tab (#2698)
• f34d428 chore(release): version 2.117.0 changelogs (#2697)
• cc45ccf feat(auth): enable passkey API by default and deprecate experimental passkey ...
• c511286 docs(realtime): document relationship of accessToken() and heartbeat (#2680)
• 84af33f chore(release): version 2.116.0 changelogs (#2679)
• See full diff in compare view

Updates @oxlint/plugins from 1.83.0 to 1.86.0

Release notes

Sourced from @​oxlint/plugins's releases.

oxlint v1.86.0

🚀 Features

• 9d80eed linter/react/only-export-components: Support allowCompoundComponents (#27117) (Kuroda Kayn)
• e05b155 linter: Add typescript/no-generated-empty-object-type (#26958) (camc314)

🐛 Bug Fixes

• 8306aa4 linter/typescript/no-unnecessary-parameter-property-assignment: Account for parameter property reassignment (#26955) (camc314)
• 42dfbb5 linter/eslint/one-var: Keep declare when splitting declarations (#27081) (Cheolhee Lee)
• 2ba7e33 linter/eslint/require-await: Count await using as an await (#27080) (Cheolhee Lee)
• 611e4ed linter/plugins: Include executing selectors in JS plugin rule timings (#27111) (overlookmotel)
• 2cac66f react-compiler: Handle recursive function expressions (#26796) (Brennan Butler)
• e996e6c react-compiler: Treat zero-argument new Date as impure (#26894) (Boshen)
• 571cfa3 oxlint: Skip type-aware lint rules in type-check-only mode (#27076) (camc314)
• d0b2462 oxlint: Skip undefined children in CFG walker (#27075) (camc314)
• 5186328 parser: Handle HTML comment values (#22933) (Boshen)
• 0b630e8 linter/typescript/unified-signatures: Align rule with upstream (#26956) (camc314)
• ebb22f1 linter/node/no-exports-assign: Change category from style to suspicious (#26555) (Bartok)
• cce28a0 linter/import/no-duplicates: Distinguish import attributes (#26936) (camc314)
• feb733b linter/unicorn/prefer-spread: Stop checking string split calls (#26935) (camc314)
• 929e154 linter/eslint/no-unused-vars: Honor ignore patterns inside array rest bindings (#26923) (camc314)
• 5bdb9b8 linter/eslint/no-unused-vars: Recognize consumed update expressions (#26782) (camc314)
• 5c05bef linter/eslint/prefer-const: Ignore embedded assignments (#26920) (camc314)

⚡ Performance

• ded4c29 linter/eslint/no-unused-vars: Skip sequence checks when absent (#26921) (camc314)

oxlint v1.85.0

🚀 Features

• 415b742 oxlint,oxfmt: Do not discover nested config in Vite+ mode (#26763) (leaysgur)

oxlint v1.84.0 & oxfmt v0.69.0

Table of Contents

• Oxlint v1.84.0
• Oxfmt v0.69.0

Oxlint v1.84.0

🚀 Features

• 809090c oxlint,oxfmt: Find all vite.config.* variants (#26755) (leaysgur)
• a047b67 linter: Report JavaScript plugin rule timings (#26415) (Alexander Lichter)
• 2300898 linter/unicorn/no-unreadable-iife: Implement suggestion (#26658) (Mikhail Baev)

🐛 Bug Fixes

• 12cb547 linter/eslint/no-unused-vars: Report private namespace bindings (#26842) (camc314)

... (truncated)

Commits

• 2ae2939 release(apps): oxlint v1.86.0 && oxfmt v0.71.0 (#27132)
• 288d8cc release(apps): oxlint v1.85.0 && oxfmt v0.70.0 (#26903)
• f02a64a release(apps): oxlint v1.84.0 && oxfmt v0.69.0 (#26874)
• See full diff in compare view

Updates @types/node from 26.6.1 to 26.6.3

Commits

• See full diff in compare view

Updates jsdom from 30.0.1 to 30.1.1

Release notes

Sourced from jsdom's releases.

v30.1.1

• Fixed spurious window blur and focusout events and incorrect event.relatedTarget values when focusing an element after removing the previously focused element, which regressed in v30.1.0. (@​asamuzaK)
• Fixed focus and blur behavior across frames, and focusing the document's viewport through document.documentElement.focus(). (@​asamuzaK)
• Fixed focus targets removed or disabled by blur listeners becoming active, and text selections made by focus and blur listeners being overwritten. (@​asamuzaK)
• Fixed element.focus() incorrectly focusing disabled form controls and <input type="hidden"> elements with tabindex="". (@​scttcper)
• Fixed invalid style.setProperty() calls changing existing !important priorities, serialized styles, or mutation records. (@​FedgeNo)
• Fixed !important handling when updating CSS longhands after shorthands, using variables or CSS-wide keywords, and assigning style properties directly. (@​FedgeNo)
• Fixed <noscript> parsing with includeNodeLocations: true or inside frames to honor the runScripts option.
• Fixed the storageQuota option being ignored by frames.
• Fixed encoding detection of HTML and XML byte input to honor XML encoding declarations and detect UTF-16 without a byte order mark.
• Fixed exceptions caused by truncated charset parameters in <meta> elements, and encoding detection incorrectly using incomplete <meta> tags. (@​FedgeNo)
• Fixed XML serialization errors for namespaces named constructor, toString, __proto__, or "null", and incorrect reuse of namespace prefixes declared on sibling elements.
• Fixed element.innerHTML and element.outerHTML in XML documents to reject invalid characters in attribute values and avoid stack overflows on large strings.
• Fixed selector matching for :lang(), :nth-child(... of ...) after mutations, and :has() with duplicate IDs or nested logical pseudo-classes. (@​asamuzaK)

v30.1.0

jsdom is feeling the AGI!

This release is dedicated to @​scttcper, who unleashed @​codex upon jsdom and found tons of performance improvements. Along the way, he found and fixed many correctness issues as well.

We really appreciate his thoughtful PRs, which did a great job following the project's contribution guidelines, and were clearly human-curated, with their PR descriptions edited to be brief and respectful of the maintainers' time.

Thanks to @​scttcper, as well as all the other contributors of this release (most of whom were AI-assisted).

• Added named access to elements on document, such as document.myForm for <form name="myForm">. (@​vojtisprime11)
• Added QuotaExceededError, including its use for storage quota errors and oversized crypto.getRandomValues() requests.
• Added support for the relaxed DOM naming rules when creating elements, attributes, and document types.
• Improved performance of DOM construction, tree mutations, range operations, and live collection access, especially on large documents. (@​scttcper, @​erezrokah)
• Improved performance of getComputedStyle(), style changes, and CSS serialization. (@​scttcper, @​jhult)
• Improved performance of event dispatch, form control and label lookups, and updates to <select> elements and radio button groups. (@​scttcper)
• Reduced memory use when creating and working with DOM nodes, attributes, event listeners, and mutation observers. (@​scttcper)
• Changed window.close() to preserve access to the document and its DOM through retained references.
• Fixed element.querySelectorAll() returning no matches when the first part of the selector matches the element itself, which regressed in v30.0.0. (@​asamuzaK)
• Fixed case sensitivity in CSS attribute selectors, including selectors matching data-state="", title="", and other case-sensitive values. (@​asamuzaK)
• Fixed document.querySelector() failing to find a matching element when an earlier element has the same ID but does not match the rest of the selector. (@​vojtisprime11)
• Fixed :focus matching in shadow trees. (@​asamuzaK)
• Fixed DOM insertion and replacement, including valid document.replaceChildren() calls, invalid document element and doctype placements, and mutations during element.replaceWith().
• Fixed the ordering of script execution, custom element callbacks, iframe loading, and mutation observer notifications during DOM insertion, including in shadow trees.
• Fixed queued events and navigation continuing after window.close() or iframe removal, and prevented new scripts, resource loads, timers, and animation frames from starting in destroyed documents. (@​scttcper)
• Fixed parent documents waiting indefinitely for loading to finish when a child iframe removes itself during loading.
• Fixed request cancellation across redirects, during pending requestInterceptor() callbacks, and when reusing an XMLHttpRequest after aborting it.
• Fixed resource loading and JSDOM.fromURL() potentially hanging when response handling throws and response stream cleanup does not finish.
• Fixed successful cached resource loads being treated as aborted.
• Fixed getComputedStyle() and document.styleSheets using the wrong stylesheet order after inserting or updating <style> elements.
• Fixed getComputedStyle() ignoring nested @import and @media rules in imported stylesheets, and returning stale results after imports finish loading.
• Fixed style invalidation, stylesheet removal, and frame source updates in shadow trees.
• Fixed repeated getComputedStyle() calls changing case-sensitive background URLs, and inconsistent resolution of border shorthands containing system colors. (@​scttcper)
• Fixed computed border widths, including borderless elements incorrectly reporting 16px, which regressed in v30.0.0. (@​Alberto-BaseNet)
• Fixed getComputedStyle() to resolve 'font-weight' keywords to numeric values. (@​tianrking)
• Fixed getComputedStyle() to convert lengths to pixels inside CSS math functions containing percentages, and to resolve percentages in 'font-size' math functions. (@​soroushm)

... (truncated)

Commits

• 0a117f4 30.1.1
• 103f67d Remove unnecessary window cleanup from API tests
• cdda00a Test HTTP/2 document and subresource loading
• 7ab92ce Update @​asamuzakjp/dom-selector to v9.2.1
• d940c20 Share jsdom settings across descendant windows
• 6ba40cb Fix and simplify option propagation
• 3b3be70 Preserve CSS priorities across declaration updates
• 97b2758 Align focusing and unfocusing with HTML
• b7b460b Update w3c-xmlserializer to v6
• 71d562f Update html-encoding-sniffer to v7
• Additional commits viewable in compare view

Updates oxlint from 1.83.0 to 1.86.0

Release notes

Sourced from oxlint's releases.

oxlint v1.86.0

🚀 Features

• 9d80eed linter/react/only-export-components: Support allowCompoundComponents (#27117) (Kuroda Kayn)
• e05b155 linter: Add typescript/no-generated-empty-object-type (#26958) (camc314)

🐛 Bug Fixes

• 8306aa4 linter/typescript/no-unnecessary-parameter-property-assignment: Account for parameter property reassignment (#26955) (camc314)
• 42dfbb5 linter/eslint/one-var: Keep declare when splitting declarations (#27081) (Cheolhee Lee)
• 2ba7e33 linter/eslint/require-await: Count await using as an await (#27080) (Cheolhee Lee)
• 611e4ed linter/plugins: Include executing selectors in JS plugin rule timings (#27111) (overlookmotel)
• 2cac66f react-compiler: Handle recursive function expressions (#26796) (Brennan Butler)
• e996e6c react-compiler: Treat zero-argument new Date as impure (#26894) (Boshen)
• 571cfa3 oxlint: Skip type-aware lint rules in type-check-only mode (#27076) (camc314)
• d0b2462 oxlint: Skip undefined children in CFG walker (#27075) (camc314)
• 5186328 parser: Handle HTML comment values (#22933) (Boshen)
• 0b630e8 linter/typescript/unified-signatures: Align rule with upstream (#26956) (camc314)
• ebb22f1 linter/node/no-exports-assign: Change category from style to suspicious (#26555) (Bartok)
• cce28a0 linter/import/no-duplicates: Distinguish import attributes (#26936) (camc314)
• feb733b linter/unicorn/prefer-spread: Stop checking string split calls (#26935) (camc314)
• 929e154 linter/eslint/no-unused-vars: Honor ignore patterns inside array rest bindings (#26923) (camc314)
• 5bdb9b8 linter/eslint/no-unused-vars: Recognize consumed update expressions (#26782) (camc314)
• 5c05bef linter/eslint/prefer-const: Ignore embedded assignments (#26920) (camc314)

⚡ Performance

• ded4c29 linter/eslint/no-unused-vars: Skip sequence checks when absent (#26921) (camc314)

oxlint v1.85.0

🚀 Features

• 415b742 oxlint,oxfmt: Do not discover nested config in Vite+ mode (#26763) (leaysgur)

Changelog

Sourced from oxlint's changelog.

[1.86.0] - 2026-09-28

🚀 Features

• 9d80eed linter/react/only-export-components: Support allowCompoundComponents (#27117) (Kuroda Kayn)
• e05b155 linter: Add typescript/no-generated-empty-object-type (#26958) (camc314)

[1.82.0] - 2026-09-07

🚀 Features

• 6a0e19c linter/eslint/no-unmodified-loop-condition: Support checkConditionalExpressions option (#26249) (camc314)

[1.81.0] - 2026-08-31

📚 Documentation

• d5be037 linter/typescript/switch-exhaustiveness-check: Clarify default case comment pattern (#26100) (camc314)

[1.79.0] - 2026-08-18

💥 BREAKING CHANGES

• 8c4552d linter: [BREAKING] Split react/react-compiler into per-category rules (#25500) (Boshen)

🐛 Bug Fixes

• 228e8e0 linter: Resolve inactive React compiler rules (#25830) (Boshen)
• aa49d86 linter: Allow spread rule options in config types (#25675) (ch3rry)
• 36f8451 linter/eslint/no-eval: Align indirect default with ESLint (#25656) (camc314)
• beb724d linter/eslint/no-unused-vars: Report bare underscore parameters (#25663) (camc314)
• 4004c10 linter/eslint/no-irregular-whitespace: Check comments by default (#25660) (camc314)
• 285820e linter/no-large-snapshots: Precompile and document allowed snapshot matchers (#25611) (Mikhail Baev)
• 4df5835 linter: Allow capitalized built-in calls (#25516) (Boshen)

[1.78.0] - 2026-08-10

🚀 Features

• ccb8fe8 linter/jsdoc: Implement no-blank-blocks rule (#25207) (Mikhail Baev)
• d4a897c linter/eslint: Implement one-var rule (#24470) (Cole Ellison)
• 5ab9340 linter/jsx-a11y/anchor-has-content: Add options to match eslint (#24571) (Cole Ellison)

🐛 Bug Fixes

• 9573937 linter/typescript: Validate ban-ts-comment description_format (#25320) (Mikhail Baev)

[1.77.0] - 2026-08-03

🐛 Bug Fixes

... (truncated)

Commits

• 2ae2939 release(apps): oxlint v1.86.0 && oxfmt v0.71.0 (#27132)
• 9d80eed feat(linter/react/only-export-components): support allowCompoundComponents ...
• e05b155 feat(linter): add typescript/no-generated-empty-object-type (#26958)
• 88a0096 chore(oxlint): require tsgolint 7.0.2003 (#27021)
• 288d8cc release(apps): oxlint v1.85.0 && oxfmt v0.70.0 (#26903)
• f02a64a release(apps): oxlint v1.84.0 && oxfmt v0.69.0 (#26874)
• See full diff in compare view

Updates prettier from 3.9.7 to 3.9.9

Release notes

Sourced from prettier's releases.

3.9.9

• Markdown: Fix text with $ been incorrectly parsed as math syntax (#20140 by @​fisker)

🔗 Changelog

3.9.8

• Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by @​seiyab)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.9

diff

Markdown: Fix text with $ been incorrectly parsed as math syntax (#20140 by @​fisker)

<!-- Input -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR` from `c.sh`, before anything else runs here.
<!-- Prettier 3.9.8 -->
Uses $FOO from a.sh and b.sh, plus $BARfromc.sh, before anything else runs here.
<!-- Prettier 3.9.9 -->
Uses $FOO from a.sh and b.sh, plus $BAR from c.sh, before anything else runs here.

3.9.8

diff

Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by @​seiyab)

<!-- Input -->
If `module` is not a [`WebAssembly.Module`](https://github.com/prettier/prettier/blob/main/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module) object instance, a
{{jsxref("TypeError")}} is thrown.
<!-- Prettier 3.9.7 -->
If module is not a WebAssembly.Module object instance, a
{{jsxref("TypeError")}} is thrown.
<!-- Prettier 3.9.8 -->
If module is not a WebAssembly.Module object instance, a
{{jsxref("TypeError")}} is thrown.

Commits

• cdd17f2 Release 3.9.9
• dc7b896 Disable singleDollarTextMath in mdast-util-math (#20140)
• f9be58f Git blame ignore 3.9.8
• 88470cb Bump Prettier dependency to 3.9.8
• 9559cab Clean changelog_unreleased
• 4fc8ee8 Update dependents count
• 4f2ab67 Release 3.9.8
• 3d82af8 Update Regex related dependencies (#20082)
• 5ec8db1 [3.9.x] Markdown: Don't let Liquid objects interrupt paragraphs (#20087)
• 5b142ed Release Release @​prettier/plugin-hermes@​0.2.3, @​prettier/plugin-oxc@​0.2.3, an...
• Additional commits viewable in compare view

Updates vite from 8.3.0 to 8.3.1

Release notes

Sourced from vite's releases.

v8.3.1

Bug Fixes

• deps: update all non-major dependencies (#23482) (3c752c8)
• deps: update all non-major dependencies (#23537) (e8990c4)
• deps: update rolldown-related dependencies (#23483) (9aecbbf)
• handle server.ws: false in mergeConfig (#23511) (f68c0d5)
• merge build.rolldownOptions.output.comments correctly (#23514) (4aba8d8)
• optimizer: don't skip imports whose binding starts with type (#23540) (39330f4)
• optimizer: resolve pending discovered dep processing on close before init (#23567) (5f89433)
• server: avoid reinitializing watcher when adding file after server close (#23572) (6f831f9)
• sourcemap: skip URL source roots when injecting sources content (#23519) (04fc30a)

Miscellaneous Chores

• merge prereleases in changelog (#23466) (99bd9d1)
• optimizer: add debug log when waiting for dep before init (#23566) (63567c7)
• update optimizeDeps.include comment (#23489) (6a84c72)

Code Refactoring

• assets regexp use non-capture (#23491) (f4b4431)
• remove duplicate configurations (#23532) (9abd99b)
• replace find with some (#23554) (af7cdf6)

Changelog

Sourced from vite's changelog.

8.3.1 (2026-09-24)

Bug Fixes

• deps: update all non-major dependencies (#23482) (3c752c8)
• deps: update all non-major dependencies (#23537) (e8990c4)
• deps: update rolldown-related dependencies (#23483) (9aecbbf)
• handle server.ws: false in mergeConfig (#23511) (f68c0d5)
• merge build.rolldownOptions.output.comments correctly (#23514) (4aba8d8)
• optimizer: don't skip imports whose binding starts with type (#23540) (39330f4)
• optimizer: resolve pending discovered dep processing on close before init (#23567) (5f89433)
• server: avoid reinitializing watcher when adding file after server close (#23572) (6f831f9)
• sourcemap: skip URL source roots when injecting sources content (#23519) (04fc30a)

Miscellaneous Chores

• merge prereleases in changelog (#23466) (99bd9d1)
• optimizer: add debug log when waiting for dep before init (#23566) (63567c7)
• update optimizeDeps.include comment (#23489) (6a84c72)

Code Refactoring

• assets regexp use non-capture (#23491) (f4b4431)
• remove duplicate configurations (#23532) (9abd99b)
• replace find with some (#23554) (af7cdf6)

Commits

• 39ddf7c release: v8.3.1 (#23573)
• f68c0d5 fix: handle server.ws: false in mergeConfig (#23511)
• 6f831f9 fix(server): avoid reinitializing watcher when adding file after server close...
• 04fc30a fix(sourcemap): skip URL source roots when injecting sources content (#23519)
• 5f89433 fix(optimizer): resolve pending discovered dep processing on close before ini...
• 63567c7 chore(optimizer): add debug log when waiting for dep before init (#23566)
• e8990c4 fix(deps): update all non-major dependencies (#23537)
• af7cdf6 refactor: replace find with some (#23554)
• 39330f4 fix(optimizer): don't skip imports whose binding starts with type (#23540)
• 9abd99b refactor: remove duplicate configurations (#23532)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
collect	Ready	Preview	Oct 3, 2026 6:24pm UTC

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.