Data

Tools

Indexes

Applications

Experiments

Dependabot

An open index of dependabot pull requests across open source projects.

chore(deps): Bump the minor-and-patch group across 1 directory with 25 updates

Open
Number: #14
Type: Pull Request
State: Open
Author: dependabot[bot] dependabot[bot]
Association: Unknown
Comments: 1
Created: May 06, 2026 at 02:50 AM UTC
(13 days ago)
Updated: May 06, 2026 at 02:50 AM UTC
(13 days ago)
Description:

Bumps the minor-and-patch group with 23 updates in the / directory:

Package From To
@anthropic-ai/sdk 0.78.0 0.94.0
@netlify/blobs 10.7.0 10.7.4
@netlify/functions 5.1.2 5.2.0
@remotion/media-utils 4.0.434 4.0.457
@remotion/player 4.0.434 4.0.457
@supabase/supabase-js 2.99.0 2.105.3
drizzle-orm 0.45.1 0.45.2
gsap 3.14.2 3.15.0
jspdf 4.2.0 4.2.1
mammoth 1.11.0 1.12.0
next 16.1.6 16.2.4
react 19.2.3 19.2.5
react-dom 19.2.3 19.2.5
react-hook-form 7.71.2 7.75.0
react-resizable-panels 4.7.2 4.11.0
recharts 3.8.0 3.8.1
ws 8.19.0 8.20.0
zod 4.3.6 4.4.3
@playwright/test 1.58.2 1.59.1
@tailwindcss/postcss 4.2.1 4.2.4
drizzle-kit 0.31.9 0.31.10
eslint-config-next 16.1.6 16.2.4
shadcn 4.0.3 4.7.0

Updates @anthropic-ai/sdk from 0.78.0 to 0.94.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk: v0.94.0

0.94.0 (2026-05-05)

Full Changelog: sdk-v0.93.0...sdk-v0.94.0

Features

  • client: allow targeting a workspace for OIDC federation token exchange (bde6620)

sdk: v0.93.0

0.93.0 (2026-05-04)

Full Changelog: sdk-v0.92.0...sdk-v0.93.0

Features

  • client: add Workload Identity Federation, interactive OAuth, and auth profiles (d5d6abd)

sdk: v0.92.0

0.92.0 (2026-04-30)

Full Changelog: sdk-v0.91.1...sdk-v0.92.0

Features

  • api: improve Managed Agents APIs (ca1bf4a)
  • support setting headers via env (32f67d4)

Bug Fixes

  • bedrock: throw APIError for error events delivered in chunk frames (#1021) (3ae887b)

Chores

  • format: run eslint and prettier separately (7ce257c)
  • internal: codegen related update (f08cc77)

sdk: v0.91.1

0.91.1 (2026-04-24)

Full Changelog: sdk-v0.91.0...sdk-v0.91.1

Bug Fixes

  • memory: use restrictive file mode for memory files (#901) (6db3b7e)

Chores

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.94.0 (2026-05-05)

Full Changelog: sdk-v0.93.0...sdk-v0.94.0

Features

  • client: allow targeting a workspace for OIDC federation token exchange (bde6620)

0.93.0 (2026-05-04)

Full Changelog: sdk-v0.92.0...sdk-v0.93.0

Features

  • client: add Workload Identity Federation, interactive OAuth, and auth profiles (d5d6abd)

0.92.0 (2026-04-30)

Full Changelog: sdk-v0.91.1...sdk-v0.92.0

Features

  • api: improve Managed Agents APIs (ca1bf4a)
  • support setting headers via env (32f67d4)

Bug Fixes

  • bedrock: throw APIError for error events delivered in chunk frames (#1021) (3ae887b)

Chores

  • format: run eslint and prettier separately (7ce257c)
  • internal: codegen related update (f08cc77)

0.91.1 (2026-04-24)

Full Changelog: sdk-v0.91.0...sdk-v0.91.1

Bug Fixes

  • memory: use restrictive file mode for memory files (#901) (6db3b7e)

Chores

  • formatter: run prettier and eslint separately (974d22f)

0.91.0 (2026-04-23)

... (truncated)

Commits

Updates @netlify/blobs from 10.7.0 to 10.7.4

Release notes

Sourced from @​netlify/blobs's releases.

blobs: v10.7.4

10.7.4 (2026-03-19)

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​netlify/dev-utils bumped from 4.4.2 to 4.4.3
      • @​netlify/otel bumped from ^5.1.4 to ^5.1.5

blobs: v10.7.3

10.7.3 (2026-03-18)

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​netlify/dev-utils bumped from 4.4.1 to 4.4.2
      • @​netlify/otel bumped from ^5.1.3 to ^5.1.4
Changelog

Sourced from @​netlify/blobs's changelog.

10.7.4 (2026-03-19)

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​netlify/dev-utils bumped from 4.4.2 to 4.4.3
      • @​netlify/otel bumped from ^5.1.4 to ^5.1.5

10.7.3 (2026-03-18)

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​netlify/dev-utils bumped from 4.4.1 to 4.4.2
      • @​netlify/otel bumped from ^5.1.3 to ^5.1.4

10.7.2 (2026-03-12)

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​netlify/dev-utils bumped from 4.4.0 to 4.4.1
      • @​netlify/otel bumped from ^5.1.2 to ^5.1.3

10.7.1 (2026-03-10)

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​netlify/dev-utils bumped from 4.3.3 to 4.4.0
      • @​netlify/otel bumped from ^5.1.1 to ^5.1.2
Commits

Updates @netlify/functions from 5.1.2 to 5.2.0

Release notes

Sourced from @​netlify/functions's releases.

functions: v5.2.0

5.2.0 (2026-04-07)

Features

functions: v5.1.5

5.1.5 (2026-03-19)

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​netlify/types bumped from 2.5.0 to 2.6.0

otel: v5.1.5

5.1.5 (2026-03-19)

Dependencies

  • The following workspace dependencies were updated
    • devDependencies
      • @​netlify/dev-utils bumped from ^4.4.2 to ^4.4.3

functions: v5.1.4

5.1.4 (2026-03-18)

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​netlify/types bumped from 2.4.0 to 2.5.0

otel: v5.1.4

5.1.4 (2026-03-18)

Dependencies

  • The following workspace dependencies were updated
    • devDependencies
      • @​netlify/dev-utils bumped from ^4.4.1 to ^4.4.2
Changelog

Sourced from @​netlify/functions's changelog.

5.2.0 (2026-04-07)

Features

5.1.5 (2026-03-19)

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​netlify/types bumped from 2.5.0 to 2.6.0

5.1.4 (2026-03-18)

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​netlify/types bumped from 2.4.0 to 2.5.0

5.1.3 (2026-03-12)

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​netlify/types bumped from 2.3.0 to 2.4.0
Commits

Updates @remotion/media-utils from 4.0.434 to 4.0.457

Release notes

Sourced from @​remotion/media-utils's releases.

v4.0.457

What's Changed

Docs

Full Changelog: https://github.com/remotion-dev/remotion/compare/v4.0.456...v4.0.457

v4.0.456

What's Changed

Docs

Full Changelog: https://github.com/remotion-dev/remotion/compare/v4.0.455...v4.0.456

v4.0.455

What's Changed

Experts

Internals

New Contributors

Full Changelog: https://github.com/remotion-dev/remotion/compare/v4.0.454...v4.0.455

v4.0.454

What's Changed

Full Changelog: https://github.com/remotion-dev/remotion/compare/v4.0.453...v4.0.454

... (truncated)

Commits

Updates @remotion/player from 4.0.434 to 4.0.457

Release notes

Sourced from @​remotion/player's releases.

v4.0.457

What's Changed

Docs

Full Changelog: https://github.com/remotion-dev/remotion/compare/v4.0.456...v4.0.457

v4.0.456

What's Changed

Docs

Full Changelog: https://github.com/remotion-dev/remotion/compare/v4.0.455...v4.0.456

v4.0.455

What's Changed

Experts

Internals

New Contributors

Full Changelog: https://github.com/remotion-dev/remotion/compare/v4.0.454...v4.0.455

v4.0.454

What's Changed

Full Changelog: https://github.com/remotion-dev/remotion/compare/v4.0.453...v4.0.454

... (truncated)

Commits

Updates @supabase/supabase-js from 2.99.0 to 2.105.3

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.105.3

2.105.3 (2026-05-04)

🩹 Fixes

  • auth: narrow OAuth/CustomProvider types to fix downstream consumer typecheck (#2326)

v2.105.2

2.105.2 (2026-05-04)

🩹 Fixes

  • auth: forward lockAcquireTimeout to SupabaseAuthClient (#2309)
  • auth: add toJSON to WebAuthnError for correct JSON serialization (#2317)
  • misc: widen enum-like unions with (string & {}) for forward compat (#2303)
  • misc: reduce any usage across packages (#2314)
  • postgrest: unify insert/upsert signatures (#2315)

❤️ Thank You

v2.105.2-canary.4

2.105.2-canary.4 (2026-05-04)

This was a version bump only, there were no code changes.

v2.105.2-canary.3

2.105.2-canary.3 (2026-05-04)

This was a version bump only, there were no code changes.

v2.105.2-canary.2

2.105.2-canary.2 (2026-05-04)

🩹 Fixes

  • auth: add toJSON to WebAuthnError for correct JSON serialization (#2317)
  • misc: reduce any usage across packages (#2314)
  • postgrest: unify insert/upsert signatures (#2315)

v2.105.2-canary.1

2.105.2-canary.1 (2026-05-04)

🩹 Fixes

  • auth: forward lockAcquireTimeout to SupabaseAuthClient (#2309)

❤️ Thank You

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.105.1 (2026-04-28)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.105.0 (2026-04-27)

🚀 Features

  • auth: add passkey support with WebAuthn registration, authentication, and management (#2283)
  • realtime: Realtime deferred disconnect (#2282)

2.104.1 (2026-04-23)

🩹 Fixes

  • supabase: propagate custom fetch to realtime client (#2267)

❤️ Thank You

2.104.0 (2026-04-20)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.103.3 (2026-04-16)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.103.2 (2026-04-15)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.103.1 (2026-04-15)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.103.0 (2026-04-09)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.102.1 (2026-04-07)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.102.0 (2026-04-07)

🚀 Features

  • supabase: export PostgrestFilterBuilder and StorageApiError from supabase-js (#2222)

... (truncated)

Commits
  • db53b0f chore(release): version 2.105.2 changelogs (#2323)
  • 5223888 [patchback] docs(repo): @​category and @​subcategory tags across all packages (...
  • 0412d0d fix(auth): forward lockAcquireTimeout to SupabaseAuthClient (#2309)
  • 42c9cbb [patchback] fix(misc): widen enum-like unions with (string & {}) for forward ...
  • 7e1773c chore(release): version 2.105.1 changelogs (#2302)
  • ca8c418 chore(release): version 2.105.0 changelogs (#2290)
  • d19e6d3 [patchback] docs(misc): rename anon key → publishable key and service role ke...
  • c420456 [patchback] feat(auth): add passkey support with WebAuthn registration, authe...
  • bfb18bc [patchback] feat(realtime): Realtime deferred disconnect (#2282)
  • ed49eed chore(release): version 2.104.1 changelogs (#2273)
  • Additional commits viewable in compare view

Updates drizzle-orm from 0.45.1 to 0.45.2

Release notes

Sourced from drizzle-orm's releases.

0.45.2

  • Fixed sql.identifier(), sql.as() escaping issues. Previously all the values passed to this functions were not properly escaped causing a possible SQL Injection (CWE-89) vulnerability

Thanks to @​EthanKim88, @​0x90sh and @​wgoodall01 for reaching out to us with a reproduction and suggested fix

Commits

Updates gsap from 3.14.2 to 3.15.0

Commits

Updates jspdf from 4.2.0 to 4.2.1

Release notes

Sourced from jspdf's releases.

v4.2.1

This release fixes two security issues.

What's Changed

Full Changelog: https://github.com/parallax/jsPDF/compare/v4.2.0...v4.2.1

Commits

Updates mammoth from 1.11.0 to 1.12.0

Changelog

Sourced from mammoth's changelog.

1.12.0

  • Handle hyperlinked wp:anchor and wp:inline elements.

  • Handle hyperlink complex fields with unquoted hrefs.

Commits
  • 380a4a8 Bump version to 1.12.0
  • 0830b29 Clarify variable name
  • 8e6c5c7 Clarify test names
  • 04ac1b9 Simplify HYPERLINK field handling
  • 6cfbe0b Handle hyperlink complex fields with unquoted hrefs
  • 5b8d20f Handle hyperlinked wp:anchor and wp:inline elements
  • See full diff in compare view

Updates next from 16.1.6 to 16.2.4

Release notes

Sourced from next's releases.

v16.2.4

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • chore: Bump reqwest to 0.13.2 (Fixes Google Fonts with Turbopack for Windows on ARM64) (#92713)
  • Turbopack: fix filesystem watcher config not applying follow_symlinks(false) (#92631)
  • Scope Safari ?ts= cache-buster to CSS/font assets only (Pages Router) (#92580)
  • Compiler: Support boolean and number primtives in next.config defines (#92731)
  • turbo-tasks: Fix recomputation loop by allowing cell cleanup on error during recomputation (#92725)
  • Turbopack: shorter error for ChunkGroupInfo::get_index_of (#92814)
  • Turbopack: shorter error message for ModuleBatchesGraph::get_entry_index (#92828)
  • Adding more system info to the 'initialize project' trace (#92427)

Credits

Huge thanks to @​Badbird5907, @​lukesandberg, @​andrewimm, @​sokra, and @​mischnic for helping!

v16.2.3

[!NOTE] This release is backporting security and bug fixes. For more information about the fixed security vulnerability, please see https://vercel.com/changelog/summary-of-cve-2026-23869. The release does not include all pending features/changes on canary.

Core Changes

  • Ensure app-page reports stale ISR revalidation errors via onRequestError (#92282)
  • Fix [Bug]: manifest.ts breaks HMR in Next.js 16.2 (#91981 through #92273)
  • Deduplicate output assets and detect content conflicts on emit (#92292)
  • Fix styled-jsx race condition: styles lost due to concurrent rendering (#92459)
  • turbo-tasks-backend: stability fixes for task cancellation and error handling (#92254)

Credits

Huge thanks to @​icyJoseph, @​sokra, @​wbinnssmith, @​eps1lon and @​ztanner for helping!

v16.2.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • backport: Move expanded adapters docs to API reference (#92115) (#92129)
  • Backport: TypeScript v6 deprecations for baseUrl and moduleResolution (#92130)
  • [create-next-app] Skip interactive prompts when CLI flags are provided (#91840)
  • next.config.js: Accept an option for serverFastRefresh (#91968)
  • Turbopack: enable server HMR for app route handlers (#91466)
  • Turbopack: exclude metadata routes from server HMR (#92034)
  • Fix CI for glibc linux builds
  • Backport: disable bmi2 in qfilter #92177
  • [backport] Fix CSS HMR on Safari (#92174)

... (truncated)

Commits
  • 2275bd8 v16.2.4
  • e073983 Adding more system info to the 'initialize project' trace (#92427)
  • 8a540b5 Turbopack: shorter error message for ModuleBatchesGraph::get_entry_index (#92...
  • 2f5343f Turbopack: shorter error for ChunkGroupInfo::get_index_of (#92814)
  • 2ad9d3f turbo-tasks: Fix recomputation loop by allowing cell cleanup on error during ...
  • 6f3808e Compiler: Support boolean and number primtives in next.config defines (#92731)
  • fbc7684 Scope Safari ?ts= cache-buster to CSS/font assets only (Pages Router) (#92580)
  • 805d758 Turbopack: fix filesystem watcher config not applying follow_symlinks(false) ...
  • 1056fae chore: Bump reqwest to 0.13.2 (#92713)
  • d5f649b v16.2.3
  • Additional commits viewable in compare view

Updates react from 19.2.3 to 19.2.5

Release notes

Sourced from react's releases.

19.2.5 (April 8th, 2026)

React Server Components

19.2.4 (January 26th, 2026)

React Server Components

Commits

Updates react-dom from 19.2.3 to 19.2.5

Release notes

Sourced from react-dom's releases.

19.2.5 (April 8th, 2026)

React Server Components

19.2.4 (January 26th, 2026)

React Server Components

Commits

Updates react-hook-form from 7.71.2 to 7.75.0

Release notes

Sourced from react-hook-form's releases.

Version 7.75.0

🦧 feat: improve get dirty fields prune empty fields (#13363)

+ dirtyFields: { test: [{ data: false }] }
- dirtyFields: {} // removed the empty node with false value

🎹 typescript 6.0 (#13330) 🌡️ chore: minor improvement on setValue & reset (#13366) 🐞 fix #13403: include setValues in FormProvider context value (#13404) 🐞 fix: recompute isDirty after re-registering a previously unregistered field (#13399) 🐞 fix: preserve watch updates on field array unmount fixes #13375 (#13385) 🐞 fix: prevent useWatch re-render when unrelated field validation is … (#13398)

thanks to @​dfedoryshchev, @​cyky & @​gkarabelos

Version 7.74.0

🪇 feat: setValues (#13201)

setValues((data) => {
  return {
    ...data,
    name: 'test'
  }
})

setValues(formValues);

🐞 fix: preserve previous field value when useController name changes (#13395) 🐞 fix: handle null parent when unregistering nested field (#13396) 🐞 fix: treat NaN as empty when valueAsNumber is true in validateField (#13388<...

Description has been truncated

Package Dependencies
Package:
 zod
Ecosystem:
npm
Version Change:
4.3.6 → 4.4.3
Update Type:
Minor
Package:
react-dom
Ecosystem:
npm
Version Change:
19.2.3 → 19.2.5
Update Type:
Patch
Package:
next
Ecosystem:
npm
Version Change:
16.1.6 → 16.2.4
Update Type:
Minor
Package:
ws
Ecosystem:
npm
Version Change:
8.19.0 → 8.20.0
Update Type:
Minor
Package:
@supabase/supabase-js
Ecosystem:
npm
Version Change:
2.99.0 → 2.105.3
Update Type:
Minor
Package:
@tailwindcss/postcss
Ecosystem:
npm
Version Change:
4.2.1 → 4.2.4
Update Type:
Patch
Package:
eslint-config-next
Ecosystem:
npm
Version Change:
16.1.6 → 16.2.4
Update Type:
Minor
Package:
@playwright/test
Ecosystem:
npm
Version Change:
1.58.2 → 1.59.1
Update Type:
Minor
Package:
@anthropic-ai/sdk
Ecosystem:
npm
Version Change:
0.78.0 → 0.94.0
Update Type:
Minor
Package:
react
Ecosystem:
npm
Version Change:
19.2.3 → 19.2.5
Update Type:
Patch
Package:
react-hook-form
Ecosystem:
npm
Version Change:
7.71.2 → 7.75.0
Update Type:
Minor
Package:
drizzle-orm
Ecosystem:
npm
Version Change:
0.45.1 → 0.45.2
Update Type:
Patch
Package:
@netlify/blobs
Ecosystem:
npm
Version Change:
10.7.0 → 10.7.4
Update Type:
Patch
Package:
@netlify/functions
Ecosystem:
npm
Version Change:
5.1.2 → 5.2.0
Update Type:
Minor
Package:
react-resizable-panels
Ecosystem:
npm
Version Change:
4.7.2 → 4.11.0
Update Type:
Minor
Package:
recharts
Ecosystem:
npm
Version Change:
3.8.0 → 3.8.1
Update Type:
Patch
Package:
shadcn
Ecosystem:
npm
Version Change:
4.0.3 → 4.7.0
Update Type:
Minor
Package:
drizzle-kit
Ecosystem:
npm
Version Change:
0.31.9 → 0.31.10
Update Type:
Patch
Package:
jspdf
Ecosystem:
npm
Version Change:
4.2.0 → 4.2.1
Update Type:
Patch
Package:
gsap
Ecosystem:
npm
Version Change:
3.14.2 → 3.15.0
Update Type:
Minor
Package:
mammoth
Ecosystem:
npm
Version Change:
1.11.0 → 1.12.0
Update Type:
Minor
Package:
@remotion/media-utils
Ecosystem:
npm
Version Change:
4.0.434 → 4.0.457
Update Type:
Patch
Package:
@remotion/player
Ecosystem:
npm
Version Change:
4.0.434 → 4.0.457
Update Type:
Patch
Security Advisories
jsPDF has HTML Injection in New Window paths
GHSA-wfv2-pwc8-crg5 CVE-2026-31938 CRITICAL
### Impact User control of the `options` argument of the `output` function allows attackers to inject arbitrary HTML (such as scripts) into the browser context the created PDF is opened in. The af...
jsPDF has a PDF Object Injection via FreeText color
GHSA-7x6v-j9x4-qf24 CVE-2026-31898 HIGH
### Impact User control of arguments of the `createAnnotation` method allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input ...
Actions
View on GitHub View Repository All Dependabot PRs
Technical Details
ID: 15670498
UUID: 4388401886
Node ID: PR_kwDORkWTZs7YnPpE
Host: GitHub
Repository: sergiodiazsch/young-owls-studio