Skip to content

fix(deps): bump the npm-major group across 1 directory with 12 updates - #6121

Closed
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/npm-major-ff61c0a4bc
Closed

fix(deps): bump the npm-major group across 1 directory with 12 updates#6121
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/npm-major-ff61c0a4bc

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-major group with 12 updates in the / directory:

Package From To
pkg-pr-new 0.0.82 0.0.86
jose 6.2.4 6.2.6
@types/react 19.2.17 19.2.18
posthog-node 5.46.1 5.47.3
fumadocs-core 16.13.0 16.14.0
fumadocs-mdx 15.2.0 15.2.1
fumadocs-ui 16.13.0 16.14.0
@types/react-dom 19.2.3 19.2.4
@nx/devkit 23.1.0 23.1.1
knip 6.29.0 6.31.0
nx 23.1.0 23.1.1
tldts 6.1.86 7.4.10

Updates pkg-pr-new from 0.0.82 to 0.0.86

Commits

Updates jose from 6.2.4 to 6.2.6

Release notes

Sourced from jose's releases.

v6.2.6

Fixes

  • types: accept host CryptoKey declarations (b48a15b)

v6.2.5

Fixes

  • compare claim values for falsy validation options (eb86956)
  • forward key management parameters for a single JWE recipient (2d4f801)
  • handle a zero-length JWE additional authenticated data (16ca398)
  • reject a generateKeyPair crv option the algorithm does not imply (76364e9)
  • reject an unencoded payload in the JWS Compact Serialization (01d053f)
  • reject characters outside the Base64URL alphabet (0ebb971), references #879
  • reject duplicate "crit" values when producing (31d60e1)
  • reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (5df3fed)
  • reject truncated ASN.1 key data (7a16c66)
  • surface non-ASCII token segments as JOSE errors (194fe11)
  • types: correct JWK and CryptoKey types (62a196d)
  • types: correct key resolver and JWT header types (e95f8c4)
  • validate the clockTolerance and currentDate options are finite (ab2f18d)

Documentation

  • correct subpaths and API documentation (2daec38)
  • document consumer-supplied type parameters (9e9f66c)
  • stop claiming the JWK "use" parameter is used during import (47a07b2)
  • update CHANGELOG.md (fc51bf5)

Refactor

  • assert key shape and type from the entry (971057e)
  • avoid 32-bit truncation of the AES-CBC-HMAC AAD bit length (1c8c6e9)
  • correct swapped JWE unprotected header type error messages (894c498)
  • describe each JWS algorithm once (7375028)
  • discriminate a key once (0b59a69)
  • fold single-consumer modules into their consumers (c2f0ca3)
  • generate and import keys from the entry (da69b68)
  • keep JWE out of the JWKS and embedded-JWK paths (241dd48)
  • keep JWS and JWE out of each other's bundles (2a98564)
  • parse a Protected Header in one place (30f72af)
  • resolve the content encryption algorithm once (98b50ab)
  • tighten key property checks (fe0dc3b)
  • types: add discriminated JOSE error types (f7f764e)
  • types: add JOSE identifier unions and JWK narrowing (2a20f49)
  • types: improve key and result inference (cb25e77)
  • types: trim published declaration comments (544f179)
  • unify base64 decode errors (3a91833)
  • validate each token once rather than once per layer (bbdae09)
  • write each algorithm identifier once (73d83b5)
Changelog

Sourced from jose's changelog.

6.2.6 (2026-07-31)

Fixes

  • types: accept host CryptoKey declarations (b48a15b)

6.2.5 (2026-07-29)

Fixes

  • compare claim values for falsy validation options (eb86956)
  • forward key management parameters for a single JWE recipient (2d4f801)
  • handle a zero-length JWE additional authenticated data (16ca398)
  • reject a generateKeyPair crv option the algorithm does not imply (76364e9)
  • reject an unencoded payload in the JWS Compact Serialization (01d053f)
  • reject characters outside the Base64URL alphabet (0ebb971), references #879
  • reject duplicate "crit" values when producing (31d60e1)
  • reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (5df3fed)
  • reject truncated ASN.1 key data (7a16c66)
  • surface non-ASCII token segments as JOSE errors (194fe11)
  • types: correct JWK and CryptoKey types (62a196d)
  • types: correct key resolver and JWT header types (e95f8c4)
  • validate the clockTolerance and currentDate options are finite (ab2f18d)

Documentation

  • correct subpaths and API documentation (2daec38)
  • document consumer-supplied type parameters (9e9f66c)
  • stop claiming the JWK "use" parameter is used during import (47a07b2)
  • update CHANGELOG.md (fc51bf5)

Refactor

  • assert key shape and type from the entry (971057e)
  • avoid 32-bit truncation of the AES-CBC-HMAC AAD bit length (1c8c6e9)
  • correct swapped JWE unprotected header type error messages (894c498)
  • describe each JWS algorithm once (7375028)
  • discriminate a key once (0b59a69)
  • fold single-consumer modules into their consumers (c2f0ca3)
  • generate and import keys from the entry (da69b68)
  • keep JWE out of the JWKS and embedded-JWK paths (241dd48)
  • keep JWS and JWE out of each other's bundles (2a98564)
  • parse a Protected Header in one place (30f72af)
  • resolve the content encryption algorithm once (98b50ab)
  • tighten key property checks (fe0dc3b)
  • types: add discriminated JOSE error types (f7f764e)
  • types: add JOSE identifier unions and JWK narrowing (2a20f49)
  • types: improve key and result inference (cb25e77)
  • types: trim published declaration comments (544f179)
  • unify base64 decode errors (3a91833)

... (truncated)

Commits
  • a269a17 chore(release): 6.2.6
  • 25c2a4f build: refactor postchangelog to a script
  • b48a15b fix(types): accept host CryptoKey declarations
  • de353df ci: track staged npm release availability
  • 832c1af chore: cleanup after release
  • 3bac350 chore(release): 6.2.5
  • 544f179 refactor(types): trim published declaration comments
  • ef6b73e ci: enforce the family split and check the built dist
  • c2f0ca3 refactor: fold single-consumer modules into their consumers
  • 0b59a69 refactor: discriminate a key once
  • Additional commits viewable in compare view

Updates @types/react from 19.2.17 to 19.2.18

Commits

Updates posthog-node from 5.46.1 to 5.47.3

Release notes

Sourced from posthog-node's releases.

posthog-node@5.47.3

5.47.3

Patch Changes

  • #4349 0e2b371 Thanks @​marandaneto! - Apply the feature flag definition request timeout while consuming the response body. (2026-07-31)

  • #4349 0e2b371 Thanks @​marandaneto! - Keep the feature flag definition request timeout active until the request settles. (2026-07-31)

posthog-node@5.47.2

5.47.2

Patch Changes

  • #4332 b9a241e Thanks @​ioannisj! - Fix identify() leaving a user anonymous when the supplied ID already matches the persisted distinct ID (for example after a non-identified bootstrap seeded the same ID). The user is now marked identified and a person-processed $set event is captured. Ports the same fix from posthog-js (browser) to the shared core used by React Native, Node, and posthog-js-lite. (2026-07-31)
  • Updated dependencies [b9a241e]:
    • @​posthog/core@​1.46.1

posthog-node@5.47.1

5.47.1

Patch Changes

posthog-node@5.47.0

5.47.0

Minor Changes

  • #4308 6e7f3ae Thanks @​ablaszkiewicz! - Emit the release id that posthog-cli injects into your bundle as $release_id on $exception events, so PostHog can attach exceptions to a release without joining through symbol sets. Adds getInjectedReleaseId() to @posthog/core. The property is only attached when an injected release id can be read. (2026-07-30)

Patch Changes

  • Updated dependencies [6e7f3ae]:
    • @​posthog/core@​1.46.0
Changelog

Sourced from posthog-node's changelog.

5.47.3

Patch Changes

  • #4349 0e2b371 Thanks @​marandaneto! - Apply the feature flag definition request timeout while consuming the response body. (2026-07-31)

  • #4349 0e2b371 Thanks @​marandaneto! - Keep the feature flag definition request timeout active until the request settles. (2026-07-31)

5.47.2

Patch Changes

  • #4332 b9a241e Thanks @​ioannisj! - Fix identify() leaving a user anonymous when the supplied ID already matches the persisted distinct ID (for example after a non-identified bootstrap seeded the same ID). The user is now marked identified and a person-processed $set event is captured. Ports the same fix from posthog-js (browser) to the shared core used by React Native, Node, and posthog-js-lite. (2026-07-31)
  • Updated dependencies [b9a241e]:
    • @​posthog/core@​1.46.1

5.47.1

Patch Changes

5.47.0

Minor Changes

  • #4308 6e7f3ae Thanks @​ablaszkiewicz! - Emit the release id that posthog-cli injects into your bundle as $release_id on $exception events, so PostHog can attach exceptions to a release without joining through symbol sets. Adds getInjectedReleaseId() to @posthog/core. The property is only attached when an injected release id can be read. (2026-07-30)

Patch Changes

  • Updated dependencies [6e7f3ae]:
    • @​posthog/core@​1.46.0
Commits
  • 4e4aab7 chore: update versions and lockfile [version bump]
  • 0e2b371 fix(node): keep feature flag definition timeout active (#4349)
  • 557798d chore: update versions and lockfile [version bump]
  • cbc7b22 chore: update versions and lockfile [version bump]
  • 15aad20 fix(node): isolate NestJS context per subscription (#4351)
  • 4ef8a41 chore: update versions and lockfile [version bump]
  • 6e7f3ae feat: emit $release_id from the injected release id (#4308)
  • 3b2e68d fix: prevent Jest worker resource leaks (#4247)
  • See full diff in compare view

Updates fumadocs-core from 16.13.0 to 16.14.0

Release notes

Sourced from fumadocs-core's releases.

fumadocs@16.14.0

  • @​fumadocs/base-ui@​16.14.0
  • fumadocs-core@16.14.0
  • fumadocs-ui@16.14.0

Replace Orama with ZBSearch, zero-config i18n search

The built-in search engine moved from @orama/orama to ZBSearch, a near drop-in successor. All module paths and APIs are unchanged, and search now works with every language out of the box: the new default multilingual mode uses Unicode word segmentation, so i18n search needs zero config.

import { createFromSource } from 'fumadocs-core/search/server';
// no localeMap, no @orama/tokenizers, CJK included
export const { GET } = createFromSource(source);

All locales now share a single search database — results are filtered by the locale of your pages at query time. Same for static mode:

import { staticClient } from 'fumadocs-core/search/client/orama-static';
const client = staticClient({ locale });

Renames

  • oramaStaticClient → staticClient (old name kept as deprecated alias)
  • initOrama → initDB, it now creates a ZBSearch instance and is optional — the exported data restores the tokenizer on load

Deprecated

  • localeMap is no longer needed. It still works for language-specific stemming/stop-words and keeps the legacy per-locale databases when specified.

Notes for advanced usage

  • language, components, plugins and search options are now typed against ZBSearch instead of @orama/orama — custom tokenizers or plugins written for Orama must be swapped to their ZBSearch equivalents.
  • The exported static search data is now a ZBSearch database (i18n exports became a single unified database), so server and client should be on the same fumadocs-core version.
  • @orama/orama and @orama/tokenizers can be removed from your dependencies unless you use them directly. Orama Cloud integrations (fumadocs-core/search/orama-cloud) are unaffected.
Commits
  • 81c88c6 Version Packages (#3445)
  • 4108f03 chore: fix example builds
  • a279c17 fix(mdx): workaround for base ui issues
  • f29a484 refactor(*): migrate non-rsc examples to macro api
  • f845513 feat(mdx): browser helpers for macro
  • e0d374c refactor(*): migrate examples & docs to macro API
  • 4047bf7 feat(mdx): improve vite plugin usage
  • b1636d5 chore: bump deps
  • d1245c4 refactor(ui): build tailwind css via tsdown hooks
  • 693bb19 docs: mention MDX macro usage
  • Additional commits viewable in compare view

Updates fumadocs-mdx from 15.2.0 to 15.2.1

Release notes

Sourced from fumadocs-mdx's releases.

fumadocs-mdx@15.2.1

Support simpler fumadocsMdx vite plugin usage

Use the fumadocsMdx method instead for better syntax around macro usage.

Support browser helpers for Macro API

Use preload & lazy body renderer on non-rsc environment.

Commits
  • 81c88c6 Version Packages (#3445)
  • 4108f03 chore: fix example builds
  • a279c17 fix(mdx): workaround for base ui issues
  • f29a484 refactor(*): migrate non-rsc examples to macro api
  • f845513 feat(mdx): browser helpers for macro
  • e0d374c refactor(*): migrate examples & docs to macro API
  • 4047bf7 feat(mdx): improve vite plugin usage
  • b1636d5 chore: bump deps
  • d1245c4 refactor(ui): build tailwind css via tsdown hooks
  • 693bb19 docs: mention MDX macro usage
  • Additional commits viewable in compare view

Updates fumadocs-ui from 16.13.0 to 16.14.0

Release notes

Sourced from fumadocs-ui's releases.

fumadocs@16.14.0

  • @​fumadocs/base-ui@​16.14.0
  • fumadocs-core@16.14.0
  • fumadocs-ui@16.14.0

Replace Orama with ZBSearch, zero-config i18n search

The built-in search engine moved from @orama/orama to ZBSearch, a near drop-in successor. All module paths and APIs are unchanged, and search now works with every language out of the box: the new default multilingual mode uses Unicode word segmentation, so i18n search needs zero config.

import { createFromSource } from 'fumadocs-core/search/server';
// no localeMap, no @orama/tokenizers, CJK included
export const { GET } = createFromSource(source);

All locales now share a single search database — results are filtered by the locale of your pages at query time. Same for static mode:

import { staticClient } from 'fumadocs-core/search/client/orama-static';
const client = staticClient({ locale });

Renames

  • oramaStaticClient → staticClient (old name kept as deprecated alias)
  • initOrama → initDB, it now creates a ZBSearch instance and is optional — the exported data restores the tokenizer on load

Deprecated

  • localeMap is no longer needed. It still works for language-specific stemming/stop-words and keeps the legacy per-locale databases when specified.

Notes for advanced usage

  • language, components, plugins and search options are now typed against ZBSearch instead of @orama/orama — custom tokenizers or plugins written for Orama must be swapped to their ZBSearch equivalents.
  • The exported static search data is now a ZBSearch database (i18n exports became a single unified database), so server and client should be on the same fumadocs-core version.
  • @orama/orama and @orama/tokenizers can be removed from your dependencies unless you use them directly. Orama Cloud integrations (fumadocs-core/search/orama-cloud) are unaffected.
Commits
  • 81c88c6 Version Packages (#3445)
  • 4108f03 chore: fix example builds
  • a279c17 fix(mdx): workaround for base ui issues
  • f29a484 refactor(*): migrate non-rsc examples to macro api
  • f845513 feat(mdx): browser helpers for macro
  • e0d374c refactor(*): migrate examples & docs to macro API
  • 4047bf7 feat(mdx): improve vite plugin usage
  • b1636d5 chore: bump deps
  • d1245c4 refactor(ui): build tailwind css via tsdown hooks
  • 693bb19 docs: mention MDX macro usage
  • Additional commits viewable in compare view

Updates @types/react-dom from 19.2.3 to 19.2.4

Commits

Updates @nx/devkit from 23.1.0 to 23.1.1

Release notes

Sourced from @​nx/devkit's releases.

23.1.1 (2026-07-30)

🚀 Features

  • core: derive stable repo key from normalized remote and relative path (#36439)
  • repo: add react + vite + vitest + playwright example (#35921)

🩹 Fixes

  • angular-rspack: speed up builds and align behavior with the esbuild application builder (#36268, #34936)
  • bundling: support TypeScript esbuildConfig files in the esbuild executor (#36352, #36349)
  • bundling: acknowledge @​swc/core build scripts when configuring rollup (#36412)
  • core: speed up npm lockfile parsing (#36216)
  • core: speed up lockfile parsing and catalog resolution (#36223)
  • core: show performance report recommendations only when actionable (#36344)
  • core: close daemon log descriptors after spawn to avoid Node 26 crash (#36280)
  • core: prevent shell injection in nx import (#36348)
  • core: correct the 22.6.0 gitignore and analytics migration wiring (#36356)
  • core: support npm 12 and pnpm in the package provenance check (#36354, #36338)
  • core: honor pnpm minimumReleaseAge config on pnpm 11 (#36335, #36330)
  • core: support pnpm 11 patched dependency hashes (#36360)
  • core: resolve name refs copied into pattern-matched target arrays (#36359)
  • core: resolve source-loaded plugin transitive workspace imports (#36296)
  • core: unbreak pnpm 11 installs by acknowledging build-script deps from generators (#36302)
  • core: include continuous and default-config dependencies in show target (#36374)
  • core: make unit tests pass locally regardless of invoking package manager (#35994)
  • core: respect --aiAgents none to skip AI agent file generation (#34944, #34692)
  • core: use --config.frozen-lockfile=false for pnpm add during migrate (#36337)
  • core: run selected projects with --exclude-task-dependencies (#35562)
  • core: stop passing git revisions through a shell in affected commands (#36379)
  • core: collect trickling watcher bursts fully on daemon force-flush (#36391)
  • core: report tasks running in another Nx process in the inline TUI (#36341)
  • core: stop ratatui cursor queries from racing the TUI event stream (#36318)
  • core: render critical-path tasks as a nested list in the job summary (#36394)
  • core: keep pnpm-workspace.yaml comments and read package.json as jsonc (#36411)
  • core: support multiple brace groups in workspace glob matching (#36395)
  • core: handle CRLF line endings in pnpm multi-document lockfiles (#36419, #35828, #35840)
  • core: correct glob pattern expansion for ZeroOrOne groups (#31857)
  • core: stop re-querying confirmed cache misses in task orchestrator (#36301, #35632)
  • core: sample project graph perf span telemetry per session at 10% (#36420)
  • core: strip terminal query sequences when replaying task output (#36432)
  • core: preserve FORCE_COLOR=0 intent for forked child tasks (#35293)
  • core: handle colons in target name when resolving inputs to generate graph (#36429, #33710)
  • core: merge default plugins through the source-map-aware merge path (#36257)
  • core: keep nx migrate on the requested version when release-age gates interfere (#36444)
  • core: avoid bogus duplicate project name errors when generating nested apps (#36458)
  • core: pin typescript in preset dependencies so npm cannot hoist typescript 7 (#36497)
  • core: bump pinned axios and brace-expansion past vulnerable versions (#36507, #36474)
  • core: parse pnpm lockfiles that omit the packages block (#36512)
  • core: keep real dependencies when omitting peers from npm temp installs (#36518)

... (truncated)

Commits
  • 1210aac fix(devkit): resolve ensurePackage against the workspace (#36496)
  • dd97e9c fix(core): avoid bogus duplicate project name errors when generating nested a...
  • 5b6abe1 fix(core): unbreak pnpm 11 installs by acknowledging build-script deps from g...
  • 1ec8682 cleanup(devkit): remove catalog utils copy and reuse nx implementation (#36350)
  • 268394a fix(core): speed up lockfile parsing and catalog resolution (#36223)
  • See full diff in compare view

Updates knip from 6.29.0 to 6.31.0

Release notes

Sourced from knip's releases.

Release 6.31.0

  • feat: Add basic support for Marko 6 and 5 (#1914) (c6b151642701f9b4864ddb5ea8e40580623f59d1) - thanks @​caseycarroll!
  • Use Array.from in Marko compiler (5aadf47a22bdfd43bb8ad4082768e07fe37fc5ca)
  • Update release-it and fix release script flags (6fa9c269c65c0923965924226a5ccf0778842967)
  • Downgrade @​types/vscode to match extension engines range (6d8e9bf5200cf982d0bc801469c4e2be5627e5b8)

Release 6.30.0

  • docs: migrate to Starlight Blog plugin (#1854) (c89e3e3c9) - thanks @​trueberryless!
  • Include workspace dependencies in scoped runs (resolve #1901) (a75309eda)
  • Simplify workspace assembly (b3ac16411)
  • Document export declaration safety (ef98a7682)
  • Read object jsPlugin specifiers from Vite+ config (#1879) (3ea6a92d4) - thanks @​matchai!
  • Compile gitignore negations once (6884cdb20)
  • Cache Node test script detection (d970f67d8)
  • Track only enabled workspace plugins (67d48268a)
  • Skip unsupported Vite config command (545bb2d36)
  • Add SARIF reporter (ce11cf5d4)
  • Track catalog refs in pnpm dlx scripts (resolve #1885, close #1886) (102189a1a)
  • Report unresolved catalog references (b2b86c3e5)
  • Track catalog references across scoped runs (resolve #1905) (f0365bae0)
  • Track script catalog references across scoped runs (9b3ab3778)
  • Remove tsc from ignoreBinaries (a0a283040)
  • fix: detect dynamic imports in Svelte component templates (#1908) (aa303fb04) - thanks @​firatciftci!
  • fix(remark): support all types of dependency names (#1911) (3441bea3a) - thanks @​voxpelli!
  • Update sanity snapshot (d04aa04e5)
  • feat(stryker): add ts extensions (#1910) (cfc50886e) - thanks @​christopher-buss!
  • Adopt @​e18e/eslint-plugin (adf2511ab)
  • Remove Workleap from sponsors (d4f6af9ff)
  • Update dependencies (3f61542f6)
  • Add ES2023 array types to TypeScript 5 CI (360a47157)
  • Update sentry snapshot (7defc1853)
  • Analyze published type dependencies (resolve #1909) (#1912) (87d713e52)
  • Update TanStack and Code Forge logos (39ed8c82b)
  • Track assets referenced from SCSS URLs (resolve #1916) (cbe13bf87)
  • Consume only the default export of inline dynamic import loaders (resolve #1915) (b90a299e2)
  • Update ecosystem snapshots (3f6cdee15)
  • Update dependencies (6cdb3a6ac)
Commits

Updates nx from 23.1.0 to 23.1.1

Release notes

Sourced from nx's releases.

23.1.1 (2026-07-30)

🚀 Features

  • core: derive stable repo key from normalized remote and relative path (#36439)
  • repo: add react + vite + vitest + playwright example (#35921)

🩹 Fixes

  • angular-rspack: speed up builds and align behavior with the esbuild application builder (#36268, #34936)
  • bundling: support TypeScript esbuildConfig files in the esbuild executor (#36352, #36349)
  • bundling: acknowledge @​swc/core build scripts when configuring rollup (#36412)
  • core: speed up npm lockfile parsing (#36216)
  • core: speed up lockfile parsing and catalog resolution (#36223)
  • core: show performance report recommendations only when actionable (#36344)
  • core: close daemon log descriptors after spawn to avoid Node 26 crash (#36280)
  • core: prevent shell injection in nx import (#36348)
  • core: correct the 22.6.0 gitignore and analytics migration wiring (#36356)
  • core: support npm 12 and pnpm in the package provenance check (#36354, #36338)
  • core: honor pnpm minimumReleaseAge config on pnpm 11 (#36335, #36330)
  • core: support pnpm 11 patched dependency hashes (#36360)
  • core: resolve name refs copied into pattern-matched target arrays (#36359)
  • core: resolve source-loaded plugin transitive workspace imports (#36296)
  • core: unbreak pnpm 11 installs by acknowledging build-script deps from generators (#36302)
  • core: include continuous and default-config dependencies in show target (#36374)
  • core: make unit tests pass locally regardless of invoking package manager (#35994)
  • core: respect --aiAgents none to skip AI agent file generation (#34944, #34692)
  • core: use --config.frozen-lockfile=false for pnpm add during migrate (#36337)
  • core: run selected projects with --exclude-task-dependencies (#35562)
  • core: stop passing git revisions through a shell in affected commands (#36379)
  • core: collect trickling watcher bursts fully on daemon force-flush (#36391)
  • core: report tasks running in another Nx process in the inline TUI (#36341)
  • core: stop ratatui cursor queries from racing the TUI event stream (#36318)
  • core: render critical-path tasks as a nested list in the job summary (#36394)
  • core: keep pnpm-workspace.yaml comments and read package.json as jsonc (#36411)
  • core: support multiple brace groups in workspace glob matching (#36395)
  • core: handle CRLF line endings in pnpm multi-document lockfiles (#36419, #35828, #35840)
  • core: correct glob pattern expansion for ZeroOrOne groups (#31857)
  • core: stop re-querying confirmed cache misses in task orchestrator (#36301, #35632)
  • core: sample project graph perf span telemetry per session at 10% (#36420)
  • core: strip terminal query sequences when replaying task output (#36432)
  • core: preserve FORCE_COLOR=0 intent for forked child tasks (#35293)
  • core: handle colons in target name when resolving inputs to generate graph (#36429, #33710)
  • core: merge default plugins through the source-map-aware merge path (#36257)
  • core: keep nx migrate on the requested version when release-age gates interfere (#36444)
  • core: avoid bogus duplicate project name errors when generating nested apps (#36458)
  • core: pin typescript in preset dependencies so npm cannot hoist typescript 7 (#36497)
  • core: bump pinned axios and brace-expansion past vulnerable versions (#36507, #36474)
  • core: parse pnpm lockfiles that omit the packages block (#36512)
  • core: keep real dependencies when omitting peers from npm temp installs (#36518)

... (truncated)

Commits
  • 8841f1c fix(core): keep real dependencies when omitting peers from npm temp installs ...
  • 86dbded fix(core): parse pnpm lockfiles that omit the packages block (#36512)
  • cff77e2 fix(core): bump pinned axios and brace-expansion past vulnerable versions (#3...
  • a2e6ac4 chore(repo): stop eslint linting json files with no applicable rules (#36454)
  • dd97e9c fix(core): avoid bogus duplicate project name errors when generating nested a...
  • 50f61ef feat(core): derive stable repo key from normalized remote and relative path (...
  • 9d51f0a fix(core): keep nx migrate on the requested version when release-age gates in...
  • 36208e9 fix(core): merge default plugins through the source-map-aware merge path (#36...
  • 49a9afe fix(misc): prevent crash when opening browser in Podman+WSL container (#34639)
  • a92116d fix(core): handle colons in target name when resolving inputs to generate gra...
  • Additional commits viewable in compare view

Updates tldts from 6.1.86 to 7.4.10

Release notes

Sourced from tldts's releases.

v7.4.10

📜 Update Public Suffix List

  • tldts-experimental, tldts-icann, tldts

Authors: 1

v7.4.9

📜 Update Public Suffix List

  • tldts-experimental, tldts-icann, tldts

Authors: 1

@dependabot
fix(deps): bump the npm-major group across 1 directory with 12 updates
61cdc02 
Bumps the npm-major group with 12 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [pkg-pr-new](https://github.com/stackblitz-labs/pkg.pr.new/tree/HEAD/packages/cli) | `0.0.82` | `0.0.86` |
| [jose](https://github.com/panva/jose) | `6.2.4` | `6.2.6` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.17` | `19.2.18` |
| [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.46.1` | `5.47.3` |
| [fumadocs-core](https://github.com/fuma-nama/fumadocs) | `16.13.0` | `16.14.0` |
| [fumadocs-mdx](https://github.com/fuma-nama/fumadocs) | `15.2.0` | `15.2.1` |
| [fumadocs-ui](https://github.com/fuma-nama/fumadocs) | `16.13.0` | `16.14.0` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.3` | `19.2.4` |
| [@nx/devkit](https://github.com/nrwl/nx/tree/HEAD/packages/devkit) | `23.1.0` | `23.1.1` |
| [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) | `6.29.0` | `6.31.0` |
| [nx](https://github.com/nrwl/nx/tree/HEAD/packages/nx) | `23.1.0` | `23.1.1` |
| [tldts](https://github.com/remusao/tldts) | `6.1.86` | `7.4.10` |



Updates `pkg-pr-new` from 0.0.82 to 0.0.86
- [Commits](https://github.com/stackblitz-labs/pkg.pr.new/commits/v0.0.86/packages/cli)

Updates `jose` from 6.2.4 to 6.2.6
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v6.2.4...v6.2.6)

Updates `@types/react` from 19.2.17 to 19.2.18
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `posthog-node` from 5.46.1 to 5.47.3
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.47.3/packages/node)

Updates `fumadocs-core` from 16.13.0 to 16.14.0
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs@16.13.0...fumadocs@16.14.0)

Updates `fumadocs-mdx` from 15.2.0 to 15.2.1
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs-mdx@15.2.0...fumadocs-mdx@15.2.1)

Updates `fumadocs-ui` from 16.13.0 to 16.14.0
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs@16.13.0...fumadocs@16.14.0)

Updates `@types/react-dom` from 19.2.3 to 19.2.4
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `@nx/devkit` from 23.1.0 to 23.1.1
- [Release notes](https://github.com/nrwl/nx/releases)
- [Commits](https://github.com/nrwl/nx/commits/23.1.1/packages/devkit)

Updates `knip` from 6.29.0 to 6.31.0
- [Release notes](https://github.com/webpro-nl/knip/releases)
- [Commits](https://github.com/webpro-nl/knip/commits/knip@6.31.0/packages/knip)

Updates `nx` from 23.1.0 to 23.1.1
- [Release notes](https://github.com/nrwl/nx/releases)
- [Commits](https://github.com/nrwl/nx/commits/23.1.1/packages/nx)

Updates `tldts` from 6.1.86 to 7.4.10
- [Release notes](https://github.com/remusao/tldts/releases)
- [Changelog](https://github.com/remusao/tldts/blob/master/CHANGELOG.md)
- [Commits](remusao/tldts@v6.1.86...v7.4.10)

---
updated-dependencies:
- dependency-name: pkg-pr-new
  dependency-version: 0.0.86
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: jose
  dependency-version: 6.2.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: "@types/react"
  dependency-version: 19.2.18
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: posthog-node
  dependency-version: 5.47.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-major
- dependency-name: fumadocs-core
  dependency-version: 16.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-major
- dependency-name: fumadocs-mdx
  dependency-version: 15.2.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: fumadocs-ui
  dependency-version: 16.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-major
- dependency-name: "@types/react-dom"
  dependency-version: 19.2.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: "@nx/devkit"
  dependency-version: 23.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: knip
  dependency-version: 6.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-major
- dependency-name: nx
  dependency-version: 23.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: tldts
  dependency-version: 7.4.10
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 8, 2026
@github-actions

github-actions Bot commented Aug 8, 2026

Copy link
Copy Markdown
Contributor

Supabase CLI preview

npx --yes https://pkg.pr.new/supabase/cli/supabase@61cdc02866d4c317350b5b19a4f3fb369428359c

Preview package for commit 61cdc02.

@dependabot @github

dependabot Bot commented on behalf of github Aug 9, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 9, 2026
auto-merge was automatically disabled August 9, 2026 00:10

Pull request was closed

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm-major-ff61c0a4bc branch August 9, 2026 00:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@supabase-cli-releaser supabase-cli-releaser[bot] supabase-cli-releaser[bot] approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants