Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Feb 9, 2026

Bumps the production-dependencies group with 4 updates: @supabase/supabase-js, axios, dotenv and glob.

Updates @supabase/supabase-js from 2.93.3 to 2.95.3

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.95.3

2.95.3 (2026-02-06)

🚀 Features

  • supabase: add canonical CORS headers export for edge functions (#2071)

🩹 Fixes

  • realtime: removeChannel when unsubscribe successfully (#2091)
  • storage: expose fetch parameters in download method (#2090)

❤️ Thank You

v2.95.2

2.95.2 (2026-02-05)

🩹 Fixes

  • supabase: add module to tsdoc (1fac0c45)

❤️ Thank You

  • Katerina Skroumpelou

v2.95.2-canary.2

2.95.2-canary.2 (2026-02-05)

🩹 Fixes

  • repo: test old working version on esm (dbb1e6d0)
  • supabase: small addition (95e8938f)

❤️ Thank You

  • Katerina Skroumpelou

v2.95.2-canary.1

2.95.2-canary.1 (2026-02-05)

🩹 Fixes

  • repo: remove subpath to see if fixed (d156c991)

❤️ Thank You

  • Katerina Skroumpelou

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.95.3 (2026-02-06)

🚀 Features

  • supabase: add canonical CORS headers export for edge functions (#2071)

❤️ Thank You

2.95.0 (2026-02-05)

🚀 Features

  • supabase: add canonical CORS headers export for edge functions (#2071)

❤️ Thank You

2.94.1 (2026-02-04)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.94.0 (2026-02-03)

🚀 Features

  • postgrest: add URL length validation and timeout protection (#2078)

❤️ Thank You

Commits
  • c74bde1 docs(supabase): include cors module in TypeDoc generation (#2095)
  • acd85d4 chore(release): version 2.95.0 changelogs (#2094)
  • c4a8a43 feat(supabase): add canonical CORS headers export for edge functions (#2071)
  • a867430 chore(release): version 2.94.1 changelogs (#2089)
  • edb3009 chore(release): version 2.94.0 changelogs (#2085)
  • 7ec2df9 feat(postgrest): add URL length validation and timeout protection (#2078)
  • 366b665 chore(release): version 2.93.3 changelogs (#2076)
  • See full diff in compare view

Updates axios from 1.13.4 to 1.13.5

Release notes

Sourced from axios's releases.

v1.13.5

Release 1.13.5

Highlights

  • Security: Fixed a potential Denial of Service issue involving the __proto__ key in mergeConfig. (PR #7369)
  • Bug fix: Resolved an issue where AxiosError could be missing the status field on and after v1.13.3. (PR #7368)

Changes

Security

  • Fix Denial of Service via __proto__ key in mergeConfig. (PR #7369)

Fixes

  • Fix/5657. (PR #7313)
  • Ensure status is present in AxiosError on and after v1.13.3. (PR #7368)

Features / Improvements

  • Add input validation to isAbsoluteURL. (PR #7326)
  • Refactor: bump minor package versions. (PR #7356)

Documentation

  • Clarify object-check comment. (PR #7323)
  • Fix deprecated Buffer constructor usage and README formatting. (PR #7371)

CI / Maintenance

  • Chore: fix issues with YAML. (PR #7355)
  • CI: update workflow YAMLs. (PR #7372)
  • CI: fix run condition. (PR #7373)
  • Dev deps: bump karma-sourcemap-loader from 0.3.8 to 0.4.0. (PR #7360)
  • Chore(release): prepare release 1.13.5. (PR #7379)

New Contributors

Full Changelog: axios/axios@v1.13.4...v1.13.5

Commits
  • 29f7542 chore(release): prepare release 1.13.5 (#7379)
  • 431c3a3 ci: fix run condition (#7373)
  • 9ff3a78 ci: update ymls (#7372)
  • 265b712 docs: fix deprecated Buffer constructor and formatting issues in README (#7371)
  • 475e75a feat: add input validation to isAbsoluteURL (#7326)
  • 28c7215 fix: Denial of Service via proto Key in mergeConfig (#7369)
  • 04cf019 docs: clarify object check comment (#7323)
  • 696fa75 fix: status is missing in AxiosError on and after v1.13.3 (#7368)
  • 569f028 fix: added a option to choose between legacy and the new request/response int...
  • 44b7c9f chore(deps-dev): bump karma-sourcemap-loader (#7360)
  • Additional commits viewable in compare view

Updates dotenv from 17.2.3 to 17.2.4

Changelog

Sourced from dotenv's changelog.

17.2.4 (2026-02-05)

Changed

  • Make DotenvPopulateInput accept NodeJS.ProcessEnv type (#915)
  • Give back to dotenv by checking out my newest project vestauth. It is auth for agents. Thank you for using my software.
Commits

Updates glob from 13.0.0 to 13.0.1

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the production-dependencies group with 4 updates: [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js), [axios](https://github.com/axios/axios), [dotenv](https://github.com/motdotla/dotenv) and [glob](https://github.com/isaacs/node-glob).


Updates `@supabase/supabase-js` from 2.93.3 to 2.95.3
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.95.3/packages/core/supabase-js)

Updates `axios` from 1.13.4 to 1.13.5
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.13.4...v1.13.5)

Updates `dotenv` from 17.2.3 to 17.2.4
- [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md)
- [Commits](https://github.com/motdotla/dotenv/commits)

Updates `glob` from 13.0.0 to 13.0.1
- [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md)
- [Commits](isaacs/node-glob@v13.0.0...v13.0.1)

---
updated-dependencies:
- dependency-name: "@supabase/supabase-js"
  dependency-version: 2.95.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: axios
  dependency-version: 1.13.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: dotenv
  dependency-version: 17.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: glob
  dependency-version: 13.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Feb 9, 2026

Labels

The following labels could not be found: automated. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Feb 9, 2026
@portfedh portfedh merged commit 9b72cb3 into main Feb 9, 2026
1 of 3 checks passed
@dependabot dependabot bot deleted the dependabot/npm_and_yarn/production-dependencies-47a9613d55 branch February 9, 2026 17:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant