gitchegumi/GitchAlerts
gitchegumi/GitchAlerts
Watch
1
0
Fork
You've already forked GitchAlerts
 0
Code Issues 1 Pull requests 1 Releases 56 Packages 3 Activity Actions

chore(deps): bump the production-dependencies group with 8 updates #141

Closed
dependabot[bot] wants to merge 1 commit from dependabot/npm_and_yarn/production-dependencies-e6fa6956c9 into main
pull from: dependabot/npm_and_yarn/production-dependencies-e6fa6956c9
merge into: gitchegumi:main
Conversation 1 Commits 1 Files changed 3 +162 -150
dependabot[bot] commented 2026-07-27 04:25:01 -05:00 (Migrated from github.com)
Copy link

Bumps the production-dependencies group with 8 updates:

Package From To
@next/env 16.2.10 16.2.12
jose 6.2.3 6.2.4
next 16.2.10 16.2.12
next-auth 4.24.14 4.24.15
react 19.2.7 19.2.8
react-dom 19.2.7 19.2.8
@prisma/adapter-pg 7.8.0 7.9.0
@prisma/client 7.8.0 7.9.0

Updates @next/env from 16.2.10 to 16.2.12

Release notes

Sourced from @​next/env's releases.

v16.2.12

What's Changed

Full Changelog: https://github.com/vercel/next.js/compare/v16.2.11...v16.2.12

v16.2.11

This release contains security fixes for the following advisories:

High:

Moderate:

Commits

Updates jose from 6.2.3 to 6.2.4

Release notes

Sourced from jose's releases.

v6.2.4

Documentation

  • update README.md and SECURITY.md to reflect passed EOL dates (2a84032)

Refactor

  • normalize JWK export members from runtime quirks (386a3eb)
Changelog

Sourced from jose's changelog.

6.2.4 (2026-07-21)

Documentation

  • update README.md and SECURITY.md to reflect passed EOL dates (2a84032)

Refactor

  • normalize JWK export members from runtime quirks (386a3eb)
Commits
  • 3ced677 chore(release): 6.2.4
  • 9725456 chore: bump packages
  • 386a3eb refactor: normalize JWK export members from runtime quirks
  • f86dbef chore: bump packages
  • 990c670 test: update electron expectations
  • 0bbe2d0 chore: fix broken links for undici
  • 294c40c test: update electron expectations
  • a378068 chore(deps): bump the actions group with 2 updates
  • b299ce2 chore(deps-dev): bump undici
  • f261d84 chore(deps-dev): bump tar in the npm_and_yarn group across 1 directory
  • Additional commits viewable in compare view

Updates next from 16.2.10 to 16.2.12

Release notes

Sourced from next's releases.

v16.2.12

What's Changed

Full Changelog: https://github.com/vercel/next.js/compare/v16.2.11...v16.2.12

v16.2.11

This release contains security fixes for the following advisories:

High:

Moderate:

Commits
  • 2234717 v16.2.12
  • 957f5ed [Backport] Fixes to support TypeScript 7 (#95831)
  • b56eb16 Backport/docs fixes 16.2 - July round (#96031)
  • 9beca08 v16.2.11
  • 3c48c7a [16.x] Fix Turbopack middleware matcher with i18n single locale
  • ac1eff3 [16.x] Improve performance of checking valid MPA form submissions
  • 9a4651e [16.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
  • b512063 [16.x] Set correct origin for internal redirects in custom server
  • d303326 [16.x] Ensure exotic rewrite param values are properly encoded
  • 73b9487 [16.x] fix(fetch-cache): key fetch(Request, init) by the effective request
  • Additional commits viewable in compare view

Updates next-auth from 4.24.14 to 4.24.15

Release notes

Sourced from next-auth's releases.

next-auth@4.24.15

Security patch release for the 4.x line.

  • getToken() now returns null instead of throwing when the Authorization header contains a malformed Bearer value.
  • OAuth state, nonce, and PKCE check cookies are now bound to the provider that created them and are rejected when a different provider handles the callback. Sign-ins in flight across the upgrade fail once and succeed on retry.
  • Email addresses are Unicode-normalized (NFKC) before validation in the email sign-in flow, closing a homoglyph @ bypass.
  • An explicitly configured NEXTAUTH_URL now takes precedence over the auto-detected forwarded host in trusted-host mode.
  • Restores CommonJS compatibility by pinning uuid to ^11.1.1; the 14.x line is ESM-only and broke require() on Node versions below 20.19.
Commits

Updates react from 19.2.7 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

Commits

Updates react-dom from 19.2.7 to 19.2.8

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

Commits

Updates @prisma/adapter-pg from 7.8.0 to 7.9.0

Release notes

Sourced from @​prisma/adapter-pg's releases.

7.9.0

Today, we are excited to share the 7.9.0 stable release 🎉

🌟 Star this repo for notifications about new releases, bug fixes & features — or follow us on X!

Highlights

ORM

Tab completions for the Prisma CLI

Typing out CLI commands from memory is now optional. Prisma ships shell tab completions for bash, zsh, fish, and PowerShell, covering commands, subcommands, options, flags, and even option values.

Setting it up. Most projects run Prisma through a package manager, so completions are enabled through @bomb.sh/tab's package-manager integration — install it once, then source the completion for your package manager and shell:

# 1. Install @bomb.sh/tab globally
npm install -g @bomb.sh/tab

2. Wire up your package manager + shell (pnpm shown; swap in npm / yarn / bun):


echo 'source <(tab pnpm zsh)'  >> ~/.zshrc            # zsh

echo 'source <(tab pnpm bash)' >> ~/.bashrc           # bash

tab pnpm fish > ~/.config/fish/completions/pnpm.fish  # fish

tab pnpm powershell > ~/.tab-pnpm.ps1                 # PowerShell (then dot-source it from $PROFILE)

@bomb.sh/tab delegates to any locally-installed CLI that ships completions, so pnpm prisma <TAB>, pnpm exec prisma <TAB>, yarn prisma <TAB>, and bun x prisma <TAB> all complete Prisma's commands, options, and values — no per-project setup. (npx and bunx don't support completion themselves; use npm exec and bun x.)

If instead you have Prisma installed globally on your PATH, source its own completion directly: source <(prisma complete zsh) (or the bash / fish / powershell variant).

This is built on @bomb.sh/tab, the same completion library that powers other CLIs in the ecosystem — including Cloudflare, Nuxt, and Vitest — so the package-manager completions you enable for Prisma work for those tools too. A wonderful community contribution from @​AmirSa12 (#28351) — thank you!

https://github.com/user-attachments/assets/1f916a60-ee4d-40be-bb7d-74035d48ca83

Prisma ORM, ready for AI agents

Coding agents are now a first-class audience for Prisma, and 7.9.0 brings the first wave of work to make Prisma projects safe and productive for them to work in.

Agent skills installed with prisma init (#29689)

prisma init now installs the prisma/skills catalog into freshly scaffolded projects. Agents such as Claude Code, Cursor, Codex, and Windsurf start out with current, version-relevant Prisma knowledge instead of relying on whatever happened to be in their training data. The install is best-effort and never blocks scaffolding; opt out at any time with --no-skills.

npx prisma@latest init

prisma init scaffolds a project and installs the Prisma agent skills catalog

A safer default around destructive commands (#29684, #29691, #29713)

... (truncated)

Commits

Updates @prisma/client from 7.8.0 to 7.9.0

Release notes

Sourced from @​prisma/client's releases.

7.9.0

Today, we are excited to share the 7.9.0 stable release 🎉

🌟 Star this repo for notifications about new releases, bug fixes & features — or follow us on X!

Highlights

ORM

Tab completions for the Prisma CLI

Typing out CLI commands from memory is now optional. Prisma ships shell tab completions for bash, zsh, fish, and PowerShell, covering commands, subcommands, options, flags, and even option values.

Setting it up. Most projects run Prisma through a package manager, so completions are enabled through @bomb.sh/tab's package-manager integration — install it once, then source the completion for your package manager and shell:

# 1. Install @bomb.sh/tab globally
npm install -g @bomb.sh/tab

2. Wire up your package manager + shell (pnpm shown; swap in npm / yarn / bun):


echo 'source <(tab pnpm zsh)'  >> ~/.zshrc            # zsh

echo 'source <(tab pnpm bash)' >> ~/.bashrc           # bash

tab pnpm fish > ~/.config/fish/completions/pnpm.fish  # fish

tab pnpm powershell > ~/.tab-pnpm.ps1                 # PowerShell (then dot-source it from $PROFILE)

@bomb.sh/tab delegates to any locally-installed CLI that ships completions, so pnpm prisma <TAB>, pnpm exec prisma <TAB>, yarn prisma <TAB>, and bun x prisma <TAB> all complete Prisma's commands, options, and values — no per-project setup. (npx and bunx don't support completion themselves; use npm exec and bun x.)

If instead you have Prisma installed globally on your PATH, source its own completion directly: source <(prisma complete zsh) (or the bash / fish / powershell variant).

This is built on @bomb.sh/tab, the same completion library that powers other CLIs in the ecosystem — including Cloudflare, Nuxt, and Vitest — so the package-manager completions you enable for Prisma work for those tools too. A wonderful community contribution from @​AmirSa12 (#28351) — thank you!

https://github.com/user-attachments/assets/1f916a60-ee4d-40be-bb7d-74035d48ca83

Prisma ORM, ready for AI agents

Coding agents are now a first-class audience for Prisma, and 7.9.0 brings the first wave of work to make Prisma projects safe and productive for them to work in.

Agent skills installed with prisma init (#29689)

prisma init now installs the prisma/skills catalog into freshly scaffolded projects. Agents such as Claude Code, Cursor, Codex, and Windsurf start out with current, version-relevant Prisma knowledge instead of relying on whatever happened to be in their training data. The install is best-effort and never blocks scaffolding; opt out at any time with --no-skills.

npx prisma@latest init

prisma init scaffolds a project and installs the Prisma agent skills catalog

A safer default around destructive commands (#29684, #29691, #29713)

... (truncated)

Commits
  • b829850 ci: upgrade pnpm to 11 to restore pnpm audit (#29725)
  • 280fd56 fix(client): mask each quoted string in maskQuery independently (#29723)
  • 4da3774 fix(client): reject invalid raw dates (#29697)
  • a7cec97 chore(deps): update engines to 7.9.0-1.e922089b7d7502aff4249d5da3420f6fa55fc6...
  • 58f8439 fix(client): pin pg-protocol in prisma-client-imports-postgres e2e test (#29687)
  • 918cf5d fix(client): improve adapter-related Prisma 7 error messages (#29624)
  • 93da6ea ci(e2e): shard client e2e suite across 3 jobs to fix chronic timeouts (#29619)
  • 3937779 fix: remove duplicate 'the the' in test comments (#29610)
  • fda8fbc chore(deps): bump @​prisma/dev to 0.24.9 (resolves hono GHSA-92pp-h63x-v22m) (...
  • 0036baf fix(client-engine-runtime): surface unmapped driver errors as user-facing P20...
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
Bumps the production-dependencies group with 8 updates: | Package | From | To | | --- | --- | --- | | [@next/env](https://github.com/vercel/next.js/tree/HEAD/packages/next-env) | `16.2.10` | `16.2.12` | | [jose](https://github.com/panva/jose) | `6.2.3` | `6.2.4` | | [next](https://github.com/vercel/next.js) | `16.2.10` | `16.2.12` | | [next-auth](https://github.com/nextauthjs/next-auth) | `4.24.14` | `4.24.15` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.7` | `19.2.8` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.7` | `19.2.8` | | [@prisma/adapter-pg](https://github.com/prisma/prisma/tree/HEAD/packages/adapter-pg) | `7.8.0` | `7.9.0` | | [@prisma/client](https://github.com/prisma/prisma/tree/HEAD/packages/client) | `7.8.0` | `7.9.0` | Updates `@next/env` from 16.2.10 to 16.2.12 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">@​next/env's releases</a>.</em></p> <blockquote> <h2>v16.2.12</h2> <h2>What's Changed</h2> <ul> <li>Backport/docs fixes 16.2 - July round by <a href="https://github.com/icyJoseph"><code>@​icyJoseph</code></a> in <a href="https://redirect.github.com/vercel/next.js/pull/96031">vercel/next.js#96031</a></li> <li>[Backport] Fixes to support TypeScript 7 by <a href="https://github.com/lukesandberg"><code>@​lukesandberg</code></a> in <a href="https://redirect.github.com/vercel/next.js/pull/95831">vercel/next.js#95831</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/vercel/next.js/compare/v16.2.11...v16.2.12">https://github.com/vercel/next.js/compare/v16.2.11...v16.2.12</a></p> <h2>v16.2.11</h2> <p>This release contains security fixes for the following advisories:</p> <p>High:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial of Service in App Router using Server Actions</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware / Proxy bypass in App Router applications using Turbopack and single locale</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side Request Forgery in rewrites via attacker-controlled destination hostname</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side Request Forgery in Server Actions on custom servers</a></li> </ul> <p>Moderate:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache confusion of response bodies for requests with bodies</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial of Service in the Image Optimization API using SVGs</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated disclosure of internal Server Function endpoints</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded Server Action payload in Edge runtime</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/next.js/commit/2234717e74ff24cd179d8128fa8af6c46cc4f24e"><code>2234717</code></a> v16.2.12</li> <li><a href="https://github.com/vercel/next.js/commit/9beca0821cf4606ae33466ed6f4fc75f2887a4da"><code>9beca08</code></a> v16.2.11</li> <li>See full diff in <a href="https://github.com/vercel/next.js/commits/v16.2.12/packages/next-env">compare view</a></li> </ul> </details> <br /> Updates `jose` from 6.2.3 to 6.2.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/panva/jose/releases">jose's releases</a>.</em></p> <blockquote> <h2>v6.2.4</h2> <h3>Documentation</h3> <ul> <li>update README.md and SECURITY.md to reflect passed EOL dates (<a href="https://github.com/panva/jose/commit/2a840328fa119b46183b95199b0a6082a445d983">2a84032</a>)</li> </ul> <h3>Refactor</h3> <ul> <li>normalize JWK export members from runtime quirks (<a href="https://github.com/panva/jose/commit/386a3eb03ceadbd2c0e9626bdcb4ec66eccd7558">386a3eb</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/panva/jose/blob/main/CHANGELOG.md">jose's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/panva/jose/compare/v6.2.3...v6.2.4">6.2.4</a> (2026-07-21)</h2> <h3>Documentation</h3> <ul> <li>update README.md and SECURITY.md to reflect passed EOL dates (<a href="https://github.com/panva/jose/commit/2a840328fa119b46183b95199b0a6082a445d983">2a84032</a>)</li> </ul> <h3>Refactor</h3> <ul> <li>normalize JWK export members from runtime quirks (<a href="https://github.com/panva/jose/commit/386a3eb03ceadbd2c0e9626bdcb4ec66eccd7558">386a3eb</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/panva/jose/commit/3ced6774009b792ff800e9a3a73477c5add45a01"><code>3ced677</code></a> chore(release): 6.2.4</li> <li><a href="https://github.com/panva/jose/commit/97254561d5ae8b9642c2564b5855a4410990687d"><code>9725456</code></a> chore: bump packages</li> <li><a href="https://github.com/panva/jose/commit/386a3eb03ceadbd2c0e9626bdcb4ec66eccd7558"><code>386a3eb</code></a> refactor: normalize JWK export members from runtime quirks</li> <li><a href="https://github.com/panva/jose/commit/f86dbefd9afd7a278acf8c65bd250dfe09f4bc5e"><code>f86dbef</code></a> chore: bump packages</li> <li><a href="https://github.com/panva/jose/commit/990c670bc0a1d2ba5086f362646721cda871bfb8"><code>990c670</code></a> test: update electron expectations</li> <li><a href="https://github.com/panva/jose/commit/0bbe2d0129d95dbfff62ce85566fd6673c6d9fed"><code>0bbe2d0</code></a> chore: fix broken links for undici</li> <li><a href="https://github.com/panva/jose/commit/294c40c4419828743b9bfc36fb0e6243c0352d72"><code>294c40c</code></a> test: update electron expectations</li> <li><a href="https://github.com/panva/jose/commit/a378068fe862d3a7f9b822cd744327855768f0d7"><code>a378068</code></a> chore(deps): bump the actions group with 2 updates</li> <li><a href="https://github.com/panva/jose/commit/b299ce2415662c0e7e481993c8c21ae76f041996"><code>b299ce2</code></a> chore(deps-dev): bump undici</li> <li><a href="https://github.com/panva/jose/commit/f261d847a7264d61dae27b185ca1c33a007a2517"><code>f261d84</code></a> chore(deps-dev): bump tar in the npm_and_yarn group across 1 directory</li> <li>Additional commits viewable in <a href="https://github.com/panva/jose/compare/v6.2.3...v6.2.4">compare view</a></li> </ul> </details> <br /> Updates `next` from 16.2.10 to 16.2.12 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">next's releases</a>.</em></p> <blockquote> <h2>v16.2.12</h2> <h2>What's Changed</h2> <ul> <li>Backport/docs fixes 16.2 - July round by <a href="https://github.com/icyJoseph"><code>@​icyJoseph</code></a> in <a href="https://redirect.github.com/vercel/next.js/pull/96031">vercel/next.js#96031</a></li> <li>[Backport] Fixes to support TypeScript 7 by <a href="https://github.com/lukesandberg"><code>@​lukesandberg</code></a> in <a href="https://redirect.github.com/vercel/next.js/pull/95831">vercel/next.js#95831</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/vercel/next.js/compare/v16.2.11...v16.2.12">https://github.com/vercel/next.js/compare/v16.2.11...v16.2.12</a></p> <h2>v16.2.11</h2> <p>This release contains security fixes for the following advisories:</p> <p>High:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial of Service in App Router using Server Actions</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware / Proxy bypass in App Router applications using Turbopack and single locale</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side Request Forgery in rewrites via attacker-controlled destination hostname</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side Request Forgery in Server Actions on custom servers</a></li> </ul> <p>Moderate:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache confusion of response bodies for requests with bodies</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial of Service in the Image Optimization API using SVGs</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated disclosure of internal Server Function endpoints</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded Server Action payload in Edge runtime</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/next.js/commit/2234717e74ff24cd179d8128fa8af6c46cc4f24e"><code>2234717</code></a> v16.2.12</li> <li><a href="https://github.com/vercel/next.js/commit/957f5ed3fc827d52bb7f2809d80fa90cc86f66e5"><code>957f5ed</code></a> [Backport] Fixes to support TypeScript 7 (<a href="https://redirect.github.com/vercel/next.js/issues/95831">#95831</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/b56eb16ece1d405cbb5fdd3bb7c37c5cb93beb8e"><code>b56eb16</code></a> Backport/docs fixes 16.2 - July round (<a href="https://redirect.github.com/vercel/next.js/issues/96031">#96031</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/9beca0821cf4606ae33466ed6f4fc75f2887a4da"><code>9beca08</code></a> v16.2.11</li> <li><a href="https://github.com/vercel/next.js/commit/3c48c7af78f2c01691065cb303da1b107a2c8617"><code>3c48c7a</code></a> [16.x] Fix Turbopack middleware matcher with i18n single locale</li> <li><a href="https://github.com/vercel/next.js/commit/ac1eff3f7a7285176396ecc69c3b160a3d6ad1a2"><code>ac1eff3</code></a> [16.x] Improve performance of checking valid MPA form submissions</li> <li><a href="https://github.com/vercel/next.js/commit/9a4651e754f70b12e397694ffc41f44c3ba8cc17"><code>9a4651e</code></a> [16.x] Enforce <code>serverActions.bodySizeLimit</code> for Server Actions in Edge runtime</li> <li><a href="https://github.com/vercel/next.js/commit/b51206321854193208c0805ba42acc49287f942b"><code>b512063</code></a> [16.x] Set correct origin for internal redirects in custom server</li> <li><a href="https://github.com/vercel/next.js/commit/d3033266c6dff23f7be71e19341fe3a8c6e2c599"><code>d303326</code></a> [16.x] Ensure exotic rewrite param values are properly encoded</li> <li><a href="https://github.com/vercel/next.js/commit/73b94872bc343d09494b50394d8c08eb9fc8e56a"><code>73b9487</code></a> [16.x] fix(fetch-cache): key fetch(Request, init) by the effective request</li> <li>Additional commits viewable in <a href="https://github.com/vercel/next.js/compare/v16.2.10...v16.2.12">compare view</a></li> </ul> </details> <br /> Updates `next-auth` from 4.24.14 to 4.24.15 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/nextauthjs/next-auth/releases">next-auth's releases</a>.</em></p> <blockquote> <h2>next-auth@4.24.15</h2> <p>Security patch release for the 4.x line.</p> <ul> <li><code>getToken()</code> now returns <code>null</code> instead of throwing when the <code>Authorization</code> header contains a malformed Bearer value.</li> <li>OAuth <code>state</code>, <code>nonce</code>, and PKCE check cookies are now bound to the provider that created them and are rejected when a different provider handles the callback. Sign-ins in flight across the upgrade fail once and succeed on retry.</li> <li>Email addresses are Unicode-normalized (NFKC) before validation in the email sign-in flow, closing a homoglyph <code>@</code> bypass.</li> <li>An explicitly configured <code>NEXTAUTH_URL</code> now takes precedence over the auto-detected forwarded host in trusted-host mode.</li> <li>Restores CommonJS compatibility by pinning <code>uuid</code> to <code>^11.1.1</code>; the 14.x line is ESM-only and broke <code>require()</code> on Node versions below 20.19.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nextauthjs/next-auth/commit/d857eec560fb99c8b18d3b22a2693b849a62d1c3"><code>d857eec</code></a> chore(release): next-auth@4.24.15 [skip ci]</li> <li><a href="https://github.com/nextauthjs/next-auth/commit/5bca2399a79ba8d116ca5179b4b1ebcd152e7f05"><code>5bca239</code></a> fix(next-auth): harden getToken parsing and bind OAuth check cookies to provi...</li> <li><a href="https://github.com/nextauthjs/next-auth/commit/db7e27de64fd7ffb97d4d04f602014954d685991"><code>db7e27d</code></a> chore(deps): use uuid ^11.1.1 to keep CommonJS support (<a href="https://redirect.github.com/nextauthjs/next-auth/issues/13466">#13466</a>)</li> <li><a href="https://github.com/nextauthjs/next-auth/commit/32d874c15305adaf03edfdf0ffce5af88fc8c76d"><code>32d874c</code></a> fix(next-auth): repair red v4 CI (lint + pre-existing test drift) (<a href="https://redirect.github.com/nextauthjs/next-auth/issues/13447">#13447</a>)</li> <li><a href="https://github.com/nextauthjs/next-auth/commit/fa858580cd110256f5830515c027ada6dd769bd5"><code>fa85858</code></a> chore: update uuid to v14, remove deprecated types (<a href="https://redirect.github.com/nextauthjs/next-auth/issues/13422">#13422</a>)</li> <li><a href="https://github.com/nextauthjs/next-auth/commit/2a39465620081987179ef435be91a6e2a68ee44f"><code>2a39465</code></a> Merge commit from fork</li> <li><a href="https://github.com/nextauthjs/next-auth/commit/19d2feb24359fa8c79418907fc68d9ec8152ca94"><code>19d2feb</code></a> Merge commit from fork</li> <li>See full diff in <a href="https://github.com/nextauthjs/next-auth/compare/next-auth@4.24.14...next-auth@4.24.15">compare view</a></li> </ul> </details> <br /> Updates `react` from 19.2.7 to 19.2.8 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/react/react/releases">react's releases</a>.</em></p> <blockquote> <h2>19.2.8 (July 21st, 2026)</h2> <h2>React Server Components</h2> <ul> <li>Performance improvements when decoding (<a href="https://redirect.github.com/facebook/react/pull/37087">#37087</a> by <a href="https://github.com/eps1lon"><code>@​eps1lon</code></a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/react/react/commit/1dd4ecbdabf826f527fc9a58c05ea70375b7d170"><code>1dd4ecb</code></a> [FlightReply] Performance improvements when decoding (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/37087">#37087</a>)</li> <li><a href="https://github.com/react/react/commit/b0d2fdb78bdfae075a7fa02ddcebbf25f90952c2"><code>b0d2fdb</code></a> [19.2.x] Update required references to GitHub repo (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/36753">#36753</a>)</li> <li>See full diff in <a href="https://github.com/react/react/commits/v19.2.8/packages/react">compare view</a></li> </ul> </details> <br /> Updates `react-dom` from 19.2.7 to 19.2.8 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/react/react/releases">react-dom's releases</a>.</em></p> <blockquote> <h2>19.2.8 (July 21st, 2026)</h2> <h2>React Server Components</h2> <ul> <li>Performance improvements when decoding (<a href="https://redirect.github.com/facebook/react/pull/37087">#37087</a> by <a href="https://github.com/eps1lon"><code>@​eps1lon</code></a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/react/react/commit/1dd4ecbdabf826f527fc9a58c05ea70375b7d170"><code>1dd4ecb</code></a> [FlightReply] Performance improvements when decoding (<a href="https://github.com/react/react/tree/HEAD/packages/react-dom/issues/37087">#37087</a>)</li> <li><a href="https://github.com/react/react/commit/b0d2fdb78bdfae075a7fa02ddcebbf25f90952c2"><code>b0d2fdb</code></a> [19.2.x] Update required references to GitHub repo (<a href="https://github.com/react/react/tree/HEAD/packages/react-dom/issues/36753">#36753</a>)</li> <li>See full diff in <a href="https://github.com/react/react/commits/v19.2.8/packages/react-dom">compare view</a></li> </ul> </details> <br /> Updates `@prisma/adapter-pg` from 7.8.0 to 7.9.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/prisma/prisma/releases">@​prisma/adapter-pg's releases</a>.</em></p> <blockquote> <h2>7.9.0</h2> <p>Today, we are excited to share the <code>7.9.0</code> stable release 🎉</p> <p><strong>🌟 Star this repo for notifications about new releases, bug fixes &amp; features — or <a href="https://pris.ly/x">follow us on X</a>!</strong></p> <h1>Highlights</h1> <h2>ORM</h2> <h3>Tab completions for the Prisma CLI</h3> <p>Typing out CLI commands from memory is now optional. Prisma ships <strong>shell tab completions</strong> for <code>bash</code>, <code>zsh</code>, <code>fish</code>, and PowerShell, covering commands, subcommands, options, flags, and even option values.</p> <p><strong>Setting it up.</strong> Most projects run Prisma through a package manager, so completions are enabled through <code>@bomb.sh/tab</code>'s package-manager integration — install it once, then source the completion for your package manager and shell:</p> <pre lang="bash"><code># 1. Install @bomb.sh/tab globally npm install -g @bomb.sh/tab <h1>2. Wire up your package manager + shell (pnpm shown; swap in npm / yarn / bun):</h1> <p>echo 'source &lt;(tab pnpm zsh)' &gt;&gt; ~/.zshrc # zsh<br /> echo 'source &lt;(tab pnpm bash)' &gt;&gt; ~/.bashrc # bash<br /> tab pnpm fish &gt; ~/.config/fish/completions/pnpm.fish # fish<br /> tab pnpm powershell &gt; ~/.tab-pnpm.ps1 # PowerShell (then dot-source it from $PROFILE)<br /> </code></pre></p> <p><code>@bomb.sh/tab</code> delegates to any locally-installed CLI that ships completions, so <code>pnpm prisma &lt;TAB&gt;</code>, <code>pnpm exec prisma &lt;TAB&gt;</code>, <code>yarn prisma &lt;TAB&gt;</code>, and <code>bun x prisma &lt;TAB&gt;</code> all complete Prisma's commands, options, and values — no per-project setup. (<code>npx</code> and <code>bunx</code> don't support completion themselves; use <code>npm exec</code> and <code>bun x</code>.)</p> <p>If instead you have Prisma installed globally on your <code>PATH</code>, source its own completion directly: <code>source &lt;(prisma complete zsh)</code> (or the <code>bash</code> / <code>fish</code> / <code>powershell</code> variant).</p> <p>This is built on <a href="https://github.com/bombshell-dev/tab/"><code>@bomb.sh/tab</code></a>, the same completion library that powers other CLIs in the ecosystem — including Cloudflare, Nuxt, and Vitest — so the package-manager completions you enable for Prisma work for those tools too. A wonderful community contribution from <a href="https://github.com/AmirSa12"><code>@​AmirSa12</code></a> (<a href="https://redirect.github.com/prisma/prisma/pull/28351">#28351</a>) — thank you!</p> <p><a href="https://github.com/user-attachments/assets/1f916a60-ee4d-40be-bb7d-74035d48ca83">https://github.com/user-attachments/assets/1f916a60-ee4d-40be-bb7d-74035d48ca83</a></p> <h3>Prisma ORM, ready for AI agents</h3> <p>Coding agents are now a first-class audience for Prisma, and 7.9.0 brings the first wave of work to make Prisma projects safe and productive for them to work in.</p> <p><strong>Agent skills installed with <code>prisma init</code></strong> (<a href="https://redirect.github.com/prisma/prisma/pull/29689">#29689</a>)</p> <p><code>prisma init</code> now installs the <a href="https://github.com/prisma/skills">prisma/skills</a> catalog into freshly scaffolded projects. Agents such as Claude Code, Cursor, Codex, and Windsurf start out with current, version-relevant Prisma knowledge instead of relying on whatever happened to be in their training data. The install is best-effort and never blocks scaffolding; opt out at any time with <code>--no-skills</code>.</p> <pre lang="terminal"><code>npx prisma@latest init </code></pre> <p><img src="https://github.com/user-attachments/assets/8244a6dc-cdad-4028-a652-bb5ac6e4b271" alt="prisma init scaffolds a project and installs the Prisma agent skills catalog" /></p> <p><strong>A safer default around destructive commands</strong> (<a href="https://redirect.github.com/prisma/prisma/pull/29684">#29684</a>, <a href="https://redirect.github.com/prisma/prisma/pull/29691">#29691</a>, <a href="https://redirect.github.com/prisma/prisma/pull/29713">#29713</a>)</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/prisma/prisma/commit/35003fd86c574741cb5d93a57b773ee33015a79c"><code>35003fd</code></a> chore(adapter-pg): remove duplicate values parameter (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/adapter-pg/issues/29650">#29650</a>)</li> <li><a href="https://github.com/prisma/prisma/commit/d6d9fc9ed341946d45c7d0aba35081a7bd741aa1"><code>d6d9fc9</code></a> chore: remove parameterization from sqlcommenter-query-insights (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/adapter-pg/issues/29518">#29518</a>)</li> <li>See full diff in <a href="https://github.com/prisma/prisma/commits/7.9.0/packages/adapter-pg">compare view</a></li> </ul> </details> <br /> Updates `@prisma/client` from 7.8.0 to 7.9.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/prisma/prisma/releases">@​prisma/client's releases</a>.</em></p> <blockquote> <h2>7.9.0</h2> <p>Today, we are excited to share the <code>7.9.0</code> stable release 🎉</p> <p><strong>🌟 Star this repo for notifications about new releases, bug fixes &amp; features — or <a href="https://pris.ly/x">follow us on X</a>!</strong></p> <h1>Highlights</h1> <h2>ORM</h2> <h3>Tab completions for the Prisma CLI</h3> <p>Typing out CLI commands from memory is now optional. Prisma ships <strong>shell tab completions</strong> for <code>bash</code>, <code>zsh</code>, <code>fish</code>, and PowerShell, covering commands, subcommands, options, flags, and even option values.</p> <p><strong>Setting it up.</strong> Most projects run Prisma through a package manager, so completions are enabled through <code>@bomb.sh/tab</code>'s package-manager integration — install it once, then source the completion for your package manager and shell:</p> <pre lang="bash"><code># 1. Install @bomb.sh/tab globally npm install -g @bomb.sh/tab <h1>2. Wire up your package manager + shell (pnpm shown; swap in npm / yarn / bun):</h1> <p>echo 'source &lt;(tab pnpm zsh)' &gt;&gt; ~/.zshrc # zsh<br /> echo 'source &lt;(tab pnpm bash)' &gt;&gt; ~/.bashrc # bash<br /> tab pnpm fish &gt; ~/.config/fish/completions/pnpm.fish # fish<br /> tab pnpm powershell &gt; ~/.tab-pnpm.ps1 # PowerShell (then dot-source it from $PROFILE)<br /> </code></pre></p> <p><code>@bomb.sh/tab</code> delegates to any locally-installed CLI that ships completions, so <code>pnpm prisma &lt;TAB&gt;</code>, <code>pnpm exec prisma &lt;TAB&gt;</code>, <code>yarn prisma &lt;TAB&gt;</code>, and <code>bun x prisma &lt;TAB&gt;</code> all complete Prisma's commands, options, and values — no per-project setup. (<code>npx</code> and <code>bunx</code> don't support completion themselves; use <code>npm exec</code> and <code>bun x</code>.)</p> <p>If instead you have Prisma installed globally on your <code>PATH</code>, source its own completion directly: <code>source &lt;(prisma complete zsh)</code> (or the <code>bash</code> / <code>fish</code> / <code>powershell</code> variant).</p> <p>This is built on <a href="https://github.com/bombshell-dev/tab/"><code>@bomb.sh/tab</code></a>, the same completion library that powers other CLIs in the ecosystem — including Cloudflare, Nuxt, and Vitest — so the package-manager completions you enable for Prisma work for those tools too. A wonderful community contribution from <a href="https://github.com/AmirSa12"><code>@​AmirSa12</code></a> (<a href="https://redirect.github.com/prisma/prisma/pull/28351">#28351</a>) — thank you!</p> <p><a href="https://github.com/user-attachments/assets/1f916a60-ee4d-40be-bb7d-74035d48ca83">https://github.com/user-attachments/assets/1f916a60-ee4d-40be-bb7d-74035d48ca83</a></p> <h3>Prisma ORM, ready for AI agents</h3> <p>Coding agents are now a first-class audience for Prisma, and 7.9.0 brings the first wave of work to make Prisma projects safe and productive for them to work in.</p> <p><strong>Agent skills installed with <code>prisma init</code></strong> (<a href="https://redirect.github.com/prisma/prisma/pull/29689">#29689</a>)</p> <p><code>prisma init</code> now installs the <a href="https://github.com/prisma/skills">prisma/skills</a> catalog into freshly scaffolded projects. Agents such as Claude Code, Cursor, Codex, and Windsurf start out with current, version-relevant Prisma knowledge instead of relying on whatever happened to be in their training data. The install is best-effort and never blocks scaffolding; opt out at any time with <code>--no-skills</code>.</p> <pre lang="terminal"><code>npx prisma@latest init </code></pre> <p><img src="https://github.com/user-attachments/assets/8244a6dc-cdad-4028-a652-bb5ac6e4b271" alt="prisma init scaffolds a project and installs the Prisma agent skills catalog" /></p> <p><strong>A safer default around destructive commands</strong> (<a href="https://redirect.github.com/prisma/prisma/pull/29684">#29684</a>, <a href="https://redirect.github.com/prisma/prisma/pull/29691">#29691</a>, <a href="https://redirect.github.com/prisma/prisma/pull/29713">#29713</a>)</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/prisma/prisma/commit/b82985029d44349849dfbb4990bb19278178ee61"><code>b829850</code></a> ci: upgrade pnpm to 11 to restore pnpm audit (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/client/issues/29725">#29725</a>)</li> <li><a href="https://github.com/prisma/prisma/commit/280fd56f28c53f42fb2dfbc190c3d35d046e19fa"><code>280fd56</code></a> fix(client): mask each quoted string in maskQuery independently (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/client/issues/29723">#29723</a>)</li> <li><a href="https://github.com/prisma/prisma/commit/4da377494cc27bc0784d3629df21e94989abd153"><code>4da3774</code></a> fix(client): reject invalid raw dates (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/client/issues/29697">#29697</a>)</li> <li><a href="https://github.com/prisma/prisma/commit/a7cec97b204e734cf30049ee7a39c9b61da085de"><code>a7cec97</code></a> chore(deps): update engines to 7.9.0-1.e922089b7d7502aff4249d5da3420f6fa55fc6...</li> <li><a href="https://github.com/prisma/prisma/commit/58f8439d020d70bf7cc9a77cca62dfc95d9ddc0f"><code>58f8439</code></a> fix(client): pin pg-protocol in prisma-client-imports-postgres e2e test (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/client/issues/29687">#29687</a>)</li> <li><a href="https://github.com/prisma/prisma/commit/918cf5d72c1ba85ed0bb85c50c34d483b02a19e1"><code>918cf5d</code></a> fix(client): improve adapter-related Prisma 7 error messages (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/client/issues/29624">#29624</a>)</li> <li><a href="https://github.com/prisma/prisma/commit/93da6ea2dcd65b8b4b9d58daf2e2821f1a4e9320"><code>93da6ea</code></a> ci(e2e): shard client e2e suite across 3 jobs to fix chronic timeouts (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/client/issues/29619">#29619</a>)</li> <li><a href="https://github.com/prisma/prisma/commit/3937779e617c743966ebb50901d013167dd9171e"><code>3937779</code></a> fix: remove duplicate 'the the' in test comments (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/client/issues/29610">#29610</a>)</li> <li><a href="https://github.com/prisma/prisma/commit/fda8fbce23b3af6b1651bd539da09e62c863ed6e"><code>fda8fbc</code></a> chore(deps): bump <code>@​prisma/dev</code> to 0.24.9 (resolves hono GHSA-92pp-h63x-v22m) (...</li> <li><a href="https://github.com/prisma/prisma/commit/0036baf8c9bb0b53e18c04fb27de4acf0535a306"><code>0036baf</code></a> fix(client-engine-runtime): surface unmapped driver errors as user-facing P20...</li> <li>See full diff in <a href="https://github.com/prisma/prisma/commits/7.9.0/packages/client">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details>
dependabot[bot] commented 2026-08-10 04:25:05 -05:00 (Migrated from github.com)
Copy link

Looks like these dependencies are updatable in another way, so this is no longer needed.

Looks like these dependencies are updatable in another way, so this is no longer needed.

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
auth

   
autorelease: pending

   
autorelease: tagged

   
bug
Something isn't working

  
dependencies
Pull requests that update a dependency file

  
devops

   
docker
Pull requests that update docker code

  
documentation
Improvements or additions to documentation

  
duplicate
This issue or pull request already exists

  
enhancement
New feature or request

  
github_actions
Pull requests that update GitHub Actions code

  
good first issue
Good for newcomers

  
help wanted
Extra attention is needed

  
invalid
This doesn't seem right

  
javascript
Pull requests that update javascript code

  
maintenance

   
question
Further information is requested

  
refactor

   
ui

   
wontfix
This will not be worked on

No labels
auth
autorelease: pending
autorelease: tagged
bug
dependencies
devops
docker
documentation
duplicate
enhancement
github_actions
good first issue
help wanted
invalid
javascript
maintenance
question
refactor
ui
wontfix
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
gitchegumi/GitchAlerts!141
No description provided.