Skip to content

chore(deps): bump the minor-and-patch group across 1 directory with 13 updates - #63

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-a5347a7de2
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-a5347a7de2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 17, 2026 •

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 13 updates in the / directory:

Package From To
@supabase/supabase-js 2.116.0 2.117.3
react 19.3.0 19.3.1
react-dom 19.3.0 19.3.1
zod 4.6.5 4.6.7
@oxlint/plugins 1.83.0 1.88.0
@testing-library/user-event 14.6.7 14.6.8
@types/node 26.6.1 26.6.5
@vitejs/plugin-react 6.1.1 6.1.2
axe-core 4.13.0 4.14.0
jsdom 30.0.1 30.1.2
oxlint 1.83.0 1.88.0
prettier 3.9.7 3.9.10
vite 8.3.0 8.3.4

Updates @supabase/supabase-js from 2.116.0 to 2.117.3

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.117.3

2.117.3 (2026-10-07)

🩹 Fixes

  • deps: bump next to patch RCE in realtime-js example (#2733)
  • functions: send a Blob or File with its own content type (#2714)
  • postgrest: treat TimeoutError as an abort in retry guard (#2732)
  • storage: send multipart fields before files (#2736)

❤️ Thank You

v2.117.3-canary.1

2.117.3-canary.1 (2026-10-07)

🩹 Fixes

  • storage: send multipart fields before files (#2736)

❤️ Thank You

v2.117.3-canary.0

2.117.3-canary.0 (2026-10-02)

🩹 Fixes

  • deps: bump next to patch RCE in realtime-js example (#2733)
  • functions: send a Blob or File with its own content type (#2714)
  • postgrest: treat TimeoutError as an abort in retry guard (#2732)

❤️ Thank You

v2.117.2

2.117.2 (2026-09-25)

🩹 Fixes

  • postgrest: avoid instantiation depth errors for large relationship unions (#2701)

❤️ Thank You

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.117.3 (2026-10-07)

🩹 Fixes

  • storage: send multipart fields before files (#2736)

❤️ Thank You

2.117.2 (2026-09-25)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.117.1 (2026-09-23)

🩹 Fixes

  • auth: return stored session when a refresh loses to another tab (#2698)

❤️ Thank You

2.117.0 (2026-09-22)

🚀 Features

  • auth: enable passkey API by default and deprecate experimental passkey opt-in (#2695)

❤️ Thank You

  • fadymak
Commits
  • 4d23055 fix(storage): send multipart fields before files (#2736)
  • a684cf9 chore(release): version 2.117.2 changelogs (#2707)
  • 54c225d chore(release): version 2.117.1 changelogs (#2700)
  • 739b351 fix(auth): return stored session when a refresh loses to another tab (#2698)
  • f34d428 chore(release): version 2.117.0 changelogs (#2697)
  • cc45ccf feat(auth): enable passkey API by default and deprecate experimental passkey ...
  • c511286 docs(realtime): document relationship of accessToken() and heartbeat (#2680)
  • 84af33f chore(release): version 2.116.0 changelogs (#2679)
  • See full diff in compare view

Updates react from 19.3.0 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

Commits

Updates react-dom from 19.3.0 to 19.3.1

Release notes

Sourced from react-dom's releases.

19.3.1 (October 14th, 2026)

React Server Components

Commits

Updates zod from 4.6.5 to 4.6.7

Release notes

Sourced from zod's releases.

v4.6.7

Commits:

  • b500a2ee95134f81d74da7911d7378dd2853d042 4.6.7

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

  • 0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini
  • 9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales
  • 34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note
  • 74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)
  • b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors
  • 8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze
  • bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles
  • c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)
  • a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)
  • a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)
  • 529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6
  • 9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why
Commits
  • b500a2e 4.6.7
  • 9c21983 ci: stage at verbose so a failed OIDC token exchange says why
  • 529f78d 4.6.6
  • a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
  • a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
  • c42596b release: hold the run on the release-approval environment until the staged ve...
  • bacad51 docs: square the Code for Japan logo to match the other bronze tiles
  • 8fb2faf docs: crop the Code for Japan logo and list it first in bronze
  • b2ef983 docs: add Code for Japan to bronze sponsors
  • 74304ce release: stage npm versions instead of publishing them (#6622)
  • Additional commits viewable in compare view

Updates @oxlint/plugins from 1.83.0 to 1.88.0

Release notes

Sourced from @​oxlint/plugins's releases.

oxlint v1.88.0

💥 BREAKING CHANGES

  • 7730e14 ast: [BREAKING] Refactor comment attachment storage (#27512) (camc314)
  • c904b61 ast: [BREAKING] Add comment attachment storage (#27393) (camc314)

🚀 Features

  • bde9f69 oxlint/lsp: Show config errors to LSP client (#25486) (Sysix)
  • 3c361a7 linter/unicorn/prefer-query-selector: Add allowWithVariables option (#27346) (Mikhail Baev)

🐛 Bug Fixes

  • 82ecc43 linter/sort-keys: Compare natural order like ESLint (#27579) (Dunqing)
  • 598ac03 linter/unicorn/prefer-bigint-literals: Unwrap redundant constructor call; don't auto-fix for lost precision (#25690) (Jacob Bandes-Storch)
  • 2512213 linter: Prevent conflicting type import fixes (#27409) (camc314)
  • 2349a31 oxfmt: Follow symlinked configs in discovery (#27389) (leaysgur)
  • 6e573f9 oxlint,oxfmt: Set stderr blocking (#27363) (leaysgur)

⚡ Performance

  • 91b588c linter/oxc/bad-array-method-on-arguments: Check arguments references once (#26930) (camc314)
  • c5f47ed linter/plugins: Inline firstCommentAtOrAfter into call sites (#27539) (overlookmotel)
  • c5f9235 linter/plugins: Use shift over multiply for powers of 2 (#27536) (overlookmotel)
  • 8c57c5e linter: Share one source per file across type-aware diagnostics (#27462) (Max Schwenk)
  • 19c227d minifier: Use ident when checking specific id names (#27208) (Armano)

📚 Documentation

  • 98cc2b4 linter/plugins: Improve documentation for firstCommentAtOrAfter (#27538) (overlookmotel)
  • 3bb54f6 linter: Update stale comment (#27519) (overlookmotel)
  • 848a4e7 linter: Update fix metadata for tsgolint rules that already provide fixes (#27408) (Mikhail Baev)

oxlint v1.87.0

🚀 Features

  • 42dcfd2 linter/react/no-unescaped-entities: Implement suggestion (#27292) (Mikhail Baev)
  • cd4510d linter/unicorn/no-useless-switch-case: Implement suggestion (#27245) (Mikhail Baev)
  • 1a7c902 linter/react/jsx-no-target-blank: Implement suggestion (#27181) (Mikhail Baev)

🐛 Bug Fixes

  • 176b4b9 linter/jsx-a11y/label-has-associated-control: Validate label attribute values (#27302) (sama Pyb)
  • 7d381c3 linter/jsx-a11y/mouse-events-have-key-events: Handle nullish event handlers (#27306) (sama Pyb)
  • 4e09837 linter/jsx-a11y/lang: Validate lang expression strings (#27304) (sama Pyb)
  • 7d28a66 linter/unicorn/numeric-separators-style: Report misgrouped BigInt literals (#27207) (breken)
  • e928322 linter/unicorn/no-zero-fractions: Parenthesize separator and large integers in fixer (#27206) (breken)
  • 3d61a59 parser: Validate TypeScript type member separators (#27222) (camc314)
  • f08236b linter/eslint/prefer-exponentiation-operator: Preserve autofix precedence (#27150) (camc314)
  • 7d60ae3 linter/valid-title: Continue checks after allowed words (#27146) (Cameron)

... (truncated)

Commits

Updates @testing-library/user-event from 14.6.7 to 14.6.8

Release notes

Sourced from @​testing-library/user-event's releases.

v14.6.8

14.6.8 (2026-10-13)

Bug Fixes

  • treat programmatic null input values as empty string (#1329) (1951eb7)
Commits

Updates @types/node from 26.6.1 to 26.6.5

Commits

Updates @vitejs/plugin-react from 6.1.1 to 6.1.2

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.1.2

Fix HMR for compound components (#1484)

Adding or removing a component from a compound component was not handled, creating stale updates. Doing this now triggers hmr invalidate on the file and propagates the invalidation to importers.

Fix compiler.logDiagnostics option not working (#1483)

With oxc-transform-react >= 0.148, the logDiagnostics was not working. This version fixes it and requires oxc-transform-react >= 0.152 as a peer dependency if you are using the compiler option. compiler.logDiagnostics option is now deprecated and should be swapped for the builtin compiler.reportDiagnostics.

Disable refresh for non-jsx with compiler enabled (fix #1478) (#1485)

When the compiler was enabled, TS files could trigger fast refresh which would cause runtime errors. The logic now follows what the builtin oxc plugin in Vite does.

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.1.2 (2026-10-05)

Fix HMR for compound components (#1484)

Adding or removing a component from a compound component was not handled, creating stale updates. Doing this now triggers hmr invalidate on the file and propagates the invalidation to importers.

Fix compiler.logDiagnostics option not working (#1483)

With oxc-transform-react >= 0.148, the logDiagnostics was not working. This version fixes it and requires oxc-transform-react >= 0.152 as a peer dependency if you are using the compiler option. compiler.logDiagnostics option is now deprecated and should be swapped for the builtin compiler.reportDiagnostics.

Disable refresh for non-jsx with compiler enabled (fix #1478) (#1485)

When the compiler was enabled, TS files could trigger fast refresh which would cause runtime errors. The logic now follows what the builtin oxc plugin in Vite does.

Commits

Updates axe-core from 4.13.0 to 4.14.0

Release notes

Sourced from axe-core's releases.

Release 4.14.0

This release enables a new rule, and introduces new violations in some existing rules. These can cause the issue totals to go up from a previous version. Similarly we've included various bug fixes to false positives which may see the issue count go down as well. This release focused on various performance improvements which should speed runs up 20% - 40% on most pages. On especially large pages we've measured a 15x performance improvement.

Features

Bug Fixes

Changelog

Sourced from axe-core's changelog.

4.14.0 (2026-10-05)

Features

Bug Fixes

Commits
  • e797173 chore(release): v4.14.0 (#5438)
  • 6976881 chore(release): 4.14.0
  • d53cb0a fix(label-content-name-mismatch): add support for cjk word splitting (#5437)
  • 35a38d8 fix(aria-required-children): explain presentational children that cannot be i...
  • 2ba0812 fix(target-size): ignore overlapping links with the same destination (#5428)
  • 1e33c6c fix(aria-allowed-attr): report case-sensitive aria attributes with non-lowerc...
  • f59642e chore: bump mocha from 11.8.0 to 12.0.2 (#5426)
  • 6efcb6e chore: bump emoji-regex from 10.6.0 to 11.0.0 (#5427)
  • 2da49a3 chore: bump the npm-low-risk group across 1 directory with 7 updates (#5425)
  • aa4a0a1 fix(aria-hidden-focus): suggest removing aria-hidden in the fail messages (#5...
  • Additional commits viewable in compare view

Updates jsdom from 30.0.1 to 30.1.2

Release notes

Sourced from jsdom's releases.

v30.1.2

  • Updated URLs to support Unicode v18.0.0 in internationalized domain names.
  • Reduced package size and memory use for CSS property definitions. (@​scttcper)
  • Fixed severe slowdowns when building large DOM trees, including SVG charts with D3, which regressed in v30.1.0. (@​cmdcolin)
  • Fixed exponentially slow reads of empty inherited CSS custom properties in deeply nested documents, and custom properties incorrectly inheriting past an initial reset. (@​scttcper)
  • Fixed getComputedStyle() returning stale results after editing stylesheet declarations, selectors, or media queries, including in imported stylesheets.
  • Fixed selector matching and computed styles after changes to form control checkedness, indeterminacy, selection, values, and validity, including during form resets and canceled clicks.
  • Fixed computed styles for :focus, :focus-visible, :focus-within, and selectors containing them after focus changes, including inside focus and blur listeners. (@​asamuzaK)
  • Fixed element.focus() incorrectly focusing elements hidden by 'display', including through shadow hosts and slots, and elements excluded by shadow DOM slot assignment. (@​asamuzaK)
  • Fixed getComputedStyle() throwing for elements without inline-style support, including XML and MathML elements.
  • Fixed a memory leak where stylesheet parsing retained the last parsed stylesheet's window after window.close().
  • Fixed memory growth from long-lived MutationObserver instances retaining bookkeeping for garbage-collected nodes. (@​scttcper)
  • Fixed retained select.selectedOptions collections becoming stale after selection changes and form resets.
  • Fixed rejection of negative CSS sizing values, including for 'min-width', 'min-height', 'max-width', and 'max-height', which regressed in v30.1.0.
  • Fixed handling of deeply nested color-mix() expressions, including exceptions during color resolution. (@​asamuzaK)

v30.1.1

  • Fixed spurious window blur and focusout events and incorrect event.relatedTarget values when focusing an element after removing the previously focused element, which regressed in v30.1.0. (@​asamuzaK)
  • Fixed focus and blur behavior across frames, and focusing the document's viewport through document.documentEl...

    Description has been truncated

…3 updates

Bumps the minor-and-patch group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.116.0` | `2.117.3` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.3.0` | `19.3.1` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.3.0` | `19.3.1` |
| [zod](https://github.com/colinhacks/zod) | `4.6.5` | `4.6.7` |
| [@oxlint/plugins](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugins) | `1.83.0` | `1.88.0` |
| [@testing-library/user-event](https://github.com/testing-library/user-event) | `14.6.7` | `14.6.8` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.1` | `26.6.5` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.1.1` | `6.1.2` |
| [axe-core](https://github.com/dequelabs/axe-core) | `4.13.0` | `4.14.0` |
| [jsdom](https://github.com/jsdom/jsdom) | `30.0.1` | `30.1.2` |
| [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.83.0` | `1.88.0` |
| [prettier](https://github.com/prettier/prettier) | `3.9.7` | `3.9.10` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.3.0` | `8.3.4` |



Updates `@supabase/supabase-js` from 2.116.0 to 2.117.3
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.117.3/packages/core/supabase-js)

Updates `react` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react)

Updates `react-dom` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom)

Updates `zod` from 4.6.5 to 4.6.7
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.6.5...v4.6.7)

Updates `@oxlint/plugins` from 1.83.0 to 1.88.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.88.0/npm/oxlint-plugins)

Updates `@testing-library/user-event` from 14.6.7 to 14.6.8
- [Release notes](https://github.com/testing-library/user-event/releases)
- [Changelog](https://github.com/testing-library/user-event/blob/main/CHANGELOG.md)
- [Commits](testing-library/user-event@v14.6.7...v14.6.8)

Updates `@types/node` from 26.6.1 to 26.6.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@vitejs/plugin-react` from 6.1.1 to 6.1.2
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.2/packages/plugin-react)

Updates `axe-core` from 4.13.0 to 4.14.0
- [Release notes](https://github.com/dequelabs/axe-core/releases)
- [Changelog](https://github.com/dequelabs/axe-core/blob/develop/CHANGELOG.md)
- [Commits](dequelabs/axe-core@v4.13.0...v4.14.0)

Updates `jsdom` from 30.0.1 to 30.1.2
- [Release notes](https://github.com/jsdom/jsdom/releases)
- [Commits](jsdom/jsdom@v30.0.1...v30.1.2)

Updates `oxlint` from 1.83.0 to 1.88.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.88.0/npm/oxlint)

Updates `prettier` from 3.9.7 to 3.9.10
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.9.7...3.9.10)

Updates `vite` from 8.3.0 to 8.3.4
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.4/packages/vite)

---
updated-dependencies:
- dependency-name: "@supabase/supabase-js"
  dependency-version: 2.117.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: react
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: react-dom
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: zod
  dependency-version: 4.6.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@oxlint/plugins"
  dependency-version: 1.88.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@testing-library/user-event"
  dependency-version: 14.6.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@types/node"
  dependency-version: 26.6.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.1.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: axe-core
  dependency-version: 4.14.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: jsdom
  dependency-version: 30.1.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: oxlint
  dependency-version: 1.88.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: prettier
  dependency-version: 3.9.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: vite
  dependency-version: 8.3.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 17, 2026
@vercel

vercel Bot commented Oct 17, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
collect Ready Ready Preview Oct 17, 2026 6:24pm UTC

@dependabot dependabot Bot added the javascript Pull requests that update javascript code label Oct 17, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 24, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 24, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/minor-and-patch-a5347a7de2 branch October 24, 2026 18:23

This branch was successfully deployed

1 active deployment
Preview — 2317ef6b Deployed Oct 17, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants