Skip to content

chore(deps): bump the minor-and-patch group across 1 directory with 30 updates - #3221

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-366ce39081
Closed

chore(deps): bump the minor-and-patch group across 1 directory with 30 updates#3221
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-366ce39081

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 21, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 30 updates in the / directory:

Package From To
@anthropic-ai/sdk 0.107.0 0.112.4
@sentry/nextjs 10.62.0 10.67.0
@supabase/ssr 0.12.0 0.12.3
@supabase/supabase-js 2.108.2 2.110.8
dompurify 3.4.11 3.4.12
driver.js 1.6.0 1.8.0
idb-keyval 6.2.6 6.3.0
next 16.2.9 16.2.11
next-auth 4.24.14 4.24.15
next-intl 4.13.0 4.13.3
sharp 0.35.2 0.35.3
swagger-ui-react 5.32.6 5.32.10
@emnapi/core 1.11.1 1.11.2
@emnapi/runtime 1.11.1 1.11.2
@next/env 16.2.9 16.2.11
@typescript-eslint/eslint-plugin 8.62.1 8.65.0
@typescript-eslint/parser 8.62.1 8.65.0
@vitest/coverage-v8 4.1.9 4.1.10
autoprefixer 10.5.2 10.5.4
eslint 9.39.4 9.39.5
eslint-config-next 16.2.9 16.2.11
postcss 8.5.16 8.5.21
vitest 4.1.9 4.1.10
web-tree-sitter 0.26.10 0.26.11
@img/sharp-linux-x64 0.35.2 0.35.3
@parcel/watcher-darwin-arm64 2.5.6 2.6.0
@parcel/watcher-darwin-x64 2.5.6 2.6.0
@parcel/watcher-linux-x64-glibc 2.5.6 2.6.0
@parcel/watcher-linux-x64-musl 2.5.6 2.6.0
@swc/core-linux-x64-gnu 1.15.43 1.15.46

Updates @anthropic-ai/sdk from 0.107.0 to 0.112.4

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk: v0.112.4

0.112.4 (2026-07-20)

Full Changelog: sdk-v0.112.3...sdk-v0.112.4

Bug Fixes

  • aws: preserve AWS options and auth mode across withOptions() (#214) (3f7665c)

Chores

sdk: v0.112.3

0.112.3 (2026-07-17)

Full Changelog: sdk-v0.112.2...sdk-v0.112.3

Chores

sdk: v0.112.2

0.112.2 (2026-07-17)

Full Changelog: sdk-v0.112.1...sdk-v0.112.2

Chores

sdk: v0.112.1

0.112.1 (2026-07-16)

Full Changelog: sdk-v0.112.0...sdk-v0.112.1

sdk: v0.112.0

0.112.0 (2026-07-16)

Full Changelog: sdk-v0.111.0...sdk-v0.112.0

Features

  • api: add support for MCP Tunnels (597ac41)

sdk: v0.111.0

0.111.0 (2026-07-10)

Full Changelog: sdk-v0.110.0...sdk-v0.111.0

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.112.4 (2026-07-20)

Full Changelog: sdk-v0.112.3...sdk-v0.112.4

Bug Fixes

  • aws: preserve AWS options and auth mode across withOptions() (#214) (3f7665c)

Chores

0.112.3 (2026-07-17)

Full Changelog: sdk-v0.112.2...sdk-v0.112.3

Chores

0.112.2 (2026-07-17)

Full Changelog: sdk-v0.112.1...sdk-v0.112.2

Chores

0.112.1 (2026-07-16)

Full Changelog: sdk-v0.112.0...sdk-v0.112.1

0.112.0 (2026-07-16)

Full Changelog: sdk-v0.111.0...sdk-v0.112.0

Features

  • api: add support for MCP Tunnels (597ac41)

0.111.0 (2026-07-10)

Full Changelog: sdk-v0.110.0...sdk-v0.111.0

Features

  • api: add support for dreaming (77b28a6)
  • tools: gate session tool calls on evaluated_permission; bound idle by server stop_reason (68a6d7b)

... (truncated)

Commits
  • 3e9a2e1 chore(aws): raise minimum @​anthropic-ai/sdk version to 0.112.4
  • 1cdfa7f chore: release main
  • 0cd535b fix(aws): remove duplicate loggerFor import breaking the build (#235)
  • ff7d620 fix(aws): preserve AWS options and auth mode across withOptions() (#214)
  • 0b39044 chore(docs): small updates
  • f84e863 chore: release main
  • 373cf7e chore(docs): small updates
  • 4d3022d chore(internal): tidy changelog
  • 5019578 chore: release main
  • 01e74ee fix(google-cloud): bump google-auth-library to ^10.2.0 (#230)
  • Additional commits viewable in compare view

Updates @sentry/nextjs from 10.62.0 to 10.67.0

Release notes

Sourced from @​sentry/nextjs's releases.

10.67.0

Important Changes

  • feat(sveltekit): Add support for SvelteKit 3 (#22264)

    The SvelteKit SDK now supports the pre-release of SvelteKit 3, including client-side pageload and navigation tracing and server-side native tracing, alongside continued SvelteKit 2 support. No Sentry-specific setup changes are required. The SDK detects your SvelteKit version and picks the right implementation automatically.

Other Changes

  • feat(aws-serverless): Use orchestrion aws-sdk integration under diagnostics-channel opt-in (#22143)
  • feat(cloudflare): Auto-instrument Workers AI binding via env instrumentation (#22126)
  • feat(cloudflare): Instrument Cloudflare rate limiter bindings (#22035)
  • feat(core): Instrument workers-ai-provider (#22119)
  • feat(core): Rename queryParams to urlQueryParams (#22217)
  • feat(mongodb): implement orchestrion mongodb integration (#22308)
  • feat(mongoose): implement orchestrion mongoose integration (#22202)
  • feat(node): Rewrite tedious instrumentation to orchestrion tracing channels (#22238)
  • feat(nuxt): Add _experimental.useDiagnosticsChannelInjection (#22323)
  • feat(remix): Add orchestrion-based remix instrumentation (#22244)
  • feat(replay): Allow skipping the final flush on stop() via { flush: false } (#22300)
  • feat(server-utils): Add @​opentelemetry/instrumentation-koa orchestrion integration (#22146)
  • feat(server-utils): Add orchestrion aws-sdk channel integration core (#22142)
  • feat(server-utils): Allow passing custom transforms to orchestrion (#22319)
  • feat(server-utils): Port Bedrock aws-sdk extension and add integration tests (#22166)
  • feat(server-utils): Port S3, Kinesis, DynamoDB, SecretsManager and StepFunctions aws-sdk extensions (#22164)
  • feat(server-utils): Port SQS, SNS and Lambda aws-sdk extensions with trace propagation (#22165)
  • feat(server-utils): Rewrite SentryLangChainInstrumentation to orchestrion (#22266)
  • feat(server-utils): Rewrite SentryLangGraphInstrumentation to orchestrion (#22268)
  • feat(vue): Set navigation.route.id from the route name (#22372)
  • fix(bundler): do not import type from optional peer dep (#22304)
  • fix(cloudflare): Bind Durable Object built-in handlers (#22340)
  • fix(cloudflare): Instrument custom WorkerEntrypoint RPC methods (#22310)
  • fix(cloudflare): Route DO teardown through original waitUntil (#22339)
  • fix(cloudflare): Skip spans for Cloudflare-internal Durable Object SQL queries (#22376)
  • fix(core): Prevent functionToStringIntegration from throwing on cross-origin realms (#22273)
  • fix(core): Prevent infinite recursion when console is instrumented twice (#21959)
  • fix(nextjs): Mark internal chunk frames as not in_app (#22354)
  • fix(node): Register tracer provider when OTel API global pre-exists with a different version (#22374)
  • fix(node-native): Don't drop breadcrumbs from event loop block events (#22322)
  • fix(serve-rutils): Orchestrion diagnostics for async and require (#22327)
  • fix(server-utils): Only skip loader thread (#22336)
  • fix(sveltekit): Detect SvelteKit server build via Vite Environment API (#21629)
  • fix(vercelai): Avoid double-capturing v4 tool errors in orchestrion mode (#22293)
  • fix(vue): Support pinia 4 in peer dependency range (#22324)
  • chore: Add external contributor to CHANGELOG.md (#22357)
  • chore: Add external contributor to CHANGELOG.md (#22359)

... (truncated)

Changelog

Sourced from @​sentry/nextjs's changelog.

10.67.0

Important Changes

  • feat(sveltekit): Add support for SvelteKit 3 (#22264)

    The SvelteKit SDK now supports the pre-release of SvelteKit 3, including client-side pageload and navigation tracing and server-side native tracing, alongside continued SvelteKit 2 support. No Sentry-specific setup changes are required. The SDK detects your SvelteKit version and picks the right implementation automatically.

Other Changes

  • feat(aws-serverless): Use orchestrion aws-sdk integration under diagnostics-channel opt-in (#22143)
  • feat(cloudflare): Auto-instrument Workers AI binding via env instrumentation (#22126)
  • feat(cloudflare): Instrument Cloudflare rate limiter bindings (#22035)
  • feat(core): Instrument workers-ai-provider (#22119)
  • feat(core): Rename queryParams to urlQueryParams (#22217)
  • feat(mongodb): implement orchestrion mongodb integration (#22308)
  • feat(mongoose): implement orchestrion mongoose integration (#22202)
  • feat(node): Rewrite tedious instrumentation to orchestrion tracing channels (#22238)
  • feat(nuxt): Add _experimental.useDiagnosticsChannelInjection (#22323)
  • feat(remix): Add orchestrion-based remix instrumentation (#22244)
  • feat(replay): Allow skipping the final flush on stop() via { flush: false } (#22300)
  • feat(server-utils): Add @​opentelemetry/instrumentation-koa orchestrion integration (#22146)
  • feat(server-utils): Add orchestrion aws-sdk channel integration core (#22142)
  • feat(server-utils): Allow passing custom transforms to orchestrion (#22319)
  • feat(server-utils): Port Bedrock aws-sdk extension and add integration tests (#22166)
  • feat(server-utils): Port S3, Kinesis, DynamoDB, SecretsManager and StepFunctions aws-sdk extensions (#22164)
  • feat(server-utils): Port SQS, SNS and Lambda aws-sdk extensions with trace propagation (#22165)
  • feat(server-utils): Rewrite SentryLangChainInstrumentation to orchestrion (#22266)
  • feat(server-utils): Rewrite SentryLangGraphInstrumentation to orchestrion (#22268)
  • feat(vue): Set navigation.route.id from the route name (#22372)
  • fix(bundler): do not import type from optional peer dep (#22304)
  • fix(cloudflare): Bind Durable Object built-in handlers (#22340)
  • fix(cloudflare): Instrument custom WorkerEntrypoint RPC methods (#22310)
  • fix(cloudflare): Route DO teardown through original waitUntil (#22339)
  • fix(cloudflare): Skip spans for Cloudflare-internal Durable Object SQL queries (#22376)
  • fix(core): Prevent functionToStringIntegration from throwing on cross-origin realms (#22273)
  • fix(core): Prevent infinite recursion when console is instrumented twice (#21959)
  • fix(nextjs): Mark internal chunk frames as not in_app (#22354)
  • fix(node): Register tracer provider when OTel API global pre-exists with a different version (#22374)
  • fix(node-native): Don't drop breadcrumbs from event loop block events (#22322)
  • fix(serve-rutils): Orchestrion diagnostics for async and require (#22327)
  • fix(server-utils): Only skip loader thread (#22336)
  • fix(sveltekit): Detect SvelteKit server build via Vite Environment API (#21629)
  • fix(vercelai): Avoid double-capturing v4 tool errors in orchestrion mode (#22293)
  • fix(vue): Support pinia 4 in peer dependency range (#22324)
  • chore: Add external contributor to CHANGELOG.md (#22357)

... (truncated)

Commits
  • a88e286 release: 10.67.0
  • db27830 Merge pull request #22382 from getsentry/prepare-release/10.67.0
  • 3c20967 meta(changelog): Update changelog for 10.67.0
  • ee99468 feat(cloudflare): Auto-instrument Workers AI binding via env instrumentation ...
  • 55bd48a feat(core): Instrument workers-ai-provider (#22119)
  • c47b449 chore(ci): Use openrouter keys for claude in ci (#22381)
  • 326fbc9 fix(cloudflare): Skip spans for Cloudflare-internal Durable Object SQL querie...
  • 8e20a26 feat(vue): Set navigation.route.id from the route name (#22372)
  • e47e5d8 feat(remix): Add orchestrion-based remix instrumentation (#22244)
  • 1e26f76 feat(mongodb): implement orchestrion mongodb integration (#22308)
  • Additional commits viewable in compare view

Updates @supabase/ssr from 0.12.0 to 0.12.3

Release notes

Sourced from @​supabase/ssr's releases.

v0.12.3

0.12.3 (2026-07-14)

Bug Fixes

  • cookies: keep domain-scoped deletion in name-keyed cookie stores (#258) (d3a8a98), closes #256

v0.12.3-rc.135

What's Changed

New Contributors

Full Changelog: supabase/ssr@v0.12.2...v0.12.3-rc.135

v0.12.2

0.12.2 (2026-07-14)

Bug Fixes

  • align parseCookieHeader return type with getAll cookie method (#239) (e8fe1d5), closes #115

v0.12.2-rc.133

What's Changed

Full Changelog: supabase/ssr@v0.12.2-rc.132...v0.12.2-rc.133

v0.12.2-rc.132

What's Changed

New Contributors

Full Changelog: supabase/ssr@v0.12.1...v0.12.2-rc.132

v0.12.1

0.12.1 (2026-07-13)

Bug Fixes

  • cookies: deduplicate server cookie writes (#246) (035eabe)

v0.12.1-rc.130

... (truncated)

Changelog

Sourced from @​supabase/ssr's changelog.

0.12.3 (2026-07-14)

Bug Fixes

  • cookies: keep domain-scoped deletion in name-keyed cookie stores (#258) (d3a8a98), closes #256

0.12.2 (2026-07-14)

Bug Fixes

  • align parseCookieHeader return type with getAll cookie method (#239) (e8fe1d5), closes #115

0.12.1 (2026-07-13)

Bug Fixes

  • cookies: deduplicate server cookie writes (#246) (035eabe)
Commits
  • dd2b20b chore(main): release 0.12.3 (#264)
  • d3a8a98 fix(cookies): keep domain-scoped deletion in name-keyed cookie stores (#258)
  • bd7c8c8 chore(main): release 0.12.2 (#261)
  • 21e185a chore: update @​supabase/supabase-js to v2.110.5 (#263)
  • e8fe1d5 fix: align parseCookieHeader return type with getAll cookie method (#239)
  • d06ca21 chore(main): release 0.12.1 (#255)
  • 1c175c1 chore: update @​supabase/supabase-js to v2.110.3 (#260)
  • 7e1c519 docs: align getSession/getUser/getClaims guidance with docs (#259)
  • 509fc8e chore: update @​supabase/supabase-js to v2.110.2 (#257)
  • 035eabe fix(cookies): deduplicate server cookie writes (#246)
  • Additional commits viewable in compare view

Updates @supabase/supabase-js from 2.108.2 to 2.110.8

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.110.8

2.110.8 (2026-07-21)

🩹 Fixes

  • auth: downgrade aborted/transient fetch failures from console.error to warn (#2544)
  • functions: clean up cross-signal abort listener on invoke() return (#2487)
  • functions: match response Content-Type case-insensitively (#2515)
  • storage: url-encode object key in CDN purge methods (#2545)
  • supabase: skip Node warning in Deno (#2541)

❤️ Thank You

v2.110.8-canary.2

2.110.8-canary.2 (2026-07-21)

🩹 Fixes

  • storage: url-encode object key in CDN purge methods (#2545)

❤️ Thank You

v2.110.8-canary.1

2.110.8-canary.1 (2026-07-21)

🩹 Fixes

  • auth: downgrade aborted/transient fetch failures from console.error to warn (#2544)

❤️ Thank You

v2.110.8-canary.0

2.110.8-canary.0 (2026-07-21)

🩹 Fixes

  • functions: clean up cross-signal abort listener on invoke() return (#2487)
  • functions: match response Content-Type case-insensitively (#2515)
  • supabase: skip Node warning in Deno (#2541)

❤️ Thank You

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.110.7 (2026-07-16)

🩹 Fixes

  • realtime: trigger set auth on INITIAL_SESSION event (#2531)

❤️ Thank You

2.110.6 (2026-07-15)

🩹 Fixes

  • supabase: warn instead of throw for unrecognized sb_ API key subtypes (#2526)

❤️ Thank You

2.110.5 (2026-07-14)

🩹 Fixes

  • supabase: avoid edge runtime warning (#2522)

❤️ Thank You

2.110.4 (2026-07-14)

🩹 Fixes

  • functions: stop sending API key in Authorization header for function calls (#2511)

❤️ Thank You

2.110.3 (2026-07-13)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.110.2 (2026-07-09)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.110.1 (2026-07-07)

... (truncated)

Commits
  • 01dbb53 fix(supabase): skip Node warning in Deno (#2541)
  • 150b00c chore(release): version 2.110.7 changelogs (#2533)
  • 130fa11 fix(realtime): trigger set auth on INITIAL_SESSION event (#2531)
  • c90b1cd chore(release): version 2.110.6 changelogs (#2527)
  • c23e1ab fix(supabase): warn instead of throw for unrecognized sb_ API key subtypes (#...
  • 8af3c3a chore(release): version 2.110.5 changelogs (#2524)
  • 25da097 chore(release): version 2.110.4 changelogs (#2523)
  • dafa7f5 fix(supabase): avoid edge runtime warning (#2522)
  • 558c1f5 fix(functions): stop sending API key in Authorization header for function cal...
  • aaec93f chore(release): version 2.110.3 changelogs (#2519)
  • Additional commits viewable in compare view

Updates dompurify from 3.4.11 to 3.4.12

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.12

  • Fixed an issue where a hook would not get called for custom elements, thanks @​Rikuxx0
  • Hardened the handling of hooks removing elements, @​mkrause-bee360
  • Added support for a few new SVG attributes, thanks @​cbn-falias & @​Develop-KIM
  • Hardened the handling of declarative partial updates
  • Updated the documentation is several spots, README, wiki, etc.
  • Bumped several dependencies where possible
Commits

Updates driver.js from 1.6.0 to 1.8.0

Release notes

Sourced from driver.js's releases.

1.8.0

Added

  • Hints: pulsing beacons that open a popover on click; overlay optional, the page stays interactive. driver.js/hints, ~5KB gzip. Guide. (#363)
  • advanceOnClick (driver and step level) to advance the tour by clicking the highlighted element itself. (#606)
  • waitForElement (driver and step level) to wait up to N ms for a step's element before treating it as missing. (#606)
  • sideEffects field in package.json for better tree-shaking.

Changed

  • Popover internals shared between tours and hints; tour behaviour verified unchanged against 1.7.0.
  • Build migrated from vite to tsdown; artifact names, exports map and CDN globals unchanged, sizes within ±2%.

Fixed

  • skipMissingElement: the last reachable step now shows Done and runs onDoneClick; step queries like isLastStep() account for skips. (#616)

1.7.0

Added

  • skipMissingElement option to skip a step whose target element is missing (#489, #395)
  • index on the options passed to every hook (#490)
  • --driver-popover-font-family CSS variable to set the popover font (#607)

Changed

  • The popover title and description now render in the default font stack. Set --driver-popover-font-family to use your own.

Fixed

  • Icon fonts placed inside a step description are no longer overridden (#510, #512)
  • Each driver() call keeps its own config, steps and state, (#571)
  • Popover no longer jumps when its content has images that load after render.
Commits
  • ccc94cb 1.8.0
  • b93a4fc Add advanceOnClick and waitForElement
  • ab56c56 Fix missing step and button texts #616
  • 3821035 Increase beacon indicator size
  • 8678291 Refactor tests
  • e2aa992 Reorganize internals and unify step popover
  • b4d221f Add onButtonClick to take over the hint button
  • 09484c7 Clean up the hints module
  • 95df19e Give the hint popover and its arrow one seamless shadow
  • 24763f9 Anchor overlay-mode hints to the element and enlarge the hint arrow
  • Additional commits viewable in compare view

Updates idb-keyval from 6.2.6 to 6.3.0

Commits

Updates next from 16.2.9 to 16.2.11

Release notes

Sourced from next's releases.

v16.2.10

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 16.2.4.

Commits
  • 9beca08 v16.2.11
  • 3c48c7a [16.x] Fix Turbopack middleware matcher with i18n single locale
  • ac1eff3 [16.x] Improve performance of checking valid MPA form submissions
  • 9a4651e [16.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
  • b512063 [16.x] Set correct origin for internal redirects in custom server
  • d303326 [16.x] Ensure exotic rewrite param values are properly encoded
  • 73b9487 [16.x] fix(fetch-cache): key fetch(Request, init) by the effective request
  • bf9d17f [16.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies
  • fe28768 [16.x] fix(next/image): improve performance of detectContentType()
  • d8afb8d [16.x] Performance improvements when decoding React Server function payloads
  • Additional commits viewable in compare view

Updates next-auth from 4.24.14 to 4.24.15

Release notes

Sourced from next-auth's releases.

next-auth@4.24.15

Security patch release for the 4.x line.

  • getToken() now returns null instead of throwing when the Authorization header contains a malformed Bearer value.
  • OAuth state, nonce, and PKCE check cookies are now bound to the provider that created them and are rejected when a different provider handles the callback. Sign-ins in flight across the upgrade fail once and succeed on retry.
  • Email addresses are Unicode-normalized (NFKC) before validation in the email sign-in flow, closing a homoglyph @ bypass.
  • An explicitly configured NEXTAUTH_URL now takes precedence over the auto-detected forwarded host in trusted-host mode.
  • Restores CommonJS compatibility by pinning uuid to ^11.1.1; the 14.x line is ESM-only and broke require() on Node versions below 20.19.
Commits
  • d857eec chore(release): next-auth@4.24.15 [skip ci]
  • 5bca239 fix(next-auth): harden getToken parsing and bind OAuth check cookies to provi...
  • db7e27d chore(deps): use uuid ^11.1.1 to keep CommonJS support (#13466)
  • 32d874c fix(next-auth): repair red v4 CI (lint + pre-existing test drift) (#13447)
  • fa85858 chore: update uuid to v14, remove deprecated types (#13422)
  • 2a39465 Merge commit from fork
  • 19d2feb Merge commit from fork
  • See full diff in compare view

Updates next-intl from 4.13.0 to 4.13.3

Release notes

Sourced from next-intl's releases.

v4.13.3

4.13.3 (2026-07-21)

Bug Fixes

  • Next.js 16.3 compatibility preparation (only update locale cookie for document requests and not prefetches) (#2355) (0555ace) – by @​amannn

v4.13.2

4.13.2 (2026-07-10)

Bug Fixes

v4.13.1

4.13.1 (2026-06-30)

Bug Fixes

Changelog

Sourced from next-intl's changelog.

4.13.3 (2026-07-21)

Bug Fixes

  • Next.js 16.3 compatibility preparation (only update locale cookie for document requests and not prefetches) (#2355) (0555ace) – by @​amannn

4.13.2 (2026-07-10)

Bug Fixes

4.13.1 (2026-06-30)

Bug Fixes

Commits
  • 89ae783 v4.13.3
  • 0555ace fix: Next.js 16.3 compatibility preparation (only update locale cookie for do...
  • 89c72b1 docs: Add AI agents page, integrate eloqnt studio, and update nav (#2357)
  • d14dd6f v4.13.2
  • cc34d9a fix: Correctly format plural/select branches that are only # or empty (#2356)
  • 976ca1f v4.13.1
  • 4025d1f fix: Handle ICU escape sequences around < consistently in dev and productio...
  • 90691ed docs: Add hooks hint to extraction.mdx (#2348)
  • 30d1004 docs: Handle malformed tweet entities from API (#2343)
  • 030afd3 docs: Add copy-to-clipboard for details section permalinks (#2342)
  • See full diff in compare view

Updates sharp from 0.35.2 to 0.35.3

Release notes

Sourced from sharp's releases.

v0.35.3

  • Tighten verification of text dimensions, TIFF tile dimensions and extend values.

  • Improve code bundler support by resolving path to libvips binary.

  • Increase default concurrency when use of MALLOC_ARENA_MAX is detected.

  • Emit warning about binaries provided by Electron for use on Linux.

  • Add hasAlpha property to output info. #4500

  • TypeScript: Return more precise Buffer<ArrayBuffer> from toBuffer. #4520 @​Andarist

  • Bound clahe width and height to avoid signed overflow. #4551 @​metsw24-max

  • Bound trim margin to avoid signed overflow. #4552 @​metsw24-max

  • Reject infinite values when validating numbers. #4553 @​metsw24-max

  • Bound extract region to libvips coordinate limit. #4555 @​metsw24-max

  • Verify background colour values are numbers. #4556 @​metsw24-max

  • Bound create and raw input dimensions to coordinate limit. #4558 @​metsw24-max

  • Tighten recomb and affine matrix verification. #4560 @​chatman-media

  • Verify cache memory limit to avoid overflow. #4561 @​metsw24-max

v0.35.3-rc.2

  • Tighten verification of text dimensions, TIFF tile dimensions and extend values.

... (truncated)

Commits
  • 1018449 Release v0.35.3
  • ba303a7 Prerelease v0.35.3-rc.2
  • 4f94fc5 Upgrade to sharp-libvips v1.3.2
  • c5e7a3f Bump devDeps, fix Deno/Windows smoke tests
  • 9a8d002 Docs: Add changelog entry and note about transferable #4520
  • 8694db0 TypeScript: Return more precise Buffer\<ArrayBuffer> from toBu...

    Description has been truncated

@dependabot dependabot Bot added level:beginner GSSoC: Beginner difficulty (20 pts) type:devops GSSoC type bonus: devops (+15 pts) labels Jul 21, 2026
@dependabot dependabot Bot added level:beginner GSSoC: Beginner difficulty (20 pts) type:devops GSSoC type bonus: devops (+15 pts) labels Jul 21, 2026
@github-actions github-actions Bot added the gssoc26 GSSoC 2026 contribution label Jul 21, 2026
@Priyanshu-byte-coder

Copy link
Copy Markdown
Owner

Holding — the grouped dependency bump fails CI (Continuous Integration Security & Audit Suite is red), so one of the bundled updates is breaking. @dependabot please rebase/split so the breaking package is isolated; the safe patches can land separately from whatever's failing.

…0 updates

Bumps the minor-and-patch group with 30 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `0.107.0` | `0.112.4` |
| [@sentry/nextjs](https://github.com/getsentry/sentry-javascript) | `10.62.0` | `10.67.0` |
| [@supabase/ssr](https://github.com/supabase/ssr) | `0.12.0` | `0.12.3` |
| [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.108.2` | `2.110.8` |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.4.11` | `3.4.12` |
| [driver.js](https://github.com/nilbuild/driver.js/tree/HEAD/packages/driver) | `1.6.0` | `1.8.0` |
| [idb-keyval](https://github.com/jakearchibald/idb-keyval) | `6.2.6` | `6.3.0` |
| [next](https://github.com/vercel/next.js) | `16.2.9` | `16.2.11` |
| [next-auth](https://github.com/nextauthjs/next-auth) | `4.24.14` | `4.24.15` |
| [next-intl](https://github.com/amannn/next-intl) | `4.13.0` | `4.13.3` |
| [sharp](https://github.com/lovell/sharp) | `0.35.2` | `0.35.3` |
| [swagger-ui-react](https://github.com/swagger-api/swagger-ui) | `5.32.6` | `5.32.10` |
| [@emnapi/core](https://github.com/toyobayashi/emnapi) | `1.11.1` | `1.11.2` |
| [@emnapi/runtime](https://github.com/toyobayashi/emnapi) | `1.11.1` | `1.11.2` |
| [@next/env](https://github.com/vercel/next.js/tree/HEAD/packages/next-env) | `16.2.9` | `16.2.11` |
| [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.62.1` | `8.65.0` |
| [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.62.1` | `8.65.0` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.9` | `4.1.10` |
| [autoprefixer](https://github.com/postcss/autoprefixer) | `10.5.2` | `10.5.4` |
| [eslint](https://github.com/eslint/eslint) | `9.39.4` | `9.39.5` |
| [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.2.9` | `16.2.11` |
| [postcss](https://github.com/postcss/postcss) | `8.5.16` | `8.5.21` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.9` | `4.1.10` |
| [web-tree-sitter](https://github.com/tree-sitter/tree-sitter/tree/HEAD/lib/binding_web) | `0.26.10` | `0.26.11` |
| [@img/sharp-linux-x64](https://github.com/lovell/sharp/tree/HEAD/npm/linux-x64) | `0.35.2` | `0.35.3` |
| [@parcel/watcher-darwin-arm64](https://github.com/parcel-bundler/watcher) | `2.5.6` | `2.6.0` |
| [@parcel/watcher-darwin-x64](https://github.com/parcel-bundler/watcher) | `2.5.6` | `2.6.0` |
| [@parcel/watcher-linux-x64-glibc](https://github.com/parcel-bundler/watcher) | `2.5.6` | `2.6.0` |
| [@parcel/watcher-linux-x64-musl](https://github.com/parcel-bundler/watcher) | `2.5.6` | `2.6.0` |
| [@swc/core-linux-x64-gnu](https://github.com/swc-project/swc) | `1.15.43` | `1.15.46` |



Updates `@anthropic-ai/sdk` from 0.107.0 to 0.112.4
- [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md)
- [Commits](anthropics/anthropic-sdk-typescript@sdk-v0.107.0...sdk-v0.112.4)

Updates `@sentry/nextjs` from 10.62.0 to 10.67.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.62.0...10.67.0)

Updates `@supabase/ssr` from 0.12.0 to 0.12.3
- [Release notes](https://github.com/supabase/ssr/releases)
- [Changelog](https://github.com/supabase/ssr/blob/main/CHANGELOG.md)
- [Commits](supabase/ssr@v0.12.0...v0.12.3)

Updates `@supabase/supabase-js` from 2.108.2 to 2.110.8
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.110.8/packages/core/supabase-js)

Updates `dompurify` from 3.4.11 to 3.4.12
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.11...3.4.12)

Updates `driver.js` from 1.6.0 to 1.8.0
- [Release notes](https://github.com/nilbuild/driver.js/releases)
- [Commits](https://github.com/nilbuild/driver.js/commits/1.8.0/packages/driver)

Updates `idb-keyval` from 6.2.6 to 6.3.0
- [Changelog](https://github.com/jakearchibald/idb-keyval/blob/main/CHANGELOG.md)
- [Commits](jakearchibald/idb-keyval@v6.2.6...v6.3.0)

Updates `next` from 16.2.9 to 16.2.11
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.2.9...v16.2.11)

Updates `next-auth` from 4.24.14 to 4.24.15
- [Release notes](https://github.com/nextauthjs/next-auth/releases)
- [Commits](https://github.com/nextauthjs/next-auth/compare/next-auth@4.24.14...next-auth@4.24.15)

Updates `next-intl` from 4.13.0 to 4.13.3
- [Release notes](https://github.com/amannn/next-intl/releases)
- [Changelog](https://github.com/amannn/next-intl/blob/main/CHANGELOG.md)
- [Commits](amannn/next-intl@v4.13.0...v4.13.3)

Updates `sharp` from 0.35.2 to 0.35.3
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.35.2...v0.35.3)

Updates `swagger-ui-react` from 5.32.6 to 5.32.10
- [Release notes](https://github.com/swagger-api/swagger-ui/releases)
- [Commits](swagger-api/swagger-ui@v5.32.6...v5.32.10)

Updates `@emnapi/core` from 1.11.1 to 1.11.2
- [Release notes](https://github.com/toyobayashi/emnapi/releases)
- [Commits](toyobayashi/emnapi@v1.11.1...v1.11.2)

Updates `@emnapi/runtime` from 1.11.1 to 1.11.2
- [Release notes](https://github.com/toyobayashi/emnapi/releases)
- [Commits](toyobayashi/emnapi@v1.11.1...v1.11.2)

Updates `@next/env` from 16.2.9 to 16.2.11
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.2.11/packages/next-env)

Updates `@typescript-eslint/eslint-plugin` from 8.62.1 to 8.65.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.65.0/packages/eslint-plugin)

Updates `@typescript-eslint/parser` from 8.62.1 to 8.65.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.65.0/packages/parser)

Updates `@vitest/coverage-v8` from 4.1.9 to 4.1.10
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/coverage-v8)

Updates `autoprefixer` from 10.5.2 to 10.5.4
- [Release notes](https://github.com/postcss/autoprefixer/releases)
- [Changelog](https://github.com/postcss/autoprefixer/blob/main/CHANGELOG.md)
- [Commits](postcss/autoprefixer@10.5.2...10.5.4)

Updates `eslint` from 9.39.4 to 9.39.5
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v9.39.4...v9.39.5)

Updates `eslint-config-next` from 16.2.9 to 16.2.11
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.2.11/packages/eslint-config-next)

Updates `postcss` from 8.5.16 to 8.5.21
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.16...8.5.21)

Updates `vitest` from 4.1.9 to 4.1.10
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest)

Updates `web-tree-sitter` from 0.26.10 to 0.26.11
- [Release notes](https://github.com/tree-sitter/tree-sitter/releases)
- [Commits](https://github.com/tree-sitter/tree-sitter/commits/v0.26.11/lib/binding_web)

Updates `@img/sharp-linux-x64` from 0.35.2 to 0.35.3
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](https://github.com/lovell/sharp/commits/v0.35.3/npm/linux-x64)

Updates `@parcel/watcher-darwin-arm64` from 2.5.6 to 2.6.0
- [Release notes](https://github.com/parcel-bundler/watcher/releases)
- [Commits](parcel-bundler/watcher@v2.5.6...v2.6.0)

Updates `@parcel/watcher-darwin-x64` from 2.5.6 to 2.6.0
- [Release notes](https://github.com/parcel-bundler/watcher/releases)
- [Commits](parcel-bundler/watcher@v2.5.6...v2.6.0)

Updates `@parcel/watcher-linux-x64-glibc` from 2.5.6 to 2.6.0
- [Release notes](https://github.com/parcel-bundler/watcher/releases)
- [Commits](parcel-bundler/watcher@v2.5.6...v2.6.0)

Updates `@parcel/watcher-linux-x64-musl` from 2.5.6 to 2.6.0
- [Release notes](https://github.com/parcel-bundler/watcher/releases)
- [Commits](parcel-bundler/watcher@v2.5.6...v2.6.0)

Updates `@swc/core-linux-x64-gnu` from 1.15.43 to 1.15.46
- [Release notes](https://github.com/swc-project/swc/releases)
- [Changelog](https://github.com/swc-project/swc/blob/main/CHANGELOG.md)
- [Commits](swc-project/swc@v1.15.43...v1.15.46)

---
updated-dependencies:
- dependency-name: "@anthropic-ai/sdk"
  dependency-version: 0.112.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@emnapi/core"
  dependency-version: 1.11.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@emnapi/runtime"
  dependency-version: 1.11.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@img/sharp-linux-x64"
  dependency-version: 0.35.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@next/env"
  dependency-version: 16.2.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@parcel/watcher-darwin-arm64"
  dependency-version: 2.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@parcel/watcher-darwin-x64"
  dependency-version: 2.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@parcel/watcher-linux-x64-glibc"
  dependency-version: 2.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@parcel/watcher-linux-x64-musl"
  dependency-version: 2.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@sentry/nextjs"
  dependency-version: 10.67.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@supabase/ssr"
  dependency-version: 0.12.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@supabase/supabase-js"
  dependency-version: 2.110.7
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@swc/core-linux-x64-gnu"
  dependency-version: 1.15.46
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@typescript-eslint/eslint-plugin"
  dependency-version: 8.65.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@typescript-eslint/parser"
  dependency-version: 8.65.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 4.1.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: autoprefixer
  dependency-version: 10.5.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: dompurify
  dependency-version: 3.4.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: driver.js
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: eslint
  dependency-version: 9.39.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: eslint-config-next
  dependency-version: 16.2.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: idb-keyval
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: next
  dependency-version: 16.2.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: next-auth
  dependency-version: 4.24.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: next-intl
  dependency-version: 4.13.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: postcss
  dependency-version: 8.5.20
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: sharp
  dependency-version: 0.35.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: swagger-ui-react
  dependency-version: 5.32.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: vitest
  dependency-version: 4.1.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: web-tree-sitter
  dependency-version: 0.26.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/minor-and-patch-366ce39081 branch from 058c31c to 4f055a2 Compare July 21, 2026 16:42
@dependabot @github

dependabot Bot commented on behalf of github Jul 28, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Jul 28, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/minor-and-patch-366ce39081 branch July 28, 2026 00:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

gssoc26 GSSoC 2026 contribution level:beginner GSSoC: Beginner difficulty (20 pts) type:devops GSSoC type bonus: devops (+15 pts)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant