chore(deps): bump the npm-major group across 1 directory with 14 updates

[dependabot]

Bumps the npm-major group with 14 updates in the / directory:

Package	From	To
pkg-pr-new	0.0.82	0.0.86
verdaccio	6.9.0	6.9.2
jose	6.2.4	6.2.7
@types/pg	8.20.0	8.20.3
@types/react	19.2.17	19.2.18
posthog-node	5.46.1	5.47.3
fumadocs-core	16.13.0	16.14.0
fumadocs-mdx	15.2.0	15.2.2
fumadocs-ui	16.13.0	16.14.0
@types/react-dom	19.2.3	19.2.4
@nx/devkit	23.1.0	23.1.1
knip	6.29.0	6.31.0
nx	23.1.0	23.1.1
tldts	6.1.86	7.4.10

Updates pkg-pr-new from 0.0.82 to 0.0.86

Commits

• cc27684 release: v0.0.86
• 7ec965c release: v0.0.85
• 41bf979 release: v0.0.84
• 80d1b1b release: v0.0.83
• See full diff in compare view

Updates verdaccio from 6.9.0 to 6.9.2

Release notes

Sourced from verdaccio's releases.

v6.9.2

Patch Changes

• 297dc43: fix: apply package access controls to the starredByUser endpoint

  The GET /-/_view/starredByUser view did not enforce the configured package access policy when listing a user's starred packages. Results are now filtered through auth.allow_access, so the response only includes packages the requesting client is authorized to see.

• 05917d5: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

  • @verdaccio/ui-theme: 9.0.0-next-9.22 → 9.0.0-next-9.23

v6.9.1

Patch Changes

• dfe3938: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

  • @verdaccio/auth: 8.1.0 → 8.1.1
  • @verdaccio/config: 8.2.0 → 8.2.1
  • @verdaccio/core: 8.2.0 → 8.2.1
  • @verdaccio/hooks: 8.1.1 → 8.1.2
  • @verdaccio/loaders: 8.1.0 → 8.1.1
  • @verdaccio/local-storage-legacy: 11.4.0 → 11.4.1
  • @verdaccio/logger: 8.1.0 → 8.1.1
  • @verdaccio/middleware: 8.1.0 → 8.1.1
  • @verdaccio/package-filter: 13.1.0 → 13.1.1
  • @verdaccio/signature: 8.1.0 → 8.1.1
  • @verdaccio/tarball: 13.1.0 → 13.1.1
  • @verdaccio/ui-theme: 9.0.0-next-9.21 → 9.0.0-next-9.22
  • @verdaccio/url: 13.1.0 → 13.1.1
  • @verdaccio/utils: 8.2.0 → 8.2.1
  • verdaccio-audit: 13.1.0 → 13.1.1
  • verdaccio-htpasswd: 13.1.0 → 13.1.1

Changelog

Sourced from verdaccio's changelog.

6.9.2

Patch Changes

• 297dc43: fix: apply package access controls to the starredByUser endpoint

  The GET /-/_view/starredByUser view did not enforce the configured package access policy when listing a user's starred packages. Results are now filtered through auth.allow_access, so the response only includes packages the requesting client is authorized to see.

• 05917d5: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

  • @verdaccio/ui-theme: 9.0.0-next-9.22 → 9.0.0-next-9.23

6.9.1

Patch Changes

• dfe3938: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

  • @verdaccio/auth: 8.1.0 → 8.1.1
  • @verdaccio/config: 8.2.0 → 8.2.1
  • @verdaccio/core: 8.2.0 → 8.2.1
  • @verdaccio/hooks: 8.1.1 → 8.1.2
  • @verdaccio/loaders: 8.1.0 → 8.1.1
  • @verdaccio/local-storage-legacy: 11.4.0 → 11.4.1
  • @verdaccio/logger: 8.1.0 → 8.1.1
  • @verdaccio/middleware: 8.1.0 → 8.1.1
  • @verdaccio/package-filter: 13.1.0 → 13.1.1
  • @verdaccio/signature: 8.1.0 → 8.1.1
  • @verdaccio/tarball: 13.1.0 → 13.1.1
  • @verdaccio/ui-theme: 9.0.0-next-9.21 → 9.0.0-next-9.22
  • @verdaccio/url: 13.1.0 → 13.1.1
  • @verdaccio/utils: 8.2.0 → 8.2.1
  • verdaccio-audit: 13.1.0 → 13.1.1
  • verdaccio-htpasswd: 13.1.0 → 13.1.1

Commits

• 648ecf9 chore: release 6.x (#6108)
• 05917d5 chore: update verdaccio 6.x dependencies (#6107)
• 297dc43 fix: apply package access controls to the starredByUser endpoint (#6106)
• a2b6c1d chore: release 6.x (#6097)
• 544cf35 chore: fix audit
• dfe3938 chore: update verdaccio 6.x dependencies (#6078)
• f1c5007 chore(deps): update dependency @​types/express-serve-static-core to v4.19.9 (#...
• 5c50a12 chore(deps): update yarn to v4.18.0 (#6093)
• See full diff in compare view

Updates jose from 6.2.4 to 6.2.7

Release notes

Sourced from jose's releases.

v6.2.7

Fixes

• require own JOSE properties for presence checks (90ab09c)

Refactor

• reduce bundle size (767d7f1)

v6.2.6

Fixes

• types: accept host CryptoKey declarations (b48a15b)

v6.2.5

Fixes

• compare claim values for falsy validation options (eb86956)
• forward key management parameters for a single JWE recipient (2d4f801)
• handle a zero-length JWE additional authenticated data (16ca398)
• reject a generateKeyPair crv option the algorithm does not imply (76364e9)
• reject an unencoded payload in the JWS Compact Serialization (01d053f)
• reject characters outside the Base64URL alphabet (0ebb971), references #879
• reject duplicate "crit" values when producing (31d60e1)
• reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (5df3fed)
• reject truncated ASN.1 key data (7a16c66)
• surface non-ASCII token segments as JOSE errors (194fe11)
• types: correct JWK and CryptoKey types (62a196d)
• types: correct key resolver and JWT header types (e95f8c4)
• validate the clockTolerance and currentDate options are finite (ab2f18d)

Documentation

• correct subpaths and API documentation (2daec38)
• document consumer-supplied type parameters (9e9f66c)
• stop claiming the JWK "use" parameter is used during import (47a07b2)
• update CHANGELOG.md (fc51bf5)

Refactor

• assert key shape and type from the entry (971057e)
• avoid 32-bit truncation of the AES-CBC-HMAC AAD bit length (1c8c6e9)
• correct swapped JWE unprotected header type error messages (894c498)
• describe each JWS algorithm once (7375028)
• discriminate a key once (0b59a69)
• fold single-consumer modules into their consumers (c2f0ca3)
• generate and import keys from the entry (da69b68)
• keep JWE out of the JWKS and embedded-JWK paths (241dd48)
• keep JWS and JWE out of each other's bundles (2a98564)
• parse a Protected Header in one place (30f72af)

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.7 (2026-08-01)

Fixes

• require own JOSE properties for presence checks (90ab09c)

Refactor

• reduce bundle size (767d7f1)

6.2.6 (2026-07-31)

Fixes

• types: accept host CryptoKey declarations (b48a15b)

6.2.5 (2026-07-29)

Fixes

• compare claim values for falsy validation options (eb86956)
• forward key management parameters for a single JWE recipient (2d4f801)
• handle a zero-length JWE additional authenticated data (16ca398)
• reject a generateKeyPair crv option the algorithm does not imply (76364e9)
• reject an unencoded payload in the JWS Compact Serialization (01d053f)
• reject characters outside the Base64URL alphabet (0ebb971), references #879
• reject duplicate "crit" values when producing (31d60e1)
• reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (5df3fed)
• reject truncated ASN.1 key data (7a16c66)
• surface non-ASCII token segments as JOSE errors (194fe11)
• types: correct JWK and CryptoKey types (62a196d)
• types: correct key resolver and JWT header types (e95f8c4)
• validate the clockTolerance and currentDate options are finite (ab2f18d)

Documentation

• correct subpaths and API documentation (2daec38)
• document consumer-supplied type parameters (9e9f66c)
• stop claiming the JWK "use" parameter is used during import (47a07b2)
• update CHANGELOG.md (fc51bf5)

Refactor

• assert key shape and type from the entry (971057e)
• avoid 32-bit truncation of the AES-CBC-HMAC AAD bit length (1c8c6e9)
• correct swapped JWE unprotected header type error messages (894c498)
• describe each JWS algorithm once (7375028)
• discriminate a key once (0b59a69)
• fold single-consumer modules into their consumers (c2f0ca3)
• generate and import keys from the entry (da69b68)

... (truncated)

Commits

• 60b941f chore(release): 6.2.7
• 90ab09c fix: require own JOSE properties for presence checks
• 767d7f1 refactor: reduce bundle size
• 8fc9a98 ci: fix post-release discussion body update
• a544a03 chore: cleanup after release
• a269a17 chore(release): 6.2.6
• 25c2a4f build: refactor postchangelog to a script
• b48a15b fix(types): accept host CryptoKey declarations
• de353df ci: track staged npm release availability
• 832c1af chore: cleanup after release
• Additional commits viewable in compare view

Updates @types/pg from 8.20.0 to 8.20.3

Commits

• See full diff in compare view

Updates @types/react from 19.2.17 to 19.2.18

Commits

• See full diff in compare view

Updates posthog-node from 5.46.1 to 5.47.3

Release notes

Sourced from posthog-node's releases.

posthog-node@5.47.3

5.47.3

Patch Changes

• #4349 0e2b371 Thanks @​marandaneto! - Apply the feature flag definition request timeout while consuming the response body. (2026-07-31)

• #4349 0e2b371 Thanks @​marandaneto! - Keep the feature flag definition request timeout active until the request settles. (2026-07-31)

posthog-node@5.47.2

5.47.2

Patch Changes

• #4332 b9a241e Thanks @​ioannisj! - Fix identify() leaving a user anonymous when the supplied ID already matches the persisted distinct ID (for example after a non-identified bootstrap seeded the same ID). The user is now marked identified and a person-processed $set event is captured. Ports the same fix from posthog-js (browser) to the shared core used by React Native, Node, and posthog-js-lite. (2026-07-31)
• Updated dependencies [b9a241e]:
  • @​posthog/core@​1.46.1

posthog-node@5.47.1

5.47.1

Patch Changes

• #4351 15aad20 Thanks @​marandaneto! - Isolate NestJS request context per Observable subscription. (2026-07-31)

posthog-node@5.47.0

5.47.0

Minor Changes

• #4308 6e7f3ae Thanks @​ablaszkiewicz! - Emit the release id that posthog-cli injects into your bundle as $release_id on $exception events, so PostHog can attach exceptions to a release without joining through symbol sets. Adds getInjectedReleaseId() to @posthog/core. The property is only attached when an injected release id can be read. (2026-07-30)

Patch Changes

• Updated dependencies [6e7f3ae]:
  • @​posthog/core@​1.46.0

Changelog

Sourced from posthog-node's changelog.

5.47.3

Patch Changes

• #4349 0e2b371 Thanks @​marandaneto! - Apply the feature flag definition request timeout while consuming the response body. (2026-07-31)

• #4349 0e2b371 Thanks @​marandaneto! - Keep the feature flag definition request timeout active until the request settles. (2026-07-31)

5.47.2

Patch Changes

• #4332 b9a241e Thanks @​ioannisj! - Fix identify() leaving a user anonymous when the supplied ID already matches the persisted distinct ID (for example after a non-identified bootstrap seeded the same ID). The user is now marked identified and a person-processed $set event is captured. Ports the same fix from posthog-js (browser) to the shared core used by React Native, Node, and posthog-js-lite. (2026-07-31)
• Updated dependencies [b9a241e]:
  • @​posthog/core@​1.46.1

5.47.1

Patch Changes

• #4351 15aad20 Thanks @​marandaneto! - Isolate NestJS request context per Observable subscription. (2026-07-31)

5.47.0

Minor Changes

• #4308 6e7f3ae Thanks @​ablaszkiewicz! - Emit the release id that posthog-cli injects into your bundle as $release_id on $exception events, so PostHog can attach exceptions to a release without joining through symbol sets. Adds getInjectedReleaseId() to @posthog/core. The property is only attached when an injected release id can be read. (2026-07-30)

Patch Changes

• Updated dependencies [6e7f3ae]:
  • @​posthog/core@​1.46.0

Commits

• 4e4aab7 chore: update versions and lockfile [version bump]
• 0e2b371 fix(node): keep feature flag definition timeout active (#4349)
• 557798d chore: update versions and lockfile [version bump]
• cbc7b22 chore: update versions and lockfile [version bump]
• 15aad20 fix(node): isolate NestJS context per subscription (#4351)
• 4ef8a41 chore: update versions and lockfile [version bump]
• 6e7f3ae feat: emit $release_id from the injected release id (#4308)
• 3b2e68d fix: prevent Jest worker resource leaks (#4247)
• See full diff in compare view

Updates fumadocs-core from 16.13.0 to 16.14.0

Release notes

Sourced from fumadocs-core's releases.

fumadocs@16.14.0

• @​fumadocs/base-ui@​16.14.0
• fumadocs-core@16.14.0
• fumadocs-ui@16.14.0

Replace Orama with ZBSearch, zero-config i18n search

The built-in search engine moved from @orama/orama to ZBSearch, a near drop-in successor. All module paths and APIs are unchanged, and search now works with every language out of the box: the new default multilingual mode uses Unicode word segmentation, so i18n search needs zero config.

import { createFromSource } from 'fumadocs-core/search/server';
// no localeMap, no @orama/tokenizers, CJK included
export const { GET } = createFromSource(source);

All locales now share a single search database — results are filtered by the locale of your pages at query time. Same for static mode:

import { staticClient } from 'fumadocs-core/search/client/orama-static';
const client = staticClient({ locale });

Renames

• oramaStaticClient → staticClient (old name kept as deprecated alias)
• initOrama → initDB, it now creates a ZBSearch instance and is optional — the exported data restores the tokenizer on load

Deprecated

• localeMap is no longer needed. It still works for language-specific stemming/stop-words and keeps the legacy per-locale databases when specified.

Notes for advanced usage

• language, components, plugins and search options are now typed against ZBSearch instead of @orama/orama — custom tokenizers or plugins written for Orama must be swapped to their ZBSearch equivalents.
• The exported static search data is now a ZBSearch database (i18n exports became a single unified database), so server and client should be on the same fumadocs-core version.
• @orama/orama and @orama/tokenizers can be removed from your dependencies unless you use them directly. Orama Cloud integrations (fumadocs-core/search/orama-cloud) are unaffected.

Commits

• 81c88c6 Version Packages (#3445)
• 4108f03 chore: fix example builds
• a279c17 fix(mdx): workaround for base ui issues
• f29a484 refactor(*): migrate non-rsc examples to macro api
• f845513 feat(mdx): browser helpers for macro
• e0d374c refactor(*): migrate examples & docs to macro API
• 4047bf7 feat(mdx): improve vite plugin usage
• b1636d5 chore: bump deps
• d1245c4 refactor(ui): build tailwind css via tsdown hooks
• 693bb19 docs: mention MDX macro usage
• Additional commits viewable in compare view

Updates fumadocs-mdx from 15.2.0 to 15.2.2

Release notes

Sourced from fumadocs-mdx's releases.

fumadocs-mdx@15.2.2

Support thenable Next.js config

Allow the promises to be awaited.

fumadocs-mdx@15.2.1

Support simpler fumadocsMdx vite plugin usage

Use the fumadocsMdx method instead for better syntax around macro usage.

Support browser helpers for Macro API

Use preload & lazy body renderer on non-rsc environment.

Commits

• 1025ff3 Version Packages (#3451)
• 5f1a185 fix(mdx): support thenable Next.js config
• 81c88c6 Version Packages (#3445)
• 4108f03 chore: fix example builds
• a279c17 fix(mdx): workaround for base ui issues
• f29a484 refactor(*): migrate non-rsc examples to macro api
• f845513 feat(mdx): browser helpers for macro
• e0d374c refactor(*): migrate examples & docs to macro API
• 4047bf7 feat(mdx): improve vite plugin usage
• b1636d5 chore: bump deps
• Additional commits viewable in compare view

Updates fumadocs-ui from 16.13.0 to 16.14.0

Release notes

Sourced from fumadocs-ui's releases.

fumadocs@16.14.0

• @​fumadocs/base-ui@​16.14.0
• fumadocs-core@16.14.0
• fumadocs-ui@16.14.0

Replace Orama with ZBSearch, zero-config i18n search

The built-in search engine moved from @orama/orama to ZBSearch, a near drop-in successor. All module paths and APIs are unchanged, and search now works with every language out of the box: the new default multilingual mode uses Unicode word segmentation, so i18n search needs zero config.

import { createFromSource } from 'fumadocs-core/search/server';
// no localeMap, no @orama/tokenizers, CJK included
export const { GET } = createFromSource(source);

All locales now share a single search database — results are filtered by the locale of your pages at query time. Same for static mode:

import { staticClient } from 'fumadocs-core/search/client/orama-static';
const client = staticClient({ locale });

Renames

• oramaStaticClient → staticClient (old name kept as deprecated alias)
• initOrama → initDB, it now creates a ZBSearch instance and is optional — the exported data restores the tokenizer on load

Deprecated

• localeMap is no longer needed. It still works for language-specific stemming/stop-words and keeps the legacy per-locale databases when specified.

Notes for advanced usage

• language, components, plugins and search options are now typed against ZBSearch instead of @orama/orama — custom tokenizers or plugins written for Orama must be swapped to their ZBSearch equivalents.
• The exported static search data is now a ZBSearch database (i18n exports became a single unified database), so server and client should be on the same fumadocs-core version.
• @orama/orama and @orama/tokenizers can be removed from your dependencies unless you use them directly. Orama Cloud integrations (fumadocs-core/search/orama-cloud) are unaffected.

Commits

• 81c88c6 Version Packages (#3445)
• 4108f03 chore: fix example builds
• a279c17 fix(mdx): workaround for base ui issues
• f29a484 refactor(*): migrate non-rsc examples to macro api
• f845513 feat(mdx): browser helpers for macro
• e0d374c refactor(*): migrate examples & docs to macro API
• 4047bf7 feat(mdx): improve vite plugin usage
• b1636d5 chore: bump deps
• d1245c4 refactor(ui): build tailwind css via tsdown hooks
• 693bb19 docs: mention MDX macro usage
• Additional commits viewable in compare view

Updates @types/react-dom from 19.2.3 to 19.2.4

Commits

• See full diff in compare view

Updates @nx/devkit from 23.1.0 to 23.1.1

Release notes

Sourced from @​nx/devkit's releases.

23.1.1 (2026-07-30)

🚀 Features

• core: derive stable repo key from normalized remote and relative path (#36439)
• repo: add react + vite + vitest + playwright example (#35921)

🩹 Fixes

• angular-rspack: speed up builds and align behavior with the esbuild application builder (#36268, #34936)
• bundling: support TypeScript esbuildConfig files in the esbuild executor (#36352, #36349)
• bundling: acknowledge @​swc/core build scripts when configuring rollup (#36412)
• core: speed up npm lockfile parsing (#36216)
• core: speed up lockfile parsing and catalog resolution (#36223)
• core: show performance report recommendations only when actionable (#36344)
• core: close daemon log descriptors after spawn to avoid Node 26 crash (#36280)
• core: prevent shell injection in nx import (#36348)
• core: correct the 22.6.0 gitignore and analytics migration wiring (#36356)
• core: support npm 12 and pnpm in the package provenance check (#36354, #36338)
• core: honor pnpm minimumReleaseAge config on pnpm 11 (#36335, #36330)
• core: support pnpm 11 patched dependency hashes (#36360)
• core: resolve name refs copied into pattern-matched target arrays (#36359)
• core: resolve source-loaded plugin transitive workspace imports (#36296)
• core: unbreak pnpm 11 installs by acknowledging build-script deps from generators (#36302)
• core: include continuous and default-config dependencies in show target (#36374)
• core: make unit tests pass locally regardless of invoking package manager (#35994)
• core: respect --aiAgents none to skip AI agent file generation (#34944, #34692)
• core: use --config.frozen-lockfile=false for pnpm add during migrate (#36337)
• core: run selected projects with --exclude-task-dependencies (#35562)
• core: stop passing git revisions through a shell in affected commands (#36379)
• core: collect trickling watcher bursts fully on daemon force-flush (#36391)
• core: report tasks running in another Nx process in the inline TUI (#36341)
• core: stop ratatui cursor queries from racing the TUI event stream (#36318)
• core: render critical-path tasks as a nested list in the job summary (#36394)
• core: keep pnpm-workspace.yaml comments and read package.json as jsonc (#36411)
• core: support multiple brace groups in workspace glob matching (#36395)
• core: handle CRLF line endings in pnpm multi-document lockfiles (#36419, #35828, #35840)
• core: correct glob pattern expansion for ZeroOrOne groups (#31857)
• core: stop re-querying confirmed cache misses in task orchestrator (#36301, #35632)
• core: sample project graph perf span telemetry per session at 10% (#36420)
• core: strip terminal query sequences when replaying task output (#36432)
• core: preserve FORCE_COLOR=0 intent for forked child tasks (#35293)
• core: handle colons in target name when resolving inputs to generate graph (#36429, #33710)
• core: merge default plugins through the source-map-aware merge path (#36257)
• core: keep nx migrate on the requested version when release-age gates interfere (#36444)
• core: avoid bogus duplicate project name errors when generating nested apps (#36458)
• core: pin typescript in preset dependencies so npm cannot hoist typescript 7 (#36497)
• core: bump pinned axios and brace-expansion past vulnerable versions (#36507, #36474)
• core: parse pnpm lockfiles that omit the packages block (#36512)
• core: keep real dependencies when omitting peers from npm temp installs (#36518)

... (truncated)

Commits

• 1210aac fix(devkit): resolve ensurePackage against the workspace (#36496)
• dd97e9c fix(core): avoid bogus duplicate project name errors when generating nested a...
• 5b6abe1 fix(core): unbreak pnpm 11 installs by acknowledging build-script deps from g...
• 1ec8682 cleanup(devkit): remove catalog utils copy and reuse nx implementation (#36350)
• 268394a fix(core): speed up lockfile parsing and catalog resolution (#36223)
• See full diff in compare view

Updates knip from 6.29.0 to 6.31.0

Release notes

Sourced from knip's releases.

Release 6.31.0

• feat: Add basic support for Marko 6 and 5 (#1914) (c6b151642701f9b4864ddb5ea8e40580623f59d1) - thanks @​caseycarroll!
• Use Array.from in Marko compiler (5aadf47a22bdfd43bb8ad4082768e07fe37fc5ca)
• Update release-it and fix release script flags (6fa9c269c65c0923965924226a5ccf0778842967)
• Downgrade @​types/vscode to match extension engines range (6d8e9bf5200cf982d0bc801469c4e2be5627e5b8)

Release 6.30.0

• docs: migrate to Starlight Blog plugin (#1854) (c89e3e3c9) - thanks @​trueberryless!
• Include workspace dependencies in scoped runs (resolve #1901) (a75309eda)
• Simplify workspace assembly (b3ac16411)
• Document export declaration safety (ef98a7682)
• Read object jsPlugin specifiers from Vite+ config (#1879) (3ea6a92d4) - thanks @​matchai!
• Compile gitignore negations once (6884cdb20)
• Cache Node test script detection (d970f67d8)
• Track only enabled workspace plugins (67d48268a)
• Skip unsupported Vite config command (545bb2d36)
• Add SARIF reporter (ce11cf5d4)
• Track catalog refs in pnpm dlx scripts (resolve #1885, close #1886) (102189a1a)
• Report unresolved catalog references (b2b86c3e5)
• Track catalog references across scoped runs (resolve #1905) (f0365bae0)
• Track script catalog references across scoped runs (9b3ab3778)
• Remove tsc from ignoreBinaries (a0a283040)
• fix: detect dynamic imports in Svelte component templates (#1908) (aa303fb04) - thanks @​firatciftci!
• fix(remark): support all types of dependency names (#1911) (3441bea3a) - thanks @​voxpelli!
• Update sanity snapshot (d04aa04e5)
• feat(stryker): add ts extensions (#1910) (cfc50886e) - thanks @​christopher-buss!
• Adopt @​e18e/eslint-plugin (adf2511ab)
• Remove Workleap from sponsors (d4f6af9ff)
• Update dependencies (3f61542f6)
• Add ES2023 array types to TypeScript 5 CI (360a47157)
• Update sentry snapshot (7defc1853)
• Analyze published type dependencies (resolve #1909) (#1912) (87d713e52)
• Update TanStack and Code Forge logos (39ed8c82b)
• Track assets referenced from SCSS URLs (resolve #1916) (cbe13bf87)
• Consume only the default export of inline dynamic import loaders (resolve #1915) (b90a299e2)
• Update ecosystem snapshots (3f6cdee15)
• Update dependencies (6cdb3a6ac)

Commits

• 69c6006 Release knip@6.31.0
• 5aadf47 Use Array.from in Marko compiler
• c6b1516 feat: Add basic support for Marko 6 and 5 (#1914)
• 837e52c Release knip@6.30.0
• 6cdb3a6 Update dependencies
• b90a299 Consume only the default export of inline dynamic import loaders (resolve #1915)
• cbe13bf Track assets referenced from SCSS URLs (resolve #1916)
• 87d713e Analyze published type dependencies (resolve #1909) (#1912)
• 360a471 Add ES2023 array types to TypeScript 5 CI
• 3f61542 Update dependencies
• Additional commits viewable in compare view

Updates nx from 23.1.0 to 23.1.1

Release notes

Sourced from nx's releases.

23.1.1 (2026-07-30)

🚀 Features

• core: derive stable repo key from normalized remote and relative path (#36439)
• repo: add react + vite + vitest + playwright example (#35921)

🩹 Fixes

• angular-rspack: speed up builds and align behavior with the esbuild application builder (#36268, #34936)
• bundling: support TypeScript esbuildConfig files in the esbuild executor (#36352, #36349)
• bundling: acknowledge @​swc/core build scripts when configuring rollup (#36412)
• core: speed up npm lockfile parsing (#36216)
• core: speed up lockfile parsing and catalog resolution (#36223)
• core: show performance report recommendations only when actionable (#36344)
• core: close daemon log descriptors after spawn to avoid Node 26 crash (#36280)
• core: prevent shell injection in nx import (#36348)
• core: correct the 22.6.0 gitignore and analytics migration wiring (#36356)
• core: support npm 12 and pnpm in the package provenance check (#36354, #36338)
• core: honor pnpm minimumReleaseAge config on pnpm 11 (#36335, #36330)
• core: support pnpm 11 patched dependency hashes (#36360)
• core: resolve name refs copied into pattern-matched target arrays (#36359)
• core: resolve source-loaded plugin transitive workspace imports (#36296)
• core: unbreak pnpm 11 installs by acknowledging build-script deps from generators (#36302)
• core: include continuous and default-config dependencies in show target (#36374)
• core: make unit tests pass locally regardless of invoking package manager (#35994)
• core: respect --aiAgents none to skip AI agent file generation (#34944, #34692)
• core: use --config.frozen-lockfile=false for pnpm add during migrate (#36337)
• core: run selected projects with --exclude-task-dependencies (#35562)
• core: stop passing git revisions through a shell in affected commands (#36379)
• core: collect trickling watcher bursts fully on daemon force-flush (#36391)
• core: report tasks running in another Nx process in the inline TUI (#36341)
• core: stop ratatui cursor queries from racing the TUI event stream (#36318)
• core: render critical-path tasks as a nested list in the job summary (#36394)
• core: keep pnpm-workspace.yaml comments and read package.json as jsonc (#36411)
• core: support multiple brace groups in workspace glob matching (#36395)
• core: handle CRLF line endings in pnpm multi-document lockfiles (#36419, #35828, #35840)
• core: correct glob pattern expansion for ZeroOrOne groups (#31857)
• core: stop re-querying confirmed cache misses in task orchestrator (#36301, #35632)
• core: sample project graph perf span telemetry per session at 10% (#36420)
• core: strip terminal query sequences when repla...

  Description has been truncated

[github-actions]

Supabase CLI preview

npx --yes https://pkg.pr.new/supabase/cli/supabase@0728338968ace8dafed820a6e1b899ad7d487a5f

Preview package for commit 0728338.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.