gitchegumi/GitchAlerts

Watch

Fork 0

chore(deps): bump the production-dependencies group across 1 directory with 6 updates #169

Merged

dependabot[bot] merged 1 commit from dependabot/npm_and_yarn/production-dependencies-9577576a2c into main

2026-09-10 19:49:19 -05:00

dependabot[bot] commented

2026-09-07 04:22:02 -05:00

(Migrated from github.com)

Bumps the production-dependencies group with 6 updates in the / directory:

Package	From	To
zod	`4.4.3`	`4.5.4`
@next/env	`16.3.1`	`16.3.4`
jose	`6.2.8`	`6.2.10`
next	`16.3.1`	`16.3.4`
@prisma/adapter-pg	`7.9.1`	`7.10.0`
@prisma/client	`7.9.1`	`7.10.0`

Updates zod from 4.4.3 to 4.5.4

Release notes

Sourced from zod's releases.

v4.5.4

Commits:

84e416fbf4740527bbc8f319634f4e1b065bb42c fix(v4): stop the cycle walk from firing a default factory (#6500)

e8e206fa33ac5fe7ce20a2beb12d57b1cb3df653 4.5.4

v4.5.3

Commits:

e6b6ab347675cd2bd54b1bdbed16f98c59be82a9 docs(blog): widen the z.compile example to a 20-property schema

87d6464418582bb96fc665a01f852ca6da324ad0 fix(docs): drop the OG description when the title wraps past two lines

99fce394a026823e602b9c30d8d5d9f5f1932ce7 bench(v4): z.compile() against zod-compiler (#6499)

e3a695b6bf3f0d591ea682816e3cdaea04b0f967 docs(v4): record the email regex and container output-shape findings under Open

7e24a24288183ce02554f1ded7775d0650a7b7e6 docs(blog): drop the reading time and put a GitHub link in the navbar

eab51ff3592b2d11d863f4ee4d5452f31a3de1b6 fix(v4): emit record numeric keys as strings in toJSONSchema (#6497)

v4.5.2

Commits:

a354314ac04fdd5484aa62dd5c3a4b553211a0e4 fix(docs): keep blog posts out of the docs collection (#6484)

d378c42aff6869f0929058a7923cd775880f5c4c ci: drop canary publishing from the release workflow (#6487)

212b941791e7faae078e17645eb612824fd8f79a fix(v4): let a prototype method getter answer a bare call so vi.spyOn works (#6488)

e7576f542a7bc7ef3cc5eeec237714fd0e6b6e98 docs(blog): let the page show through the navbar in dark mode (#6489)

fedb06fafe33a66ce0b5c236ad2557e0a5a170fe fix(docs): match the blog TOC hover bar to the 2px active indicator

6c932fcb2eea6eb671710ea058ca9fdc382ada89 chore: bump devcontainer image to Node 24 (#6470)

6635d9dd367a664109de83c021995821f48efa29 docs(blog): soften the "method memoization" attribution

019ae299cc75daa132bf1acf59086a520abf6b85 fix(docs): drop ISR on the docs route so the home page hydrates

652bb438aa4c626c1cd7948c6849c4691239fca7 chore(docs): drop the scroll log from the route-change scroller

571c8e8a3d73b4305f4abfdd6977773cc12f2bf5 fix(docs): render blog tabs with the stock fumadocs tab card

9a193aa24b4efa3b315b91d4c56c8bc385b8513f 4.5.2

v4.5.1

Commits:

2e862dbf89da2835e5206a8fd3d3be61afe3cf7f ci: gate the GitHub release and JSR publish on the version being live on npm

8e03380510db36fa6fda979fc78a375fdea8021c 4.5.1

v4.5.0

Zod 4.5 is now available.
npm install zod@latest
At a glance:

https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADmhttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADmhttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD — the flagship feature of Zod 4.5

https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADChttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD — 12–19 digits plus Luhn checksum

https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADshttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADshttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD — the multi-property counterpart to z.property()

https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADPhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD/https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADxhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADPhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADxhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD

... (truncated)

Commits

e8e206f 4.5.4
84e416f fix(v4): stop the cycle walk from firing a default factory (#6500)
1a16102 4.5.3
eab51ff fix(v4): emit record numeric keys as strings in toJSONSchema (#6497)
7e24a24 docs(blog): drop the reading time and put a GitHub link in the navbar
e3a695b docs(v4): record the email regex and container output-shape findings under Open
99fce39 bench(v4): z.compile() against zod-compiler (#6499)
87d6464 fix(docs): drop the OG description when the title wraps past two lines
e6b6ab3 docs(blog): widen the z.compile example to a 20-property schema
9a193aa 4.5.2
Additional commits viewable in compare view

Updates @next/env from 16.3.1 to 16.3.4

Release notes

Sourced from @next/env's releases.

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

testmode: Fix infinite recursion in testmode passthrough fetch (#97691)

Fix build error when aliasing typescript to @typescript/typescript6 (#97997)

Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

Huge thanks to @eps1lon, @mischnic, and @timneutkens for helping!

v16.3.3

This release contains security fixes for the following advisories:

Critical:

Unauthenticated Remote Code Execution on windows-hosted servers

Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

[backport] Scope app-entry export validation to files inside the app directory (#97357)

[backport] Fix catch-all index page being served for every other slug (#97416)

[16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)

[16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)

[16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)

[16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @lubieowoce, @unstubbable, @timneutkens, @mischnic, and @eps1lon for helping!

Commits

299180d v16.3.4
a9a1cb7 v16.3.3
d0ac882 v16.3.2
See full diff in compare view

Updates jose from 6.2.8 to 6.2.10

Release notes

Sourced from jose's releases.

v6.2.10

Fixes

jose: consume serialization members once (9bee285)

jose: reject empty protected and JWE AAD members (8da4145)

jose: validate serialized header values (b711d8f)

jwe: conceal invalid decrypted CEK lengths (41fafe0)

jwe: enforce AES-GCM tag boundaries (9a5b744)

jwe: validate explicit encryption parameters (7a02697)

jwk: accept empty octet-sequence keys (3f871e7)

jwk: normalize key resolution inputs (f54ee7b)

jwks: enforce verification key metadata (f9ba510)

jwks: order overlapping remote reloads (9a1a913)

jwks: reject invalid remote duration values (7bdb9e5)

jwk: validate ext and key_ops parameters (4d91c37)

jws: reject mixed payload encoding modes (dc69713)

jws: validate unencoded payload strings (541f282)

jwt: enforce explicit verification policies (b347182)

jwt: prevent replacing protected headers (ae07d09)

jwt: reject invalid duration inputs (282f9aa)

jwt: validate builder claim values (ea03f83)

jwt: validate unsecured protected headers (230c14e)

key: validate generation and import options (15d880e)

reject mixed b64 modes for empty General JWS payloads (61a2ef7)

x509: reject DER truncated past its outer length (d8db9f6)

Documentation

jwks: correct cache timestamp units (01a44d9)

Refactor

jose: share binary input validation (eedb124)

jose: share compact token processing internals (85e30ed)

jwe: consolidate CBC decryption failures (1ee6f61)

jwe: specialize compact processing (a998927)

jwe: streamline single-recipient encryption (290aaa6)

jwks: compact JWK Set shape validation (930c7df), references Array#every

jwks: compact local key selection (4cb5ae5)

jwks: compact remote resolver state (ef5eaf4)

jws: specialize compact processing (021abf4)

jwt: compact claim validation helpers (f390683)

jwt: consolidate replicated claim checks (7dd5591)

jwt: share producer claim state (52ba159)

key: compact JWK algorithm selection (a6b29da)

key: compact secret length parsing (cc03be8)

v6.2.9

Fixes

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.10 (2026-08-21)

Fixes

jose: consume serialization members once (9bee285)

jose: reject empty protected and JWE AAD members (8da4145)

jose: validate serialized header values (b711d8f)

jwe: conceal invalid decrypted CEK lengths (41fafe0)

jwe: enforce AES-GCM tag boundaries (9a5b744)

jwe: validate explicit encryption parameters (7a02697)

jwk: accept empty octet-sequence keys (3f871e7)

jwk: normalize key resolution inputs (f54ee7b)

jwks: enforce verification key metadata (f9ba510)

jwks: order overlapping remote reloads (9a1a913)

jwks: reject invalid remote duration values (7bdb9e5)

jwk: validate ext and key_ops parameters (4d91c37)

jws: reject mixed payload encoding modes (dc69713)

jws: validate unencoded payload strings (541f282)

jwt: enforce explicit verification policies (b347182)

jwt: prevent replacing protected headers (ae07d09)

jwt: reject invalid duration inputs (282f9aa)

jwt: validate builder claim values (ea03f83)

jwt: validate unsecured protected headers (230c14e)

key: validate generation and import options (15d880e)

reject mixed b64 modes for empty General JWS payloads (61a2ef7)

x509: reject DER truncated past its outer length (d8db9f6)

Documentation

jwks: correct cache timestamp units (01a44d9)

Refactor

jose: share binary input validation (eedb124)

jose: share compact token processing internals (85e30ed)

jwe: consolidate CBC decryption failures (1ee6f61)

jwe: specialize compact processing (a998927)

jwe: streamline single-recipient encryption (290aaa6)

jwks: compact JWK Set shape validation (930c7df), references Array#every

jwks: compact local key selection (4cb5ae5)

jwks: compact remote resolver state (ef5eaf4)

jws: specialize compact processing (021abf4)

jwt: compact claim validation helpers (f390683)

jwt: consolidate replicated claim checks (7dd5591)

jwt: share producer claim state (52ba159)

key: compact JWK algorithm selection (a6b29da)

key: compact secret length parsing (cc03be8)

6.2.9 (2026-08-15)

... (truncated)

Commits

3eab152 chore(release): 6.2.10
021abf4 refactor(jws): specialize compact processing
a998927 refactor(jwe): specialize compact processing
eedb124 refactor(jose): share binary input validation
52ba159 refactor(jwt): share producer claim state
85e30ed refactor(jose): share compact token processing internals
0bd81d2 test(jose): cover hidden critical-header options
9cf7876 test(jose): reject callable object impostors
f23cafd test(jose): preserve resolved key data properties
1ee6f61 refactor(jwe): consolidate CBC decryption failures
Additional commits viewable in compare view

Updates next from 16.3.1 to 16.3.4

Release notes

Sourced from next's releases.

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

testmode: Fix infinite recursion in testmode passthrough fetch (#97691)

Fix build error when aliasing typescript to @typescript/typescript6 (#97997)

Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

Huge thanks to @eps1lon, @mischnic, and @timneutkens for helping!

v16.3.3

This release contains security fixes for the following advisories:

Critical:

Unauthenticated Remote Code Execution on windows-hosted servers

Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

[backport] Scope app-entry export validation to files inside the app directory (#97357)

[backport] Fix catch-all index page being served for every other slug (#97416)

[16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)

[16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)

[16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)

[16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @lubieowoce, @unstubbable, @timneutkens, @mischnic, and @eps1lon for helping!

Commits

299180d v16.3.4
12e173d [16.3.x] Re-enable AVIF image optimization and require sharp 0.35.4 (#97949)
5d9022e [backport] Fix unset crossOrigin in Turbopack manifests (#97930)
d8f4560 [16.3.x] Fix build error when aliasing typescript to @typescript/typescript6 ...
656aebf [16.3] testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
f37c1d6 [16.3.x] ci: remove pull_request_stats workflow (#97975)
a9a1cb7 v16.3.3
968b9fc [16.3.x] Fix ISR misses with backslashes in segments when deployed on Windows
3a15b4a [16.3.x] [next/image]: disable avif image optimization
7378b51 Backport/docs fixes 16.3 (#97649)
Additional commits viewable in compare view

Updates @prisma/adapter-pg from 7.9.1 to 7.10.0

Release notes

Sourced from @prisma/adapter-pg's releases.

7.10.0

Prisma ORM 7.10.0

Prisma ORM 7.10.0 introduces a compatibility package for running Prisma 7 alongside newer Prisma versions, secures Prisma Studio's local server, and includes fixes across Prisma Client and the PostgreSQL, MariaDB, Neon, SQLite, and Prisma Postgres Serverless adapters.

Highlights

Run Prisma 7 alongside Prisma 8

This release introduces @prisma/prisma7, a compatibility package that lets you retain a matching Prisma 7 CLI and configuration while installing Prisma 8 in the same project.

Once 7.10.0 is released, a side-by-side installation can use:
npm install --save-dev prisma@8 @prisma/prisma7@7.10.0
npm install @prisma/client@7.10.0
Use prisma for the directly installed Prisma 8 CLI and prisma7 for Prisma 7:
npx prisma --version
npx prisma7 --version
npx prisma7 generate

npx prisma7 migrate dev

npx prisma7 db push
Prisma 7 now prefers version-specific configuration files, allowing its configuration to coexist with Prisma 8's prisma.config.* files:
// prisma7.config.ts
import { defineConfig } from '@prisma/prisma7/config'
export default defineConfig({

schema: 'prisma/schema.prisma',

migrations: {

path: 'prisma/migrations',

},

})
Without an explicit --config option, Prisma 7 searches for:

Root-level prisma7.config.* files.

.config/prisma7.* files.

Existing prisma.config.* files as a backwards-compatible fallback.

The supported extensions are .js, .ts, .mjs, .cjs, .mts, and .cts. An explicit config path always takes precedence:

... (truncated)

Commits

3fa65ac fix(p2002): correct modelName in nested create unique constraint errors #2959...
a180209 fix(adapter-pg): map PostgreSQL deadlocks to P2034 (#29717)
800f1d1 fix(adapter-pg): preserve constraint name for unique violations (23505) (#29587)
7ef2104 fix(postgres): handle SQLSTATE 23001 for RESTRICT violations (#29554)
See full diff in compare view

Updates @prisma/client from 7.9.1 to 7.10.0

Release notes

Sourced from @prisma/client's releases.

7.10.0

Prisma ORM 7.10.0

Prisma ORM 7.10.0 introduces a compatibility package for running Prisma 7 alongside newer Prisma versions, secures Prisma Studio's local server, and includes fixes across Prisma Client and the PostgreSQL, MariaDB, Neon, SQLite, and Prisma Postgres Serverless adapters.

Highlights

Run Prisma 7 alongside Prisma 8

This release introduces @prisma/prisma7, a compatibility package that lets you retain a matching Prisma 7 CLI and configuration while installing Prisma 8 in the same project.

Once 7.10.0 is released, a side-by-side installation can use:
npm install --save-dev prisma@8 @prisma/prisma7@7.10.0
npm install @prisma/client@7.10.0
Use prisma for the directly installed Prisma 8 CLI and prisma7 for Prisma 7:
npx prisma --version
npx prisma7 --version
npx prisma7 generate

npx prisma7 migrate dev

npx prisma7 db push
Prisma 7 now prefers version-specific configuration files, allowing its configuration to coexist with Prisma 8's prisma.config.* files:
// prisma7.config.ts
import { defineConfig } from '@prisma/prisma7/config'
export default defineConfig({

schema: 'prisma/schema.prisma',

migrations: {

path: 'prisma/migrations',

},

})
Without an explicit --config option, Prisma 7 searches for:

Root-level prisma7.config.* files.

.config/prisma7.* files.

Existing prisma.config.* files as a backwards-compatible fallback.

The supported extensions are .js, .ts, .mjs, .cjs, .mts, and .cts. An explicit config path always takes precedence:

... (truncated)

Commits

05c1b88 Teach Prisma 7 to prefer versioned config files (#30020)
cf2bc1f Rename prisma7 package to @prisma/prisma7 (#30002)
ce5a34c Complete downstream actionable Prisma 7 guidance propagation (#29994)
3f13ec6 Complete CLI-owned prisma7 distribution identity (#29969)
179ba0c feat(prisma7): add side-by-side CLI wrapper (#29949)
3fa65ac fix(p2002): correct modelName in nested create unique constraint errors #2959...
6b6d9e9 chore(deps): update engines to 7.10.0-4.0edf323efd1d98336f3f0a68684b56f689b90...
b64e33c chore(deps): update engines to 7.10.0-3.9d90ce2c89d5c95a1148aef15e5561ab6c490...
2046f9b feat(client): expose ModelName to compute function in Result extensions (#29782)
f2b3abd chore(deps): update engines to 7.10.0-1.6d040c802892de6d56c7e0061b7a10b3e6a0c...
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the production-dependencies group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.5.4` | | [@next/env](https://github.com/vercel/next.js/tree/HEAD/packages/next-env) | `16.3.1` | `16.3.4` | | [jose](https://github.com/panva/jose) | `6.2.8` | `6.2.10` | | [next](https://github.com/vercel/next.js) | `16.3.1` | `16.3.4` | | [@prisma/adapter-pg](https://github.com/prisma/prisma/tree/HEAD/packages/adapter-pg) | `7.9.1` | `7.10.0` | | [@prisma/client](https://github.com/prisma/prisma/tree/HEAD/packages/client) | `7.9.1` | `7.10.0` | Updates `zod` from 4.4.3 to 4.5.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/colinhacks/zod/releases">zod's releases</a>.</em></p> <blockquote> <h2>v4.5.4</h2> <h2>Commits:</h2> <ul> <li>84e416fbf4740527bbc8f319634f4e1b065bb42c fix(v4): stop the cycle walk from firing a default factory (<a href="https://redirect.github.com/colinhacks/zod/issues/6500">#6500</a>)</li> <li>e8e206fa33ac5fe7ce20a2beb12d57b1cb3df653 4.5.4</li> </ul> <h2>v4.5.3</h2> <h2>Commits:</h2> <ul> <li>e6b6ab347675cd2bd54b1bdbed16f98c59be82a9 docs(blog): widen the z.compile example to a 20-property schema</li> <li>87d6464418582bb96fc665a01f852ca6da324ad0 fix(docs): drop the OG description when the title wraps past two lines</li> <li>99fce394a026823e602b9c30d8d5d9f5f1932ce7 bench(v4): z.compile() against zod-compiler (<a href="https://redirect.github.com/colinhacks/zod/issues/6499">#6499</a>)</li> <li>e3a695b6bf3f0d591ea682816e3cdaea04b0f967 docs(v4): record the email regex and container output-shape findings under Open</li> <li>7e24a24288183ce02554f1ded7775d0650a7b7e6 docs(blog): drop the reading time and put a GitHub link in the navbar</li> <li>eab51ff3592b2d11d863f4ee4d5452f31a3de1b6 fix(v4): emit record numeric keys as strings in toJSONSchema (<a href="https://redirect.github.com/colinhacks/zod/issues/6497">#6497</a>)</li> </ul> <h2>v4.5.2</h2> <h2>Commits:</h2> <ul> <li>a354314ac04fdd5484aa62dd5c3a4b553211a0e4 fix(docs): keep blog posts out of the docs collection (<a href="https://redirect.github.com/colinhacks/zod/issues/6484">#6484</a>)</li> <li>d378c42aff6869f0929058a7923cd775880f5c4c ci: drop canary publishing from the release workflow (<a href="https://redirect.github.com/colinhacks/zod/issues/6487">#6487</a>)</li> <li>212b941791e7faae078e17645eb612824fd8f79a fix(v4): let a prototype method getter answer a bare call so vi.spyOn works (<a href="https://redirect.github.com/colinhacks/zod/issues/6488">#6488</a>)</li> <li>e7576f542a7bc7ef3cc5eeec237714fd0e6b6e98 docs(blog): let the page show through the navbar in dark mode (<a href="https://redirect.github.com/colinhacks/zod/issues/6489">#6489</a>)</li> <li>fedb06fafe33a66ce0b5c236ad2557e0a5a170fe fix(docs): match the blog TOC hover bar to the 2px active indicator</li> <li>6c932fcb2eea6eb671710ea058ca9fdc382ada89 chore: bump devcontainer image to Node 24 (<a href="https://redirect.github.com/colinhacks/zod/issues/6470">#6470</a>)</li> <li>6635d9dd367a664109de83c021995821f48efa29 docs(blog): soften the "method memoization" attribution</li> <li>019ae299cc75daa132bf1acf59086a520abf6b85 fix(docs): drop ISR on the docs route so the home page hydrates</li> <li>652bb438aa4c626c1cd7948c6849c4691239fca7 chore(docs): drop the scroll log from the route-change scroller</li> <li>571c8e8a3d73b4305f4abfdd6977773cc12f2bf5 fix(docs): render blog tabs with the stock fumadocs tab card</li> <li>9a193aa24b4efa3b315b91d4c56c8bc385b8513f 4.5.2</li> </ul> <h2>v4.5.1</h2> <h2>Commits:</h2> <ul> <li>2e862dbf89da2835e5206a8fd3d3be61afe3cf7f ci: gate the GitHub release and JSR publish on the version being live on npm</li> <li>8e03380510db36fa6fda979fc78a375fdea8021c 4.5.1</li> </ul> <h2>v4.5.0</h2> <p>Zod 4.5 is now available.</p> <pre lang="sh"><code>npm install zod@latest </code></pre> <p>At a glance:</p> <ul> <li><a href="https://github.com/colinhacks/zod/blob/HEAD%5Bhttps://github.com/colinhacks/zod/blob/HEAD%60https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADmhttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD%60https://github.com/colinhacks/zod/blob/HEAD%5Dhttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADmhttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD">https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADmhttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADmhttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD</a> — the flagship feature of Zod 4.5</li> <li><a href="https://github.com/colinhacks/zod/blob/HEAD%5Bhttps://github.com/colinhacks/zod/blob/HEAD%60https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADChttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD%60https://github.com/colinhacks/zod/blob/HEAD%5Dhttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD">https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADChttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD</a> — 12–19 digits plus Luhn checksum</li> <li><a href="https://github.com/colinhacks/zod/blob/HEAD%5Bhttps://github.com/colinhacks/zod/blob/HEAD%60https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADshttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD%60https://github.com/colinhacks/zod/blob/HEAD%5Dhttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADshttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD">https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADshttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADshttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD</a> — the multi-property counterpart to <code>z.property()</code></li> <li><a href="https://github.com/colinhacks/zod/blob/HEAD%5Bhttps://github.com/colinhacks/zod/blob/HEAD%60https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADPhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD%60https://github.com/colinhacks/zod/blob/HEAD%5Dhttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD/https://github.com/colinhacks/zod/blob/HEAD%5Bhttps://github.com/colinhacks/zod/blob/HEAD%60https://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADxhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADPhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD%60https://github.com/colinhacks/zod/blob/HEAD%5Dhttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADxhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD">https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADPhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD/https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADxhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADPhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADxhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD</a></li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/colinhacks/zod/commit/e8e206fa33ac5fe7ce20a2beb12d57b1cb3df653"><code>e8e206f</code></a> 4.5.4</li> <li><a href="https://github.com/colinhacks/zod/commit/84e416fbf4740527bbc8f319634f4e1b065bb42c"><code>84e416f</code></a> fix(v4): stop the cycle walk from firing a default factory (<a href="https://redirect.github.com/colinhacks/zod/issues/6500">#6500</a>)</li> <li><a href="https://github.com/colinhacks/zod/commit/1a16102a494b03ce1df7b80b663ae2df465f419e"><code>1a16102</code></a> 4.5.3</li> <li><a href="https://github.com/colinhacks/zod/commit/eab51ff3592b2d11d863f4ee4d5452f31a3de1b6"><code>eab51ff</code></a> fix(v4): emit record numeric keys as strings in toJSONSchema (<a href="https://redirect.github.com/colinhacks/zod/issues/6497">#6497</a>)</li> <li><a href="https://github.com/colinhacks/zod/commit/7e24a24288183ce02554f1ded7775d0650a7b7e6"><code>7e24a24</code></a> docs(blog): drop the reading time and put a GitHub link in the navbar</li> <li><a href="https://github.com/colinhacks/zod/commit/e3a695b6bf3f0d591ea682816e3cdaea04b0f967"><code>e3a695b</code></a> docs(v4): record the email regex and container output-shape findings under Open</li> <li><a href="https://github.com/colinhacks/zod/commit/99fce394a026823e602b9c30d8d5d9f5f1932ce7"><code>99fce39</code></a> bench(v4): z.compile() against zod-compiler (<a href="https://redirect.github.com/colinhacks/zod/issues/6499">#6499</a>)</li> <li><a href="https://github.com/colinhacks/zod/commit/87d6464418582bb96fc665a01f852ca6da324ad0"><code>87d6464</code></a> fix(docs): drop the OG description when the title wraps past two lines</li> <li><a href="https://github.com/colinhacks/zod/commit/e6b6ab347675cd2bd54b1bdbed16f98c59be82a9"><code>e6b6ab3</code></a> docs(blog): widen the z.compile example to a 20-property schema</li> <li><a href="https://github.com/colinhacks/zod/commit/9a193aa24b4efa3b315b91d4c56c8bc385b8513f"><code>9a193aa</code></a> 4.5.2</li> <li>Additional commits viewable in <a href="https://github.com/colinhacks/zod/compare/v4.4.3...v4.5.4">compare view</a></li> </ul> </details> <br /> Updates `@next/env` from 16.3.1 to 16.3.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">@next/env's releases</a>.</em></p> <blockquote> <h2>v16.3.4</h2> <p>Follow-up release to <a href="https://github.com/vercel/next.js/releases/tag/v16.3.3">v16.3.3</a> re-enabling AVIF Image Optimization (<a href="https://redirect.github.com/vercel/next.js/pull/97949">#97949</a>).</p> <p>The following bug fixes have been backported. It does <strong>not</strong> include all pending features/changes on canary.</p> <ul> <li>testmode: Fix infinite recursion in testmode passthrough fetch (<a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/97691">#97691</a>)</li> <li>Fix build error when aliasing typescript to <code>@typescript/typescript6</code> (<a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/97997">#97997</a>)</li> <li>Fix unset crossOrigin in Turbopack manifests (<a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/97930">#97930</a>)</li> </ul> <h3>Credits</h3> <p>Huge thanks to <a href="https://github.com/eps1lon"><code>@eps1lon</code></a>, <a href="https://github.com/mischnic"><code>@mischnic</code></a>, and <a href="https://github.com/timneutkens"><code>@timneutkens</code></a> for helping!</p> <h2>v16.3.3</h2> <p>This release contains security fixes for the following advisories:</p> <p>Critical:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36">Unauthenticated Remote Code Execution on windows-hosted servers</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4">Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used</a></li> </ul> <h2>v16.3.2</h2> <blockquote> <p>[!NOTE] This release is backporting bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p> </blockquote> <h3>Core Changes</h3> <ul> <li>[backport] Scope app-entry export validation to files inside the app directory (<a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/97357">#97357</a>)</li> <li>[backport] Fix catch-all index page being served for every other slug (<a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/97416">#97416</a>)</li> <li>[16.3] Turbopack: don't trace embedded WASM loader helpers (<a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/97353">#97353</a>) (<a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/97463">#97463</a>)</li> <li>[16.3] Turbopack: retain conditions when replacing resolve request keys (<a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/97453">#97453</a>)</li> <li>[16.3.x] Fix Turbopack worker chunk loading with asset prefix (<a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/97419">#97419</a>)</li> <li>[16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (<a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/97603">#97603</a>)</li> </ul> <h3>Credits</h3> <p>Huge thanks to <a href="https://github.com/lubieowoce"><code>@lubieowoce</code></a>, <a href="https://github.com/unstubbable"><code>@unstubbable</code></a>, <a href="https://github.com/timneutkens"><code>@timneutkens</code></a>, <a href="https://github.com/mischnic"><code>@mischnic</code></a>, and <a href="https://github.com/eps1lon"><code>@eps1lon</code></a> for helping!</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/next.js/commit/299180d3315c7ebd7b199d2b1a265b5986c5fc7d"><code>299180d</code></a> v16.3.4</li> <li><a href="https://github.com/vercel/next.js/commit/a9a1cb7859f178f830ad3773b303130c21b19586"><code>a9a1cb7</code></a> v16.3.3</li> <li><a href="https://github.com/vercel/next.js/commit/d0ac8828c2fe6026dd7d700488bfd8289711fde6"><code>d0ac882</code></a> v16.3.2</li> <li>See full diff in <a href="https://github.com/vercel/next.js/commits/v16.3.4/packages/next-env">compare view</a></li> </ul> </details> <br /> Updates `jose` from 6.2.8 to 6.2.10 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/panva/jose/releases">jose's releases</a>.</em></p> <blockquote> <h2>v6.2.10</h2> <h3>Fixes</h3> <ul> <li><strong>jose:</strong> consume serialization members once (<a href="https://github.com/panva/jose/commit/9bee285a6bc356b495c29ae0a5e70b24e723568e">9bee285</a>)</li> <li><strong>jose:</strong> reject empty protected and JWE AAD members (<a href="https://github.com/panva/jose/commit/8da41453dce79967c6e3f47a787039a7f94de8fe">8da4145</a>)</li> <li><strong>jose:</strong> validate serialized header values (<a href="https://github.com/panva/jose/commit/b711d8fe223e3e85520d6c822d7a417cd872b718">b711d8f</a>)</li> <li><strong>jwe:</strong> conceal invalid decrypted CEK lengths (<a href="https://github.com/panva/jose/commit/41fafe035a62d85f4b313e166100004dd09b111f">41fafe0</a>)</li> <li><strong>jwe:</strong> enforce AES-GCM tag boundaries (<a href="https://github.com/panva/jose/commit/9a5b74454bf145a106312d519efe95b8a9b53a87">9a5b744</a>)</li> <li><strong>jwe:</strong> validate explicit encryption parameters (<a href="https://github.com/panva/jose/commit/7a02697126e40757ed9e02ae786ec9a2b180aa5c">7a02697</a>)</li> <li><strong>jwk:</strong> accept empty octet-sequence keys (<a href="https://github.com/panva/jose/commit/3f871e7859c1ce51d1afcbfeff92c354b8e96dd9">3f871e7</a>)</li> <li><strong>jwk:</strong> normalize key resolution inputs (<a href="https://github.com/panva/jose/commit/f54ee7bad8e21c975606bc5e47b352921ac0d890">f54ee7b</a>)</li> <li><strong>jwks:</strong> enforce verification key metadata (<a href="https://github.com/panva/jose/commit/f9ba5101383154147780da7acf1aabc705f75aaf">f9ba510</a>)</li> <li><strong>jwks:</strong> order overlapping remote reloads (<a href="https://github.com/panva/jose/commit/9a1a913983aa44d065a423692a92148b2a6a36c3">9a1a913</a>)</li> <li><strong>jwks:</strong> reject invalid remote duration values (<a href="https://github.com/panva/jose/commit/7bdb9e56e6a74b833af582532c6fff5bc727ec1c">7bdb9e5</a>)</li> <li><strong>jwk:</strong> validate ext and key_ops parameters (<a href="https://github.com/panva/jose/commit/4d91c37fdd36241785cb172774fa017bb8854458">4d91c37</a>)</li> <li><strong>jws:</strong> reject mixed payload encoding modes (<a href="https://github.com/panva/jose/commit/dc69713081a55a3d6955dd1d8c2cf184905febad">dc69713</a>)</li> <li><strong>jws:</strong> validate unencoded payload strings (<a href="https://github.com/panva/jose/commit/541f28234442c5cbfc5f843a95ccd18a721f3697">541f282</a>)</li> <li><strong>jwt:</strong> enforce explicit verification policies (<a href="https://github.com/panva/jose/commit/b3471826b02589656eaf71843671922644cc60e2">b347182</a>)</li> <li><strong>jwt:</strong> prevent replacing protected headers (<a href="https://github.com/panva/jose/commit/ae07d09bcbac91825e27cde9989b603af3495263">ae07d09</a>)</li> <li><strong>jwt:</strong> reject invalid duration inputs (<a href="https://github.com/panva/jose/commit/282f9aaa496e57f55417bca15e13c369b3f242fb">282f9aa</a>)</li> <li><strong>jwt:</strong> validate builder claim values (<a href="https://github.com/panva/jose/commit/ea03f83d607fcaee6fc0778c8a4d40a2bbd75c9e">ea03f83</a>)</li> <li><strong>jwt:</strong> validate unsecured protected headers (<a href="https://github.com/panva/jose/commit/230c14e7a148f168912a4b9c21daff935f07722c">230c14e</a>)</li> <li><strong>key:</strong> validate generation and import options (<a href="https://github.com/panva/jose/commit/15d880e112777991cc9d38e0af255cc762c79884">15d880e</a>)</li> <li>reject mixed b64 modes for empty General JWS payloads (<a href="https://github.com/panva/jose/commit/61a2ef7bc405580073152b52e39287149b247dfe">61a2ef7</a>)</li> <li><strong>x509:</strong> reject DER truncated past its outer length (<a href="https://github.com/panva/jose/commit/d8db9f6dd751ecb852cd492f62d19d299b4fa1fe">d8db9f6</a>)</li> </ul> <h3>Documentation</h3> <ul> <li><strong>jwks:</strong> correct cache timestamp units (<a href="https://github.com/panva/jose/commit/01a44d918abd25a93259ada4f89e83bb2ff130c6">01a44d9</a>)</li> </ul> <h3>Refactor</h3> <ul> <li><strong>jose:</strong> share binary input validation (<a href="https://github.com/panva/jose/commit/eedb124fe2a719305f579a3e444f6ce74abbc681">eedb124</a>)</li> <li><strong>jose:</strong> share compact token processing internals (<a href="https://github.com/panva/jose/commit/85e30ed91ead6c10f19a500f14a49dc97875f2e2">85e30ed</a>)</li> <li><strong>jwe:</strong> consolidate CBC decryption failures (<a href="https://github.com/panva/jose/commit/1ee6f61cda63174c55c915687e34893b7c40de33">1ee6f61</a>)</li> <li><strong>jwe:</strong> specialize compact processing (<a href="https://github.com/panva/jose/commit/a998927cbd2faa8e1cdad36f97a86ebff13d0a5b">a998927</a>)</li> <li><strong>jwe:</strong> streamline single-recipient encryption (<a href="https://github.com/panva/jose/commit/290aaa60f14a8362024f1e23fb2659cebb3471be">290aaa6</a>)</li> <li><strong>jwks:</strong> compact JWK Set shape validation (<a href="https://github.com/panva/jose/commit/930c7dfc7979feb83ed2d1420dd627c42c5f44c4">930c7df</a>), references <a href="https://github.com/panva/jose/issues/every">Array#every</a></li> <li><strong>jwks:</strong> compact local key selection (<a href="https://github.com/panva/jose/commit/4cb5ae59ac4fae2cb4cfadcdba868be8203a58d4">4cb5ae5</a>)</li> <li><strong>jwks:</strong> compact remote resolver state (<a href="https://github.com/panva/jose/commit/ef5eaf405f7d07b61c1d52104af24bdc22ac1a52">ef5eaf4</a>)</li> <li><strong>jws:</strong> specialize compact processing (<a href="https://github.com/panva/jose/commit/021abf48774ef3921738cc7ea9f9705d488cae90">021abf4</a>)</li> <li><strong>jwt:</strong> compact claim validation helpers (<a href="https://github.com/panva/jose/commit/f39068383f8bd0db43c476b7447440c4a8406a5d">f390683</a>)</li> <li><strong>jwt:</strong> consolidate replicated claim checks (<a href="https://github.com/panva/jose/commit/7dd559118bc76303f888cd61a0356556580c9273">7dd5591</a>)</li> <li><strong>jwt:</strong> share producer claim state (<a href="https://github.com/panva/jose/commit/52ba1592cb7fe9e1995bd4c8230e3a5da56230c7">52ba159</a>)</li> <li><strong>key:</strong> compact JWK algorithm selection (<a href="https://github.com/panva/jose/commit/a6b29da1b8d4ed0f1f19f39d2684be44ce05aad0">a6b29da</a>)</li> <li><strong>key:</strong> compact secret length parsing (<a href="https://github.com/panva/jose/commit/cc03be885053160abc64fd90224fc8d0fa9edd0b">cc03be8</a>)</li> </ul> <h2>v6.2.9</h2> <h3>Fixes</h3>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/panva/jose/blob/main/CHANGELOG.md">jose's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/panva/jose/compare/v6.2.9...v6.2.10">6.2.10</a> (2026-08-21)</h2> <h3>Fixes</h3> <ul> <li><strong>jose:</strong> consume serialization members once (<a href="https://github.com/panva/jose/commit/9bee285a6bc356b495c29ae0a5e70b24e723568e">9bee285</a>)</li> <li><strong>jose:</strong> reject empty protected and JWE AAD members (<a href="https://github.com/panva/jose/commit/8da41453dce79967c6e3f47a787039a7f94de8fe">8da4145</a>)</li> <li><strong>jose:</strong> validate serialized header values (<a href="https://github.com/panva/jose/commit/b711d8fe223e3e85520d6c822d7a417cd872b718">b711d8f</a>)</li> <li><strong>jwe:</strong> conceal invalid decrypted CEK lengths (<a href="https://github.com/panva/jose/commit/41fafe035a62d85f4b313e166100004dd09b111f">41fafe0</a>)</li> <li><strong>jwe:</strong> enforce AES-GCM tag boundaries (<a href="https://github.com/panva/jose/commit/9a5b74454bf145a106312d519efe95b8a9b53a87">9a5b744</a>)</li> <li><strong>jwe:</strong> validate explicit encryption parameters (<a href="https://github.com/panva/jose/commit/7a02697126e40757ed9e02ae786ec9a2b180aa5c">7a02697</a>)</li> <li><strong>jwk:</strong> accept empty octet-sequence keys (<a href="https://github.com/panva/jose/commit/3f871e7859c1ce51d1afcbfeff92c354b8e96dd9">3f871e7</a>)</li> <li><strong>jwk:</strong> normalize key resolution inputs (<a href="https://github.com/panva/jose/commit/f54ee7bad8e21c975606bc5e47b352921ac0d890">f54ee7b</a>)</li> <li><strong>jwks:</strong> enforce verification key metadata (<a href="https://github.com/panva/jose/commit/f9ba5101383154147780da7acf1aabc705f75aaf">f9ba510</a>)</li> <li><strong>jwks:</strong> order overlapping remote reloads (<a href="https://github.com/panva/jose/commit/9a1a913983aa44d065a423692a92148b2a6a36c3">9a1a913</a>)</li> <li><strong>jwks:</strong> reject invalid remote duration values (<a href="https://github.com/panva/jose/commit/7bdb9e56e6a74b833af582532c6fff5bc727ec1c">7bdb9e5</a>)</li> <li><strong>jwk:</strong> validate ext and key_ops parameters (<a href="https://github.com/panva/jose/commit/4d91c37fdd36241785cb172774fa017bb8854458">4d91c37</a>)</li> <li><strong>jws:</strong> reject mixed payload encoding modes (<a href="https://github.com/panva/jose/commit/dc69713081a55a3d6955dd1d8c2cf184905febad">dc69713</a>)</li> <li><strong>jws:</strong> validate unencoded payload strings (<a href="https://github.com/panva/jose/commit/541f28234442c5cbfc5f843a95ccd18a721f3697">541f282</a>)</li> <li><strong>jwt:</strong> enforce explicit verification policies (<a href="https://github.com/panva/jose/commit/b3471826b02589656eaf71843671922644cc60e2">b347182</a>)</li> <li><strong>jwt:</strong> prevent replacing protected headers (<a href="https://github.com/panva/jose/commit/ae07d09bcbac91825e27cde9989b603af3495263">ae07d09</a>)</li> <li><strong>jwt:</strong> reject invalid duration inputs (<a href="https://github.com/panva/jose/commit/282f9aaa496e57f55417bca15e13c369b3f242fb">282f9aa</a>)</li> <li><strong>jwt:</strong> validate builder claim values (<a href="https://github.com/panva/jose/commit/ea03f83d607fcaee6fc0778c8a4d40a2bbd75c9e">ea03f83</a>)</li> <li><strong>jwt:</strong> validate unsecured protected headers (<a href="https://github.com/panva/jose/commit/230c14e7a148f168912a4b9c21daff935f07722c">230c14e</a>)</li> <li><strong>key:</strong> validate generation and import options (<a href="https://github.com/panva/jose/commit/15d880e112777991cc9d38e0af255cc762c79884">15d880e</a>)</li> <li>reject mixed b64 modes for empty General JWS payloads (<a href="https://github.com/panva/jose/commit/61a2ef7bc405580073152b52e39287149b247dfe">61a2ef7</a>)</li> <li><strong>x509:</strong> reject DER truncated past its outer length (<a href="https://github.com/panva/jose/commit/d8db9f6dd751ecb852cd492f62d19d299b4fa1fe">d8db9f6</a>)</li> </ul> <h3>Documentation</h3> <ul> <li><strong>jwks:</strong> correct cache timestamp units (<a href="https://github.com/panva/jose/commit/01a44d918abd25a93259ada4f89e83bb2ff130c6">01a44d9</a>)</li> </ul> <h3>Refactor</h3> <ul> <li><strong>jose:</strong> share binary input validation (<a href="https://github.com/panva/jose/commit/eedb124fe2a719305f579a3e444f6ce74abbc681">eedb124</a>)</li> <li><strong>jose:</strong> share compact token processing internals (<a href="https://github.com/panva/jose/commit/85e30ed91ead6c10f19a500f14a49dc97875f2e2">85e30ed</a>)</li> <li><strong>jwe:</strong> consolidate CBC decryption failures (<a href="https://github.com/panva/jose/commit/1ee6f61cda63174c55c915687e34893b7c40de33">1ee6f61</a>)</li> <li><strong>jwe:</strong> specialize compact processing (<a href="https://github.com/panva/jose/commit/a998927cbd2faa8e1cdad36f97a86ebff13d0a5b">a998927</a>)</li> <li><strong>jwe:</strong> streamline single-recipient encryption (<a href="https://github.com/panva/jose/commit/290aaa60f14a8362024f1e23fb2659cebb3471be">290aaa6</a>)</li> <li><strong>jwks:</strong> compact JWK Set shape validation (<a href="https://github.com/panva/jose/commit/930c7dfc7979feb83ed2d1420dd627c42c5f44c4">930c7df</a>), references <a href="https://github.com/panva/jose/issues/every">Array#every</a></li> <li><strong>jwks:</strong> compact local key selection (<a href="https://github.com/panva/jose/commit/4cb5ae59ac4fae2cb4cfadcdba868be8203a58d4">4cb5ae5</a>)</li> <li><strong>jwks:</strong> compact remote resolver state (<a href="https://github.com/panva/jose/commit/ef5eaf405f7d07b61c1d52104af24bdc22ac1a52">ef5eaf4</a>)</li> <li><strong>jws:</strong> specialize compact processing (<a href="https://github.com/panva/jose/commit/021abf48774ef3921738cc7ea9f9705d488cae90">021abf4</a>)</li> <li><strong>jwt:</strong> compact claim validation helpers (<a href="https://github.com/panva/jose/commit/f39068383f8bd0db43c476b7447440c4a8406a5d">f390683</a>)</li> <li><strong>jwt:</strong> consolidate replicated claim checks (<a href="https://github.com/panva/jose/commit/7dd559118bc76303f888cd61a0356556580c9273">7dd5591</a>)</li> <li><strong>jwt:</strong> share producer claim state (<a href="https://github.com/panva/jose/commit/52ba1592cb7fe9e1995bd4c8230e3a5da56230c7">52ba159</a>)</li> <li><strong>key:</strong> compact JWK algorithm selection (<a href="https://github.com/panva/jose/commit/a6b29da1b8d4ed0f1f19f39d2684be44ce05aad0">a6b29da</a>)</li> <li><strong>key:</strong> compact secret length parsing (<a href="https://github.com/panva/jose/commit/cc03be885053160abc64fd90224fc8d0fa9edd0b">cc03be8</a>)</li> </ul> <h2><a href="https://github.com/panva/jose/compare/v6.2.8...v6.2.9">6.2.9</a> (2026-08-15)</h2>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/panva/jose/commit/3eab1524782fab3f6421b98380f44c99da210a6b"><code>3eab152</code></a> chore(release): 6.2.10</li> <li><a href="https://github.com/panva/jose/commit/021abf48774ef3921738cc7ea9f9705d488cae90"><code>021abf4</code></a> refactor(jws): specialize compact processing</li> <li><a href="https://github.com/panva/jose/commit/a998927cbd2faa8e1cdad36f97a86ebff13d0a5b"><code>a998927</code></a> refactor(jwe): specialize compact processing</li> <li><a href="https://github.com/panva/jose/commit/eedb124fe2a719305f579a3e444f6ce74abbc681"><code>eedb124</code></a> refactor(jose): share binary input validation</li> <li><a href="https://github.com/panva/jose/commit/52ba1592cb7fe9e1995bd4c8230e3a5da56230c7"><code>52ba159</code></a> refactor(jwt): share producer claim state</li> <li><a href="https://github.com/panva/jose/commit/85e30ed91ead6c10f19a500f14a49dc97875f2e2"><code>85e30ed</code></a> refactor(jose): share compact token processing internals</li> <li><a href="https://github.com/panva/jose/commit/0bd81d29781e43b6374ec7ebe93d1e2acdb290c3"><code>0bd81d2</code></a> test(jose): cover hidden critical-header options</li> <li><a href="https://github.com/panva/jose/commit/9cf7876e15930781b47307f458e1b4154103ad68"><code>9cf7876</code></a> test(jose): reject callable object impostors</li> <li><a href="https://github.com/panva/jose/commit/f23cafd2d8501167b5949a07b9dbd7a72acf4faa"><code>f23cafd</code></a> test(jose): preserve resolved key data properties</li> <li><a href="https://github.com/panva/jose/commit/1ee6f61cda63174c55c915687e34893b7c40de33"><code>1ee6f61</code></a> refactor(jwe): consolidate CBC decryption failures</li> <li>Additional commits viewable in <a href="https://github.com/panva/jose/compare/v6.2.8...v6.2.10">compare view</a></li> </ul> </details> <br /> Updates `next` from 16.3.1 to 16.3.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">next's releases</a>.</em></p> <blockquote> <h2>v16.3.4</h2> <p>Follow-up release to <a href="https://github.com/vercel/next.js/releases/tag/v16.3.3">v16.3.3</a> re-enabling AVIF Image Optimization (<a href="https://redirect.github.com/vercel/next.js/pull/97949">#97949</a>).</p> <p>The following bug fixes have been backported. It does <strong>not</strong> include all pending features/changes on canary.</p> <ul> <li>testmode: Fix infinite recursion in testmode passthrough fetch (<a href="https://redirect.github.com/vercel/next.js/issues/97691">#97691</a>)</li> <li>Fix build error when aliasing typescript to <code>@typescript/typescript6</code> (<a href="https://redirect.github.com/vercel/next.js/issues/97997">#97997</a>)</li> <li>Fix unset crossOrigin in Turbopack manifests (<a href="https://redirect.github.com/vercel/next.js/issues/97930">#97930</a>)</li> </ul> <h3>Credits</h3> <p>Huge thanks to <a href="https://github.com/eps1lon"><code>@eps1lon</code></a>, <a href="https://github.com/mischnic"><code>@mischnic</code></a>, and <a href="https://github.com/timneutkens"><code>@timneutkens</code></a> for helping!</p> <h2>v16.3.3</h2> <p>This release contains security fixes for the following advisories:</p> <p>Critical:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36">Unauthenticated Remote Code Execution on windows-hosted servers</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4">Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used</a></li> </ul> <h2>v16.3.2</h2> <blockquote> <p>[!NOTE] This release is backporting bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p> </blockquote> <h3>Core Changes</h3> <ul> <li>[backport] Scope app-entry export validation to files inside the app directory (<a href="https://redirect.github.com/vercel/next.js/issues/97357">#97357</a>)</li> <li>[backport] Fix catch-all index page being served for every other slug (<a href="https://redirect.github.com/vercel/next.js/issues/97416">#97416</a>)</li> <li>[16.3] Turbopack: don't trace embedded WASM loader helpers (<a href="https://redirect.github.com/vercel/next.js/issues/97353">#97353</a>) (<a href="https://redirect.github.com/vercel/next.js/issues/97463">#97463</a>)</li> <li>[16.3] Turbopack: retain conditions when replacing resolve request keys (<a href="https://redirect.github.com/vercel/next.js/issues/97453">#97453</a>)</li> <li>[16.3.x] Fix Turbopack worker chunk loading with asset prefix (<a href="https://redirect.github.com/vercel/next.js/issues/97419">#97419</a>)</li> <li>[16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (<a href="https://redirect.github.com/vercel/next.js/issues/97603">#97603</a>)</li> </ul> <h3>Credits</h3> <p>Huge thanks to <a href="https://github.com/lubieowoce"><code>@lubieowoce</code></a>, <a href="https://github.com/unstubbable"><code>@unstubbable</code></a>, <a href="https://github.com/timneutkens"><code>@timneutkens</code></a>, <a href="https://github.com/mischnic"><code>@mischnic</code></a>, and <a href="https://github.com/eps1lon"><code>@eps1lon</code></a> for helping!</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/next.js/commit/299180d3315c7ebd7b199d2b1a265b5986c5fc7d"><code>299180d</code></a> v16.3.4</li> <li><a href="https://github.com/vercel/next.js/commit/12e173dd73ed6c39622281c7282c8364234ad94f"><code>12e173d</code></a> [16.3.x] Re-enable AVIF image optimization and require sharp 0.35.4 (<a href="https://redirect.github.com/vercel/next.js/issues/97949">#97949</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/5d9022edd29e32d7061bc56cf713ffe8769cd900"><code>5d9022e</code></a> [backport] Fix unset crossOrigin in Turbopack manifests (<a href="https://redirect.github.com/vercel/next.js/issues/97930">#97930</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/d8f45609fa74e56f24958d45d93d3426511f957f"><code>d8f4560</code></a> [16.3.x] Fix build error when aliasing typescript to <code>@typescript/typescript6</code> ...</li> <li><a href="https://github.com/vercel/next.js/commit/656aebfb58ce194fb603f18942dad6e94d15b21c"><code>656aebf</code></a> [16.3] testmode: Fix infinite recursion in testmode passthrough fetch (<a href="https://redirect.github.com/vercel/next.js/issues/97691">#97691</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/f37c1d656553b8950330b6683ab242a5c610135c"><code>f37c1d6</code></a> [16.3.x] ci: remove pull_request_stats workflow (<a href="https://redirect.github.com/vercel/next.js/issues/97975">#97975</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/a9a1cb7859f178f830ad3773b303130c21b19586"><code>a9a1cb7</code></a> v16.3.3</li> <li><a href="https://github.com/vercel/next.js/commit/968b9fcb26bdeb8e0a861a9df05361474666d51b"><code>968b9fc</code></a> [16.3.x] Fix ISR misses with backslashes in segments when deployed on Windows</li> <li><a href="https://github.com/vercel/next.js/commit/3a15b4ac6ac8e70b1a9b18ecc18e8434462899b3"><code>3a15b4a</code></a> [16.3.x] [next/image]: disable avif image optimization</li> <li><a href="https://github.com/vercel/next.js/commit/7378b51ea05a6745d3676bee00cb4c63aac3dd16"><code>7378b51</code></a> Backport/docs fixes 16.3 (<a href="https://redirect.github.com/vercel/next.js/issues/97649">#97649</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vercel/next.js/compare/v16.3.1...v16.3.4">compare view</a></li> </ul> </details> <br /> Updates `@prisma/adapter-pg` from 7.9.1 to 7.10.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/prisma/prisma/releases">@prisma/adapter-pg's releases</a>.</em></p> <blockquote> <h2>7.10.0</h2> <h1>Prisma ORM 7.10.0</h1> <p>Prisma ORM 7.10.0 introduces a compatibility package for running Prisma 7 alongside newer Prisma versions, secures Prisma Studio's local server, and includes fixes across Prisma Client and the PostgreSQL, MariaDB, Neon, SQLite, and Prisma Postgres Serverless adapters.</p> <h2>Highlights</h2> <h3>Run Prisma 7 alongside Prisma 8</h3> <p>This release introduces <code>@prisma/prisma7</code>, a compatibility package that lets you retain a matching Prisma 7 CLI and configuration while installing Prisma 8 in the same project.</p> <p>Once 7.10.0 is released, a side-by-side installation can use:</p> <pre lang="sh"><code>npm install --save-dev prisma@8 @prisma/prisma7@7.10.0 npm install @prisma/client@7.10.0 </code></pre> <p>Use <code>prisma</code> for the directly installed Prisma 8 CLI and <code>prisma7</code> for Prisma 7:</p> <pre lang="sh"><code>npx prisma --version npx prisma7 --version <p>npx prisma7 generate<br /> npx prisma7 migrate dev<br /> npx prisma7 db push<br /> </code></pre></p> <p>Prisma 7 now prefers version-specific configuration files, allowing its configuration to coexist with Prisma 8's <code>prisma.config.*</code> files:</p> <pre lang="ts"><code>// prisma7.config.ts import { defineConfig } from '@prisma/prisma7/config' <p>export default defineConfig({<br /> schema: 'prisma/schema.prisma',<br /> migrations: {<br /> path: 'prisma/migrations',<br /> },<br /> })<br /> </code></pre></p> <p>Without an explicit <code>--config</code> option, Prisma 7 searches for:</p> <ol> <li>Root-level <code>prisma7.config.*</code> files.</li> <li><code>.config/prisma7.*</code> files.</li> <li>Existing <code>prisma.config.*</code> files as a backwards-compatible fallback.</li> </ol> <p>The supported extensions are <code>.js</code>, <code>.ts</code>, <code>.mjs</code>, <code>.cjs</code>, <code>.mts</code>, and <code>.cts</code>. An explicit config path always takes precedence:</p>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/prisma/orm/commit/3fa65ac134696ca8eb3d1f869b1ab894ce5c93eb"><code>3fa65ac</code></a> fix(p2002): correct modelName in nested create unique constraint errors <a href="https://github.com/prisma/prisma/tree/HEAD/packages/adapter-pg/issues/2959">#2959</a>...</li> <li><a href="https://github.com/prisma/orm/commit/a180209baf96724f6ea6ca16a39652a668abff7a"><code>a180209</code></a> fix(adapter-pg): map PostgreSQL deadlocks to P2034 (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/adapter-pg/issues/29717">#29717</a>)</li> <li><a href="https://github.com/prisma/orm/commit/800f1d1090a3bb110e2c76cc68c739cb545cc731"><code>800f1d1</code></a> fix(adapter-pg): preserve constraint name for unique violations (23505) (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/adapter-pg/issues/29587">#29587</a>)</li> <li><a href="https://github.com/prisma/orm/commit/7ef2104dd52cbe673f30c067d14ce75c73bc9e0c"><code>7ef2104</code></a> fix(postgres): handle SQLSTATE 23001 for RESTRICT violations (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/adapter-pg/issues/29554">#29554</a>)</li> <li>See full diff in <a href="https://github.com/prisma/prisma/commits/7.10.0/packages/adapter-pg">compare view</a></li> </ul> </details> <br /> Updates `@prisma/client` from 7.9.1 to 7.10.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/prisma/prisma/releases">@prisma/client's releases</a>.</em></p> <blockquote> <h2>7.10.0</h2> <h1>Prisma ORM 7.10.0</h1> <p>Prisma ORM 7.10.0 introduces a compatibility package for running Prisma 7 alongside newer Prisma versions, secures Prisma Studio's local server, and includes fixes across Prisma Client and the PostgreSQL, MariaDB, Neon, SQLite, and Prisma Postgres Serverless adapters.</p> <h2>Highlights</h2> <h3>Run Prisma 7 alongside Prisma 8</h3> <p>This release introduces <code>@prisma/prisma7</code>, a compatibility package that lets you retain a matching Prisma 7 CLI and configuration while installing Prisma 8 in the same project.</p> <p>Once 7.10.0 is released, a side-by-side installation can use:</p> <pre lang="sh"><code>npm install --save-dev prisma@8 @prisma/prisma7@7.10.0 npm install @prisma/client@7.10.0 </code></pre> <p>Use <code>prisma</code> for the directly installed Prisma 8 CLI and <code>prisma7</code> for Prisma 7:</p> <pre lang="sh"><code>npx prisma --version npx prisma7 --version <p>npx prisma7 generate<br /> npx prisma7 migrate dev<br /> npx prisma7 db push<br /> </code></pre></p> <p>Prisma 7 now prefers version-specific configuration files, allowing its configuration to coexist with Prisma 8's <code>prisma.config.*</code> files:</p> <pre lang="ts"><code>// prisma7.config.ts import { defineConfig } from '@prisma/prisma7/config' <p>export default defineConfig({<br /> schema: 'prisma/schema.prisma',<br /> migrations: {<br /> path: 'prisma/migrations',<br /> },<br /> })<br /> </code></pre></p> <p>Without an explicit <code>--config</code> option, Prisma 7 searches for:</p> <ol> <li>Root-level <code>prisma7.config.*</code> files.</li> <li><code>.config/prisma7.*</code> files.</li> <li>Existing <code>prisma.config.*</code> files as a backwards-compatible fallback.</li> </ol> <p>The supported extensions are <code>.js</code>, <code>.ts</code>, <code>.mjs</code>, <code>.cjs</code>, <code>.mts</code>, and <code>.cts</code>. An explicit config path always takes precedence:</p>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/prisma/orm/commit/05c1b8870678db5efc787b95172e4155f0712c7d"><code>05c1b88</code></a> Teach Prisma 7 to prefer versioned config files (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/client/issues/30020">#30020</a>)</li> <li><a href="https://github.com/prisma/orm/commit/cf2bc1f4b2d781330d09c7b425272734e3a2e9d2"><code>cf2bc1f</code></a> Rename prisma7 package to <code>@prisma/prisma7</code> (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/client/issues/30002">#30002</a>)</li> <li><a href="https://github.com/prisma/orm/commit/ce5a34cbe0d77228b1dbebb020b72460e883f2b9"><code>ce5a34c</code></a> Complete downstream actionable Prisma 7 guidance propagation (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/client/issues/29994">#29994</a>)</li> <li><a href="https://github.com/prisma/orm/commit/3f13ec60f8506fa882556bc257cbeff28eb6e392"><code>3f13ec6</code></a> Complete CLI-owned prisma7 distribution identity (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/client/issues/29969">#29969</a>)</li> <li><a href="https://github.com/prisma/orm/commit/179ba0c56b80b77e0708e5b07373135592d93f5e"><code>179ba0c</code></a> feat(prisma7): add side-by-side CLI wrapper (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/client/issues/29949">#29949</a>)</li> <li><a href="https://github.com/prisma/orm/commit/3fa65ac134696ca8eb3d1f869b1ab894ce5c93eb"><code>3fa65ac</code></a> fix(p2002): correct modelName in nested create unique constraint errors <a href="https://github.com/prisma/prisma/tree/HEAD/packages/client/issues/2959">#2959</a>...</li> <li><a href="https://github.com/prisma/orm/commit/6b6d9e90b002b4bf29e3f0d642a16629fae21a6b"><code>6b6d9e9</code></a> chore(deps): update engines to 7.10.0-4.0edf323efd1d98336f3f0a68684b56f689b90...</li> <li><a href="https://github.com/prisma/orm/commit/b64e33c9c21e23e83b5fedb3786ae25125394114"><code>b64e33c</code></a> chore(deps): update engines to 7.10.0-3.9d90ce2c89d5c95a1148aef15e5561ab6c490...</li> <li><a href="https://github.com/prisma/orm/commit/2046f9b74bc68d283c586e7c8e83da192e448d9b"><code>2046f9b</code></a> feat(client): expose ModelName to compute function in Result extensions (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/client/issues/29782">#29782</a>)</li> <li><a href="https://github.com/prisma/orm/commit/f2b3abd550657bf80f2cfdeafdbb5a2f10dc256b"><code>f2b3abd</code></a> chore(deps): update engines to 7.10.0-1.6d040c802892de6d56c7e0061b7a10b3e6a0c...</li> <li>Additional commits viewable in <a href="https://github.com/prisma/prisma/commits/7.10.0/packages/client">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details>

Gitchegumi (Migrated from github.com) approved these changes

2026-09-10 19:49:12 -05:00