fix(deps): bump the npm-major group across 1 directory with 32 updates

[dependabot]

Bumps the npm-major group with 32 updates in the / directory:

Package	From	To
pkg-pr-new	0.0.82	0.0.87
verdaccio	6.9.0	6.9.2
undici	8.9.0	8.10.0
@supabase/supabase-js	2.111.0	2.112.2
jose	6.2.4	6.2.8
@anthropic-ai/claude-agent-sdk	0.3.220	0.3.227
@anthropic-ai/sdk	0.115.0	0.116.0
@types/react	19.2.17	19.2.18
@vercel/detect-agent	1.2.3	1.2.4
esbuild	0.28.1	0.28.2
pg	8.22.0	8.23.0
@types/pg	8.20.0	8.21.0
posthog-node	5.46.1	5.48.1
semantic-release	25.0.8	25.0.9
fumadocs-core	16.13.0	16.14.3
fumadocs-mdx	15.2.0	15.2.3
fumadocs-ui	16.13.0	16.14.3
next	16.3.0-preview.10	16.3.0
@types/node	26.1.2	26.2.0
@types/react-dom	19.2.3	19.2.4
@effect/atom-react	4.0.0-beta.103	4.0.0-beta.107
@effect/platform-bun	4.0.0-beta.103	4.0.0-beta.107
@effect/platform-node	4.0.0-beta.103	4.0.0-beta.107
@effect/sql-pg	4.0.0-beta.103	4.0.0-beta.107
@effect/vitest	4.0.0-beta.103	4.0.0-beta.107
@nx/devkit	23.1.0	23.1.1
effect	4.0.0-beta.103	4.0.0-beta.107
knip	6.29.0	6.32.1
nx	23.1.0	23.1.1
oxfmt	0.61.0	0.63.0
oxlint	1.76.0	1.78.0
tldts	6.1.86	7.4.10

Updates pkg-pr-new from 0.0.82 to 0.0.87

Commits

• d293ab2 release: v0.0.87
• cc27684 release: v0.0.86
• 7ec965c release: v0.0.85
• 41bf979 release: v0.0.84
• 80d1b1b release: v0.0.83
• See full diff in compare view

Updates verdaccio from 6.9.0 to 6.9.2

Release notes

Sourced from verdaccio's releases.

v6.9.2

Patch Changes

• 297dc43: fix: apply package access controls to the starredByUser endpoint

  The GET /-/_view/starredByUser view did not enforce the configured package access policy when listing a user's starred packages. Results are now filtered through auth.allow_access, so the response only includes packages the requesting client is authorized to see.

• 05917d5: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

  • @verdaccio/ui-theme: 9.0.0-next-9.22 → 9.0.0-next-9.23

v6.9.1

Patch Changes

• dfe3938: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

  • @verdaccio/auth: 8.1.0 → 8.1.1
  • @verdaccio/config: 8.2.0 → 8.2.1
  • @verdaccio/core: 8.2.0 → 8.2.1
  • @verdaccio/hooks: 8.1.1 → 8.1.2
  • @verdaccio/loaders: 8.1.0 → 8.1.1
  • @verdaccio/local-storage-legacy: 11.4.0 → 11.4.1
  • @verdaccio/logger: 8.1.0 → 8.1.1
  • @verdaccio/middleware: 8.1.0 → 8.1.1
  • @verdaccio/package-filter: 13.1.0 → 13.1.1
  • @verdaccio/signature: 8.1.0 → 8.1.1
  • @verdaccio/tarball: 13.1.0 → 13.1.1
  • @verdaccio/ui-theme: 9.0.0-next-9.21 → 9.0.0-next-9.22
  • @verdaccio/url: 13.1.0 → 13.1.1
  • @verdaccio/utils: 8.2.0 → 8.2.1
  • verdaccio-audit: 13.1.0 → 13.1.1
  • verdaccio-htpasswd: 13.1.0 → 13.1.1

Changelog

Sourced from verdaccio's changelog.

6.9.2

Patch Changes

• 297dc43: fix: apply package access controls to the starredByUser endpoint

  The GET /-/_view/starredByUser view did not enforce the configured package access policy when listing a user's starred packages. Results are now filtered through auth.allow_access, so the response only includes packages the requesting client is authorized to see.

• 05917d5: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

  • @verdaccio/ui-theme: 9.0.0-next-9.22 → 9.0.0-next-9.23

6.9.1

Patch Changes

• dfe3938: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

  • @verdaccio/auth: 8.1.0 → 8.1.1
  • @verdaccio/config: 8.2.0 → 8.2.1
  • @verdaccio/core: 8.2.0 → 8.2.1
  • @verdaccio/hooks: 8.1.1 → 8.1.2
  • @verdaccio/loaders: 8.1.0 → 8.1.1
  • @verdaccio/local-storage-legacy: 11.4.0 → 11.4.1
  • @verdaccio/logger: 8.1.0 → 8.1.1
  • @verdaccio/middleware: 8.1.0 → 8.1.1
  • @verdaccio/package-filter: 13.1.0 → 13.1.1
  • @verdaccio/signature: 8.1.0 → 8.1.1
  • @verdaccio/tarball: 13.1.0 → 13.1.1
  • @verdaccio/ui-theme: 9.0.0-next-9.21 → 9.0.0-next-9.22
  • @verdaccio/url: 13.1.0 → 13.1.1
  • @verdaccio/utils: 8.2.0 → 8.2.1
  • verdaccio-audit: 13.1.0 → 13.1.1
  • verdaccio-htpasswd: 13.1.0 → 13.1.1

Commits

• 648ecf9 chore: release 6.x (#6108)
• 05917d5 chore: update verdaccio 6.x dependencies (#6107)
• 297dc43 fix: apply package access controls to the starredByUser endpoint (#6106)
• a2b6c1d chore: release 6.x (#6097)
• 544cf35 chore: fix audit
• dfe3938 chore: update verdaccio 6.x dependencies (#6078)
• f1c5007 chore(deps): update dependency @​types/express-serve-static-core to v4.19.9 (#...
• 5c50a12 chore(deps): update yarn to v4.18.0 (#6093)
• See full diff in compare view

Updates undici from 8.9.0 to 8.10.0

Release notes

Sourced from undici's releases.

v8.10.0

What's Changed

• feat: namespace h2 options by @​metcoder95 in nodejs/undici#5498
• test: update WPT expectations by @​mcollina in nodejs/undici#5587
• test: add cache/dedupe + dns re-dispatch integration tests by @​GiHoon1123 in nodejs/undici#5535
• fix(websocket): support process.unref by @​mcollina in nodejs/undici#5578
• fix(h2): ensure every request settles by @​mcollina in nodejs/undici#5603
• fix(readable): consume a body whose end has already been emitted by @​marko1olo in nodejs/undici#5617
• fix(retry): skip the content-length checkpoint for HEAD and for a 206 without content-range by @​marko1olo in nodejs/undici#5610
• fix: revert idle socket validation to setTimeout(0) to prevent stall on idle event loop by @​marceli1404 in nodejs/undici#5606
• fix(env-http-proxy-agent): match bare IPv6 addresses in no_proxy by @​marko1olo in nodejs/undici#5623
• test: handle aggregate balanced pool errors by @​marko1olo in nodejs/undici#5377
• fix(readable): keep body bytes that arrive after setEncoding() by @​mcollina in nodejs/undici#5620
• fix(socks5): evict unused origin pools by @​Kkartik14 in nodejs/undici#5595
• fix: skip deduplication for upgrade requests by @​Ram-blip in nodejs/undici#5593
• fix(retry): forward informational responses by @​mcollina in nodejs/undici#5625
• fix(mock): non-string path matchers under ignoreTrailingSlash, and DataView reply bodies by @​marko1olo in nodejs/undici#5619
• fix(interceptors): cache() and deduplicate() silently inert on Client/Pool without opts.origin by @​marko1olo in nodejs/undici#5628
• build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by @​dependabot[bot] in nodejs/undici#5633
• build(deps): bump github/codeql-action/init from 4.36.2 to 4.37.3 by @​dependabot[bot] in nodejs/undici#5634
• build(deps): bump actions/setup-node from 6.4.0 to 7.0.0 by @​dependabot[bot] in nodejs/undici#5636
• fix(mock): emit request body lifecycle hooks by @​marko1olo in nodejs/undici#5367
• fix(h2): detach upgrade close handler after GOAWAY by @​pacocartones in nodejs/undici#5641
• fix: retry refused HTTP/2 streams by @​mcollina in nodejs/undici#5598
• fix: preserve DNS origin hostname on sockets by @​cyphercodes in nodejs/undici#5577

New Contributors

• @​marceli1404 made their first contribution in nodejs/undici#5606
• @​Kkartik14 made their first contribution in nodejs/undici#5595
• @​pacocartones made their first contribution in nodejs/undici#5641
• @​cyphercodes made their first contribution in nodejs/undici#5577

Full Changelog: nodejs/undici@v8.9.0...v8.10.0

Commits

• c8d80e6 Bumped v8.10.0 (#5644)
• 66923b4 fix: preserve DNS origin hostname on sockets (#5577)
• 3926499 fix: retry refused HTTP/2 streams (#5598)
• 73d6e9e fix(h2): detach upgrade close handler after GOAWAY (#5641)
• b111adb fix(mock): emit request body lifecycle hooks (#5367)
• ae4a3e3 build(deps): bump actions/setup-node from 6.4.0 to 7.0.0 (#5636)
• ec3fbf1 build(deps): bump github/codeql-action/init from 4.36.2 to 4.37.3 (#5634)
• 2151720 build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 (#5633)
• b96a116 fix(interceptors): allow interceptors without opts.origin (#5628)
• a18ef2d fix(mock): non-string path matchers under ignoreTrailingSlash, and DataView r...
• Additional commits viewable in compare view

Updates @supabase/supabase-js from 2.111.0 to 2.112.2

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.112.2

2.112.2 (2026-08-06)

🩹 Fixes

• realtime: prevent duplicate on bindings (#2594)
• realtime: clear stale join payload on sign-out (#2597)

❤️ Thank You

• Filipe Cabaço @​filipecabaco
• Vaibhav @​7ttp

v2.112.2-canary.1

2.112.2-canary.1 (2026-08-06)

🩹 Fixes

• realtime: clear stale join payload on sign-out (#2597)

❤️ Thank You

• Vaibhav @​7ttp

v2.112.2-canary.0

2.112.2-canary.0 (2026-08-06)

🩹 Fixes

• realtime: prevent duplicate on bindings (#2594)

❤️ Thank You

• Filipe Cabaço @​filipecabaco

v2.112.1

2.112.1 (2026-08-05)

🩹 Fixes

• auth: preserve 5xx error message (#2587)
• realtime: ensure setAuth doesn't disable token refresh (#2592)

❤️ Thank You

• Eduardo Gurgel
• Vaibhav @​7ttp

v2.112.1-canary.1

2.112.1-canary.1 (2026-08-05)

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.112.2 (2026-08-06)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.112.1 (2026-08-05)

🩹 Fixes

• realtime: ensure setAuth doesn't disable token refresh (#2592)

❤️ Thank You

• Eduardo Gurgel

2.112.0 (2026-08-03)

🚀 Features

• supabase: move OpenTelemetry tracing to opt-in /tracing subpath (#2583)

🩹 Fixes

• supabase: forward db retry option (#2571)

❤️ Thank You

• Katerina Skroumpelou @​mandarini
• Vaibhav @​7ttp

Commits

• 07b27ee chore(release): version 2.112.1 changelogs (#2593)
• 1831402 fix(realtime): ensure setAuth doesn't disable token refresh (#2592)
• 0136f34 chore(release): version 2.112.0 changelogs (#2589)
• 2877b5b test(supabase): replace test-tracing harness with real-OTel unit and e2e cove...
• a413544 feat(supabase): move OpenTelemetry tracing to opt-in /tracing subpath (#2583)
• e6c975c fix(supabase): forward db retry option (#2571)
• a262492 chore(release): version 2.111.0 changelogs (#2572)
• See full diff in compare view

Updates jose from 6.2.4 to 6.2.8

Release notes

Sourced from jose's releases.

v6.2.8

Fixes

• enforce a single recipient when decrypting dir and ECDH-ES (505c383)
• reject a non-string "alg" in EmbeddedJWK (714f870)

Refactor

• index the JWS and JWE registries without a wrapper (925f3bb)
• name the "alg" source in unsupported algorithm failures (1500459)

v6.2.7

Fixes

• require own JOSE properties for presence checks (90ab09c)

Refactor

• reduce bundle size (767d7f1)

v6.2.6

Fixes

• types: accept host CryptoKey declarations (b48a15b)

v6.2.5

Fixes

• compare claim values for falsy validation options (eb86956)
• forward key management parameters for a single JWE recipient (2d4f801)
• handle a zero-length JWE additional authenticated data (16ca398)
• reject a generateKeyPair crv option the algorithm does not imply (76364e9)
• reject an unencoded payload in the JWS Compact Serialization (01d053f)
• reject characters outside the Base64URL alphabet (0ebb971), references #879
• reject duplicate "crit" values when producing (31d60e1)
• reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (5df3fed)
• reject truncated ASN.1 key data (7a16c66)
• surface non-ASCII token segments as JOSE errors (194fe11)
• types: correct JWK and CryptoKey types (62a196d)
• types: correct key resolver and JWT header types (e95f8c4)
• validate the clockTolerance and currentDate options are finite (ab2f18d)

Documentation

• correct subpaths and API documentation (2daec38)
• document consumer-supplied type parameters (9e9f66c)
• stop claiming the JWK "use" parameter is used during import (47a07b2)
• update CHANGELOG.md (fc51bf5)

Refactor

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.8 (2026-08-03)

Fixes

• enforce a single recipient when decrypting dir and ECDH-ES (505c383)
• reject a non-string "alg" in EmbeddedJWK (714f870)

Refactor

• index the JWS and JWE registries without a wrapper (925f3bb)
• name the "alg" source in unsupported algorithm failures (1500459)

6.2.7 (2026-08-01)

Fixes

• require own JOSE properties for presence checks (90ab09c)

Refactor

• reduce bundle size (767d7f1)

6.2.6 (2026-07-31)

Fixes

• types: accept host CryptoKey declarations (b48a15b)

6.2.5 (2026-07-29)

Fixes

• compare claim values for falsy validation options (eb86956)
• forward key management parameters for a single JWE recipient (2d4f801)
• handle a zero-length JWE additional authenticated data (16ca398)
• reject a generateKeyPair crv option the algorithm does not imply (76364e9)
• reject an unencoded payload in the JWS Compact Serialization (01d053f)
• reject characters outside the Base64URL alphabet (0ebb971), references #879
• reject duplicate "crit" values when producing (31d60e1)
• reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (5df3fed)
• reject truncated ASN.1 key data (7a16c66)
• surface non-ASCII token segments as JOSE errors (194fe11)
• types: correct JWK and CryptoKey types (62a196d)
• types: correct key resolver and JWT header types (e95f8c4)
• validate the clockTolerance and currentDate options are finite (ab2f18d)

Documentation

• correct subpaths and API documentation (2daec38)
• document consumer-supplied type parameters (9e9f66c)

... (truncated)

Commits

• 8b768eb chore(release): 6.2.8
• 1500459 refactor: name the "alg" source in unsupported algorithm failures
• 714f870 fix: reject a non-string "alg" in EmbeddedJWK
• 925f3bb refactor: index the JWS and JWE registries without a wrapper
• 505c383 fix: enforce a single recipient when decrypting dir and ECDH-ES
• 514831d chore(deps): bump the actions group with 3 updates
• 45965db chore: cleanup after release
• 60b941f chore(release): 6.2.7
• 90ab09c fix: require own JOSE properties for presence checks
• 767d7f1 refactor: reduce bundle size
• Additional commits viewable in compare view

Updates @anthropic-ai/claude-agent-sdk from 0.3.220 to 0.3.227

Release notes

Sourced from @​anthropic-ai/claude-agent-sdk's releases.

v0.3.227

What's changed

• Updated to parity with Claude Code v2.1.227

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.227
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.227
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.227
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.227

v0.3.226

What's changed

• Updated to parity with Claude Code v2.1.226

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.226
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.226
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.226
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.226

v0.3.225

What's changed

• Fixed background subagents in headless/SDK sessions never resuming when a background shell command or Monitor they left running completed, so the subagent never saw the result

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.225
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.225
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.225
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.225

... (truncated)

Changelog

Sourced from @​anthropic-ai/claude-agent-sdk's changelog.

0.3.227

• Updated to parity with Claude Code v2.1.227

0.3.226

• Updated to parity with Claude Code v2.1.226

0.3.225

• Fixed background subagents in headless/SDK sessions never resuming when a background shell command or Monitor they left running completed, so the subagent never saw the result

0.3.224

• Added crossSessionInbound and dialogExpiry settings: cross-session messages sent to a session running with bypassed permissions are held for your approval, and messages to other sessions auto-deliver
• Added subkind: 'peer-send-message' to the task-notification member of SDKMessageOrigin, marking a notification raised by a cross-session SendMessage
• Added source: 'archive' plugin config variant to Settings, with url and optional sha256, for installing plugins from a zip over HTTPS
• Added sandbox credential-masking fields to Settings: decode: 'jwt' with maskClaims, extract/onExtractNoMatch on envVars, and awsPairs/sigv4 for AWS SigV4 re-signing
• Fixed long (>200 char) project paths resolving to another project's session directory under a shared sanitized prefix; session list/get/rename/tag/fork/delete and /resume no longer cross projects

0.3.223

• Added resumeDropsTurn option: with resumeSessionAt, declares the turn a truncating resume intends to drop; the CLI refuses the resume if anything else would be discarded
• Result messages for repeated 529 overload failures now include api_error_status: 529, so SDK consumers can detect overload terminations structurally instead of matching message text
• Bare headless (-p / SDK query() without canUseTool) now emits system/permission_denied stream events when a tool call is auto-denied
• Documented usage vs modelUsage on stream-json results: usage is main-loop-only and per-turn; modelUsage is cumulative, covers all query-pipeline calls, and is the field for cost accounting

0.3.222

• Fixed query({ sessionStore, resume }) not carrying user settings.json (apiKeyHelper, env, hooks, permissions) into the resumed subprocess

0.3.221

• Improved skills option validation: malformed names (delimiters or control characters) and wildcard-form names are rejected with a clear error; use skills: 'all' to enable every skill
• Fixed external MCP servers passed via the mcpServers option not being connected before the first turn, which caused the model to emit tool calls as literal text

Commits

• 2284706 chore: Update CHANGELOG.md
• d13c50c chore: Update CHANGELOG.md
• 4cae4b7 chore: Update CHANGELOG.md
• 86e3e94 chore: Update CHANGELOG.md
• 064793e chore: Update CHANGELOG.md
• 6e143f4 chore: Update CHANGELOG.md
• 31fbbfd chore: Update CHANGELOG.md
• See full diff in compare view

Updates @anthropic-ai/sdk from 0.115.0 to 0.116.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk: v0.116.0

0.116.0 (2026-08-07)

Full Changelog: sdk-v0.115.0...sdk-v0.116.0

Features

• api: add mid-conversation-tool-changes-2026-07-01 beta (70e04f6)
• api: add support for session budgets, advisor tool, pinned inference location and skills auto-loading from GitHub (1336a4a)
• tools: make bash timeout and abort errors matchable by class (#259) (201b12e)

Bug Fixes

• client: use hardcoded User-Agent strings instead of constructor names (0b97f04)

Chores

• api: remove retired Claude Opus 4.1 models (11b685c)
• docs: small updates to descriptions (413cc5f)
• docs: updates to a few documentation strings (c38a1de)
• internal/deps: bump @​babel/core and @​babel/helpers to 7.29.7 (#261) (3164934)
• internal/deps: install tsc-multi from the npm registry (#265) (c787f90)
• internal: codegen related update (73b3d61)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.116.0 (2026-08-07)

Full Changelog: sdk-v0.115.0...sdk-v0.116.0

Features

• api: add mid-conversation-tool-changes-2026-07-01 beta (70e04f6)
• api: add support for session budgets, advisor tool, pinned inference location and skills auto-loading from GitHub (1336a4a)
• tools: make bash timeout and abort errors matchable by class (#259) (201b12e)

Bug Fixes

• client: use hardcoded User-Agent strings instead of constructor names (0b97f04)

Chores

• api: remove retired Claude Opus 4.1 models (11b685c)
• docs: small updates to descriptions (413cc5f)
• docs: updates to a few documentation strings (c38a1de)
• internal/deps: bump @​babel/core and @​babel/helpers to 7.29.7 (#261) (3164934)
• internal/deps: install tsc-multi from the npm registry (#265) (c787f90)
• internal: codegen related update (73b3d61)

Commits

• ed02a89 chore: release main
• d72ff6a feat(api): add support for session budgets, advisor tool, pinned inference lo...
• dbfed51 chore(internal/deps): refresh provider package dev tooling to mirror-availabl...
• b7e95bf chore(docs): updates to a few documentation strings
• 9efb7bd chore(api): remove retired Claude Opus 4.1 models
• 342d422 chore(internal/deps): install tsc-multi from the npm registry (#265)
• 501955c chore(internal/deps): bump @​babel/core and @​babel/helpers to 7.29.7 (#261)
• 6641c5e feat(tools): make bash timeout and abort errors matchable by class (#259)
• e421c43 chore(docs): small updates to descriptions
• c0a963e feat(api): add mid-conversation-tool-changes-2026-07-01 beta
• Additional commits viewable in compare view

Updates @types/react from 19.2.17 to 19.2.18

Commits

• See full diff in compare view

Updates @vercel/detect-agent from 1.2.3 to 1.2.4

Release notes

Sourced from @​vercel/detect-agent's releases.

@​vercel/h3@​0.1.116

Patch Changes

• @​vercel/node@​5.9.3

@​vercel/h3@​0.1.115

Patch Changes

• @​vercel/node@​5.9.2

@​vercel/h3@​0.1.114

Patch Changes

• @​vercel/node@​5.9.1

@​vercel/h3@​0.1.113

Patch Changes

• Updated dependencies [4502520]
  • @​vercel/node@​5.9.0

@​vercel/h3@​0.1.112

Patch Changes

• @​vercel/node@​5.8.27

Changelog

Sourced from @​vercel/detect-agent's changelog.

@​vercel/detect-agent

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​vercel/detect-agent since your current version.

Attestation changes

This version has no provenance attestation, while the previous version (1.2.3) was attested. Review the package versions before updating.

Updates esbuild from 0.28.1 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2

• Fix tree shaking bug due to TypeScript import alias (#4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

• Avoid overwriting input files without --allow-overwrite (#4484)

  For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

  This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

• Fix incorrect code generated when using top-level await (#4498)

  Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

• Fix a minification bug with lowered logical assignment operators (#4508)

  This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

  // Original code
  function foo() {
    let x
    bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.2

• Fix tree shaking bug due to TypeScript import alias (#4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

• Avoid overwriting input files without --allow-overwrite (#4484)

  For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

  This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

• Fix incorrect code generated when using top-level await (#4498)

  Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

• Fix a minification bug with lowered logical assignment operators (#4508)

  This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

  // Original code
  function foo() {
    let x

... (truncated)

Commits

• 609683d publish 0.28.2 to npm
• 11b1fe4 add to release notes
• ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
• 04627b6 fix #4498: async TLA checks need a worklist
• 5c15177 disable gopls in the go folder
• fc2ee9b css: adjust parser to allow --foo: {...}
• 209db54 release notes for css nesting bugfix
• c625d31 fix #4497: preserve nested ampersands during minification (#4500)
• 34474e2 better isolation of current part in js parser
• 07f6e8c fix #4507: import assignment tree-shaking bug
• Additional commits viewable in compare view

Updates pg from 8.22.0 to 8.23.0

Changelog

Sourced from pg's changelog.

pg@8.23.0

• Add support for query pipelineing.

Commits

• df274d1 Publish
• eb19d0f Add opt-in query pipelining (#...

  Description has been truncated

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0da3b1ad4e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[github-actions]

Supabase CLI preview

npx --yes https://pkg.pr.new/supabase/cli/supabase@eb8f31bdca772c3fc6d347732cd9c10a09bdbc9c

Preview package for commit eb8f31b.