chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@supabase/ssr	^0.12.1 → ^0.12.3
@supabase/supabase-js (source)	^2.110.4 → ^2.110.7
better-sqlite3	^12.10.0 → ^12.11.1
docus	^5.12.1 → ^5.12.3
pnpm (source)	11.13.0 → 11.15.1
pnpm (source)	11.5.2 → 11.15.1
typescript (source)	5.6.3 → 5.9.3
vite (source)	^8.1.4 → ^8.1.5

---

Release Notes

supabase/ssr (@​supabase/ssr)

v0.12.3

Compare Source

Bug Fixes

• cookies: keep domain-scoped deletion in name-keyed cookie stores (#​258) (d3a8a98), closes #​256

v0.12.2

Compare Source

Bug Fixes

• align parseCookieHeader return type with getAll cookie method (#​239) (e8fe1d5), closes #​115

supabase/supabase-js (@​supabase/supabase-js)

v2.110.7

Compare Source

🩹 Fixes

• realtime: trigger set auth on INITIAL_SESSION event (#​2531)

❤️ Thank You

• Filipe Cabaço @​filipecabaco

v2.110.6

Compare Source

2.110.6 (2026-07-15)

🩹 Fixes

• postgrest: type hinted self-referencing embeds as arrays (#​2520)
• realtime: forward opts to send() in track() (#​2490)
• supabase: warn instead of throw for unrecognized sb_ API key subtypes (#​2526)

❤️ Thank You

• Franco Kaddour @​FrancoKaddour
• Katerina Skroumpelou @​mandarini

v2.110.5

Compare Source

2.110.5 (2026-07-14)

🩹 Fixes

• supabase: avoid edge runtime warning (#​2522)

❤️ Thank You

• Vaibhav @​7ttp

WiseLibs/better-sqlite3 (better-sqlite3)

v12.11.1

Compare Source

What's Changed

• Fix Electron v42 build errors on Windows by @​m4heshd in #​1488

Full Changelog: WiseLibs/better-sqlite3@v12.11.0...v12.11.1

v12.10.1

Compare Source

What's Changed

• Bump the github-actions group across 1 directory with 4 updates by @​dependabot[bot] in #​1451
• Fix V8 external API usage for Electron 42 by @​tstone-1 in #​1475

Full Changelog: WiseLibs/better-sqlite3@v12.10.0...v12.10.1

nuxt-content/docus (docus)

v5.12.3

Compare Source

Bug Fixes

• assistant: autofocus behaviour (#​1406) (aa42948)
• css: resolve app.config.ts source to an absolute path (#​1404) (b2486f4)

v5.12.2

Compare Source

Features

• assistant: refine tool display and streaming behavior (#​1390) (a2ac34c)

Bug Fixes

• layer: scope UI variant defaults to docus components (#​1395) (82abeca)

pnpm/pnpm (pnpm)

v11.15.1

Compare Source

v11.15.0: pnpm 11.15

Compare Source

Minor Changes

• Optional peer dependencies declared only via peerDependenciesMeta (for example debug's supports-color peer) are now resolved from a satisfying version already present in the dependency graph, the same way explicitly declared optional peer dependencies are. Previously such peers were only resolved this way when the package's metadata was read back from the lockfile, so an unrelated dependency change could rewrite peer resolutions across the whole lockfile.

Patch Changes

• Updated adm-zip to prevent crafted ZIP archives from causing excessive memory allocation.

• pnpm version -r no longer writes a versioning-ledger entry with no consumed intents as a bare intents: key, which the next run failed to read with ERR_PNPM_INVALID_VERSIONING_LEDGER. Empty intent lists are now written as intents: [], and the ledger reader accepts the bare form left by earlier releases.

• Fixed pnpr workspace resolution to preserve project names and versions for workspace: dependencies.

Platinum Sponsors

Gold Sponsors

v11.14.0: pnpm 11.14

Compare Source

Minor Changes

• peerDependencies now accept dependency specifiers that carry a scheme — a named-registry spec (<registry>:<version>), an npm: alias, or a file:/git/URL spec — instead of rejecting them with ERR_PNPM_INVALID_PEER_DEPENDENCY_SPECIFICATION #​13095. Such a peer is matched against the semver range carried by the specifier (work:5.x.x is checked as 5.x.x, npm:bar@^5 as ^5), or against * when it carries no version, while the original specifier still selects the package to auto-install. Bare name@version values, which are almost always a mistake, are still rejected.

• Added pnpm doctor, which diagnoses the pnpm installation and the environment it runs in: the versions and install method, whether the global bin directory is on PATH, whether the store and cache are writable, which link strategies (reflink, hardlink, symlink) the store's filesystem supports, registry connectivity, and an offline file: install that exercises the resolve/store/link path end to end. Each check reports how to fix what it finds, and the command exits non-zero when any check fails.

  Use --offline to skip the checks that need network access, --json for machine-readable output, and --benchmark to time the filesystem and install checks.

• Added support for executing multiple scripts matching a RegExp passed to pnpm run (e.g., pnpm run "/^build:.*/"), running matched scripts in deterministic lexicographical order. Restored the --sequential (-s) CLI option for pnpm run, which forces workspaceConcurrency to 1 so that matched scripts run sequentially one by one across and within packages.

Patch Changes

• Fixed pnpm install failing with ERR_PNPM_LOCKFILE_IS_SYMLINK when pnpm-lock.yaml is a symlink, as build sandboxes such as Bazel and Nix stage it #​13073. Reading a lockfile through a symlink is allowed again, and an install that leaves the lockfile unchanged no longer rewrites it, so --frozen-lockfile no longer needs to write at all. Writing a changed lockfile through a symlink is still refused, as that would redirect the write onto the symlink's target.

• Fixed frozen installs incorrectly treating equivalent Git dependency specifiers as a stale lockfile. See #​13039.

• pnpm owner ls now reports authentication and authorization failures (401/403) as dedicated errors that include the registry's response body, matching pnpm owner add/rm, instead of a generic Failed to fetch owners message.

• Recover from a metadata cache entry that disappears (concurrent cache cleanup, antivirus) after the registry has already answered the conditional request with 304 Not Modified. The metadata is re-requested once without cache validators instead of failing the install with ERR_PNPM_CACHE_MISSING_AFTER_304.

• A project pinned to a broken pnpm release via packageManager or devEngines.packageManager now reports which release is broken and what to do about it, instead of failing inside the installer. pnpm self-update already refused these releases; the version switch does too.

• Prevent broken-lockfile errors from including snippets of the lockfile's contents.

• pnpm self-update now checks that the version it installed can run before making it the active pnpm. A release that installs but cannot execute is discarded with an error instead of replacing a working installation.

• Fixed an out-of-memory regression when workspace projects concurrently resolve a package with large registry metadata pnpm/pnpm#13077.

• Fixed pnpm update rewriting exact version pins that use the = operator (for example =3.5.1) to a caret range (^3.5.1). Exact pins are now preserved and written back as the bare version. See #​12745.

Platinum Sponsors

Gold Sponsors

v11.13.1: pnpm 11.13.1

Compare Source

Patch Changes

• Fixed pnpm pack applying workspace-root ignore rules when a workspace package has its own .npmignore file.
• Keep the interactive minimumReleaseAge approval prompt visible during pnpm install. The progress reporter now pauses its redraws while a prompt is waiting for input instead of overwriting it, so the install no longer hangs on a question the user cannot see #​13019.
• Fixed pnpm self-update failing to link native platform binaries stored in sibling global virtual store slots.

microsoft/TypeScript (typescript)

v5.9.3: TypeScript 5.9.3

Compare Source

Note: this tag was recreated to point at the correct commit. The npm package contained the correct content.

For release notes, check out the release announcement

• fixed issues query for Typescript 5.9.0 (Beta).
• fixed issues query for Typescript 5.9.1 (RC).
• No specific changes for TypeScript 5.9.2 (Stable)
• fixed issues query for Typescript 5.9.3 (Stable).

Downloads are available on:

• npm

v5.9.2: TypeScript 5.9

Compare Source

Note: this tag was recreated to point at the correct commit. The npm package contained the correct content.

For release notes, check out the release announcement

• fixed issues query for Typescript 5.9.0 (Beta).
• fixed issues query for Typescript 5.9.1 (RC).
• No specific changes for TypeScript 5.9.2 (Stable)

Downloads are available on:

• npm

v5.8.3: TypeScript 5.8.3

Compare Source

Note: this tag was recreated to point at the correct commit. The npm package contained the correct content.

For release notes, check out the release announcement.

• fixed issues query for Typescript 5.8.0 (Beta).
• fixed issues query for Typescript 5.8.1 (RC).
• fixed issues query for Typescript 5.8.2 (Stable).
• fixed issues query for Typescript 5.8.3 (Stable).

Downloads are available on:

• npm

v5.8.2: TypeScript 5.8

Compare Source

For release notes, check out the release announcement.

• fixed issues query for Typescript 5.8.0 (Beta).
• fixed issues query for Typescript 5.8.1 (RC).
• fixed issues query for Typescript 5.8.2 (Stable).

Downloads are available on:

• npm

v5.7.3: TypeScript 5.7.3

Compare Source

For release notes, check out the release announcement.

• fixed issues query for Typescript 5.7.0 (Beta).
• fixed issues query for Typescript 5.7.1 (RC).
• fixed issues query for Typescript 5.7.2 (Stable).
• fixed issues query for Typescript 5.7.3 (Stable).

Downloads are available on npm

v5.7.2: TypeScript 5.7

Compare Source

For release notes, check out the release announcement.

• fixed issues query for Typescript 5.7.0 (Beta).
• fixed issues query for Typescript 5.7.1 (RC).
• fixed issues query for Typescript 5.7.2 (Stable).

Downloads are available on:

• npm

vitejs/vite (vite)

v8.1.5

Compare Source

Please refer to CHANGELOG.md for details.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
supabase	Ready	Preview	Jul 21, 2026 3:54am
supabase-demo	Ready	Preview	Jul 21, 2026 3:54am

[pkg-pr-new]

npm i https://pkg.pr.new/@nuxtjs/supabase@613

commit: db22820