Skip to content

chore(deps): bump the minor-and-patch group across 1 directory with 30 updates#3221

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-366ce39081
Open

chore(deps): bump the minor-and-patch group across 1 directory with 30 updates#3221
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-366ce39081

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 21, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 30 updates in the / directory:

Package From To
@anthropic-ai/sdk 0.107.0 0.112.4
@sentry/nextjs 10.62.0 10.67.0
@supabase/ssr 0.12.0 0.12.3
@supabase/supabase-js 2.108.2 2.110.8
dompurify 3.4.11 3.4.12
driver.js 1.6.0 1.8.0
idb-keyval 6.2.6 6.3.0
next 16.2.9 16.2.11
next-auth 4.24.14 4.24.15
next-intl 4.13.0 4.13.3
sharp 0.35.2 0.35.3
swagger-ui-react 5.32.6 5.32.10
@emnapi/core 1.11.1 1.11.2
@emnapi/runtime 1.11.1 1.11.2
@next/env 16.2.9 16.2.11
@typescript-eslint/eslint-plugin 8.62.1 8.65.0
@typescript-eslint/parser 8.62.1 8.65.0
@vitest/coverage-v8 4.1.9 4.1.10
autoprefixer 10.5.2 10.5.4
eslint 9.39.4 9.39.5
eslint-config-next 16.2.9 16.2.11
postcss 8.5.16 8.5.21
vitest 4.1.9 4.1.10
web-tree-sitter 0.26.10 0.26.11
@img/sharp-linux-x64 0.35.2 0.35.3
@parcel/watcher-darwin-arm64 2.5.6 2.6.0
@parcel/watcher-darwin-x64 2.5.6 2.6.0
@parcel/watcher-linux-x64-glibc 2.5.6 2.6.0
@parcel/watcher-linux-x64-musl 2.5.6 2.6.0
@swc/core-linux-x64-gnu 1.15.43 1.15.46

Updates @anthropic-ai/sdk from 0.107.0 to 0.112.4

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk: v0.112.4

0.112.4 (2026-07-20)

Full Changelog: sdk-v0.112.3...sdk-v0.112.4

Bug Fixes

  • aws: preserve AWS options and auth mode across withOptions() (#214) (3f7665c)

Chores

sdk: v0.112.3

0.112.3 (2026-07-17)

Full Changelog: sdk-v0.112.2...sdk-v0.112.3

Chores

sdk: v0.112.2

0.112.2 (2026-07-17)

Full Changelog: sdk-v0.112.1...sdk-v0.112.2

Chores

sdk: v0.112.1

0.112.1 (2026-07-16)

Full Changelog: sdk-v0.112.0...sdk-v0.112.1

sdk: v0.112.0

0.112.0 (2026-07-16)

Full Changelog: sdk-v0.111.0...sdk-v0.112.0

Features

  • api: add support for MCP Tunnels (597ac41)

sdk: v0.111.0

0.111.0 (2026-07-10)

Full Changelog: sdk-v0.110.0...sdk-v0.111.0

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.112.4 (2026-07-20)

Full Changelog: sdk-v0.112.3...sdk-v0.112.4

Bug Fixes

  • aws: preserve AWS options and auth mode across withOptions() (#214) (3f7665c)

Chores

0.112.3 (2026-07-17)

Full Changelog: sdk-v0.112.2...sdk-v0.112.3

Chores

0.112.2 (2026-07-17)

Full Changelog: sdk-v0.112.1...sdk-v0.112.2

Chores

0.112.1 (2026-07-16)

Full Changelog: sdk-v0.112.0...sdk-v0.112.1

0.112.0 (2026-07-16)

Full Changelog: sdk-v0.111.0...sdk-v0.112.0

Features

  • api: add support for MCP Tunnels (597ac41)

0.111.0 (2026-07-10)

Full Changelog: sdk-v0.110.0...sdk-v0.111.0

Features

  • api: add support for dreaming (77b28a6)
  • tools: gate session tool calls on evaluated_permission; bound idle by server stop_reason (68a6d7b)

... (truncated)

Commits
  • 3e9a2e1 chore(aws): raise minimum @​anthropic-ai/sdk version to 0.112.4
  • 1cdfa7f chore: release main
  • 0cd535b fix(aws): remove duplicate loggerFor import breaking the build (#235)
  • ff7d620 fix(aws): preserve AWS options and auth mode across withOptions() (#214)
  • 0b39044 chore(docs): small updates
  • f84e863 chore: release main
  • 373cf7e chore(docs): small updates
  • 4d3022d chore(internal): tidy changelog
  • 5019578 chore: release main
  • 01e74ee fix(google-cloud): bump google-auth-library to ^10.2.0 (#230)
  • Additional commits viewable in compare view

Updates @sentry/nextjs from 10.62.0 to 10.67.0

Release notes

Sourced from @​sentry/nextjs's releases.

10.67.0

Important Changes

  • feat(sveltekit): Add support for SvelteKit 3 (#22264)

    The SvelteKit SDK now supports the pre-release of SvelteKit 3, including client-side pageload and navigation tracing and server-side native tracing, alongside continued SvelteKit 2 support. No Sentry-specific setup changes are required. The SDK detects your SvelteKit version and picks the right implementation automatically.

Other Changes

  • feat(aws-serverless): Use orchestrion aws-sdk integration under diagnostics-channel opt-in (#22143)
  • feat(cloudflare): Auto-instrument Workers AI binding via env instrumentation (#22126)
  • feat(cloudflare): Instrument Cloudflare rate limiter bindings (#22035)
  • feat(core): Instrument workers-ai-provider (#22119)
  • feat(core): Rename queryParams to urlQueryParams (#22217)
  • feat(mongodb): implement orchestrion mongodb integration (#22308)
  • feat(mongoose): implement orchestrion mongoose integration (#22202)
  • feat(node): Rewrite tedious instrumentation to orchestrion tracing channels (#22238)
  • feat(nuxt): Add _experimental.useDiagnosticsChannelInjection (#22323)
  • feat(remix): Add orchestrion-based remix instrumentation (#22244)
  • feat(replay): Allow skipping the final flush on stop() via { flush: false } (#22300)
  • feat(server-utils): Add @​opentelemetry/instrumentation-koa orchestrion integration (#22146)
  • feat(server-utils): Add orchestrion aws-sdk channel integration core (#22142)
  • feat(server-utils): Allow passing custom transforms to orchestrion (#22319)
  • feat(server-utils): Port Bedrock aws-sdk extension and add integration tests (#22166)
  • feat(server-utils): Port S3, Kinesis, DynamoDB, SecretsManager and StepFunctions aws-sdk extensions (#22164)
  • feat(server-utils): Port SQS, SNS and Lambda aws-sdk extensions with trace propagation (#22165)
  • feat(server-utils): Rewrite SentryLangChainInstrumentation to orchestrion (#22266)
  • feat(server-utils): Rewrite SentryLangGraphInstrumentation to orchestrion (#22268)
  • feat(vue): Set navigation.route.id from the route name (#22372)
  • fix(bundler): do not import type from optional peer dep (#22304)
  • fix(cloudflare): Bind Durable Object built-in handlers (#22340)
  • fix(cloudflare): Instrument custom WorkerEntrypoint RPC methods (#22310)
  • fix(cloudflare): Route DO teardown through original waitUntil (#22339)
  • fix(cloudflare): Skip spans for Cloudflare-internal Durable Object SQL queries (#22376)
  • fix(core): Prevent functionToStringIntegration from throwing on cross-origin realms (#22273)
  • fix(core): Prevent infinite recursion when console is instrumented twice (#21959)
  • fix(nextjs): Mark internal chunk frames as not in_app (#22354)
  • fix(node): Register tracer provider when OTel API global pre-exists with a different version (#22374)
  • fix(node-native): Don't drop breadcrumbs from event loop block events (#22322)
  • fix(serve-rutils): Orchestrion diagnostics for async and require (#22327)
  • fix(server-utils): Only skip loader thread (#22336)
  • fix(sveltekit): Detect SvelteKit server build via Vite Environment API (#21629)
  • fix(vercelai): Avoid double-capturing v4 tool errors in orchestrion mode (#22293)
  • fix(vue): Support pinia 4 in peer dependency range (#22324)
  • chore: Add external contributor to CHANGELOG.md (#22357)
  • chore: Add external contributor to CHANGELOG.md (#22359)

... (truncated)

Changelog

Sourced from @​sentry/nextjs's changelog.

10.67.0

Important Changes

  • feat(sveltekit): Add support for SvelteKit 3 (#22264)

    The SvelteKit SDK now supports the pre-release of SvelteKit 3, including client-side pageload and navigation tracing and server-side native tracing, alongside continued SvelteKit 2 support. No Sentry-specific setup changes are required. The SDK detects your SvelteKit version and picks the right implementation automatically.

Other Changes

  • feat(aws-serverless): Use orchestrion aws-sdk integration under diagnostics-channel opt-in (#22143)
  • feat(cloudflare): Auto-instrument Workers AI binding via env instrumentation (#22126)
  • feat(cloudflare): Instrument Cloudflare rate limiter bindings (#22035)
  • feat(core): Instrument workers-ai-provider (#22119)
  • feat(core): Rename queryParams to urlQueryParams (#22217)
  • feat(mongodb): implement orchestrion mongodb integration (#22308)
  • feat(mongoose): implement orchestrion mongoose integration (#22202)
  • feat(node): Rewrite tedious instrumentation to orchestrion tracing channels (#22238)
  • feat(nuxt): Add _experimental.useDiagnosticsChannelInjection (#22323)
  • feat(remix): Add orchestrion-based remix instrumentation (#22244)
  • feat(replay): Allow skipping the final flush on stop() via { flush: false } (#22300)
  • feat(server-utils): Add @​opentelemetry/instrumentation-koa orchestrion integration (#22146)
  • feat(server-utils): Add orchestrion aws-sdk channel integration core (#22142)
  • feat(server-utils): Allow passing custom transforms to orchestrion (#22319)
  • feat(server-utils): Port Bedrock aws-sdk extension and add integration tests (#22166)
  • feat(server-utils): Port S3, Kinesis, DynamoDB, SecretsManager and StepFunctions aws-sdk extensions (#22164)
  • feat(server-utils): Port SQS, SNS and Lambda aws-sdk extensions with trace propagation (#22165)
  • feat(server-utils): Rewrite SentryLangChainInstrumentation to orchestrion (#22266)
  • feat(server-utils): Rewrite SentryLangGraphInstrumentation to orchestrion (#22268)
  • feat(vue): Set navigation.route.id from the route name (#22372)
  • fix(bundler): do not import type from optional peer dep (#22304)
  • fix(cloudflare): Bind Durable Object built-in handlers (#22340)
  • fix(cloudflare): Instrument custom WorkerEntrypoint RPC methods (#22310)
  • fix(cloudflare): Route DO teardown through original waitUntil (#22339)
  • fix(cloudflare): Skip spans for Cloudflare-internal Durable Object SQL queries (#22376)
  • fix(core): Prevent functionToStringIntegration from throwing on cross-origin realms (#22273)
  • fix(core): Prevent infinite recursion when console is instrumented twice (#21959)
  • fix(nextjs): Mark internal chunk frames as not in_app (#22354)
  • fix(node): Register tracer provider when OTel API global pre-exists with a different version (#22374)
  • fix(node-native): Don't drop breadcrumbs from event loop block events (#22322)
  • fix(serve-rutils): Orchestrion diagnostics for async and require (#22327)
  • fix(server-utils): Only skip loader thread (#22336)
  • fix(sveltekit): Detect SvelteKit server build via Vite Environment API (#21629)
  • fix(vercelai): Avoid double-capturing v4 tool errors in orchestrion mode (#22293)
  • fix(vue): Support pinia 4 in peer dependency range (#22324)
  • chore: Add external contributor to CHANGELOG.md (#22357)

... (truncated)

Commits
  • a88e286 release: 10.67.0
  • db27830 Merge pull request #22382 from getsentry/prepare-release/10.67.0
  • 3c20967 meta(changelog): Update changelog for 10.67.0
  • ee99468 feat(cloudflare): Auto-instrument Workers AI binding via env instrumentation ...
  • 55bd48a feat(core): Instrument workers-ai-provider (#22119)
  • c47b449 chore(ci): Use openrouter keys for claude in ci (#22381)
  • 326fbc9 fix(cloudflare): Skip spans for Cloudflare-internal Durable Object SQL querie...
  • 8e20a26 feat(vue): Set navigation.route.id from the route name (#22372)
  • e47e5d8 feat(remix): Add orchestrion-based remix instrumentation (#22244)
  • 1e26f76 feat(mongodb): implement orchestrion mongodb integration (#22308)
  • Additional commits viewable in compare view

Updates @supabase/ssr from 0.12.0 to 0.12.3

Release notes

Sourced from @​supabase/ssr's releases.

v0.12.3

0.12.3 (2026-07-14)

Bug Fixes

  • cookies: keep domain-scoped deletion in name-keyed cookie stores (#258) (d3a8a98), closes #256

v0.12.3-rc.135

What's Changed

New Contributors

Full Changelog: supabase/ssr@v0.12.2...v0.12.3-rc.135

v0.12.2

0.12.2 (2026-07-14)

Bug Fixes

  • align parseCookieHeader return type with getAll cookie method (#239) (e8fe1d5), closes #115

v0.12.2-rc.133

What's Changed

Full Changelog: supabase/ssr@v0.12.2-rc.132...v0.12.2-rc.133

v0.12.2-rc.132

What's Changed

New Contributors

Full Changelog: supabase/ssr@v0.12.1...v0.12.2-rc.132

v0.12.1

0.12.1 (2026-07-13)

Bug Fixes

  • cookies: deduplicate server cookie writes (#246) (035eabe)

v0.12.1-rc.130

... (truncated)

Changelog

Sourced from @​supabase/ssr's changelog.

0.12.3 (2026-07-14)

Bug Fixes

  • cookies: keep domain-scoped deletion in name-keyed cookie stores (#258) (d3a8a98), closes #256

0.12.2 (2026-07-14)

Bug Fixes

  • align parseCookieHeader return type with getAll cookie method (#239) (e8fe1d5), closes #115

0.12.1 (2026-07-13)

Bug Fixes

  • cookies: deduplicate server cookie writes (#246) (035eabe)
Commits
  • dd2b20b chore(main): release 0.12.3 (#264)
  • d3a8a98 fix(cookies): keep domain-scoped deletion in name-keyed cookie stores (#258)
  • bd7c8c8 chore(main): release 0.12.2 (#261)
  • 21e185a chore: update @​supabase/supabase-js to v2.110.5 (#263)
  • e8fe1d5 fix: align parseCookieHeader return type with getAll cookie method (#239)
  • d06ca21 chore(main): release 0.12.1 (#255)
  • 1c175c1 chore: update @​supabase/supabase-js to v2.110.3 (#260)
  • 7e1c519 docs: align getSession/getUser/getClaims guidance with docs (#259)
  • 509fc8e chore: update @​supabase/supabase-js to v2.110.2 (#257)
  • 035eabe fix(cookies): deduplicate server cookie writes (#246)
  • Additional commits viewable in compare view

Updates @supabase/supabase-js from 2.108.2 to 2.110.8

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.110.8

2.110.8 (2026-07-21)

🩹 Fixes

  • auth: downgrade aborted/transient fetch failures from console.error to warn (#2544)
  • functions: clean up cross-signal abort listener on invoke() return (#2487)
  • functions: match response Content-Type case-insensitively (#2515)
  • storage: url-encode object key in CDN purge methods (#2545)
  • supabase: skip Node warning in Deno (#2541)

❤️ Thank You

v2.110.8-canary.2

2.110.8-canary.2 (2026-07-21)

🩹 Fixes

  • storage: url-encode object key in CDN purge methods (#2545)

❤️ Thank You

v2.110.8-canary.1

2.110.8-canary.1 (2026-07-21)

🩹 Fixes

  • auth: downgrade aborted/transient fetch failures from console.error to warn (#2544)

❤️ Thank You

v2.110.8-canary.0

2.110.8-canary.0 (2026-07-21)

🩹 Fixes

  • functions: clean up cross-signal abort listener on invoke() return (#2487)
  • functions: match response Content-Type case-insensitively (#2515)
  • supabase: skip Node warning in Deno (#2541)

❤️ Thank You

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.110.7 (2026-07-16)

🩹 Fixes

  • realtime: trigger set auth on INITIAL_SESSION event (#2531)

❤️ Thank You

2.110.6 (2026-07-15)

🩹 Fixes

  • supabase: warn instead of throw for unrecognized sb_ API key subtypes (#2526)

❤️ Thank You

2.110.5 (2026-07-14)

🩹 Fixes

  • supabase: avoid edge runtime warning (#2522)

❤️ Thank You

2.110.4 (2026-07-14)

🩹 Fixes

  • functions: stop sending API key in Authorization header for function calls (#2511)

❤️ Thank You

2.110.3 (2026-07-13)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.110.2 (2026-07-09)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.110.1 (2026-07-07)

... (truncated)

Commits
  • 01dbb53 fix(supabase): skip Node warning in Deno (#2541)
  • 150b00c chore(release): version 2.110.7 changelogs (#2533)
  • 130fa11 fix(realtime): trigger set auth on INITIAL_SESSION event (#2531)
  • c90b1cd chore(release): version 2.110.6 changelogs (#2527)
  • c23e1ab fix(supabase): warn instead of throw for unrecognized sb_ API key subtypes (#...
  • 8af3c3a chore(release): version 2.110.5 changelogs (#2524)
  • 25da097 chore(release): version 2.110.4 changelogs (#2523)
  • dafa7f5 fix(supabase): avoid edge runtime warning (#2522)
  • 558c1f5 fix(functions): stop sending API key in Authorization header for function cal...
  • aaec93f chore(release): version 2.110.3 changelogs (#2519)
  • Additional commits viewable in compare view

Updates dompurify from 3.4.11 to 3.4.12

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.12

  • Fixed an issue where a hook would not get called for custom elements, thanks @​Rikuxx0
  • Hardened the handling of hooks removing elements, @​mkrause-bee360
  • Added support for a few new SVG attributes, thanks @​cbn-falias & @​Develop-KIM
  • Hardened the handling of declarative partial updates
  • Updated the documentation is several spots, README, wiki, etc.
  • Bumped several dependencies where possible
Commits

Updates driver.js from 1.6.0 to 1.8.0

Release notes

Sourced from driver.js's releases.

1.8.0

Added

  • Hints: pulsing beacons that open a popover on click; overlay optional, the page stays interactive. driver.js/hints, ~5KB gzip. Guide. (#363)
  • advanceOnClick (driver and step level) to advance the tour by clicking the highlighted element itself. (#606)
  • waitForElement (driver and step level) to wait up to N ms for a step's element before treating it as missing. (#606)
  • sideEffects field in package.json for better tree-shaking.

Changed

  • Popover internals shared between tours and hints; tour behaviour verified unchanged against 1.7.0.
  • Build migrated from vite to tsdown; artifact names, exports map and CDN globals unchanged, sizes within ±2%.

Fixed

  • skipMissingElement: the last reachable step now shows Done and runs onDoneClick; step queries like isLastStep() account for skips. (#616)

1.7.0

Added

  • skipMissingElement option to skip a step whose target element is missing (#489, #395)
  • index on the options passed to every hook (#490)
  • --driver-popover-font-family CSS variable to set the popover font (#607)

Changed

  • The popover title and description now render in the default font stack. Set --driver-popover-font-family to use your own.

Fixed

  • Icon fonts placed inside a step description are no longer overridden (#510, #512)
  • Each driver() call keeps its own config, steps and state, (#571)
  • Popover no longer jumps when its content has images that load after render.
Commits
  • ccc94cb 1.8.0
  • b93a4fc Add advanceOnClick and waitForElement
  • ab56c56 Fix missing step and button texts #616
  • 3821035 Increase beacon indicator size
  • 8678291 Refactor tests
  • e2aa992 Reorganize internals and unify step popover
  • b4d221f Add onButtonClick to take over the hint button
  • 09484c7 Clean up the hints module
  • 95df19e Give the hint popover and its arrow one seamless shadow
  • 24763f9 Anchor overlay-mode hints to the element and enlarge the hint arrow
  • Additional commits viewable in compare view

Updates idb-keyval from 6.2.6 to 6.3.0

Commits

Updates next from 16.2.9 to 16.2.11

Release notes

Sourced from next's releases.

v16.2.10

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 16.2.4.

Commits
  • 9beca08 v16.2.11
  • 3c48c7a [16.x] Fix Turbopack middleware matcher with i18n single locale
  • ac1eff3 [16.x] Improve performance of checking valid MPA form submissions
  • 9a4651e [16.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
  • b512063 [16.x] Set correct origin for internal redirects in custom server
  • d303326 [16.x] Ensure exotic rewrite param values are properly encoded
  • 73b9487 [16.x] fix(fetch-cache): key fetch(Request, init) by the effective request
  • bf9d17f [16.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies
  • fe28768 [16.x] fix(next/image): improve performance of detectContentType()
  • d8afb8d [16.x] Performance improvements when decoding React Server function payloads
  • Additional commits viewable in compare view

Updates next-auth from 4.24.14 to 4.24.15

Release notes

Sourced from next-auth's releases.

next-auth@4.24.15

Security patch release for the 4.x line.

  • getToken() now returns null instead of throwing when the Authorization header contains a malformed Bearer value.
  • OAuth state, nonce, and PKCE check cookies are now bound to the provider that created them and are rejected when a different provider handles the callback. Sign-ins in flight across the upgrade fail once and succeed on retry.
  • Email addresses are Unicode-normalized (NFKC) before validation in the email sign-in flow, closing a homoglyph @ bypass.
  • An explicitly configured NEXTAUTH_URL now takes precedence over the auto-detected forwarded host in trusted-host mode.
  • Restores CommonJS compatibility by pinning uuid to ^11.1.1; the 14.x line is ESM-only and broke require() on Node versions below 20.19.
Commits
  • d857eec chore(release): next-auth@4.24.15 [skip ci]
  • 5bca239 fix(next-auth): harden getToken parsing and bind OAuth check cookies to provi...
  • db7e27d chore(deps): use uuid ^11.1.1 to keep CommonJS support (#13466)
  • 32d874c fix(next-auth): repair red v4 CI (lint + pre-existing test drift) (#13447)
  • fa85858 chore: update uuid to v14, remove deprecated types (#13422)
  • 2a39465 Merge commit from fork
  • 19d2feb Merge commit from fork
  • See full diff in compare view

Updates next-intl from 4.13.0 to 4.13.3

Release notes

Sourced from next-intl's releases.

v4.13.3

4.13.3 (2026-07-21)

Bug Fixes

  • Next.js 16.3 compatibility preparation (only update locale cookie for document requests and not prefetches) (#2355) (0555ace) – by @​amannn

v4.13.2

4.13.2 (2026-07-10)

Bug Fixes

v4.13.1

4.13.1 (2026-06-30)

Bug Fixes

Changelog

Sourced from next-intl's changelog.

4.13.3 (2026-07-21)

Bug Fixes

  • Next.js 16.3 compatibility preparation (only update locale cookie for document requests and not prefetches) (#2355) (0555ace) – by @​amannn

4.13.2 (2026-07-10)

Bug Fixes

4.13.1 (2026-06-30)

Bug Fixes

Commits
  • 89ae783 v4.13.3
  • 0555ace fix: Next.js 16.3 compatibility preparation (only update locale cookie for do...
  • 89c72b1 docs: Add AI agents page, integrate eloqnt studio, and update nav (#2357)
  • d14dd6f v4.13.2
  • cc34d9a fix: Correctly format plural/select branches that are only # or empty (#2356)
  • 976ca1f v4.13.1
  • 4025d1f fix: Handle ICU escape sequences around < consistently in dev and productio...
  • 90691ed docs: Add hooks hint to extraction.mdx (#2348)
  • 30d1004 docs: Handle malformed tweet entities from API (#2343)
  • 030afd3 docs: Add copy-to-clipboard for details section permalinks (#2342)
  • See full diff in compare view

Updates sharp from 0.35.2 to 0.35.3

Release notes

Sourced from sharp's releases.

v0.35.3

  • Tighten verification of text dimensions, TIFF tile dimensions and extend values.

  • Improve code bundler support by resolving path to libvips binary.

  • Increase default concurrency when use of MALLOC_ARENA_MAX is detected.

  • Emit warning about binaries provided by Electron for use on Linux.

  • Add hasAlpha property to output info. #4500

  • TypeScript: Return more precise Buffer<ArrayBuffer> from toBuffer. #4520 @​Andarist

  • Bound clahe width and height to avoid signed overflow. #4551 @​metsw24-max

  • Bound trim margin to avoid signed overflow. #4552 @​metsw24-max

  • Reject infinite values when validating numbers. #4553 @​metsw24-max

  • Bound extract region to libvips coordinate limit. #4555 @​metsw24-max

  • Verify background colour values are numbers. #4556 @​metsw24-max

  • Bound create and raw input dimensions to coordinate limit. #4558 @​metsw24-max

  • Tighten recomb and affine matrix verification. #4560 @​chatman-media

  • Verify cache memory limit to avoid overflow. #4561 @​metsw24-max

v0.35.3-rc.2

  • Tighten verification of text dimensions, TIFF tile dimensions and extend values.

... (truncated)

Commits
  • 1018449 Release v0.35.3
  • ba303a7 Prerelease v0.35.3-rc.2
  • 4f94fc5 Upgrade to sharp-libvips v1.3.2
  • c5e7a3f Bump devDeps, fix Deno/Windows smoke tests
  • 9a8d002 Docs: Add changelog entry and note about transferable #4520
  • 8694db0 TypeScript: Return more precise Buffer\<ArrayBuffer> from toBu...

    Description has been truncated

@dependabot dependabot Bot added level:beginner GSSoC: Beginner difficulty (20 pts) type:devops GSSoC type bonus: devops (+15 pts) labels Jul 21, 2026
@dependabot dependabot Bot added level:beginner GSSoC: Beginner difficulty (20 pts) type:devops GSSoC type bonus: devops (+15 pts) labels Jul 21, 2026
@github-actions github-actions Bot added the gssoc26 GSSoC 2026 contribution label Jul 21, 2026
@Priyanshu-byte-coder

Copy link
Copy Markdown
Owner

Holding — the grouped dependency bump fails CI (Continuous Integration Security & Audit Suite is red), so one of the bundled updates is breaking. @dependabot please rebase/split so the breaking package is isolated; the safe patches can land separately from whatever's failing.

…0 updates

Bumps the minor-and-patch group with 30 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `0.107.0` | `0.112.4` |
| [@sentry/nextjs](https://github.com/getsentry/sentry-javascript) | `10.62.0` | `10.67.0` |
| [@supabase/ssr](https://github.com/supabase/ssr) | `0.12.0` | `0.12.3` |
| [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.108.2` | `2.110.8` |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.4.11` | `3.4.12` |
| [driver.js](https://github.com/nilbuild/driver.js/tree/HEAD/packages/driver) | `1.6.0` | `1.8.0` |
| [idb-keyval](https://github.com/jakearchibald/idb-keyval) | `6.2.6` | `6.3.0` |
| [next](https://github.com/vercel/next.js) | `16.2.9` | `16.2.11` |
| [next-auth](https://github.com/nextauthjs/next-auth) | `4.24.14` | `4.24.15` |
| [next-intl](https://github.com/amannn/next-intl) | `4.13.0` | `4.13.3` |
| [sharp](https://github.com/lovell/sharp) | `0.35.2` | `0.35.3` |
| [swagger-ui-react](https://github.com/swagger-api/swagger-ui) | `5.32.6` | `5.32.10` |
| [@emnapi/core](https://github.com/toyobayashi/emnapi) | `1.11.1` | `1.11.2` |
| [@emnapi/runtime](https://github.com/toyobayashi/emnapi) | `1.11.1` | `1.11.2` |
| [@next/env](https://github.com/vercel/next.js/tree/HEAD/packages/next-env) | `16.2.9` | `16.2.11` |
| [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.62.1` | `8.65.0` |
| [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.62.1` | `8.65.0` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.9` | `4.1.10` |
| [autoprefixer](https://github.com/postcss/autoprefixer) | `10.5.2` | `10.5.4` |
| [eslint](https://github.com/eslint/eslint) | `9.39.4` | `9.39.5` |
| [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.2.9` | `16.2.11` |
| [postcss](https://github.com/postcss/postcss) | `8.5.16` | `8.5.21` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.9` | `4.1.10` |
| [web-tree-sitter](https://github.com/tree-sitter/tree-sitter/tree/HEAD/lib/binding_web) | `0.26.10` | `0.26.11` |
| [@img/sharp-linux-x64](https://github.com/lovell/sharp/tree/HEAD/npm/linux-x64) | `0.35.2` | `0.35.3` |
| [@parcel/watcher-darwin-arm64](https://github.com/parcel-bundler/watcher) | `2.5.6` | `2.6.0` |
| [@parcel/watcher-darwin-x64](https://github.com/parcel-bundler/watcher) | `2.5.6` | `2.6.0` |
| [@parcel/watcher-linux-x64-glibc](https://github.com/parcel-bundler/watcher) | `2.5.6` | `2.6.0` |
| [@parcel/watcher-linux-x64-musl](https://github.com/parcel-bundler/watcher) | `2.5.6` | `2.6.0` |
| [@swc/core-linux-x64-gnu](https://github.com/swc-project/swc) | `1.15.43` | `1.15.46` |



Updates `@anthropic-ai/sdk` from 0.107.0 to 0.112.4
- [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md)
- [Commits](anthropics/anthropic-sdk-typescript@sdk-v0.107.0...sdk-v0.112.4)

Updates `@sentry/nextjs` from 10.62.0 to 10.67.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.62.0...10.67.0)

Updates `@supabase/ssr` from 0.12.0 to 0.12.3
- [Release notes](https://github.com/supabase/ssr/releases)
- [Changelog](https://github.com/supabase/ssr/blob/main/CHANGELOG.md)
- [Commits](supabase/ssr@v0.12.0...v0.12.3)

Updates `@supabase/supabase-js` from 2.108.2 to 2.110.8
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.110.8/packages/core/supabase-js)

Updates `dompurify` from 3.4.11 to 3.4.12
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.11...3.4.12)

Updates `driver.js` from 1.6.0 to 1.8.0
- [Release notes](https://github.com/nilbuild/driver.js/releases)
- [Commits](https://github.com/nilbuild/driver.js/commits/1.8.0/packages/driver)

Updates `idb-keyval` from 6.2.6 to 6.3.0
- [Changelog](https://github.com/jakearchibald/idb-keyval/blob/main/CHANGELOG.md)
- [Commits](jakearchibald/idb-keyval@v6.2.6...v6.3.0)

Updates `next` from 16.2.9 to 16.2.11
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.2.9...v16.2.11)

Updates `next-auth` from 4.24.14 to 4.24.15
- [Release notes](https://github.com/nextauthjs/next-auth/releases)
- [Commits](https://github.com/nextauthjs/next-auth/compare/next-auth@4.24.14...next-auth@4.24.15)

Updates `next-intl` from 4.13.0 to 4.13.3
- [Release notes](https://github.com/amannn/next-intl/releases)
- [Changelog](https://github.com/amannn/next-intl/blob/main/CHANGELOG.md)
- [Commits](amannn/next-intl@v4.13.0...v4.13.3)

Updates `sharp` from 0.35.2 to 0.35.3
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.35.2...v0.35.3)

Updates `swagger-ui-react` from 5.32.6 to 5.32.10
- [Release notes](https://github.com/swagger-api/swagger-ui/releases)
- [Commits](swagger-api/swagger-ui@v5.32.6...v5.32.10)

Updates `@emnapi/core` from 1.11.1 to 1.11.2
- [Release notes](https://github.com/toyobayashi/emnapi/releases)
- [Commits](toyobayashi/emnapi@v1.11.1...v1.11.2)

Updates `@emnapi/runtime` from 1.11.1 to 1.11.2
- [Release notes](https://github.com/toyobayashi/emnapi/releases)
- [Commits](toyobayashi/emnapi@v1.11.1...v1.11.2)

Updates `@next/env` from 16.2.9 to 16.2.11
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.2.11/packages/next-env)

Updates `@typescript-eslint/eslint-plugin` from 8.62.1 to 8.65.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.65.0/packages/eslint-plugin)

Updates `@typescript-eslint/parser` from 8.62.1 to 8.65.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.65.0/packages/parser)

Updates `@vitest/coverage-v8` from 4.1.9 to 4.1.10
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/coverage-v8)

Updates `autoprefixer` from 10.5.2 to 10.5.4
- [Release notes](https://github.com/postcss/autoprefixer/releases)
- [Changelog](https://github.com/postcss/autoprefixer/blob/main/CHANGELOG.md)
- [Commits](postcss/autoprefixer@10.5.2...10.5.4)

Updates `eslint` from 9.39.4 to 9.39.5
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v9.39.4...v9.39.5)

Updates `eslint-config-next` from 16.2.9 to 16.2.11
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.2.11/packages/eslint-config-next)

Updates `postcss` from 8.5.16 to 8.5.21
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.16...8.5.21)

Updates `vitest` from 4.1.9 to 4.1.10
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest)

Updates `web-tree-sitter` from 0.26.10 to 0.26.11
- [Release notes](https://github.com/tree-sitter/tree-sitter/releases)
- [Commits](https://github.com/tree-sitter/tree-sitter/commits/v0.26.11/lib/binding_web)

Updates `@img/sharp-linux-x64` from 0.35.2 to 0.35.3
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](https://github.com/lovell/sharp/commits/v0.35.3/npm/linux-x64)

Updates `@parcel/watcher-darwin-arm64` from 2.5.6 to 2.6.0
- [Release notes](https://github.com/parcel-bundler/watcher/releases)
- [Commits](parcel-bundler/watcher@v2.5.6...v2.6.0)

Updates `@parcel/watcher-darwin-x64` from 2.5.6 to 2.6.0
- [Release notes](https://github.com/parcel-bundler/watcher/releases)
- [Commits](parcel-bundler/watcher@v2.5.6...v2.6.0)

Updates `@parcel/watcher-linux-x64-glibc` from 2.5.6 to 2.6.0
- [Release notes](https://github.com/parcel-bundler/watcher/releases)
- [Commits](parcel-bundler/watcher@v2.5.6...v2.6.0)

Updates `@parcel/watcher-linux-x64-musl` from 2.5.6 to 2.6.0
- [Release notes](https://github.com/parcel-bundler/watcher/releases)
- [Commits](parcel-bundler/watcher@v2.5.6...v2.6.0)

Updates `@swc/core-linux-x64-gnu` from 1.15.43 to 1.15.46
- [Release notes](https://github.com/swc-project/swc/releases)
- [Changelog](https://github.com/swc-project/swc/blob/main/CHANGELOG.md)
- [Commits](swc-project/swc@v1.15.43...v1.15.46)

---
updated-dependencies:
- dependency-name: "@anthropic-ai/sdk"
  dependency-version: 0.112.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@emnapi/core"
  dependency-version: 1.11.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@emnapi/runtime"
  dependency-version: 1.11.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@img/sharp-linux-x64"
  dependency-version: 0.35.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@next/env"
  dependency-version: 16.2.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@parcel/watcher-darwin-arm64"
  dependency-version: 2.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@parcel/watcher-darwin-x64"
  dependency-version: 2.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@parcel/watcher-linux-x64-glibc"
  dependency-version: 2.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@parcel/watcher-linux-x64-musl"
  dependency-version: 2.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@sentry/nextjs"
  dependency-version: 10.67.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@supabase/ssr"
  dependency-version: 0.12.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@supabase/supabase-js"
  dependency-version: 2.110.7
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@swc/core-linux-x64-gnu"
  dependency-version: 1.15.46
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@typescript-eslint/eslint-plugin"
  dependency-version: 8.65.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@typescript-eslint/parser"
  dependency-version: 8.65.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 4.1.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: autoprefixer
  dependency-version: 10.5.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: dompurify
  dependency-version: 3.4.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: driver.js
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: eslint
  dependency-version: 9.39.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: eslint-config-next
  dependency-version: 16.2.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: idb-keyval
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: next
  dependency-version: 16.2.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: next-auth
  dependency-version: 4.24.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: next-intl
  dependency-version: 4.13.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: postcss
  dependency-version: 8.5.20
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: sharp
  dependency-version: 0.35.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: swagger-ui-react
  dependency-version: 5.32.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: vitest
  dependency-version: 4.1.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: web-tree-sitter
  dependency-version: 0.26.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/minor-and-patch-366ce39081 branch from 058c31c to 4f055a2 Compare July 21, 2026 16:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

gssoc26 GSSoC 2026 contribution level:beginner GSSoC: Beginner difficulty (20 pts) type:devops GSSoC type bonus: devops (+15 pts)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant