fix(deps): bump the npm-major group across 1 directory with 28 updates

apps/cli/package.json

@@ -45,11 +45,11 @@
   },
   "dependencies": {
     "eciesjs": "^0.5.0",
-    "jose": "^6.2.9"
+    "jose": "^6.2.10"
   },
   "devDependencies": {
-    "@anthropic-ai/claude-agent-sdk": "^0.3.234",
-    "@anthropic-ai/sdk": "^0.117.1",
+    "@anthropic-ai/claude-agent-sdk": "^0.3.246",
+    "@anthropic-ai/sdk": "^0.120.0",
     "@clack/prompts": "^1.7.0",
     "@effect/atom-react": "catalog:",
     "@effect/platform-bun": "catalog:",
@@ -68,8 +68,8 @@
     "@parcel/watcher-win32-x64": "2.6.0",
     "@supabase/api": "workspace:*",
     "@supabase/config": "workspace:*",
-    "@supabase/pg-delta": "1.0.0-alpha.46",
-    "@supabase/pg-topo": "1.0.0-alpha.5",
+    "@supabase/pg-delta": "1.0.0-alpha.47",
+    "@supabase/pg-topo": "1.0.0-alpha.6",
     "@supabase/process-compose": "workspace:*",
     "@supabase/stack": "workspace:*",
     "@tsconfig/bun": "catalog:",
@@ -86,15 +86,15 @@
     "ink-spinner": "^5.0.0",
     "pg": "^8.23.0",
     "pg-copy-streams": "^7.0.0",
-    "posthog-node": "^5.49.1",
+    "posthog-node": "^5.51.2",
     "prettier": "3.9.6",
     "react": "^19.2.8",
     "react-devtools-core": "^7.0.1",
     "semantic-release": "catalog:",
     "smol-toml": "^1.8.0",
     "tldts": "catalog:",
     "typescript": "catalog:",
-    "vite": "^6.0.0 || ^7.0.0 || ^8.0.0",
+    "vite": "^8.2.2",
     "vitest": "catalog:",
     "yaml": "^2.9.0"
   },

apps/cli/src/legacy/shared/legacy-go-json.ts

@@ -21,7 +21,7 @@
  * The two behaviours `JSON.stringify(x, null, 2)` gets wrong for Go parity are:
  * 1. HTML escaping — Go's default encoder escapes `<`, `>`, `&` as
  * `<` / `>` / `&` (it does not call `SetEscapeHTML(false)`).
- * 2. Control characters — Go emits `` / `` for backspace / form
+ * 2. Control characters — Go emits `\u0008` / `\u000c` for backspace / form
  * feed (no `\b` / `\f` shorthand) and escapes U+2028 / U+2029.
  * This encoder reproduces both; the indentation/`": "`/`[]`/`{}` shape is
  * otherwise identical to `JSON.stringify(x, null, 2)`.

apps/cli/src/legacy/shared/legacy-sql-split.ts

@@ -6,9 +6,9 @@
  * inside any of those is not mistaken for a statement separator. This matters
  * for declarative diffs, which contain `CREATE FUNCTION` bodies full of `;`.
  *
- * Operates on Unicode code points (JS strings) rather than raw bytes; for the
- * ASCII delimiters the FSM keys on (`/*`, `*​/`, `;`, quotes, `$`), suffix
- * comparison is identical to Go's byte-window logic.
+ * Operates on Unicode code points (JS strings) rather than raw bytes; the ASCII
+ * delimiters are described as slash-star, star-slash, semicolon, quotes, and
+ * dollar signs; suffix comparison is identical to Go's byte-window logic.
  */
 
 interface State {

apps/cli/src/shared/functions/serve.main.ts

@@ -352,7 +352,7 @@ Deno.serve({
       ...Deno.env.toObject(),
       ...Object.fromEntries(
         Object.entries(functionsConfig[functionName].env ?? {}).filter(
-          ([name, _]) => !name.startsWith("SUPABASE_"),
+          ([name]) => !name.startsWith("SUPABASE_"),
         ),
       ),
       // Listed after the spreads so neither the container env nor function config can shadow it
@@ -370,7 +370,7 @@ Deno.serve({
     }
 
     const envVars = Object.entries(envVarsObj).filter(
-      ([name, _]) => !EXCLUDED_ENVS.includes(name) && !name.startsWith("SUPABASE_INTERNAL_"),
+      ([name]) => !EXCLUDED_ENVS.includes(name) && !name.startsWith("SUPABASE_INTERNAL_"),
     );
 
     const forceCreate = false;

apps/cli/src/shared/functions/serve.ts

@@ -1032,7 +1032,7 @@ export ${name}="\${${name}%x}"`;
   await mkdir(hostEnvDir, { recursive: true, mode: 0o700 });
   // The value files hold secret env values, so keep them owner-only.
   await Promise.all(
-    env.map(([_, value], index) =>
+    env.map(([, value], index) =>
       writeFile(join(hostEnvDir, `env-${index}`), value, { mode: 0o600 }),
     ),
   );

apps/docs/package.json

@@ -9,18 +9,18 @@
     "types:check": "pnpm exec fumadocs-mdx source.config.ts .source && tsc --noEmit --incremental false"
   },
   "dependencies": {
-    "fumadocs-core": "^16.14.4",
-    "fumadocs-mdx": "^15.2.3",
-    "fumadocs-ui": "^16.14.4",
-    "next": "16.3.1",
+    "fumadocs-core": "^16.15.1",
+    "fumadocs-mdx": "^15.3.1",
+    "fumadocs-ui": "^16.15.1",
+    "next": "16.3.3",
     "react": "^19.2.8",
     "react-dom": "^19.2.8"
   },
   "devDependencies": {
     "@types/mdx": "^2.0.14",
-    "@types/node": "^26.2.0",
+    "@types/node": "^26.3.0",
     "@types/react": "^19.2.18",
-    "@types/react-dom": "^19.2.4",
+    "@types/react-dom": "^19.2.5",
     "typescript": "catalog:"
   }
 }

package.json

@@ -39,7 +39,7 @@
     "pkg-pr-new": "0.0.88",
     "turbo": "catalog:",
     "typescript": "catalog:",
-    "verdaccio": "^6.9.3"
+    "verdaccio": "^6.10.0"
   },
   "devEngines": {
     "runtime": {

packages/api/scripts/generate.ts

@@ -263,6 +263,16 @@ export function sanitizeOpenApiSchema(
       continue;
     }
 
+    if (
+      !inPropertiesMap &&
+      key === "propertyNames" &&
+      isRecord(rawValue) &&
+      Object.keys(rawValue).length === 1 &&
+      rawValue.type === "string"
+    ) {
+      continue;
+    }
+
     if (Array.isArray(rawValue)) {
       sanitized[key] = rawValue.map((entry) =>
         isRecord(entry) ? sanitizeOpenApiSchema(entry) : entry,
@@ -303,9 +313,31 @@ export function sanitizeOpenApiSchema(
     delete sanitized.pattern;
   }
 
+  if (
+    sanitized.nullable === true &&
+    sanitized.type === undefined &&
+    Array.isArray(sanitized.anyOf)
+  ) {
+    const normalized = {
+      ...sanitized,
+      anyOf: [...sanitized.anyOf, { type: "null" }],
+    };
+    delete normalized.nullable;
+    return normalized;
+  }
+
   return sanitized;
 }
 
+function convertSchemaToDraft2020(schema: OpenApiSchema) {
+  const sanitized = sanitizeOpenApiSchema(schema);
+  return (
+    sanitized.$schema === JsonSchema.META_SCHEMA_URI_DRAFT_2020_12
+      ? JsonSchema.fromSchemaDraft2020_12(sanitized)
+      : JsonSchema.fromSchemaOpenApi3_0(sanitized)
+  ).schema;
+}
+
 function containsBinarySchema(schema: OpenApiSchema): boolean {
   if (schema.$ref !== undefined) {
     return false;
@@ -764,15 +796,13 @@ function renderSchemaSource(
   const definitions = Object.fromEntries(
     Object.entries(document.components?.schemas ?? {}).map(([name, schema]) => [
       name,
-      normalizeNullableJsonSchema(
-        JsonSchema.fromSchemaOpenApi3_0(sanitizeOpenApiSchema(schema)).schema,
-      ),
+      normalizeNullableJsonSchema(convertSchemaToDraft2020(schema)),
     ]),
   );
 
   const nameMap = schemaEntries.map((entry) => entry.name);
   const schemas = schemaEntries.map((entry) =>
-    normalizeNullableJsonSchema(JsonSchema.fromSchemaOpenApi3_0(entry.schema).schema),
+    normalizeNullableJsonSchema(convertSchemaToDraft2020(entry.schema)),
   );
 
   if (!Arr.isArrayNonEmpty(schemas)) {

packages/api/scripts/generate.unit.test.ts

@@ -115,6 +115,34 @@ describe("generate", () => {
     ).not.toContain("isPattern");
   });
 
+  test("removes tautological propertyNames schemas without dropping a property named propertyNames", () => {
+    expect(
+      sanitizeOpenApiSchema({
+        type: "object",
+        propertyNames: { type: "string" },
+        properties: {
+          propertyNames: { type: "string" },
+        },
+      }),
+    ).toEqual({
+      type: "object",
+      properties: {
+        propertyNames: { type: "string" },
+      },
+    });
+  });
+
+  test("preserves null in nullable anyOf JSON values without an explicit type", () => {
+    expect(
+      renderOpenApiSchema({
+        anyOf: [{ type: "string" }, { type: "number" }, { type: "boolean" }],
+        nullable: true,
+      }),
+    ).toBe(
+      'Schema.Union([Schema.String, Schema.Number.check(Schema.isFinite().annotate({ "expected": "a finite number" })), Schema.Boolean, Schema.Null])',
+    );
+  });
+
   test("accepts booleans for string-encoded boolean query parameters", () => {
     expect(
       normalizeQueryParameterSchema(