Skip to content

deps: bump the production-dependencies group across 1 directory with 11 updates - #148

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-477db5909d
Open

deps: bump the production-dependencies group across 1 directory with 11 updates#148
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-477db5909d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 11 updates in the / directory:

Package From To
@prisma/adapter-pg 7.8.0 7.10.0
@prisma/client 7.8.0 7.10.0
@react-pdf/renderer 4.5.1 4.9.0
@sentry/nextjs 10.66.0 10.72.0
jose 6.2.3 6.2.10
marked 18.0.6 18.0.11
next 16.2.10 16.3.3
pg 8.22.0 8.23.0
react 19.2.7 19.2.8
react-dom 19.2.7 19.2.8
zod 4.4.3 4.5.2

Updates @prisma/adapter-pg from 7.8.0 to 7.10.0

Release notes

Sourced from @​prisma/adapter-pg's releases.

7.10.0

Prisma ORM 7.10.0

Prisma ORM 7.10.0 introduces a compatibility package for running Prisma 7 alongside newer Prisma versions, secures Prisma Studio's local server, and includes fixes across Prisma Client and the PostgreSQL, MariaDB, Neon, SQLite, and Prisma Postgres Serverless adapters.

Highlights

Run Prisma 7 alongside Prisma 8

This release introduces @prisma/prisma7, a compatibility package that lets you retain a matching Prisma 7 CLI and configuration while installing Prisma 8 in the same project.

Once 7.10.0 is released, a side-by-side installation can use:

npm install --save-dev prisma@8 @prisma/prisma7@7.10.0
npm install @prisma/client@7.10.0

Use prisma for the directly installed Prisma 8 CLI and prisma7 for Prisma 7:

npx prisma --version
npx prisma7 --version
npx prisma7 generate
npx prisma7 migrate dev
npx prisma7 db push

Prisma 7 now prefers version-specific configuration files, allowing its configuration to coexist with Prisma 8's prisma.config.* files:

// prisma7.config.ts
import { defineConfig } from '@prisma/prisma7/config'
export default defineConfig({
schema: 'prisma/schema.prisma',
migrations: {
path: 'prisma/migrations',
},
})

Without an explicit --config option, Prisma 7 searches for:

  1. Root-level prisma7.config.* files.
  2. .config/prisma7.* files.
  3. Existing prisma.config.* files as a backwards-compatible fallback.

The supported extensions are .js, .ts, .mjs, .cjs, .mts, and .cts. An explicit config path always takes precedence:

... (truncated)

Commits
  • 3fa65ac fix(p2002): correct modelName in nested create unique constraint errors #2959...
  • a180209 fix(adapter-pg): map PostgreSQL deadlocks to P2034 (#29717)
  • 800f1d1 fix(adapter-pg): preserve constraint name for unique violations (23505) (#29587)
  • 7ef2104 fix(postgres): handle SQLSTATE 23001 for RESTRICT violations (#29554)
  • 35003fd chore(adapter-pg): remove duplicate values parameter (#29650)
  • d6d9fc9 chore: remove parameterization from sqlcommenter-query-insights (#29518)
  • See full diff in compare view

Updates @prisma/client from 7.8.0 to 7.10.0

Release notes

Sourced from @​prisma/client's releases.

7.10.0

Prisma ORM 7.10.0

Prisma ORM 7.10.0 introduces a compatibility package for running Prisma 7 alongside newer Prisma versions, secures Prisma Studio's local server, and includes fixes across Prisma Client and the PostgreSQL, MariaDB, Neon, SQLite, and Prisma Postgres Serverless adapters.

Highlights

Run Prisma 7 alongside Prisma 8

This release introduces @prisma/prisma7, a compatibility package that lets you retain a matching Prisma 7 CLI and configuration while installing Prisma 8 in the same project.

