Skip to content

fix(deps): bump the npm-major group across 1 directory with 28 updates - #6430

Merged
supabase-cli-releaser[bot] merged 2 commits into
developfrom
dependabot/npm_and_yarn/npm-major-eb3f3e134b
Sep 2, 2026
Merged

fix(deps): bump the npm-major group across 1 directory with 28 updates#6430
supabase-cli-releaser[bot] merged 2 commits into
developfrom
dependabot/npm_and_yarn/npm-major-eb3f3e134b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 2, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-major group with 28 updates in the / directory:

Package From To
verdaccio 6.9.3 6.10.0
vite 8.1.4 8.2.2
@supabase/supabase-js 2.112.3 2.112.4
jose 6.2.9 6.2.10
@anthropic-ai/claude-agent-sdk 0.3.234 0.3.246
@anthropic-ai/sdk 0.117.1 0.120.0
@supabase/pg-delta 1.0.0-alpha.46 1.0.0-alpha.47
@supabase/pg-topo 1.0.0-alpha.5 1.0.0-alpha.6
posthog-node 5.49.1 5.51.2
fumadocs-core 16.14.4 16.15.1
fumadocs-mdx 15.2.3 15.3.1
fumadocs-ui 16.14.4 16.15.1
next 16.3.1 16.3.3
@types/node 26.2.0 26.3.0
@types/react-dom 19.2.4 19.2.5
@effect/atom-react 4.0.0-rc.111 4.0.0-rc.112
@effect/platform-bun 4.0.0-rc.111 4.0.0-rc.112
@effect/platform-node 4.0.0-rc.111 4.0.0-rc.112
@effect/sql-pg 4.0.0-rc.111 4.0.0-rc.112
@effect/tsgo 0.36.5 0.37.0
@effect/vitest 4.0.0-rc.111 4.0.0-rc.112
@vitest/coverage-istanbul 4.1.10 4.1.11
effect 4.0.0-rc.111 4.0.0-rc.112
oxfmt 0.63.0 0.65.0
oxlint 1.78.0 1.80.0
tldts 6.1.86 7.4.11
turbo 2.10.11 2.10.12
vitest 4.1.10 4.1.11

Updates verdaccio from 6.9.3 to 6.10.0

Release notes

Sourced from verdaccio's releases.

v6.10.0

Minor Changes

  • 51c2733: Expose the optional legacy authentication cache for Verdaccio 6.x through server.legacyAuthCache.

    This feature is intended for performance-sensitive installations that still use legacy bearer tokens. When enabled, Verdaccio caches successful legacy token authentication results for a short period of time, so repeated requests using the same token do not need to run password verification through the authentication plugin every time. Concurrent requests for the same legacy token can also share the same in-flight authentication result.

    The cache is disabled by default, so existing installations keep their current authentication behavior unless they explicitly opt in. Basic authentication is not cached. If the cache is enabled, changed or revoked credentials may remain valid until the cached entry expires.

    Enable it in config.yaml:

    server:
  legacyAuthCache:
    enabled: true
    ttlMs: 15000
    maxEntries: 1000

    Options:

    • enabled: enables the legacy token authentication cache. Default: false.
    • ttlMs: time in milliseconds before a cached validation expires. Default: 15000.
    • maxEntries: maximum number of cached legacy tokens. Default: 1000.

    See #6147 and the original 8.x backport in #6143.

Changelog

Sourced from verdaccio's changelog.

6.10.0

Minor Changes

  • 51c2733: Update internal Verdaccio types to include the optional server.legacyAuthCache configuration used by the 8.x auth and config packages.
Commits

Updates vite from 8.1.4 to 8.2.2

Release notes

Sourced from vite's releases.

plugin-legacy@8.2.2

Please refer to CHANGELOG.md for details.

v8.2.2

Please refer to CHANGELOG.md for details.

plugin-legacy@8.2.1

Please refer to CHANGELOG.md for details.

v8.2.1

Please refer to CHANGELOG.md for details.

create-vite@8.2.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.2.0

Please refer to CHANGELOG.md for details.

v8.2.0

Please refer to CHANGELOG.md for details.

v8.2.0-beta.0

Please refer to CHANGELOG.md for details.

v8.1.5

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.2.2 (2026-08-20)

Features

  • deps: widen @vitejs/devtools peer range to v0.5.0 (#23302) (495d9ff)

Bug Fixes

  • bundled-dev: handle lazy request error (#23291) (3ba026d)
  • bundled-dev: hot update through circular imports instead of reloading (#23259) (3dbddef)
  • config: resolve sourcemap paths against sourcemap location (#23239) (05a003e)
  • css: don't pass empty targets to lightningcss (#23295) (2804636)
  • define: fix match escaped dots to support $-prefixed define keys (#23249) (dcf88bd)
  • deps: update all non-major dependencies (#23217) (ba958bd)
  • deps: update rolldown-related dependencies (#23218) (83ecb2c)
  • module-runner: exclude completed modules from in-flight cycle detection (fix #22999) (#23009) (d9b10a9)
  • optimizer: close custom extension analysis bundles (#23207) (8fb7675)
  • reduce Windows 8.3-short-name detection false-positives (#23066) (02cffa9)
  • respect resolve.preserveSymlinks when resolving root (fix #23197) (#23198) (8413052)
  • ssr: rewrite computed key of destructing parameter (#23307) (9db0b61)
  • vite: update outdated upstream file links in license comments (#23285) (c0f2fc6)

Documentation

Miscellaneous Chores

Code Refactoring

  • use JSON import attributes instead of readFileSync in constants (#23258) (1d9fa39)
  • use named regex constants over inline literals (#22964) (5c1c6c6)

Tests

  • define: close rolldown bundler after generate (#23231) (b4d66fe)
  • module-runner: add TLA circular import case (#23299) (4a261f2)
  • module-runner: simplify server-hmr tests (#23300) (599b44b)
  • ssr: add destructing assignment case for moduleRunnerTransform (#23308) (cb77e2a)

Build System

  • use JSON import attributes instead of readFIleSync in rolldown configs (#23251) (d615bcd)

8.2.1 (2026-08-06)

Bug Fixes

  • build: make client chunkImportMap work with sharedPlugins: true (#23184) (15f0307)
  • bundled-dev: inject client script tag before chunk scripts (#23161) (eac0cc8)

... (truncated)

Commits
  • de1111a release: v8.2.2
  • cb77e2a test(ssr): add destructing assignment case for moduleRunnerTransform (#23308)
  • 9db0b61 fix(ssr): rewrite computed key of destructing parameter (#23307)
  • 8413052 fix: respect resolve.preserveSymlinks when resolving root (fix #23197) (#23...
  • 05a003e fix(config): resolve sourcemap paths against sourcemap location (#23239)
  • 495d9ff feat(deps): widen @vitejs/devtools peer range to v0.5.0 (#23302)
  • 1d9fa39 refactor: use JSON import attributes instead of readFileSync in constants (#2...
  • 2804636 fix(css): don't pass empty targets to lightningcss (#23295)
  • 599b44b test(module-runner): simplify server-hmr tests (#23300)
  • 4a261f2 test(module-runner): add TLA circular import case (#23299)
  • Additional commits viewable in compare view

Updates @supabase/supabase-js from 2.112.3 to 2.112.4

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.112.4

2.112.4 (2026-08-24)

🩹 Fixes

  • auth: convert stolen-lock AbortError when acquireTimeout is 0 (#2616)
  • auth: warn on deprecated lock option and prevent unhandled refresh rejection (#2627)
  • postgrest: move override fixtures out of generated types, repair codegen (#2605)
  • realtime: respect custom logger for send() REST fallback warning (#2612)

❤️ Thank You

v2.112.4-canary.3

2.112.4-canary.3 (2026-08-24)

🩹 Fixes

  • auth: warn on deprecated lock option and prevent unhandled refresh rejection (#2627)

❤️ Thank You

v2.112.4-canary.2

2.112.4-canary.2 (2026-08-24)

🩹 Fixes

  • auth: convert stolen-lock AbortError when acquireTimeout is 0 (#2616)
  • realtime: respect custom logger for send() REST fallback warning (#2612)

❤️ Thank You

v2.112.4-canary.1

2.112.4-canary.1 (2026-08-12)

This was a version bump only, there were no code changes.

v2.112.4-canary.0

2.112.4-canary.0 (2026-08-11)

🩹 Fixes

  • postgrest: move override fixtures out of generated types, repair codegen (#2605)

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.112.4 (2026-08-24)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

Commits

Updates jose from 6.2.9 to 6.2.10

Release notes

Sourced from jose's releases.

v6.2.10

Fixes

  • jose: consume serialization members once (9bee285)
  • jose: reject empty protected and JWE AAD members (8da4145)
  • jose: validate serialized header values (b711d8f)
  • jwe: conceal invalid decrypted CEK lengths (41fafe0)
  • jwe: enforce AES-GCM tag boundaries (9a5b744)
  • jwe: validate explicit encryption parameters (7a02697)
  • jwk: accept empty octet-sequence keys (3f871e7)
  • jwk: normalize key resolution inputs (f54ee7b)
  • jwks: enforce verification key metadata (f9ba510)
  • jwks: order overlapping remote reloads (9a1a913)
  • jwks: reject invalid remote duration values (7bdb9e5)
  • jwk: validate ext and key_ops parameters (4d91c37)
  • jws: reject mixed payload encoding modes (dc69713)
  • jws: validate unencoded payload strings (541f282)
  • jwt: enforce explicit verification policies (b347182)
  • jwt: prevent replacing protected headers (ae07d09)
  • jwt: reject invalid duration inputs (282f9aa)
  • jwt: validate builder claim values (ea03f83)
  • jwt: validate unsecured protected headers (230c14e)
  • key: validate generation and import options (15d880e)
  • reject mixed b64 modes for empty General JWS payloads (61a2ef7)
  • x509: reject DER truncated past its outer length (d8db9f6)

Documentation

  • jwks: correct cache timestamp units (01a44d9)

Refactor

  • jose: share binary input validation (eedb124)
  • jose: share compact token processing internals (85e30ed)
  • jwe: consolidate CBC decryption failures (1ee6f61)
  • jwe: specialize compact processing (a998927)
  • jwe: streamline single-recipient encryption (290aaa6)
  • jwks: compact JWK Set shape validation (930c7df), references Array#every
  • jwks: compact local key selection (4cb5ae5)
  • jwks: compact remote resolver state (ef5eaf4)
  • jws: specialize compact processing (021abf4)
  • jwt: compact claim validation helpers (f390683)
  • jwt: consolidate replicated claim checks (7dd5591)
  • jwt: share producer claim state (52ba159)
  • key: compact JWK algorithm selection (a6b29da)
  • key: compact secret length parsing (cc03be8)
Changelog

Sourced from jose's changelog.

6.2.10 (2026-08-21)

Fixes

  • jose: consume serialization members once (9bee285)
  • jose: reject empty protected and JWE AAD members (8da4145)
  • jose: validate serialized header values (b711d8f)
  • jwe: conceal invalid decrypted CEK lengths (41fafe0)
  • jwe: enforce AES-GCM tag boundaries (9a5b744)
  • jwe: validate explicit encryption parameters (7a02697)
  • jwk: accept empty octet-sequence keys (3f871e7)
  • jwk: normalize key resolution inputs (f54ee7b)
  • jwks: enforce verification key metadata (f9ba510)
  • jwks: order overlapping remote reloads (9a1a913)
  • jwks: reject invalid remote duration values (7bdb9e5)
  • jwk: validate ext and key_ops parameters (4d91c37)
  • jws: reject mixed payload encoding modes (dc69713)
  • jws: validate unencoded payload strings (541f282)
  • jwt: enforce explicit verification policies (b347182)
  • jwt: prevent replacing protected headers (ae07d09)
  • jwt: reject invalid duration inputs (282f9aa)
  • jwt: validate builder claim values (ea03f83)
  • jwt: validate unsecured protected headers (230c14e)
  • key: validate generation and import options (15d880e)
  • reject mixed b64 modes for empty General JWS payloads (61a2ef7)
  • x509: reject DER truncated past its outer length (d8db9f6)

Documentation

  • jwks: correct cache timestamp units (01a44d9)

Refactor

  • jose: share binary input validation (eedb124)
  • jose: share compact token processing internals (85e30ed)
  • jwe: consolidate CBC decryption failures (1ee6f61)
  • jwe: specialize compact processing (a998927)
  • jwe: streamline single-recipient encryption (290aaa6)
  • jwks: compact JWK Set shape validation (930c7df), references Array#every
  • jwks: compact local key selection (4cb5ae5)
  • jwks: compact remote resolver state (ef5eaf4)
  • jws: specialize compact processing (021abf4)
  • jwt: compact claim validation helpers (f390683)
  • jwt: consolidate replicated claim checks (7dd5591)
  • jwt: share producer claim state (52ba159)
  • key: compact JWK algorithm selection (a6b29da)
  • key: compact secret length parsing (cc03be8)
Commits
  • 3eab152 chore(release): 6.2.10
  • 021abf4 refactor(jws): specialize compact processing
  • a998927 refactor(jwe): specialize compact processing
  • eedb124 refactor(jose): share binary input validation
  • 52ba159 refactor(jwt): share producer claim state
  • 85e30ed refactor(jose): share compact token processing internals
  • 0bd81d2 test(jose): cover hidden critical-header options
  • 9cf7876 test(jose): reject callable object impostors
  • f23cafd test(jose): preserve resolved key data properties
  • 1ee6f61 refactor(jwe): consolidate CBC decryption failures
  • Additional commits viewable in compare view

Updates @anthropic-ai/claude-agent-sdk from 0.3.234 to 0.3.246

Release notes

Sourced from @​anthropic-ai/claude-agent-sdk's releases.

v0.3.246

What's changed

  • Added optional user_message_uuid to error result messages and to the first assistant message or stream_event of each turn, linking a reply or failure to the user message that triggered it
  • Added modelUsage[*].costBasis ('list' | 'managed' | 'unknown') reporting which price table each model's costUSD was computed from
  • Added modelPricing support in the managedSettings option for hosts that set CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST; an admin-managed settings source that sets modelPricing still wins
  • Added perTaskStopAffordance option: when set, interrupt() aborts only the current turn and keeps background agents and workflows running; otherwise (and for one-shot string prompts) they stop

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.246
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.246
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.246
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.246

v0.3.245

What's changed

  • Updated to parity with Claude Code v2.1.245

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.245
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.245
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.245
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.245

v0.3.241

What's changed

  • Updated to parity with Claude Code v2.1.241

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.241
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.241
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.241
</tr></table>

... (truncated)

Changelog

Sourced from @​anthropic-ai/claude-agent-sdk's changelog.

0.3.246

  • Added optional user_message_uuid to error result messages and to the first assistant message or stream_event of each turn, linking a reply or failure to the user message that triggered it
  • Added modelUsage[*].costBasis ('list' | 'managed' | 'unknown') reporting which price table each model's costUSD was computed from
  • Added modelPricing support in the managedSettings option for hosts that set CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST; an admin-managed settings source that sets modelPricing still wins
  • Added perTaskStopAffordance option: when set, interrupt() aborts only the current turn and keeps background agents and workflows running; otherwise (and for one-shot string prompts) they stop

0.3.245

  • Updated to parity with Claude Code v2.1.245

0.3.244

  • Updated to parity with Claude Code v2.1.244

0.3.243

  • Added optional queued_turn_count to result messages: the number of queued user sends still pending when the result was produced, so hosts know whether another turn and result will follow
  • Fixed mcp_status reporting a remote MCP server as connected after its connection dropped; it now reports pending while reconnecting, then connected or failed
  • Fixed managed disableAllHooks also disabling hook callbacks registered through the hooks option; they now keep running, matching allowManagedHooksOnly
  • Changed Read tool PDF results: the document block (or page image blocks for pages reads) now arrives inside the tool_result content instead of as a separate user message after it
  • Updated to parity with Claude Code v2.1.243

0.3.242

  • Updated to parity with Claude Code v2.1.242

0.3.241

  • Updated to parity with Claude Code v2.1.241

0.3.240

  • Updated to parity with Claude Code v2.1.240

0.3.239

  • total_cost_usd / modelUsage.costUSD now include the 1.1× US-only-inference (data residency) multiplier when the response reports inference_geo: "us"
  • A result held back for background subagents in one-shot mode now reports total_cost_usd, duration_api_ms and modelUsage as of its release, not the turn-end snapshot
  • Fixed SYSTEM_PROMPT_DYNAMIC_BOUNDARY in an array systemPrompt being sent to the model as literal text on Bedrock, Vertex, Foundry, and gateway providers
  • A repeated initialize on a running process is now followed by a background_tasks_changed snapshot of the live background tasks, so reconnecting hosts see work that is still running

0.3.238

  • Added is_backgrounded and spawn_depth to task_started events for subagent tasks (is_backgrounded also on background Bash tasks)
  • Added suppressOriginalPrompt to UserPromptExpansion hook output, matching UserPromptSubmit
  • Added command_lifecycle state refused: a cross-session peer message the session's receive-side policy declines now reports this terminal state instead of producing no lifecycle frames
  • Fixed SDK hook callbacks silently not applying after a host re-sends initialize to an already-running CLI; the response now reports hooks_applied
  • Fixed CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION=true not keeping prompt_suggestion messages on when the account is near, but not over, its usage limit
  • Changed vcs_state_changed push events to emit one event per pushed branch

... (truncated)

Commits

Updates @anthropic-ai/sdk from 0.117.1 to 0.120.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk: v0.120.0

0.120.0 (2026-08-19)

Full Changelog: sdk-v0.119.0...sdk-v0.120.0

Features

  • api: managed agents web search config and self hosted sandbox memory (ba8ec50)

Chores

  • internal: use a single pnpm workspace lockfile (#359) (3c32145)

sdk: v0.119.0

0.119.0 (2026-08-19)

Full Changelog: sdk-v0.118.0...sdk-v0.119.0

Features

  • api: Files and Skills APIs are now GA; add computer use and browser use toolsets (ab41aa3)

sdk: v0.118.0

0.118.0 (2026-08-18)

Full Changelog: sdk-v0.117.1...sdk-v0.118.0

Features

  • api: additions to files and memory stores (fdc0379)
  • api: updates to skill, files, and user profiles (671e6b1)
  • client: add helpers for accessing the workspace ID in response headers (28aa5af)

Bug Fixes

  • api: remove unsupported mid_conv_system content block (ae6ca94)
  • session-runner: retry tool-result sends for at least the lease TTL (#339) (7dc6325)

Chores

  • internal: bump zod to 4.4.3 (#334) (faa5b7b)
  • internal: remove leftover prism references (a163b96)
  • stop shipping the v0.50 migration guide and migrate CLI (53992d7)

Documentation

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.120.0 (2026-08-19)

Full Changelog: sdk-v0.119.0...sdk-v0.120.0

Features

  • api: managed agents web search config and self hosted sandbox memory (ba8ec50)

Chores

  • internal: use a single pnpm workspace lockfile (#359) (3c32145)

0.119.0 (2026-08-19)

Full Changelog: sdk-v0.118.0...sdk-v0.119.0

Features

  • api: Files and Skills APIs are now GA; add computer use and browser use toolsets (ab41aa3)

0.118.0 (2026-08-18)

Full Changelog: sdk-v0.117.1...sdk-v0.118.0

Features

  • api: additions to files and memory stores (fdc0379)
  • api: updates to skill, files, and user profiles (671e6b1)
  • client: add helpers for accessing the workspace ID in response headers (28aa5af)

Bug Fixes

  • api: remove unsupported mid_conv_system content block (ae6ca94)
  • session-runner: retry tool-result sends for at least the lease TTL (#339) (7dc6325)

Chores

  • internal: bump zod to 4.4.3 (#334) (faa5b7b)
  • internal: remove leftover prism references (a163b96)
  • stop shipping the v0.50 migration guide and migrate CLI (53992d7)

Documentation

  • tools: warn that blocking tool bodies stall the worker heartbeat (#299) (908fdb5)
Commits
  • bfa9197 chore: release main
  • bc167f3 feat(api): managed agents web search config and self hosted sandbox memory
  • 83fd898 chore(internal): use a single pnpm workspace lockfile (#359)
  • 7fe6dd5 remove internal ticket references from changelog- #360
  • c67e4e2 chore: release main
  • 50fc0db feat(api): Files and Skills APIs are now GA; add computer use and browser use...
  • 18ea26d chore: release main
  • 6ed9ddd feat(api): updates to skill, files, and user profiles
  • 91921f5 fix(session-runner): retry tool-result sends for at least the lease TTL (#339)
  • 142adcc docs(tools): warn that blocking tool bodies stall the worker heartbeat (#299)
  • Additional commits viewable in compare view

Updates @supabase/pg-delta from 1.0.0-alpha.46 to 1.0.0-alpha.47

Release notes

Sourced from @​supabase/pg-delta's releases.

@​supabase/pg-delta@​1.0.0-alpha.47

Patch Changes

  • Updated dependencies [7c9a23f]
    • @​supabase/pg-topo@​1.0.0-alpha.6
Commits
  • 6f480e6 chore: release (alpha) (#452)
  • 7c9a23f feat(pg-topo): expose typed privilege facts on GRANT and default ACL statemen...
  • See full diff in compare view

Updates @supabase/pg-topo from 1.0.0-alpha.5 to 1.0.0-alpha.6

Release notes

Sourced from @​supabase/pg-topo's releases.

@​supabase/pg-topo@​1.0.0-alpha.6

Minor Changes

  • 7c9a23f: Expose a typed privilege payload on GRANT / REVOKE / ALTER DEFAULT PRIVILEGES nodes so consumers can read direction, roles, schemas, and privileges from the AST instead of regex-matching sql.
Changelog

Sourced from @​supabase/pg-topo's changelog.

1.0.0-alpha.6

Minor Changes

  • 7c9a23f: Expose a typed privilege payload on GRANT / REVOKE / ALTER DEFAULT PRIVILEGES nodes so consumers can read direction, roles, schemas, and privileges from the AST instead of regex-matching sql.
Commits
  • 6f480e6 chore: release (alpha) (#452)
  • 7c9a23f feat(pg-topo): expose typed privilege facts on GRANT and default ACL statemen...
  • 52cb22a feat(pg-delta)!: clean-room rewrite, promoted to @​supabase/pg-delta (BREAKING...
  • See full diff in compare view

Updates posthog-node from 5.49.1 to 5.51.2

Release notes

Sourced from posthog-node's releases.

posthog-node@5.51.2

5.51.2

Patch Changes

  • #4639 1faeb74 Thanks @​marandaneto! - Handle empty feature flag evaluation key scopes without running local or remote evaluation. (2026-08-25)

  • #4610 930de19 Thanks @​marandaneto! - Share feature flag matching, hashing, variant, and payload evaluation helpers across the Node.js and Convex SDKs without changing their runtime-specific SemVer behavior. (2026-08-25)

  • Updated dependencies [930de19, d4eee8f]:

    • @​posthog/core@​1.48.11

posthog-node@5.51.1

5.51.1

Patch Changes

  • #4614 3593c43 Thanks @​iamomiid! - The Node SDK now sends the raw gzip bytes as the request body instead of wrapping them in a Blob. On Node 24.16 and later, reading a Blob request body leaks a native BlobReader that is never released, so a service calling capture() and flush() once per request grew by roughly 2.3 KB of heap per event and never gave it back. This completes the work in #4423: switching to node:zlib removed the compression-time Blob reads, but the body itself was still a Blob and still got read once per request. Compression behaviour, headers and the wire format are unchanged, and the edge build keeps using CompressionStream. (2026-08-24)
  • Updated dependencies [3593c43]:
    • @​posthog/core@​1.48.9

posthog-node@5.51.0

5.51.0

Minor Changes

  • #4564 233ac88 Thanks @​marandaneto! - Fall back to remote evaluation when a requested flag is missing from loaded local definitions. This changes scoped calls that previously omitted the flag without making a request. (2026-08-24)

posthog-node@5.50.0

5.50.0

Minor Changes

  • #4484 557140e Thanks @​posthog! - FeatureFlagEvaluations.isEnabled() now accepts an optional defaultValue option, returned whenever the flag has no value (missing key, not loaded, or a failed request). A flag with a present value — including false and variant strings — always wins over defaultValue. Purely additive; omitting the option preserves the existing false-on-miss behavior. (2026-08-21)

posthog-node@5.49.4

5.49.4

Patch Changes

  • #4569 00d22ea Thanks @​v11t! - fix getFeatureFlagResult returning null variant instead of undefined when remotely evaluated (2026-08-21)

posthog-node@5.49.3

5.49.3

... (truncated)

Changelog

Sourced from posthog-node's changelog.

5.51.2

Patch Changes

  • #4639 1faeb74 Thanks @​marandaneto! - Handle empty feature flag evaluation key scopes without running local or remote evaluation. (2026-08-25)

  • #4610 930de19 Thanks @​marandaneto! - Share feature flag matching, hashing, variant, and payload evaluation helpers across the Node.js and Convex SDKs without changing their runtime-specific SemVer behavior. (2026-08-25)

  • Updated dependencies [930de19, d4eee8f]:

    • @​posthog/core

@dependabot
fix(deps): bump the npm-major group across 1 directory with 28 updates
a3c5d95 
Bumps the npm-major group with 28 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [verdaccio](https://github.com/verdaccio/verdaccio) | `6.9.3` | `6.10.0` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.1.4` | `8.2.2` |
| [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.112.3` | `2.112.4` |
| [jose](https://github.com/panva/jose) | `6.2.9` | `6.2.10` |
| [@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript) | `0.3.234` | `0.3.246` |
| [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `0.117.1` | `0.120.0` |
| [@supabase/pg-delta](https://github.com/supabase/pg-delta) | `1.0.0-alpha.46` | `1.0.0-alpha.47` |
| [@supabase/pg-topo](https://github.com/supabase/pg-toolbelt/tree/HEAD/packages/pg-topo) | `1.0.0-alpha.5` | `1.0.0-alpha.6` |
| [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.49.1` | `5.51.2` |
| [fumadocs-core](https://github.com/fuma-nama/fumadocs) | `16.14.4` | `16.15.1` |
| [fumadocs-mdx](https://github.com/fuma-nama/fumadocs) | `15.2.3` | `15.3.1` |
| [fumadocs-ui](https://github.com/fuma-nama/fumadocs) | `16.14.4` | `16.15.1` |
| [next](https://github.com/vercel/next.js) | `16.3.1` | `16.3.3` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.2.0` | `26.3.0` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.4` | `19.2.5` |
| [@effect/atom-react](https://github.com/Effect-TS/effect/tree/HEAD/packages/atom/react) | `4.0.0-rc.111` | `4.0.0-rc.112` |
| [@effect/platform-bun](https://github.com/Effect-TS/effect/tree/HEAD/packages/platform-bun) | `4.0.0-rc.111` | `4.0.0-rc.112` |
| [@effect/platform-node](https://github.com/Effect-TS/effect/tree/HEAD/packages/platform-node) | `4.0.0-rc.111` | `4.0.0-rc.112` |
| [@effect/sql-pg](https://github.com/Effect-TS/effect/tree/HEAD/packages/sql-pg) | `4.0.0-rc.111` | `4.0.0-rc.112` |
| [@effect/tsgo](https://github.com/Effect-TS/tsgo/tree/HEAD/_packages/tsgo) | `0.36.5` | `0.37.0` |
| [@effect/vitest](https://github.com/Effect-TS/effect/tree/HEAD/packages/vitest) | `4.0.0-rc.111` | `4.0.0-rc.112` |
| [@vitest/coverage-istanbul](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-istanbul) | `4.1.10` | `4.1.11` |
| [effect](https://github.com/Effect-TS/effect/tree/HEAD/packages/effect) | `4.0.0-rc.111` | `4.0.0-rc.112` |
| [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) | `0.63.0` | `0.65.0` |
| [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.78.0` | `1.80.0` |
| [tldts](https://github.com/remusao/tldts) | `6.1.86` | `7.4.11` |
| [turbo](https://github.com/vercel/turborepo) | `2.10.11` | `2.10.12` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.10` | `4.1.11` |



Updates `verdaccio` from 6.9.3 to 6.10.0
- [Release notes](https://github.com/verdaccio/verdaccio/releases)
- [Changelog](https://github.com/verdaccio/verdaccio/blob/v6.10.0/CHANGELOG.md)
- [Commits](verdaccio/verdaccio@v6.9.3...v6.10.0)

Updates `vite` from 8.1.4 to 8.2.2
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.2.2/packages/vite)

Updates `@supabase/supabase-js` from 2.112.3 to 2.112.4
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.112.4/packages/core/supabase-js)

Updates `jose` from 6.2.9 to 6.2.10
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v6.2.9...v6.2.10)

Updates `@anthropic-ai/claude-agent-sdk` from 0.3.234 to 0.3.246
- [Release notes](https://github.com/anthropics/claude-agent-sdk-typescript/releases)
- [Changelog](https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md)
- [Commits](anthropics/claude-agent-sdk-typescript@v0.3.234...v0.3.246)

Updates `@anthropic-ai/sdk` from 0.117.1 to 0.120.0
- [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md)
- [Commits](anthropics/anthropic-sdk-typescript@sdk-v0.117.1...sdk-v0.120.0)

Updates `@supabase/pg-delta` from 1.0.0-alpha.46 to 1.0.0-alpha.47
- [Release notes](https://github.com/supabase/pg-delta/releases)
- [Commits](https://github.com/supabase/pg-delta/compare/@supabase/pg-delta@1.0.0-alpha.46...@supabase/pg-delta@1.0.0-alpha.47)

Updates `@supabase/pg-topo` from 1.0.0-alpha.5 to 1.0.0-alpha.6
- [Release notes](https://github.com/supabase/pg-toolbelt/releases)
- [Changelog](https://github.com/supabase/pg-toolbelt/blob/main/packages/pg-topo/CHANGELOG.md)
- [Commits](https://github.com/supabase/pg-toolbelt/commits/@supabase/pg-topo@1.0.0-alpha.6/packages/pg-topo)

Updates `posthog-node` from 5.49.1 to 5.51.2
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.51.2/packages/node)

Updates `fumadocs-core` from 16.14.4 to 16.15.1
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs@16.14.4...fumadocs@16.15.1)

Updates `fumadocs-mdx` from 15.2.3 to 15.3.1
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs-mdx@15.2.3...fumadocs-mdx@15.3.1)

Updates `fumadocs-ui` from 16.14.4 to 16.15.1
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs@16.14.4...fumadocs@16.15.1)

Updates `next` from 16.3.1 to 16.3.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.3.1...v16.3.3)

Updates `@types/node` from 26.2.0 to 26.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/react-dom` from 19.2.4 to 19.2.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `@effect/atom-react` from 4.0.0-rc.111 to 4.0.0-rc.112
- [Release notes](https://github.com/Effect-TS/effect/releases)
- [Changelog](https://github.com/Effect-TS/effect/blob/main/packages/atom/react/CHANGELOG.md)
- [Commits](https://github.com/Effect-TS/effect/commits/@effect/atom-react@4.0.0-rc.112/packages/atom/react)

Updates `@effect/platform-bun` from 4.0.0-rc.111 to 4.0.0-rc.112
- [Release notes](https://github.com/Effect-TS/effect/releases)
- [Commits](https://github.com/Effect-TS/effect/commits/@effect/platform-bun@4.0.0-rc.112/packages/platform-bun)

Updates `@effect/platform-node` from 4.0.0-rc.111 to 4.0.0-rc.112
- [Release notes](https://github.com/Effect-TS/effect/releases)
- [Commits](https://github.com/Effect-TS/effect/commits/@effect/platform-node@4.0.0-rc.112/packages/platform-node)

Updates `@effect/sql-pg` from 4.0.0-rc.111 to 4.0.0-rc.112
- [Release notes](https://github.com/Effect-TS/effect/releases)
- [Commits](https://github.com/Effect-TS/effect/commits/@effect/sql-pg@4.0.0-rc.112/packages/sql-pg)

Updates `@effect/tsgo` from 0.36.5 to 0.37.0
- [Release notes](https://github.com/Effect-TS/tsgo/releases)
- [Changelog](https://github.com/Effect-TS/tsgo/blob/main/_packages/tsgo/CHANGELOG.md)
- [Commits](https://github.com/Effect-TS/tsgo/commits/@effect/tsgo@0.37.0/_packages/tsgo)

Updates `@effect/vitest` from 4.0.0-rc.111 to 4.0.0-rc.112
- [Release notes](https://github.com/Effect-TS/effect/releases)
- [Changelog](https://github.com/Effect-TS/effect/blob/main/packages/vitest/CHANGELOG.md)
- [Commits](https://github.com/Effect-TS/effect/commits/@effect/vitest@4.0.0-rc.112/packages/vitest)

Updates `@vitest/coverage-istanbul` from 4.1.10 to 4.1.11
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/coverage-istanbul)

Updates `effect` from 4.0.0-rc.111 to 4.0.0-rc.112
- [Release notes](https://github.com/Effect-TS/effect/releases)
- [Changelog](https://github.com/Effect-TS/effect/blob/main/packages/effect/CHANGELOG.md)
- [Commits](https://github.com/Effect-TS/effect/commits/effect@4.0.0-rc.112/packages/effect)

Updates `oxfmt` from 0.63.0 to 0.65.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxfmt/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxfmt_v0.65.0/npm/oxfmt)

Updates `oxlint` from 1.78.0 to 1.80.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.80.0/npm/oxlint)

Updates `tldts` from 6.1.86 to 7.4.11
- [Release notes](https://github.com/remusao/tldts/releases)
- [Changelog](https://github.com/remusao/tldts/blob/master/CHANGELOG.md)
- [Commits](remusao/tldts@v6.1.86...v7.4.11)

Updates `turbo` from 2.10.11 to 2.10.12
- [Release notes](https://github.com/vercel/turborepo/releases)
- [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md)
- [Commits](vercel/turborepo@v2.10.11...v2.10.12)

Updates `vitest` from 4.1.10 to 4.1.11
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest)

---
updated-dependencies:
- dependency-name: verdaccio
  dependency-version: 6.10.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-major
- dependency-name: vite
  dependency-version: 8.2.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-major
- dependency-name: "@supabase/supabase-js"
  dependency-version: 2.112.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: jose
  dependency-version: 6.2.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: "@anthropic-ai/claude-agent-sdk"
  dependency-version: 0.3.246
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: "@anthropic-ai/sdk"
  dependency-version: 0.120.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-major
- dependency-name: "@supabase/pg-delta"
  dependency-version: 1.0.0-alpha.47
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: "@supabase/pg-topo"
  dependency-version: 1.0.0-alpha.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: posthog-node
  dependency-version: 5.51.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-major
- dependency-name: fumadocs-core
  dependency-version: 16.15.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-major
- dependency-name: fumadocs-mdx
  dependency-version: 15.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-major
- dependency-name: fumadocs-ui
  dependency-version: 16.15.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-major
- dependency-name: next
  dependency-version: 16.3.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: "@types/node"
  dependency-version: 26.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-major
- dependency-name: "@types/react-dom"
  dependency-version: 19.2.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: "@effect/atom-react"
  dependency-version: 4.0.0-rc.112
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: "@effect/platform-bun"
  dependency-version: 4.0.0-rc.112
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: "@effect/platform-node"
  dependency-version: 4.0.0-rc.112
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: "@effect/sql-pg"
  dependency-version: 4.0.0-rc.112
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: "@effect/tsgo"
  dependency-version: 0.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-major
- dependency-name: "@effect/vitest"
  dependency-version: 4.0.0-rc.112
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: "@vitest/coverage-istanbul"
  dependency-version: 4.1.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: effect
  dependency-version: 4.0.0-rc.112
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: oxfmt
  dependency-version: 0.65.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-major
- dependency-name: oxlint
  dependency-version: 1.80.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-major
- dependency-name: tldts
  dependency-version: 7.4.11
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm-major
- dependency-name: turbo
  dependency-version: 2.10.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: vitest
  dependency-version: 4.1.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 2, 2026
@github-actions

github-actions Bot commented Sep 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Supabase CLI preview

npx --yes https://pkg.pr.new/supabase/cli/supabase@df5637a0e8f85c0b70e1b0b10b875e0c2d0c8a1a

Preview package for commit df5637a.

@jgoux
jgoux requested a review from a team as a code owner September 2, 2026 08:39
@supabase-cli-releaser
supabase-cli-releaser Bot added this pull request to the merge queue Sep 2, 2026
Merged via the queue into develop with commit 44f463a Sep 2, 2026
34 checks passed
@supabase-cli-releaser
supabase-cli-releaser Bot deleted the dependabot/npm_and_yarn/npm-major-eb3f3e134b branch September 2, 2026 09:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jgoux jgoux jgoux approved these changes
@supabase-cli-releaser supabase-cli-releaser[bot] supabase-cli-releaser[bot] approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jgoux