Once 7.10.0 is released, a side-by-side installation can use:

npm install --save-dev prisma@8 @prisma/prisma7@7.10.0
npm install @prisma/client@7.10.0

Use prisma for the directly installed Prisma 8 CLI and prisma7 for Prisma 7:

npx prisma --version
npx prisma7 --version
npx prisma7 generate
npx prisma7 migrate dev
npx prisma7 db push

Prisma 7 now prefers version-specific configuration files, allowing its configuration to coexist with Prisma 8's prisma.config.* files:

// prisma7.config.ts
import { defineConfig } from '@prisma/prisma7/config'
export default defineConfig({
schema: 'prisma/schema.prisma',
migrations: {
path: 'prisma/migrations',
},
})

Without an explicit --config option, Prisma 7 searches for:

  1. Root-level prisma7.config.* files.
  2. .config/prisma7.* files.
  3. Existing prisma.config.* files as a backwards-compatible fallback.

The supported extensions are .js, .ts, .mjs, .cjs, .mts, and .cts. An explicit config path always takes precedence:

... (truncated)

Commits
  • 05c1b88 Teach Prisma 7 to prefer versioned config files (#30020)
  • cf2bc1f Rename prisma7 package to @​prisma/prisma7 (#30002)
  • ce5a34c Complete downstream actionable Prisma 7 guidance propagation (#29994)
  • 3f13ec6 Complete CLI-owned prisma7 distribution identity (#29969)
  • 179ba0c feat(prisma7): add side-by-side CLI wrapper (#29949)
  • 3fa65ac fix(p2002): correct modelName in nested create unique constraint errors #2959...
  • 6b6d9e9 chore(deps): update engines to 7.10.0-4.0edf323efd1d98336f3f0a68684b56f689b90...
  • b64e33c chore(deps): update engines to 7.10.0-3.9d90ce2c89d5c95a1148aef15e5561ab6c490...
  • 2046f9b feat(client): expose ModelName to compute function in Result extensions (#29782)
  • f2b3abd chore(deps): update engines to 7.10.0-1.6d040c802892de6d56c7e0061b7a10b3e6a0c...
  • Additional commits viewable in compare view

Updates @react-pdf/renderer from 4.5.1 to 4.9.0

Release notes

Sourced from @​react-pdf/renderer's releases.

@​react-pdf/renderer@​4.9.0

Minor Changes

  • #3529 10d8365e2eb8fc3987cf94d4d61a7559f4ba1dfb Thanks @​diegomura! - feat: add conformance Document prop for PDF/A output

    Produces PDF/A-1/2/3 (b-level) output with XMP conformance metadata and an sRGB OutputIntent. pdfVersion defaults to what the chosen level requires. Fonts must be registered (not the built-in standard 14) to fully validate.

Patch Changes

@​react-pdf/renderer@​4.8.1

Patch Changes

@​react-pdf/renderer@​4.8.0

Minor Changes

Patch Changes

@​react-pdf/renderer@​4.7.0

Minor Changes

  • #3505 ae9a9983e8bd8b63c3873000531a8307e22c7bae Thanks @​diegomura! - Experimental pagination engine, opt-in per page

    A new pagination engine ships alongside the current one: content is measured once and packed into pages instead of relayouting on every split, making long documents paginate orders of magnitude faster (a 300-page document drops from ~40s to ~200ms).

    Opt in with <Page experimentalPagination> — any page opting in switches the whole document. The default behavior is unchanged.

... (truncated)

Changelog

Sourced from @​react-pdf/renderer's changelog.

4.9.0

Minor Changes

  • #3529 10d8365e2eb8fc3987cf94d4d61a7559f4ba1dfb Thanks @​diegomura! - feat: add conformance Document prop for PDF/A output

    Produces PDF/A-1/2/3 (b-level) output with XMP conformance metadata and an sRGB OutputIntent. pdfVersion defaults to what the chosen level requires. Fonts must be registered (not the built-in standard 14) to fully validate.

Patch Changes

4.8.1

Patch Changes

4.8.0

Minor Changes

Patch Changes

4.7.0

Minor Changes

  • #3505 ae9a9983e8bd8b63c3873000531a8307e22c7bae Thanks @​diegomura! - Experimental pagination engine, opt-in per page

    A new pagination engine ships alongside the current one: content is measured once and packed into pages instead of relayouting on every split, making long documents paginate orders of magnitude faster (a 300-page document drops from ~40s to ~200ms).

... (truncated)

Commits
  • 2c0b6d4 chore: release packages (#3530)
  • 10d8365 feat: add conformance Document prop for PDF/A output (#3529)
  • 8c047bd chore: release packages (#3525)
  • 1fe630e chore: release packages (#3507)
  • ab80c0a feat: shape-outside support for floats (#3514)
  • 533340e fix(textkit): align line widths with line rects when exclusions are present (...
  • 37a7a9f refactor: replace @​react-pdf/pdfkit fork with upstream pdfkit (#3509)
  • a568714 feat: wrapping text around floating box (#3286)
  • d5adf3d chore: release packages (#3493)
  • ae9a998 feat: experimentalPagination page prop — new engine opt-in per document (#3505)
  • Additional commits viewable in compare view

Updates @sentry/nextjs from 10.66.0 to 10.72.0

Release notes

Sourced from @​sentry/nextjs's releases.

10.72.0

Important Changes

  • AI integrations no longer report errors that propagate to the caller (#23638, #23639, #23640)

    Across all AI integrations (OpenAI, Anthropic, Google GenAI, LangChain, and LangGraph), the SDK no longer sends an event to Sentry for errors that the AI framework propagates to your code. Previously the instrumentation reported these as unhandled (handled: false) before your own error handling ran, so an error your code caught still showed up in Sentry as an unhandled crash. The span is still marked as errored and the error still propagates, so reporting is left to your application: if your code does not handle the error, it reaches Sentry's global error handlers and is captured as unhandled, just like any other uncaught error. Errors that a provider surfaces as data on an otherwise successful response (such as Anthropic error-shaped responses or Google GenAI blocked content) are still captured, since your code never sees them propagate.

  • feat(v10/cloudflare): Add rpcTracePropagationBindings (#23737, #23738)

    The new rpcTracePropagationBindings option names the env bindings that outgoing RPC calls propagate trace context to. Strings match a binding name exactly, regular expressions match by pattern, and the default empty array propagates to nothing. RPC has no headers to carry trace context, so the SDK appends it as a trailing argument that only a Sentry-instrumented receiver removes again. List only the bindings whose receiver you know runs Sentry. Setting the option takes precedence over enableRpcTracePropagation, which is now deprecated. When you build with the Sentry Cloudflare Vite plugin, the bindings that resolve to this worker (its own Durable Objects and self service bindings) are derived from your wrangler config and added for you.

Other Changes

  • fix(v10/astro): support astro v7 route patterns properly (#23657)
  • fix(v10/bundler-plugins): Preserve full file path in component annotation source maps (#23595)
  • fix(v10/core): Store child span timeout handle in _childSpanTimeoutID (#23673)
  • fix(v10/node): Only end the process session when it is still ok (#23731)
  • fix(v10/react-router): Use react-router's own instrumentation types instead of a mirrored copy (#23589)
  • fix(v10/replay): Suppress Worker destroyed error on session expiry (#23654)
  • fix(v10/server-utils): Keep orchestrion registration out of tree-shaking (#23591)
  • fix(v10/server-utils): Stop shipping orchestrion bundler plugins as production dependencies (#23667)
  • fix(v10/server-utils): Support openai v7 in auto-instrumentation (#23713)
  • fix(v10/sveltekit): Detect native tracing in flattened SvelteKit 3 config (#23656)
  • chore(v10): Add external contributor to CHANGELOG.md (#23626)
  • docs(v10): Changelog + contributor credit for AI caller-handled error fixes (#23641)
  • test(v10/e2e): Fix scripts for nuxt dev server (#23658)
  • test(v10/e2e): Look up events via the organization trace endpoint (#23680)
  • test(v10/e2e): Look up the symbolicated event via the eventids endpoint (#23681)

Work in this release was contributed by @​ryanrho-mercor, @​lux-in-tenebris-lucet, and @​suhailopensource. Thank you for your contributions!

Bundle size 📦

Path Size
@​sentry/browser 27.1 KB
@​sentry/browser - with treeshaking flags 25.58 KB
@​sentry/browser (incl. Tracing) 45.54 KB
@​sentry/browser (incl. Tracing + Span Streaming) 47.28 KB
@​sentry/browser (incl. Tracing, Profiling) 50.17 KB
@​sentry/browser (incl. Tracing, Replay) 83.87 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags 73.74 KB
@​sentry/browser (incl. Tracing, Replay with Canvas) 88.49 KB
@​sentry/browser (incl. Tracing, Replay, Feedback) 100.83 KB

... (truncated)

Changelog

Sourced from @​sentry/nextjs's changelog.

10.72.0

Important Changes

  • AI integrations no longer report errors that propagate to the caller (#23638, #23639, #23640)

    Across all AI integrations (OpenAI, Anthropic, Google GenAI, LangChain, and LangGraph), the SDK no longer sends an event to Sentry for errors that the AI framework propagates to your code. Previously the instrumentation reported these as unhandled (handled: false) before your own error handling ran, so an error your code caught still showed up in Sentry as an unhandled crash. The span is still marked as errored and the error still propagates, so reporting is left to your application: if your code does not handle the error, it reaches Sentry's global error handlers and is captured as unhandled, just like any other uncaught error. Errors that a provider surfaces as data on an otherwise successful response (such as Anthropic error-shaped responses or Google GenAI blocked content) are still captured, since your code never sees them propagate.

  • feat(v10/cloudflare): Add rpcTracePropagationBindings (#23737, #23738)

    The new rpcTracePropagationBindings option names the env bindings that outgoing RPC calls propagate trace context to. Strings match a binding name exactly, regular expressions match by pattern, and the default empty array propagates to nothing. RPC has no headers to carry trace context, so the SDK appends it as a trailing argument that only a Sentry-instrumented receiver removes again. List only the bindings whose receiver you know runs Sentry. Setting the option takes precedence over enableRpcTracePropagation, which is now deprecated. When you build with the Sentry Cloudflare Vite plugin, the bindings that resolve to this worker (its own Durable Objects and self service bindings) are derived from your wrangler config and added for you.

Other Changes

  • fix(v10/astro): support astro v7 route patterns properly (#23657)
  • fix(v10/bundler-plugins): Preserve full file path in component annotation source maps (#23595)
  • fix(v10/core): Store child span timeout handle in _childSpanTimeoutID (#23673)
  • fix(v10/node): Only end the process session when it is still ok (#23731)
  • fix(v10/react-router): Use react-router's own instrumentation types instead of a mirrored copy (#23589)
  • fix(v10/replay): Suppress Worker destroyed error on session expiry (#23654)
  • fix(v10/server-utils): Keep orchestrion registration out of tree-shaking (#23591)
  • fix(v10/server-utils): Stop shipping orchestrion bundler plugins as production dependencies (#23667)
  • fix(v10/server-utils): Support openai v7 in auto-instrumentation (#23713)
  • fix(v10/sveltekit): Detect native tracing in flattened SvelteKit 3 config (#23656)
  • chore(v10): Add external contributor to CHANGELOG.md (#23626)
  • docs(v10): Changelog + contributor credit for AI caller-handled error fixes (#23641)
  • test(v10/e2e): Fix scripts for nuxt dev server (#23658)
  • test(v10/e2e): Look up events via the organization trace endpoint (#23680)
  • test(v10/e2e): Look up the symbolicated event via the eventids endpoint (#23681)

Work in this release was contributed by @​ryanrho-mercor, @​lux-in-tenebris-lucet, and @​suhailopensource. Thank you for your contributions!

10.71.0

Important Changes

  • feat(v10/core)!: Enable logs by default (#23311)

The enableLogs client option now defaults to true, so Sentry Logs work without any manual opt-in. Nothing is captured unless you call the Sentry.logger.* APIs or add a log-forwarding integration (such as consoleLoggingIntegration, pinoIntegration, or the winston transport), and you can set enableLogs: false to opt out. Although a default change like this would normally land in a major release, we are shipping it in a minor after careful consideration, since it sends no data on its own and only takes effect once you actively use the logging APIs or a logging integration.

Other Changes

  • feat(v10/core): Deprecate scope.clear() method (#23231)
  • fix(v10/core): Bound child span tracking on long-lived spans (#23406)

... (truncated)

Commits
  • 0d23628 release: 10.72.0
  • ac2094d meta(changelog): Update changelog for 10.72.0 (#23743)
  • f325434 feat(v10/cloudflare): Derive rpcTracePropagationBindings from the wrangler co...
  • 7917b0d feat(v10/cloudflare): Add rpcTracePropagationBindings (#23737)
  • b61e912 fix(v10/node): Only end the process session when it is still ok (#23731)
  • 4316785 test(v10/e2e): Look up the symbolicated event via the eventids endpoint (#23681)
  • e09fdf8 fix(v10/server-utils): Support openai v7 in auto-instrumentation (#23713)
  • 817056d test(v10/e2e): Look up events via the organization trace endpoint (#23680)
  • 83c644d fix(v10/server-utils): Stop shipping orchestrion bundler plugins as productio...
  • 04a52dd fix(v10/core): Store child span timeout handle in _childSpanTimeoutID (#23673)
  • Additional commits viewable in compare view

Updates jose from 6.2.3 to 6.2.10

Release notes

Sourced from jose's releases.

v6.2.10

Fixes

  • jose: consume serialization members once (9bee285)
  • jose: reject empty protected and JWE AAD members (8da4145)
  • jose: validate serialized header values (b711d8f)
  • jwe: conceal invalid decrypted CEK lengths (41fafe0)
  • jwe: enforce AES-GCM tag boundaries (9a5b744)
  • jwe: validate explicit encryption parameters (7a02697)
  • jwk: accept empty octet-sequence keys (3f871e7)
  • jwk: normalize key resolution inputs (f54ee7b)
  • jwks: enforce verification key metadata (f9ba510)
  • jwks: order overlapping remote reloads (9a1a913)
  • jwks: reject invalid remote duration values (7bdb9e5)
  • jwk: validate ext and key_ops parameters (4d91c37)
  • jws: reject mixed payload encoding modes (dc69713)
  • jws: validate unencoded payload strings (541f282)
  • jwt: enforce explicit verification policies (b347182)
  • jwt: prevent replacing protected headers (ae07d09)
  • jwt: reject invalid duration inputs (282f9aa)
  • jwt: validate builder claim values (ea03f83)
  • jwt: validate unsecured protected headers (230c14e)
  • key: validate generation and import options (15d880e)
  • reject mixed b64 modes for empty General JWS payloads (61a2ef7)
  • x509: reject DER truncated past its outer length (d8db9f6)

Documentation

  • jwks: correct cache timestamp units (01a44d9)

Refactor

  • jose: share binary input validation (eedb124)
  • jose: share compact token processing internals (85e30ed)
  • jwe: consolidate CBC decryption failures (1ee6f61)
  • jwe: specialize compact processing (a998927)
  • jwe: streamline single-recipient encryption (290aaa6)
  • jwks: compact JWK Set shape validation (930c7df), references Array#every
  • jwks: compact local key selection (4cb5ae5)
  • jwks: compact remote resolver state (ef5eaf4)
  • jws: specialize compact processing (021abf4)
  • jwt: compact claim validation helpers (f390683)
  • jwt: consolidate replicated claim checks (7dd5591)
  • jwt: share producer claim state (52ba159)
  • key: compact JWK algorithm selection (a6b29da)
  • key: compact secret length parsing (cc03be8)

v6.2.9

Fixes

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.10 (2026-08-21)

Fixes

  • jose: consume serialization members once (9bee285)
  • jose: reject empty protected and JWE AAD members (8da4145)
  • jose: validate serialized header values (b711d8f)
  • jwe: conceal invalid decrypted CEK lengths (41fafe0)
  • jwe: enforce AES-GCM tag boundaries (9a5b744)
  • jwe: validate explicit encryption parameters (7a02697)
  • jwk: accept empty octet-sequence keys (3f871e7)
  • jwk: normalize key resolution inputs (f54ee7b)
  • jwks: enforce verification key metadata (f9ba510)
  • jwks: order overlapping remote reloads (9a1a913)
  • jwks: reject invalid remote duration values (7bdb9e5)
  • jwk: validate ext and key_ops parameters (4d91c37)
  • jws: reject mixed payload encoding modes (dc69713)
  • jws: validate unencoded payload strings (541f282)
  • jwt: enforce explicit verification policies (b347182)
  • jwt: prevent replacing protected headers (ae07d09)
  • jwt: reject invalid duration inputs (282f9aa)
  • jwt: validate builder claim values (ea03f83)
  • jwt: validate unsecured protected headers (230c14e)
  • key: validate generation and import options (15d880e)
  • reject mixed b64 modes for empty General JWS payloads (61a2ef7)
  • x509: reject DER truncated past its outer length (d8db9f6)

Documentation

  • jwks: correct cache timestamp units (01a44d9)

Refactor

  • jose: share binary input validation (eedb124)
  • jose: share compact token processing internals (85e30ed)
  • jwe: consolidate CBC decryption failures (1ee6f61)
  • jwe: specialize compact processing (a998927)
  • jwe: streamline single-recipient encryption (290aaa6)
  • jwks: compact JWK Set shape validation (930c7df), references Array#every
  • jwks: compact local key selection (4cb5ae5)
  • jwks: compact remote resolver state (ef5eaf4)
  • jws: specialize compact processing (021abf4)
  • jwt: compact claim validation helpers (f390683)
  • jwt: consolidate replicated claim checks (7dd5591)
  • jwt: share producer claim state (52ba159)
  • key: compact JWK algorithm selection (a6b29da)
  • key: compact secret length parsing (cc03be8)

6.2.9 (2026-08-15)

... (truncated)

Commits
  • 3eab152 chore(release): 6.2.10
  • 021abf4 refactor(jws): specialize compact processing
  • a998927 refactor(jwe): specialize compact processing
  • eedb124 refactor(jose): share binary input validation
  • 52ba159 refactor(jwt): share producer claim state
  • 85e30ed refactor(jose): share compact token processing internals
  • 0bd81d2 test(jose): cover hidden critical-header options
  • 9cf7876 test(jose): reject callable object impostors
  • f23cafd test(jose): preserve resolved key data properties
  • 1ee6f61 refactor(jwe): consolidate CBC decryption failures
  • Additional commits viewable in compare view

Updates marked from 18.0.6 to 18.0.11

Release notes

Sourced from marked's releases.

v18.0.11

18.0.11 (2026-08-24)

Bug Fixes

  • do not nest a link inside a link (#4051) (e250e31)
  • inlineTokens rebuilds the reflink-mask preamble per call (#4040) (0653c24)
  • keep emphasis in the text of a rejected reference link (#4059) (b699db3)

v18.0.10

18.0.10 (2026-08-18)

Bug Fixes

  • keep the em/strong mask the same length as the source (#4044) (681373c)
  • parse EOF backtick fences after paragraphs (#4039) (81bd750)
  • place task checkboxes after list loose is finalized (#4046) (b8cf7dc), closes #4045

v18.0.9

18.0.9 (2026-08-04)

Bug Fixes

  • an unmatched strong run before emphasis stays literal (#4008) (e8544e6)
  • Fix spurious deeper nesting in a blockquote continuation (#4030) (452f1ed)
  • pedantic foo: and "word" emphasis parsing (#3999) (823093f)

v18.0.8

18.0.8 (2026-08-04)

Bug Fixes

  • fall back to default checkbox renderer when extension returns false (#4023) (e1b6139)

v18.0.7

18.0.7 (2026-07-21)

Bug Fixes

  • Avoid O(n^2) backtracking in HTML block close and tilde interrupt regexes (#4014) (f945fc5), closes #3991
  • Avoid O(n^2) masked source rebuild in inline tokenizer (#4017) (9154f8f)
  • keep empty list after blockquote as a sibling block (#4004) (3f144a0)
  • preserve code spans adjacent to tildes (#4012) (0de7188)
  • Recognize setext headings whose first line starts with # (#4015) (f056437), closes #1
  • treat a line of only tabs as a blank line between paragraphs (#4007) (bc2f121)
Commits
  • 53cb13f chore(release): 18.0.11 [skip ci]
  • 0c6b2a6 docs: add adaptable bullet point (#4058)
  • c430a64 chore(deps-dev): bump eslint from 10.8.1 to 10.9.0 (#4069)
  • b699db3 fix: keep emphasis in the text of a rejected reference link (#4059)
  • 0653c24 fix: inlineTokens rebuilds the reflink-mask preamble per call (#4040)
  • e250e31 fix: do not nest a link inside a link (#4051)
  • 8698d35 chore(release): 18.0.10 [skip ci]
  • 58367a5 chore(deps-dev): bump eslint from 10.8.0 to 10.8.1 (#4055)
  • a426c4d chore(deps-dev): bump esbuild from 0.28.1 to 0.28.2 (#4056)
  • a5cf277 chore(deps-dev): bump highlight.js from 11.11.1 to 11.12.0 (#4057)
  • Additional commits viewable in compare view

Updates next from 16.2.10 to 16.3.3

Release notes

Sourced from next's releases.

v16.3.3

This release contains security fixes for the following advisories:

Critical:

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • [backport] Scope app-entry export validation to files inside the app directory (#97357)
  • [backport] Fix catch-all index page being served for every other slug (#97416)
  • [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
  • [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
  • [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
  • [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to Description has been truncated

@dependabot
deps: bump the production-dependencies group across 1 directory with …
b693c17 
…11 updates

Bumps the production-dependencies group with 11 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@prisma/adapter-pg](https://github.com/prisma/prisma/tree/HEAD/packages/adapter-pg) | `7.8.0` | `7.10.0` |
| [@prisma/client](https://github.com/prisma/prisma/tree/HEAD/packages/client) | `7.8.0` | `7.10.0` |
| [@react-pdf/renderer](https://github.com/diegomura/react-pdf/tree/HEAD/packages/renderer) | `4.5.1` | `4.9.0` |
| [@sentry/nextjs](https://github.com/getsentry/sentry-javascript) | `10.66.0` | `10.72.0` |
| [jose](https://github.com/panva/jose) | `6.2.3` | `6.2.10` |
| [marked](https://github.com/markedjs/marked) | `18.0.6` | `18.0.11` |
| [next](https://github.com/vercel/next.js) | `16.2.10` | `16.3.3` |
| [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.22.0` | `8.23.0` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.7` | `19.2.8` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.7` | `19.2.8` |
| [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.5.2` |



Updates `@prisma/adapter-pg` from 7.8.0 to 7.10.0
- [Release notes](https://github.com/prisma/prisma/releases)
- [Commits](https://github.com/prisma/prisma/commits/7.10.0/packages/adapter-pg)

Updates `@prisma/client` from 7.8.0 to 7.10.0
- [Release notes](https://github.com/prisma/prisma/releases)
- [Commits](https://github.com/prisma/prisma/commits/7.10.0/packages/client)

Updates `@react-pdf/renderer` from 4.5.1 to 4.9.0
- [Release notes](https://github.com/diegomura/react-pdf/releases)
- [Changelog](https://github.com/diegomura/react-pdf/blob/master/packages/renderer/CHANGELOG.md)
- [Commits](https://github.com/diegomura/react-pdf/commits/@react-pdf/renderer@4.9.0/packages/renderer)

Updates `@sentry/nextjs` from 10.66.0 to 10.72.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.72.0/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.66.0...10.72.0)

Updates `jose` from 6.2.3 to 6.2.10
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v6.2.3...v6.2.10)

Updates `marked` from 18.0.6 to 18.0.11
- [Release notes](https://github.com/markedjs/marked/releases)
- [Commits](markedjs/marked@v18.0.6...v18.0.11)

Updates `next` from 16.2.10 to 16.3.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.2.10...v16.3.3)

Updates `pg` from 8.22.0 to 8.23.0
- [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md)
- [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.0/packages/pg)

Updates `react` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react)

Updates `react-dom` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom)

Updates `zod` from 4.4.3 to 4.5.2
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.4.3...v4.5.2)

---
updated-dependencies:
- dependency-name: "@prisma/adapter-pg"
  dependency-version: 7.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@prisma/client"
  dependency-version: 7.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@react-pdf/renderer"
  dependency-version: 4.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@sentry/nextjs"
  dependency-version: 10.72.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: jose
  dependency-version: 6.2.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: marked
  dependency-version: 18.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: next
  dependency-version: 16.3.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: pg
  dependency-version: 8.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: react
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: react-dom
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: zod
  dependency-version: 4.5.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Sep 1, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, npm. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants