gitchegumi/GitchAlerts
gitchegumi/GitchAlerts
Watch
1
0
Fork
You've already forked GitchAlerts
 0
Code Issues 1 Pull requests 1 Releases 56 Packages 3 Activity Actions

chore(deps): bump the production-dependencies group across 1 directory with 9 updates #148

Closed
dependabot[bot] wants to merge 1 commit from dependabot/npm_and_yarn/production-dependencies-4f116923ed into main
pull from: dependabot/npm_and_yarn/production-dependencies-4f116923ed
merge into: gitchegumi:main
Conversation 1 Commits 1 Files changed 4 +351 -321
dependabot[bot] commented 2026-08-10 04:25:43 -05:00 (Migrated from github.com)
Copy link

Bumps the production-dependencies group with 9 updates in the / directory:

Package From To
@next/env 16.2.10 16.3.0
jose 6.2.3 6.2.8
next 16.2.10 16.3.0
next-auth 4.24.14 4.24.15
react 19.2.7 19.2.8
react-dom 19.2.7 19.2.8
@prisma/adapter-pg 7.8.0 7.9.1
@prisma/client 7.8.0 7.9.1
ioredis 5.11.1 6.0.0

Updates @next/env from 16.2.10 to 16.3.0

Release notes

Sourced from @​next/env's releases.

v16.3.0

Core Changes

  • Update vendored lodash to 4.17.23 to fix CVE-2025-13465: #91558
  • Fix invalid HTML response for route-level RSC requests in deployment adapter: #91541
  • Normalize encoded dynamic placeholders in app routes: #91603
  • Fix(pages-router): restore Content-Length and ETag for /_next/data/ JSON responses: #90304
  • Update tokio from 1.43.0 to 1.47.3: #90945
  • [turbopack] Simplify snapshotting logic: #91178
  • Turbopack: enable server HMR for app route handlers: #91466
  • turbo-tasks-backend: batch find_and_schedule_dirty using for_each_task_meta: #91497
  • [turbopack] Use bail! instead of panic! for duplicate module ident error: #91636
  • Skip loadBindings() Lightning CSS check during next start: #91538
  • turbo-tasks-backend: batch schedule dirty tasks in aggregation_update: #91461
  • Turbopack: Add importModule() support to webpack loaders: #89630
  • turbo-persistence: fix mmap page alignment and improve error context in MetaFile::open_internal: #91640
  • turbopack-css: demote recoverable CSS parse warnings to Warning severity: #91524
  • feat(node-streams): add config flag, define-env, and env precedence test: #90427
  • Rename /_next/webpack-hmr to /_next/hmr: #91415
  • Add per-slot error attribution for instant validation using slot markers and config depth preference: #91610
  • Handle encoded params further: #91627
  • [turbopack] Respect {eval:true} in worker_threads constructors: #91666
  • Fix missing route in otel spans without base-server: #91665
  • [turbopack] Optimize compaction cpu usage: #91468
  • Fix layout segment optimization: move app-page imports to server-utility transition: #91701
  • Fix server actions in standalone mode with cacheComponents: #91711
  • turbo-persistence: remove Unmergeable mmap advice: #91713
  • turbopack: move "compact database" tracing span to backend layer: #91693
  • Turbopack: lazy require metadata and handle TLA: #91705
  • Fix adapter outputs for dynamic metadata routes: #91680
  • Turbopack: fix webpack loader runner layer: #91727
  • [turbopack] Remove incorrect debug_assert in try_read_task_cell: #91699
  • Add module count field to module graph tracing spans: #91697
  • turbopack-cli: add --persistent-caching flag for filesystem-backed cache: #91657
  • Turbopack: pull in updated vercel/nft tests: #91651
  • [turbopack] Improve regressed build speed on cross-compiled MUSL: #91477
  • [Segment Bundling] [Scaffolding] Ensure inlining hint correctness: #91320
  • [Segment Bundling] [Scaffolding] Track which segments can be omitted from prefetch: #91438
  • Avoid deprecated TS node10 moduleResolution defaults: #91847
  • [turbopack] Rebuild the docker build scripts: #91799
  • Fix TS6 baseUrl deprecation for extended tsconfig: #91855
  • Add next internal post-build CLI command for Turbopack database compaction: #91336
  • Turbopack: Define Effect as a trait instead of a closure: #89080
  • Turbopack: Implement TraceRawVcs and NonLocalValue correctly for Effects: #89133
  • turbo-tasks-backend: improve print_cache_item_size instrumentation: #91742
  • Turbopack: switch from base40 to base38 hash encoding (remove ~ and . from charset): #91832
  • Use charCodeAt for normalizePathTrailingSlash: #91380
  • Turbopack: Only patch lockfile when bindings fails to load: #91379
  • [create-next-app] Skip interactive prompts when CLI flags are provided: #91840
  • [devtools] Make instant navs panel draggable: #91914
  • [Segment Bundling] Bundle static prefetches based on size: #91439

... (truncated)

Commits

Updates jose from 6.2.3 to 6.2.8

Release notes

Sourced from jose's releases.

v6.2.8

Fixes

  • enforce a single recipient when decrypting dir and ECDH-ES (505c383)
  • reject a non-string "alg" in EmbeddedJWK (714f870)

Refactor

  • index the JWS and JWE registries without a wrapper (925f3bb)
  • name the "alg" source in unsupported algorithm failures (1500459)

v6.2.7

Fixes

  • require own JOSE properties for presence checks (90ab09c)

Refactor

v6.2.6

Fixes

  • types: accept host CryptoKey declarations (b48a15b)

v6.2.5

Fixes

  • compare claim values for falsy validation options (eb86956)
  • forward key management parameters for a single JWE recipient (2d4f801)
  • handle a zero-length JWE additional authenticated data (16ca398)
  • reject a generateKeyPair crv option the algorithm does not imply (76364e9)
  • reject an unencoded payload in the JWS Compact Serialization (01d053f)
  • reject characters outside the Base64URL alphabet (0ebb971), references #879
  • reject duplicate "crit" values when producing (31d60e1)
  • reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (5df3fed)
  • reject truncated ASN.1 key data (7a16c66)
  • surface non-ASCII token segments as JOSE errors (194fe11)
  • types: correct JWK and CryptoKey types (62a196d)
  • types: correct key resolver and JWT header types (e95f8c4)
  • validate the clockTolerance and currentDate options are finite (ab2f18d)

Documentation

  • correct subpaths and API documentation (2daec38)
  • document consumer-supplied type parameters (9e9f66c)
  • stop claiming the JWK "use" parameter is used during import (47a07b2)
  • update CHANGELOG.md (fc51bf5)

Refactor

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.8 (2026-08-03)

Fixes

  • enforce a single recipient when decrypting dir and ECDH-ES (505c383)
  • reject a non-string "alg" in EmbeddedJWK (714f870)

Refactor

  • index the JWS and JWE registries without a wrapper (925f3bb)
  • name the "alg" source in unsupported algorithm failures (1500459)

6.2.7 (2026-08-01)

Fixes

  • require own JOSE properties for presence checks (90ab09c)

Refactor

6.2.6 (2026-07-31)

Fixes

  • types: accept host CryptoKey declarations (b48a15b)

6.2.5 (2026-07-29)

Fixes

  • compare claim values for falsy validation options (eb86956)
  • forward key management parameters for a single JWE recipient (2d4f801)
  • handle a zero-length JWE additional authenticated data (16ca398)
  • reject a generateKeyPair crv option the algorithm does not imply (76364e9)
  • reject an unencoded payload in the JWS Compact Serialization (01d053f)
  • reject characters outside the Base64URL alphabet (0ebb971), references #879
  • reject duplicate "crit" values when producing (31d60e1)
  • reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (5df3fed)
  • reject truncated ASN.1 key data (7a16c66)
  • surface non-ASCII token segments as JOSE errors (194fe11)
  • types: correct JWK and CryptoKey types (62a196d)
  • types: correct key resolver and JWT header types (e95f8c4)
  • validate the clockTolerance and currentDate options are finite (ab2f18d)

Documentation

  • correct subpaths and API documentation (2daec38)
  • document consumer-supplied type parameters (9e9f66c)

... (truncated)

Commits
  • 8b768eb chore(release): 6.2.8
  • 1500459 refactor: name the "alg" source in unsupported algorithm failures
  • 714f870 fix: reject a non-string "alg" in EmbeddedJWK
  • 925f3bb refactor: index the JWS and JWE registries without a wrapper
  • 505c383 fix: enforce a single recipient when decrypting dir and ECDH-ES
  • 514831d chore(deps): bump the actions group with 3 updates
  • 45965db chore: cleanup after release
  • 60b941f chore(release): 6.2.7
  • 90ab09c fix: require own JOSE properties for presence checks
  • 767d7f1 refactor: reduce bundle size
  • Additional commits viewable in compare view

Updates next from 16.2.10 to 16.3.0

Release notes

Sourced from next's releases.

v16.3.0

Core Changes

  • Update vendored lodash to 4.17.23 to fix CVE-2025-13465: #91558
  • Fix invalid HTML response for route-level RSC requests in deployment adapter: #91541
  • Normalize encoded dynamic placeholders in app routes: #91603
  • Fix(pages-router): restore Content-Length and ETag for /_next/data/ JSON responses: #90304
  • Update tokio from 1.43.0 to 1.47.3: #90945
  • [turbopack] Simplify snapshotting logic: #91178
  • Turbopack: enable server HMR for app route handlers: #91466
  • turbo-tasks-backend: batch find_and_schedule_dirty using for_each_task_meta: #91497
  • [turbopack] Use bail! instead of panic! for duplicate module ident error: #91636
  • Skip loadBindings() Lightning CSS check during next start: #91538
  • turbo-tasks-backend: batch schedule dirty tasks in aggregation_update: #91461
  • Turbopack: Add importModule() support to webpack loaders: #89630
  • turbo-persistence: fix mmap page alignment and improve error context in MetaFile::open_internal: #91640
  • turbopack-css: demote recoverable CSS parse warnings to Warning severity: #91524
  • feat(node-streams): add config flag, define-env, and env precedence test: #90427
  • Rename /_next/webpack-hmr to /_next/hmr: #91415
  • Add per-slot error attribution for instant validation using slot markers and config depth preference: #91610
  • Handle encoded params further: #91627
  • [turbopack] Respect {eval:true} in worker_threads constructors: #91666
  • Fix missing route in otel spans without base-server: #91665
  • [turbopack] Optimize compaction cpu usage: #91468
  • Fix layout segment optimization: move app-page imports to server-utility transition: #91701
  • Fix server actions in standalone mode with cacheComponents: #91711
  • turbo-persistence: remove Unmergeable mmap advice: #91713
  • turbopack: move "compact database" tracing span to backend layer: #91693
  • Turbopack: lazy require metadata and handle TLA: #91705
  • Fix adapter outputs for dynamic metadata routes: #91680
  • Turbopack: fix webpack loader runner layer: #91727
  • [turbopack] Remove incorrect debug_assert in try_read_task_cell: #91699
  • Add module count field to module graph tracing spans: #91697
  • turbopack-cli: add --persistent-caching flag for filesystem-backed cache: #91657
  • Turbopack: pull in updated vercel/nft tests: #91651
  • [turbopack] Improve regressed build speed on cross-compiled MUSL: #91477
  • [Segment Bundling] [Scaffolding] Ensure inlining hint correctness: #91320
  • [Segment Bundling] [Scaffolding] Track which segments can be omitted from prefetch: #91438
  • Avoid deprecated TS node10 moduleResolution defaults: #91847
  • [turbopack] Rebuild the docker build scripts: #91799
  • Fix TS6 baseUrl deprecation for extended tsconfig: #91855
  • Add next internal post-build CLI command for Turbopack database compaction: #91336
  • Turbopack: Define Effect as a trait instead of a closure: #89080
  • Turbopack: Implement TraceRawVcs and NonLocalValue correctly for Effects: #89133
  • turbo-tasks-backend: improve print_cache_item_size instrumentation: #91742
  • Turbopack: switch from base40 to base38 hash encoding (remove ~ and . from charset): #91832
  • Use charCodeAt for normalizePathTrailingSlash: #91380
  • Turbopack: Only patch lockfile when bindings fails to load: #91379
  • [create-next-app] Skip interactive prompts when CLI flags are provided: #91840
  • [devtools] Make instant navs panel draggable: #91914
  • [Segment Bundling] Bundle static prefetches based on size: #91439

... (truncated)

Commits

Updates next-auth from 4.24.14 to 4.24.15

Release notes

Sourced from next-auth's releases.

next-auth@4.24.15

Security patch release for the 4.x line.

  • getToken() now returns null instead of throwing when the Authorization header contains a malformed Bearer value.
  • OAuth state, nonce, and PKCE check cookies are now bound to the provider that created them and are rejected when a different provider handles the callback. Sign-ins in flight across the upgrade fail once and succeed on retry.
  • Email addresses are Unicode-normalized (NFKC) before validation in the email sign-in flow, closing a homoglyph @ bypass.
  • An explicitly configured NEXTAUTH_URL now takes precedence over the auto-detected forwarded host in trusted-host mode.
  • Restores CommonJS compatibility by pinning uuid to ^11.1.1; the 14.x line is ESM-only and broke require() on Node versions below 20.19.
Commits

Updates react from 19.2.7 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

Commits

Updates react-dom from 19.2.7 to 19.2.8

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

Commits

Updates @prisma/adapter-pg from 7.8.0 to 7.9.1

Release notes

Sourced from @​prisma/adapter-pg's releases.

7.9.1

Today, we're issuing a patch release to resolve a security advisory in a transitive dependency of Prisma CLI (via @prisma/dev).

This fixes prisma/prisma#29780.

It does not actually affect @prisma/dev or Prisma CLI so no urgent action is required, but it is recommended to upgrade nevertheless to avoid false positives from security scanners.

7.9.0

Today, we are excited to share the 7.9.0 stable release 🎉

🌟 Star this repo for notifications about new releases, bug fixes & features — or follow us on X!

Highlights

ORM

Tab completions for the Prisma CLI

Typing out CLI commands from memory is now optional. Prisma ships shell tab completions for bash, zsh, fish, and PowerShell, covering commands, subcommands, options, flags, and even option values.

Setting it up. Most projects run Prisma through a package manager, so completions are enabled through @bomb.sh/tab's package-manager integration — install it once, then source the completion for your package manager and shell:

# 1. Install @bomb.sh/tab globally
npm install -g @bomb.sh/tab

2. Wire up your package manager + shell (pnpm shown; swap in npm / yarn / bun):


echo 'source <(tab pnpm zsh)'  >> ~/.zshrc            # zsh

echo 'source <(tab pnpm bash)' >> ~/.bashrc           # bash

tab pnpm fish > ~/.config/fish/completions/pnpm.fish  # fish

tab pnpm powershell > ~/.tab-pnpm.ps1                 # PowerShell (then dot-source it from $PROFILE)

@bomb.sh/tab delegates to any locally-installed CLI that ships completions, so pnpm prisma <TAB>, pnpm exec prisma <TAB>, yarn prisma <TAB>, and bun x prisma <TAB> all complete Prisma's commands, options, and values — no per-project setup. (npx and bunx don't support completion themselves; use npm exec and bun x.)

If instead you have Prisma installed globally on your PATH, source its own completion directly: source <(prisma complete zsh) (or the bash / fish / powershell variant).

This is built on @bomb.sh/tab, the same completion library that powers other CLIs in the ecosystem — including Cloudflare, Nuxt, and Vitest — so the package-manager completions you enable for Prisma work for those tools too. A wonderful community contribution from @​AmirSa12 (#28351) — thank you!

https://github.com/user-attachments/assets/1f916a60-ee4d-40be-bb7d-74035d48ca83

Prisma ORM, ready for AI agents

Coding agents are now a first-class audience for Prisma, and 7.9.0 brings the first wave of work to make Prisma projects safe and productive for them to work in.

Agent skills installed with prisma init (#29689)

prisma init now installs the prisma/skills catalog into freshly scaffolded projects. Agents such as Claude Code, Cursor, Codex, and Windsurf start out with current, version-relevant Prisma knowledge instead of relying on whatever happened to be in their training data. The install is best-effort and never blocks scaffolding; opt out at any time with --no-skills.

</tr></table>

... (truncated)

Commits

Updates @prisma/client from 7.8.0 to 7.9.1

Release notes

Sourced from @​prisma/client's releases.

7.9.1

Today, we're issuing a patch release to resolve a security advisory in a transitive dependency of Prisma CLI (via @prisma/dev).

This fixes prisma/prisma#29780.

It does not actually affect @prisma/dev or Prisma CLI so no urgent action is required, but it is recommended to upgrade nevertheless to avoid false positives from security scanners.

7.9.0

Today, we are excited to share the 7.9.0 stable release 🎉

🌟 Star this repo for notifications about new releases, bug fixes & features — or follow us on X!

Highlights

ORM

Tab completions for the Prisma CLI

Typing out CLI commands from memory is now optional. Prisma ships shell tab completions for bash, zsh, fish, and PowerShell, covering commands, subcommands, options, flags, and even option values.

Setting it up. Most projects run Prisma through a package manager, so completions are enabled through @bomb.sh/tab's package-manager integration — install it once, then source the completion for your package manager and shell:

# 1. Install @bomb.sh/tab globally
npm install -g @bomb.sh/tab

2. Wire up your package manager + shell (pnpm shown; swap in npm / yarn / bun):


echo 'source <(tab pnpm zsh)'  >> ~/.zshrc            # zsh

echo 'source <(tab pnpm bash)' >> ~/.bashrc           # bash

tab pnpm fish > ~/.config/fish/completions/pnpm.fish  # fish

tab pnpm powershell > ~/.tab-pnpm.ps1                 # PowerShell (then dot-source it from $PROFILE)

@bomb.sh/tab delegates to any locally-installed CLI that ships completions, so pnpm prisma <TAB>, pnpm exec prisma <TAB>, yarn prisma <TAB>, and bun x prisma <TAB> all complete Prisma's commands, options, and values — no per-project setup. (npx and bunx don't support completion themselves; use npm exec and bun x.)

If instead you have Prisma installed globally on your PATH, source its own completion directly: source <(prisma complete zsh) (or the bash / fish / powershell variant).

This is built on @bomb.sh/tab, the same completion library that powers other CLIs in the ecosystem — including Cloudflare, Nuxt, and Vitest — so the package-manager completions you enable for Prisma work for those tools too. A wonderful community contribution from @​AmirSa12 (#28351) — thank you!

https://github.com/user-attachments/assets/1f916a60-ee4d-40be-bb7d-74035d48ca83

Prisma ORM, ready for AI agents

Coding agents are now a first-class audience for Prisma, and 7.9.0 brings the first wave of work to make Prisma projects safe and productive for them to work in.

Agent skills installed with prisma init (#29689)

prisma init now installs the prisma/skills catalog into freshly scaffolded projects. Agents such as Claude Code, Cursor, Codex, and Windsurf start out with current, version-relevant Prisma knowledge instead of relying on whatever happened to be in their training data. The install is best-effort and never blocks scaffolding; opt out at any time with --no-skills.

</tr></table>

... (truncated)

Commits
  • b829850 ci: upgrade pnpm to 11 to restore pnpm audit (#29725)
  • 280fd56 fix(client): mask each quoted string in maskQuery independently (#29723)
  • 4da3774 fix(client): reject invalid raw dates (#29697)
  • a7cec97 chore(deps): update engines to 7.9.0-1.e922089b7d7502aff4249d5da3420f6fa55fc6...
  • 58f8439 fix(client): pin pg-protocol in prisma-client-imports-postgres e2e test (#29687)
  • 918cf5d fix(client): improve adapter-related Prisma 7 error messages (#29624)
  • 93da6ea ci(e2e): shard client e2e suite across 3 jobs to fix chronic timeouts (#29619)
  • 3937779 fix: remove duplicate 'the the' in test comments (#29610)
  • fda8fbc chore(deps): bump @​prisma/dev to 0.24.9 (resolves hono GHSA-92pp-h63x-v22m) (...
  • 0036baf fix(client-engine-runtime): surface unmapped driver errors as user-facing P20...
  • See full diff in compare view

Updates ioredis from 5.11.1 to 6.0.0

Release notes

Sourced from ioredis's releases.

v6.0.0

6.0.0 (2026-07-31)

Bug Fixes

  • clear stale socket timeout on reconnect (#2148) (6455dbe)
  • cluster: recreate stale connection on circular MOVED (#2135) (08c8967)
  • cluster: validate MOVED slot to prevent Array.prototype pollution (#2151) (9618206), closes #1267
  • command: serialize large integer arguments in decimal notation (#2136) (09b8d04)
  • redis: keep reconnecting when connection closes during client setup (#2099) (#2123) (f9a66bc)
  • sentinel: preserve zero preferred slave priority (#2129) (a3f9f2d)
  • tracing: redact values for GETSET and PSETEX (#2134) (832765d)
  • types: export ScanStreamOptions, RedisStatus and ClusterStatus (#2158) (cf3bf71)

Features

BREAKING CHANGES

  • ioredis now requires Node.js 20 or newer and uses RESP3 by default. Set protocol: 2 to retain the v5 wire protocol.

v6.0.0-beta.1

6.0.0-beta.1 (2026-07-29)

Bug Fixes

  • clear stale socket timeout on reconnect (#2148) (6455dbe)
  • cluster: recreate stale connection on circular MOVED (#2135) (08c8967)
  • cluster: validate MOVED slot to prevent Array.prototype pollution (#2151) (9618206), closes #1267
  • command: serialize large integer arguments in decimal notation (#2136) (09b8d04)
  • redis: keep reconnecting when connection closes during client setup (#2099) (#2123) (f9a66bc)
  • sentinel: preserve zero preferred slave priority (#2129) (a3f9f2d)
  • tracing: redact values for GETSET and PSETEX (#2134) (832765d)

... (truncated)

Changelog

Sourced from ioredis's changelog.

6.0.0 (2026-07-31)

Bug Fixes

  • clear stale socket timeout on reconnect (#2148) (6455dbe)
  • cluster: recreate stale connection on circular MOVED (#2135) (08c8967)
  • cluster: validate MOVED slot to prevent Array.prototype pollution (#2151) (9618206), closes #1267
  • command: serialize large integer arguments in decimal notation (#2136) (09b8d04)
  • redis: keep reconnecting when connection closes during client setup (#2099) (#2123) (f9a66bc)
  • sentinel: preserve zero preferred slave priority (#2129) (a3f9f2d)
  • tracing: redact values for GETSET and PSETEX (#2134) (832765d)
  • types: export ScanStreamOptions, RedisStatus and ClusterStatus (#2158) (cf3bf71)

Features

BREAKING CHANGES

  • ioredis now requires Node.js 20 or newer and uses RESP3 by default. Set protocol: 2 to retain the v5 wire protocol.
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
Bumps the production-dependencies group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@next/env](https://github.com/vercel/next.js/tree/HEAD/packages/next-env) | `16.2.10` | `16.3.0` | | [jose](https://github.com/panva/jose) | `6.2.3` | `6.2.8` | | [next](https://github.com/vercel/next.js) | `16.2.10` | `16.3.0` | | [next-auth](https://github.com/nextauthjs/next-auth) | `4.24.14` | `4.24.15` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.7` | `19.2.8` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.7` | `19.2.8` | | [@prisma/adapter-pg](https://github.com/prisma/prisma/tree/HEAD/packages/adapter-pg) | `7.8.0` | `7.9.1` | | [@prisma/client](https://github.com/prisma/prisma/tree/HEAD/packages/client) | `7.8.0` | `7.9.1` | | [ioredis](https://github.com/redis/ioredis) | `5.11.1` | `6.0.0` | Updates `@next/env` from 16.2.10 to 16.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">@​next/env's releases</a>.</em></p> <blockquote> <h2>v16.3.0</h2> <h3>Core Changes</h3> <ul> <li>Update vendored lodash to 4.17.23 to fix CVE-2025-13465: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91558">#91558</a></li> <li>Fix invalid HTML response for route-level RSC requests in deployment adapter: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91541">#91541</a></li> <li>Normalize encoded dynamic placeholders in app routes: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91603">#91603</a></li> <li>Fix(pages-router): restore Content-Length and ETag for /_next/data/ JSON responses: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/90304">#90304</a></li> <li>Update tokio from 1.43.0 to 1.47.3: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/90945">#90945</a></li> <li>[turbopack] Simplify snapshotting logic: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91178">#91178</a></li> <li>Turbopack: enable server HMR for app route handlers: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91466">#91466</a></li> <li>turbo-tasks-backend: batch find_and_schedule_dirty using for_each_task_meta: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91497">#91497</a></li> <li>[turbopack] Use bail! instead of panic! for duplicate module ident error: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91636">#91636</a></li> <li>Skip loadBindings() Lightning CSS check during next start: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91538">#91538</a></li> <li>turbo-tasks-backend: batch schedule dirty tasks in aggregation_update: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91461">#91461</a></li> <li>Turbopack: Add importModule() support to webpack loaders: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/89630">#89630</a></li> <li>turbo-persistence: fix mmap page alignment and improve error context in MetaFile::open_internal: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91640">#91640</a></li> <li>turbopack-css: demote recoverable CSS parse warnings to Warning severity: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91524">#91524</a></li> <li>feat(node-streams): add config flag, define-env, and env precedence test: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/90427">#90427</a></li> <li>Rename /_next/webpack-hmr to /_next/hmr: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91415">#91415</a></li> <li>Add per-slot error attribution for instant validation using slot markers and config depth preference: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91610">#91610</a></li> <li>Handle encoded params further: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91627">#91627</a></li> <li>[turbopack] Respect <code>{eval:true}</code> in worker_threads constructors: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91666">#91666</a></li> <li>Fix missing route in otel spans without base-server: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91665">#91665</a></li> <li>[turbopack] Optimize compaction cpu usage: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91468">#91468</a></li> <li>Fix layout segment optimization: move app-page imports to server-utility transition: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91701">#91701</a></li> <li>Fix server actions in standalone mode with <code>cacheComponents</code>: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91711">#91711</a></li> <li>turbo-persistence: remove Unmergeable mmap advice: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91713">#91713</a></li> <li>turbopack: move &quot;compact database&quot; tracing span to backend layer: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91693">#91693</a></li> <li>Turbopack: lazy require metadata and handle TLA: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91705">#91705</a></li> <li>Fix adapter outputs for dynamic metadata routes: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91680">#91680</a></li> <li>Turbopack: fix webpack loader runner layer: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91727">#91727</a></li> <li>[turbopack] Remove incorrect debug_assert in try_read_task_cell: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91699">#91699</a></li> <li>Add module count field to module graph tracing spans: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91697">#91697</a></li> <li>turbopack-cli: add --persistent-caching flag for filesystem-backed cache: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91657">#91657</a></li> <li>Turbopack: pull in updated vercel/nft tests: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91651">#91651</a></li> <li>[turbopack] Improve regressed build speed on cross-compiled MUSL: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91477">#91477</a></li> <li>[Segment Bundling] [Scaffolding] Ensure inlining hint correctness: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91320">#91320</a></li> <li>[Segment Bundling] [Scaffolding] Track which segments can be omitted from prefetch: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91438">#91438</a></li> <li>Avoid deprecated TS node10 moduleResolution defaults: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91847">#91847</a></li> <li>[turbopack] Rebuild the docker build scripts: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91799">#91799</a></li> <li>Fix TS6 baseUrl deprecation for extended tsconfig: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91855">#91855</a></li> <li>Add <code>next internal post-build</code> CLI command for Turbopack database compaction: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91336">#91336</a></li> <li>Turbopack: Define <code>Effect</code> as a trait instead of a closure: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/89080">#89080</a></li> <li>Turbopack: Implement TraceRawVcs and NonLocalValue correctly for Effects: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/89133">#89133</a></li> <li>turbo-tasks-backend: improve print_cache_item_size instrumentation: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91742">#91742</a></li> <li>Turbopack: switch from base40 to base38 hash encoding (remove ~ and . from charset): <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91832">#91832</a></li> <li>Use charCodeAt for normalizePathTrailingSlash: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91380">#91380</a></li> <li>Turbopack: Only patch lockfile when bindings fails to load: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91379">#91379</a></li> <li>[create-next-app] Skip interactive prompts when CLI flags are provided: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91840">#91840</a></li> <li>[devtools] Make instant navs panel draggable: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91914">#91914</a></li> <li>[Segment Bundling] Bundle static prefetches based on size: <a href="https://github.com/vercel/next.js/tree/HEAD/packages/next-env/issues/91439">#91439</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/next.js/commit/d73f5622e226358dcef8cf7a8a373333ff265ae7"><code>d73f562</code></a> v16.3.0</li> <li><a href="https://github.com/vercel/next.js/commit/4fd843fb488f770c5b2023ddc58ff4be4ee81f14"><code>4fd843f</code></a> v16.3.0-canary.107</li> <li><a href="https://github.com/vercel/next.js/commit/9480f7f9ffdc271014d959e7b10d681882eaabb5"><code>9480f7f</code></a> v16.3.0-canary.106</li> <li><a href="https://github.com/vercel/next.js/commit/a8dcd2562f0bde39380d48507ec3fffd86c21e53"><code>a8dcd25</code></a> v16.3.0-canary.105</li> <li><a href="https://github.com/vercel/next.js/commit/38f0cdee4659b1b8f987bc46e3f1aacd12ee5c90"><code>38f0cde</code></a> v16.3.0-canary.104</li> <li><a href="https://github.com/vercel/next.js/commit/f3edea1b06730ce507aeb1b10c8e4f652ca5540d"><code>f3edea1</code></a> v16.3.0-canary.103</li> <li><a href="https://github.com/vercel/next.js/commit/0d5ff0d321424b1f1c55b4466406ddee213d11c7"><code>0d5ff0d</code></a> v16.3.0-canary.102</li> <li><a href="https://github.com/vercel/next.js/commit/cf1e001f40b311f5a4f19775ec9ea4f1d8bdece9"><code>cf1e001</code></a> v16.3.0-canary.101</li> <li><a href="https://github.com/vercel/next.js/commit/267d6b1a17fb4b4b03860c4677e6eeefa65ba2b8"><code>267d6b1</code></a> v16.3.0-canary.100</li> <li><a href="https://github.com/vercel/next.js/commit/ad618bf13fbc4be57d6b6136a20547af50708eb2"><code>ad618bf</code></a> Restore canary version 16.3.0-canary.99 after v16.3.0-preview.10 preview release</li> <li>Additional commits viewable in <a href="https://github.com/vercel/next.js/commits/v16.3.0/packages/next-env">compare view</a></li> </ul> </details> <br /> Updates `jose` from 6.2.3 to 6.2.8 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/panva/jose/releases">jose's releases</a>.</em></p> <blockquote> <h2>v6.2.8</h2> <h3>Fixes</h3> <ul> <li>enforce a single recipient when decrypting dir and ECDH-ES (<a href="https://github.com/panva/jose/commit/505c3833ecae19807e32ad7be50ff4677d31bcad">505c383</a>)</li> <li>reject a non-string &quot;alg&quot; in EmbeddedJWK (<a href="https://github.com/panva/jose/commit/714f8704347ccee8b3d0007e028b6e3f546b443c">714f870</a>)</li> </ul> <h3>Refactor</h3> <ul> <li>index the JWS and JWE registries without a wrapper (<a href="https://github.com/panva/jose/commit/925f3bbbee4b8d5e335774ffbf6ec086e71c3a05">925f3bb</a>)</li> <li>name the &quot;alg&quot; source in unsupported algorithm failures (<a href="https://github.com/panva/jose/commit/1500459c6ffce48fb486c15cb213d24064a26673">1500459</a>)</li> </ul> <h2>v6.2.7</h2> <h3>Fixes</h3> <ul> <li>require own JOSE properties for presence checks (<a href="https://github.com/panva/jose/commit/90ab09c461c9bc82fd24af269616be0907a28bc5">90ab09c</a>)</li> </ul> <h3>Refactor</h3> <ul> <li>reduce bundle size (<a href="https://github.com/panva/jose/commit/767d7f12d025ce54e74f3d38fde3571cc23de5f6">767d7f1</a>)</li> </ul> <h2>v6.2.6</h2> <h3>Fixes</h3> <ul> <li><strong>types:</strong> accept host CryptoKey declarations (<a href="https://github.com/panva/jose/commit/b48a15b39696f49c61136b1d4c40d33585f5df97">b48a15b</a>)</li> </ul> <h2>v6.2.5</h2> <h3>Fixes</h3> <ul> <li>compare claim values for falsy validation options (<a href="https://github.com/panva/jose/commit/eb8695699c75f36c736fb8159a7c7b525be5f6ff">eb86956</a>)</li> <li>forward key management parameters for a single JWE recipient (<a href="https://github.com/panva/jose/commit/2d4f8014e027a1e1ace82bdc864fd0f9b5c66248">2d4f801</a>)</li> <li>handle a zero-length JWE additional authenticated data (<a href="https://github.com/panva/jose/commit/16ca398103c4ab1527c6c6c51621fd963545bd7e">16ca398</a>)</li> <li>reject a generateKeyPair crv option the algorithm does not imply (<a href="https://github.com/panva/jose/commit/76364e9f15f2a7d1c2ff0c260e1e2960cf51e620">76364e9</a>)</li> <li>reject an unencoded payload in the JWS Compact Serialization (<a href="https://github.com/panva/jose/commit/01d053f3b02f3627396d4f70686a58f35cf09862">01d053f</a>)</li> <li>reject characters outside the Base64URL alphabet (<a href="https://github.com/panva/jose/commit/0ebb97158a6eed960ec4d5450abd28336b3c20a4">0ebb971</a>), references <a href="https://redirect.github.com/panva/jose/issues/879">#879</a></li> <li>reject duplicate &quot;crit&quot; values when producing (<a href="https://github.com/panva/jose/commit/31d60e1542141ddecf5b0b87bc894c4bc7e58b1d">31d60e1</a>)</li> <li>reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (<a href="https://github.com/panva/jose/commit/5df3fedcc06d4c52815ec9d0cccc51b508a8291c">5df3fed</a>)</li> <li>reject truncated ASN.1 key data (<a href="https://github.com/panva/jose/commit/7a16c66b9f1a48bcc2aae572da38ed06396a5181">7a16c66</a>)</li> <li>surface non-ASCII token segments as JOSE errors (<a href="https://github.com/panva/jose/commit/194fe11450d6501d0c2141a50e60886157d3f393">194fe11</a>)</li> <li><strong>types:</strong> correct JWK and CryptoKey types (<a href="https://github.com/panva/jose/commit/62a196dc8e6582dc6edd20eab31c6c44b745f996">62a196d</a>)</li> <li><strong>types:</strong> correct key resolver and JWT header types (<a href="https://github.com/panva/jose/commit/e95f8c4086cbb81321497cc7d4b78fa5e88312b6">e95f8c4</a>)</li> <li>validate the clockTolerance and currentDate options are finite (<a href="https://github.com/panva/jose/commit/ab2f18dad46a98ecae3f3ac5b2aae9c839fb9388">ab2f18d</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>correct subpaths and API documentation (<a href="https://github.com/panva/jose/commit/2daec382964be1976d5985e0413a56633becdd74">2daec38</a>)</li> <li>document consumer-supplied type parameters (<a href="https://github.com/panva/jose/commit/9e9f66c86bdf0f4b4ccd1e4b7b84cc85ac9c7883">9e9f66c</a>)</li> <li>stop claiming the JWK &quot;use&quot; parameter is used during import (<a href="https://github.com/panva/jose/commit/47a07b2f95c1b2ecf0308c04f35d4b482689568e">47a07b2</a>)</li> <li>update CHANGELOG.md (<a href="https://github.com/panva/jose/commit/fc51bf56f9f752aaed7d31c60a45e89f24e30d00">fc51bf5</a>)</li> </ul> <h3>Refactor</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/panva/jose/blob/main/CHANGELOG.md">jose's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/panva/jose/compare/v6.2.7...v6.2.8">6.2.8</a> (2026-08-03)</h2> <h3>Fixes</h3> <ul> <li>enforce a single recipient when decrypting dir and ECDH-ES (<a href="https://github.com/panva/jose/commit/505c3833ecae19807e32ad7be50ff4677d31bcad">505c383</a>)</li> <li>reject a non-string &quot;alg&quot; in EmbeddedJWK (<a href="https://github.com/panva/jose/commit/714f8704347ccee8b3d0007e028b6e3f546b443c">714f870</a>)</li> </ul> <h3>Refactor</h3> <ul> <li>index the JWS and JWE registries without a wrapper (<a href="https://github.com/panva/jose/commit/925f3bbbee4b8d5e335774ffbf6ec086e71c3a05">925f3bb</a>)</li> <li>name the &quot;alg&quot; source in unsupported algorithm failures (<a href="https://github.com/panva/jose/commit/1500459c6ffce48fb486c15cb213d24064a26673">1500459</a>)</li> </ul> <h2><a href="https://github.com/panva/jose/compare/v6.2.6...v6.2.7">6.2.7</a> (2026-08-01)</h2> <h3>Fixes</h3> <ul> <li>require own JOSE properties for presence checks (<a href="https://github.com/panva/jose/commit/90ab09c461c9bc82fd24af269616be0907a28bc5">90ab09c</a>)</li> </ul> <h3>Refactor</h3> <ul> <li>reduce bundle size (<a href="https://github.com/panva/jose/commit/767d7f12d025ce54e74f3d38fde3571cc23de5f6">767d7f1</a>)</li> </ul> <h2><a href="https://github.com/panva/jose/compare/v6.2.5...v6.2.6">6.2.6</a> (2026-07-31)</h2> <h3>Fixes</h3> <ul> <li><strong>types:</strong> accept host CryptoKey declarations (<a href="https://github.com/panva/jose/commit/b48a15b39696f49c61136b1d4c40d33585f5df97">b48a15b</a>)</li> </ul> <h2><a href="https://github.com/panva/jose/compare/v6.2.4...v6.2.5">6.2.5</a> (2026-07-29)</h2> <h3>Fixes</h3> <ul> <li>compare claim values for falsy validation options (<a href="https://github.com/panva/jose/commit/eb8695699c75f36c736fb8159a7c7b525be5f6ff">eb86956</a>)</li> <li>forward key management parameters for a single JWE recipient (<a href="https://github.com/panva/jose/commit/2d4f8014e027a1e1ace82bdc864fd0f9b5c66248">2d4f801</a>)</li> <li>handle a zero-length JWE additional authenticated data (<a href="https://github.com/panva/jose/commit/16ca398103c4ab1527c6c6c51621fd963545bd7e">16ca398</a>)</li> <li>reject a generateKeyPair crv option the algorithm does not imply (<a href="https://github.com/panva/jose/commit/76364e9f15f2a7d1c2ff0c260e1e2960cf51e620">76364e9</a>)</li> <li>reject an unencoded payload in the JWS Compact Serialization (<a href="https://github.com/panva/jose/commit/01d053f3b02f3627396d4f70686a58f35cf09862">01d053f</a>)</li> <li>reject characters outside the Base64URL alphabet (<a href="https://github.com/panva/jose/commit/0ebb97158a6eed960ec4d5450abd28336b3c20a4">0ebb971</a>), references <a href="https://redirect.github.com/panva/jose/issues/879">#879</a></li> <li>reject duplicate &quot;crit&quot; values when producing (<a href="https://github.com/panva/jose/commit/31d60e1542141ddecf5b0b87bc894c4bc7e58b1d">31d60e1</a>)</li> <li>reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (<a href="https://github.com/panva/jose/commit/5df3fedcc06d4c52815ec9d0cccc51b508a8291c">5df3fed</a>)</li> <li>reject truncated ASN.1 key data (<a href="https://github.com/panva/jose/commit/7a16c66b9f1a48bcc2aae572da38ed06396a5181">7a16c66</a>)</li> <li>surface non-ASCII token segments as JOSE errors (<a href="https://github.com/panva/jose/commit/194fe11450d6501d0c2141a50e60886157d3f393">194fe11</a>)</li> <li><strong>types:</strong> correct JWK and CryptoKey types (<a href="https://github.com/panva/jose/commit/62a196dc8e6582dc6edd20eab31c6c44b745f996">62a196d</a>)</li> <li><strong>types:</strong> correct key resolver and JWT header types (<a href="https://github.com/panva/jose/commit/e95f8c4086cbb81321497cc7d4b78fa5e88312b6">e95f8c4</a>)</li> <li>validate the clockTolerance and currentDate options are finite (<a href="https://github.com/panva/jose/commit/ab2f18dad46a98ecae3f3ac5b2aae9c839fb9388">ab2f18d</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>correct subpaths and API documentation (<a href="https://github.com/panva/jose/commit/2daec382964be1976d5985e0413a56633becdd74">2daec38</a>)</li> <li>document consumer-supplied type parameters (<a href="https://github.com/panva/jose/commit/9e9f66c86bdf0f4b4ccd1e4b7b84cc85ac9c7883">9e9f66c</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/panva/jose/commit/8b768eb8d2df7b4e25e1a32441ea770663f6d09f"><code>8b768eb</code></a> chore(release): 6.2.8</li> <li><a href="https://github.com/panva/jose/commit/1500459c6ffce48fb486c15cb213d24064a26673"><code>1500459</code></a> refactor: name the &quot;alg&quot; source in unsupported algorithm failures</li> <li><a href="https://github.com/panva/jose/commit/714f8704347ccee8b3d0007e028b6e3f546b443c"><code>714f870</code></a> fix: reject a non-string &quot;alg&quot; in EmbeddedJWK</li> <li><a href="https://github.com/panva/jose/commit/925f3bbbee4b8d5e335774ffbf6ec086e71c3a05"><code>925f3bb</code></a> refactor: index the JWS and JWE registries without a wrapper</li> <li><a href="https://github.com/panva/jose/commit/505c3833ecae19807e32ad7be50ff4677d31bcad"><code>505c383</code></a> fix: enforce a single recipient when decrypting dir and ECDH-ES</li> <li><a href="https://github.com/panva/jose/commit/514831da55bcb1121c1dadc1ccca42049e6c60b9"><code>514831d</code></a> chore(deps): bump the actions group with 3 updates</li> <li><a href="https://github.com/panva/jose/commit/45965db443b120d174a5114c7c84a75a906e9012"><code>45965db</code></a> chore: cleanup after release</li> <li><a href="https://github.com/panva/jose/commit/60b941f6d57e2bb6f87f690ab7fb4da2c9abf4b0"><code>60b941f</code></a> chore(release): 6.2.7</li> <li><a href="https://github.com/panva/jose/commit/90ab09c461c9bc82fd24af269616be0907a28bc5"><code>90ab09c</code></a> fix: require own JOSE properties for presence checks</li> <li><a href="https://github.com/panva/jose/commit/767d7f12d025ce54e74f3d38fde3571cc23de5f6"><code>767d7f1</code></a> refactor: reduce bundle size</li> <li>Additional commits viewable in <a href="https://github.com/panva/jose/compare/v6.2.3...v6.2.8">compare view</a></li> </ul> </details> <br /> Updates `next` from 16.2.10 to 16.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">next's releases</a>.</em></p> <blockquote> <h2>v16.3.0</h2> <h3>Core Changes</h3> <ul> <li>Update vendored lodash to 4.17.23 to fix CVE-2025-13465: <a href="https://redirect.github.com/vercel/next.js/issues/91558">#91558</a></li> <li>Fix invalid HTML response for route-level RSC requests in deployment adapter: <a href="https://redirect.github.com/vercel/next.js/issues/91541">#91541</a></li> <li>Normalize encoded dynamic placeholders in app routes: <a href="https://redirect.github.com/vercel/next.js/issues/91603">#91603</a></li> <li>Fix(pages-router): restore Content-Length and ETag for /_next/data/ JSON responses: <a href="https://redirect.github.com/vercel/next.js/issues/90304">#90304</a></li> <li>Update tokio from 1.43.0 to 1.47.3: <a href="https://redirect.github.com/vercel/next.js/issues/90945">#90945</a></li> <li>[turbopack] Simplify snapshotting logic: <a href="https://redirect.github.com/vercel/next.js/issues/91178">#91178</a></li> <li>Turbopack: enable server HMR for app route handlers: <a href="https://redirect.github.com/vercel/next.js/issues/91466">#91466</a></li> <li>turbo-tasks-backend: batch find_and_schedule_dirty using for_each_task_meta: <a href="https://redirect.github.com/vercel/next.js/issues/91497">#91497</a></li> <li>[turbopack] Use bail! instead of panic! for duplicate module ident error: <a href="https://redirect.github.com/vercel/next.js/issues/91636">#91636</a></li> <li>Skip loadBindings() Lightning CSS check during next start: <a href="https://redirect.github.com/vercel/next.js/issues/91538">#91538</a></li> <li>turbo-tasks-backend: batch schedule dirty tasks in aggregation_update: <a href="https://redirect.github.com/vercel/next.js/issues/91461">#91461</a></li> <li>Turbopack: Add importModule() support to webpack loaders: <a href="https://redirect.github.com/vercel/next.js/issues/89630">#89630</a></li> <li>turbo-persistence: fix mmap page alignment and improve error context in MetaFile::open_internal: <a href="https://redirect.github.com/vercel/next.js/issues/91640">#91640</a></li> <li>turbopack-css: demote recoverable CSS parse warnings to Warning severity: <a href="https://redirect.github.com/vercel/next.js/issues/91524">#91524</a></li> <li>feat(node-streams): add config flag, define-env, and env precedence test: <a href="https://redirect.github.com/vercel/next.js/issues/90427">#90427</a></li> <li>Rename /_next/webpack-hmr to /_next/hmr: <a href="https://redirect.github.com/vercel/next.js/issues/91415">#91415</a></li> <li>Add per-slot error attribution for instant validation using slot markers and config depth preference: <a href="https://redirect.github.com/vercel/next.js/issues/91610">#91610</a></li> <li>Handle encoded params further: <a href="https://redirect.github.com/vercel/next.js/issues/91627">#91627</a></li> <li>[turbopack] Respect <code>{eval:true}</code> in worker_threads constructors: <a href="https://redirect.github.com/vercel/next.js/issues/91666">#91666</a></li> <li>Fix missing route in otel spans without base-server: <a href="https://redirect.github.com/vercel/next.js/issues/91665">#91665</a></li> <li>[turbopack] Optimize compaction cpu usage: <a href="https://redirect.github.com/vercel/next.js/issues/91468">#91468</a></li> <li>Fix layout segment optimization: move app-page imports to server-utility transition: <a href="https://redirect.github.com/vercel/next.js/issues/91701">#91701</a></li> <li>Fix server actions in standalone mode with <code>cacheComponents</code>: <a href="https://redirect.github.com/vercel/next.js/issues/91711">#91711</a></li> <li>turbo-persistence: remove Unmergeable mmap advice: <a href="https://redirect.github.com/vercel/next.js/issues/91713">#91713</a></li> <li>turbopack: move &quot;compact database&quot; tracing span to backend layer: <a href="https://redirect.github.com/vercel/next.js/issues/91693">#91693</a></li> <li>Turbopack: lazy require metadata and handle TLA: <a href="https://redirect.github.com/vercel/next.js/issues/91705">#91705</a></li> <li>Fix adapter outputs for dynamic metadata routes: <a href="https://redirect.github.com/vercel/next.js/issues/91680">#91680</a></li> <li>Turbopack: fix webpack loader runner layer: <a href="https://redirect.github.com/vercel/next.js/issues/91727">#91727</a></li> <li>[turbopack] Remove incorrect debug_assert in try_read_task_cell: <a href="https://redirect.github.com/vercel/next.js/issues/91699">#91699</a></li> <li>Add module count field to module graph tracing spans: <a href="https://redirect.github.com/vercel/next.js/issues/91697">#91697</a></li> <li>turbopack-cli: add --persistent-caching flag for filesystem-backed cache: <a href="https://redirect.github.com/vercel/next.js/issues/91657">#91657</a></li> <li>Turbopack: pull in updated vercel/nft tests: <a href="https://redirect.github.com/vercel/next.js/issues/91651">#91651</a></li> <li>[turbopack] Improve regressed build speed on cross-compiled MUSL: <a href="https://redirect.github.com/vercel/next.js/issues/91477">#91477</a></li> <li>[Segment Bundling] [Scaffolding] Ensure inlining hint correctness: <a href="https://redirect.github.com/vercel/next.js/issues/91320">#91320</a></li> <li>[Segment Bundling] [Scaffolding] Track which segments can be omitted from prefetch: <a href="https://redirect.github.com/vercel/next.js/issues/91438">#91438</a></li> <li>Avoid deprecated TS node10 moduleResolution defaults: <a href="https://redirect.github.com/vercel/next.js/issues/91847">#91847</a></li> <li>[turbopack] Rebuild the docker build scripts: <a href="https://redirect.github.com/vercel/next.js/issues/91799">#91799</a></li> <li>Fix TS6 baseUrl deprecation for extended tsconfig: <a href="https://redirect.github.com/vercel/next.js/issues/91855">#91855</a></li> <li>Add <code>next internal post-build</code> CLI command for Turbopack database compaction: <a href="https://redirect.github.com/vercel/next.js/issues/91336">#91336</a></li> <li>Turbopack: Define <code>Effect</code> as a trait instead of a closure: <a href="https://redirect.github.com/vercel/next.js/issues/89080">#89080</a></li> <li>Turbopack: Implement TraceRawVcs and NonLocalValue correctly for Effects: <a href="https://redirect.github.com/vercel/next.js/issues/89133">#89133</a></li> <li>turbo-tasks-backend: improve print_cache_item_size instrumentation: <a href="https://redirect.github.com/vercel/next.js/issues/91742">#91742</a></li> <li>Turbopack: switch from base40 to base38 hash encoding (remove ~ and . from charset): <a href="https://redirect.github.com/vercel/next.js/issues/91832">#91832</a></li> <li>Use charCodeAt for normalizePathTrailingSlash: <a href="https://redirect.github.com/vercel/next.js/issues/91380">#91380</a></li> <li>Turbopack: Only patch lockfile when bindings fails to load: <a href="https://redirect.github.com/vercel/next.js/issues/91379">#91379</a></li> <li>[create-next-app] Skip interactive prompts when CLI flags are provided: <a href="https://redirect.github.com/vercel/next.js/issues/91840">#91840</a></li> <li>[devtools] Make instant navs panel draggable: <a href="https://redirect.github.com/vercel/next.js/issues/91914">#91914</a></li> <li>[Segment Bundling] Bundle static prefetches based on size: <a href="https://redirect.github.com/vercel/next.js/issues/91439">#91439</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/next.js/commit/d73f5622e226358dcef8cf7a8a373333ff265ae7"><code>d73f562</code></a> v16.3.0</li> <li><a href="https://github.com/vercel/next.js/commit/2e0d4cbe5d54346012b560925c6a58440753e6d6"><code>2e0d4cb</code></a> Edits to turbopackFileSystemCache (<a href="https://redirect.github.com/vercel/next.js/issues/96531">#96531</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/86df9c7588488355cdd6bd08f622efc32a4cb753"><code>86df9c7</code></a> docs: cover direct visits and client navigations in the instant() e2e example...</li> <li><a href="https://github.com/vercel/next.js/commit/47a52c0d6bc2b67648ba770972ec962219e68d4d"><code>47a52c0</code></a> [turbopack / next.js] Add an end-to-end test for new root detection (<a href="https://redirect.github.com/vercel/next.js/issues/96544">#96544</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/8e878d484859c86c147f4a6f7adcec36889d3831"><code>8e878d4</code></a> Remove implicit Partial Prefetching opt-in from <code>instant</code> (<a href="https://redirect.github.com/vercel/next.js/issues/96539">#96539</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/e37ddd19f5e80d0a856c41b503efa376f1e928b9"><code>e37ddd1</code></a> Fix deploy test TypeScript exclusions (<a href="https://redirect.github.com/vercel/next.js/issues/96545">#96545</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/8a4920c15ab9418e8f967f186af9e76ee4f9ee76"><code>8a4920c</code></a> docs: clarify first-party Skills workflows (<a href="https://redirect.github.com/vercel/next.js/issues/96495">#96495</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/4344b83a6beaf0541441c527c56fbce3dd07b202"><code>4344b83</code></a> Flag newly disabled deploy tests (<a href="https://redirect.github.com/vercel/next.js/issues/96505">#96505</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/459617a12598de63c34cec4d5c267207c591d13f"><code>459617a</code></a> fix: double fragment on navigation (<a href="https://redirect.github.com/vercel/next.js/issues/93132">#93132</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/cbf0cef687c9914a2cf9aa6a1ad1d461895a9069"><code>cbf0cef</code></a> Enable TypeScript CLI by default (<a href="https://redirect.github.com/vercel/next.js/issues/96497">#96497</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vercel/next.js/compare/v16.2.10...v16.3.0">compare view</a></li> </ul> </details> <br /> Updates `next-auth` from 4.24.14 to 4.24.15 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/nextauthjs/next-auth/releases">next-auth's releases</a>.</em></p> <blockquote> <h2>next-auth@4.24.15</h2> <p>Security patch release for the 4.x line.</p> <ul> <li><code>getToken()</code> now returns <code>null</code> instead of throwing when the <code>Authorization</code> header contains a malformed Bearer value.</li> <li>OAuth <code>state</code>, <code>nonce</code>, and PKCE check cookies are now bound to the provider that created them and are rejected when a different provider handles the callback. Sign-ins in flight across the upgrade fail once and succeed on retry.</li> <li>Email addresses are Unicode-normalized (NFKC) before validation in the email sign-in flow, closing a homoglyph <code>@</code> bypass.</li> <li>An explicitly configured <code>NEXTAUTH_URL</code> now takes precedence over the auto-detected forwarded host in trusted-host mode.</li> <li>Restores CommonJS compatibility by pinning <code>uuid</code> to <code>^11.1.1</code>; the 14.x line is ESM-only and broke <code>require()</code> on Node versions below 20.19.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nextauthjs/next-auth/commit/d857eec560fb99c8b18d3b22a2693b849a62d1c3"><code>d857eec</code></a> chore(release): next-auth@4.24.15 [skip ci]</li> <li><a href="https://github.com/nextauthjs/next-auth/commit/5bca2399a79ba8d116ca5179b4b1ebcd152e7f05"><code>5bca239</code></a> fix(next-auth): harden getToken parsing and bind OAuth check cookies to provi...</li> <li><a href="https://github.com/nextauthjs/next-auth/commit/db7e27de64fd7ffb97d4d04f602014954d685991"><code>db7e27d</code></a> chore(deps): use uuid ^11.1.1 to keep CommonJS support (<a href="https://redirect.github.com/nextauthjs/next-auth/issues/13466">#13466</a>)</li> <li><a href="https://github.com/nextauthjs/next-auth/commit/32d874c15305adaf03edfdf0ffce5af88fc8c76d"><code>32d874c</code></a> fix(next-auth): repair red v4 CI (lint + pre-existing test drift) (<a href="https://redirect.github.com/nextauthjs/next-auth/issues/13447">#13447</a>)</li> <li><a href="https://github.com/nextauthjs/next-auth/commit/fa858580cd110256f5830515c027ada6dd769bd5"><code>fa85858</code></a> chore: update uuid to v14, remove deprecated types (<a href="https://redirect.github.com/nextauthjs/next-auth/issues/13422">#13422</a>)</li> <li><a href="https://github.com/nextauthjs/next-auth/commit/2a39465620081987179ef435be91a6e2a68ee44f"><code>2a39465</code></a> Merge commit from fork</li> <li><a href="https://github.com/nextauthjs/next-auth/commit/19d2feb24359fa8c79418907fc68d9ec8152ca94"><code>19d2feb</code></a> Merge commit from fork</li> <li>See full diff in <a href="https://github.com/nextauthjs/next-auth/compare/next-auth@4.24.14...next-auth@4.24.15">compare view</a></li> </ul> </details> <br /> Updates `react` from 19.2.7 to 19.2.8 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/react/react/releases">react's releases</a>.</em></p> <blockquote> <h2>19.2.8 (July 21st, 2026)</h2> <h2>React Server Components</h2> <ul> <li>Performance improvements when decoding (<a href="https://redirect.github.com/facebook/react/pull/37087">#37087</a> by <a href="https://github.com/eps1lon"><code>@​eps1lon</code></a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/react/react/commit/1dd4ecbdabf826f527fc9a58c05ea70375b7d170"><code>1dd4ecb</code></a> [FlightReply] Performance improvements when decoding (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/37087">#37087</a>)</li> <li><a href="https://github.com/react/react/commit/b0d2fdb78bdfae075a7fa02ddcebbf25f90952c2"><code>b0d2fdb</code></a> [19.2.x] Update required references to GitHub repo (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/36753">#36753</a>)</li> <li>See full diff in <a href="https://github.com/react/react/commits/v19.2.8/packages/react">compare view</a></li> </ul> </details> <br /> Updates `react-dom` from 19.2.7 to 19.2.8 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/react/react/releases">react-dom's releases</a>.</em></p> <blockquote> <h2>19.2.8 (July 21st, 2026)</h2> <h2>React Server Components</h2> <ul> <li>Performance improvements when decoding (<a href="https://redirect.github.com/facebook/react/pull/37087">#37087</a> by <a href="https://github.com/eps1lon"><code>@​eps1lon</code></a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/react/react/commit/1dd4ecbdabf826f527fc9a58c05ea70375b7d170"><code>1dd4ecb</code></a> [FlightReply] Performance improvements when decoding (<a href="https://github.com/react/react/tree/HEAD/packages/react-dom/issues/37087">#37087</a>)</li> <li><a href="https://github.com/react/react/commit/b0d2fdb78bdfae075a7fa02ddcebbf25f90952c2"><code>b0d2fdb</code></a> [19.2.x] Update required references to GitHub repo (<a href="https://github.com/react/react/tree/HEAD/packages/react-dom/issues/36753">#36753</a>)</li> <li>See full diff in <a href="https://github.com/react/react/commits/v19.2.8/packages/react-dom">compare view</a></li> </ul> </details> <br /> Updates `@prisma/adapter-pg` from 7.8.0 to 7.9.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/prisma/prisma/releases">@​prisma/adapter-pg's releases</a>.</em></p> <blockquote> <h2>7.9.1</h2> <p>Today, we're issuing a patch release to resolve a security advisory in a transitive dependency of Prisma CLI (via <code>@prisma/dev</code>).</p> <p>This fixes <a href="https://redirect.github.com/prisma/prisma/issues/29780">prisma/prisma#29780</a>.</p> <p>It does not actually affect <code>@prisma/dev</code> or Prisma CLI so no urgent action is required, but it is recommended to upgrade nevertheless to avoid false positives from security scanners.</p> <h2>7.9.0</h2> <p>Today, we are excited to share the <code>7.9.0</code> stable release 🎉</p> <p><strong>🌟 Star this repo for notifications about new releases, bug fixes &amp; features — or <a href="https://pris.ly/x">follow us on X</a>!</strong></p> <h1>Highlights</h1> <h2>ORM</h2> <h3>Tab completions for the Prisma CLI</h3> <p>Typing out CLI commands from memory is now optional. Prisma ships <strong>shell tab completions</strong> for <code>bash</code>, <code>zsh</code>, <code>fish</code>, and PowerShell, covering commands, subcommands, options, flags, and even option values.</p> <p><strong>Setting it up.</strong> Most projects run Prisma through a package manager, so completions are enabled through <code>@bomb.sh/tab</code>'s package-manager integration — install it once, then source the completion for your package manager and shell:</p> <pre lang="bash"><code># 1. Install @bomb.sh/tab globally npm install -g @bomb.sh/tab <h1>2. Wire up your package manager + shell (pnpm shown; swap in npm / yarn / bun):</h1> <p>echo 'source &lt;(tab pnpm zsh)' &gt;&gt; ~/.zshrc # zsh<br /> echo 'source &lt;(tab pnpm bash)' &gt;&gt; ~/.bashrc # bash<br /> tab pnpm fish &gt; ~/.config/fish/completions/pnpm.fish # fish<br /> tab pnpm powershell &gt; ~/.tab-pnpm.ps1 # PowerShell (then dot-source it from $PROFILE)<br /> </code></pre></p> <p><code>@bomb.sh/tab</code> delegates to any locally-installed CLI that ships completions, so <code>pnpm prisma &lt;TAB&gt;</code>, <code>pnpm exec prisma &lt;TAB&gt;</code>, <code>yarn prisma &lt;TAB&gt;</code>, and <code>bun x prisma &lt;TAB&gt;</code> all complete Prisma's commands, options, and values — no per-project setup. (<code>npx</code> and <code>bunx</code> don't support completion themselves; use <code>npm exec</code> and <code>bun x</code>.)</p> <p>If instead you have Prisma installed globally on your <code>PATH</code>, source its own completion directly: <code>source &lt;(prisma complete zsh)</code> (or the <code>bash</code> / <code>fish</code> / <code>powershell</code> variant).</p> <p>This is built on <a href="https://github.com/bombshell-dev/tab/"><code>@bomb.sh/tab</code></a>, the same completion library that powers other CLIs in the ecosystem — including Cloudflare, Nuxt, and Vitest — so the package-manager completions you enable for Prisma work for those tools too. A wonderful community contribution from <a href="https://github.com/AmirSa12"><code>@​AmirSa12</code></a> (<a href="https://redirect.github.com/prisma/prisma/pull/28351">#28351</a>) — thank you!</p> <p><a href="https://github.com/user-attachments/assets/1f916a60-ee4d-40be-bb7d-74035d48ca83">https://github.com/user-attachments/assets/1f916a60-ee4d-40be-bb7d-74035d48ca83</a></p> <h3>Prisma ORM, ready for AI agents</h3> <p>Coding agents are now a first-class audience for Prisma, and 7.9.0 brings the first wave of work to make Prisma projects safe and productive for them to work in.</p> <p><strong>Agent skills installed with <code>prisma init</code></strong> (<a href="https://redirect.github.com/prisma/prisma/pull/29689">#29689</a>)</p> <p><code>prisma init</code> now installs the <a href="https://github.com/prisma/skills">prisma/skills</a> catalog into freshly scaffolded projects. Agents such as Claude Code, Cursor, Codex, and Windsurf start out with current, version-relevant Prisma knowledge instead of relying on whatever happened to be in their training data. The install is best-effort and never blocks scaffolding; opt out at any time with <code>--no-skills</code>.</p> <pre lang="terminal"><code>&lt;/tr&gt;&lt;/table&gt; </code></pre> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/prisma/prisma/commit/35003fd86c574741cb5d93a57b773ee33015a79c"><code>35003fd</code></a> chore(adapter-pg): remove duplicate values parameter (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/adapter-pg/issues/29650">#29650</a>)</li> <li><a href="https://github.com/prisma/prisma/commit/d6d9fc9ed341946d45c7d0aba35081a7bd741aa1"><code>d6d9fc9</code></a> chore: remove parameterization from sqlcommenter-query-insights (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/adapter-pg/issues/29518">#29518</a>)</li> <li>See full diff in <a href="https://github.com/prisma/prisma/commits/7.9.1/packages/adapter-pg">compare view</a></li> </ul> </details> <br /> Updates `@prisma/client` from 7.8.0 to 7.9.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/prisma/prisma/releases">@​prisma/client's releases</a>.</em></p> <blockquote> <h2>7.9.1</h2> <p>Today, we're issuing a patch release to resolve a security advisory in a transitive dependency of Prisma CLI (via <code>@prisma/dev</code>).</p> <p>This fixes <a href="https://redirect.github.com/prisma/prisma/issues/29780">prisma/prisma#29780</a>.</p> <p>It does not actually affect <code>@prisma/dev</code> or Prisma CLI so no urgent action is required, but it is recommended to upgrade nevertheless to avoid false positives from security scanners.</p> <h2>7.9.0</h2> <p>Today, we are excited to share the <code>7.9.0</code> stable release 🎉</p> <p><strong>🌟 Star this repo for notifications about new releases, bug fixes &amp; features — or <a href="https://pris.ly/x">follow us on X</a>!</strong></p> <h1>Highlights</h1> <h2>ORM</h2> <h3>Tab completions for the Prisma CLI</h3> <p>Typing out CLI commands from memory is now optional. Prisma ships <strong>shell tab completions</strong> for <code>bash</code>, <code>zsh</code>, <code>fish</code>, and PowerShell, covering commands, subcommands, options, flags, and even option values.</p> <p><strong>Setting it up.</strong> Most projects run Prisma through a package manager, so completions are enabled through <code>@bomb.sh/tab</code>'s package-manager integration — install it once, then source the completion for your package manager and shell:</p> <pre lang="bash"><code># 1. Install @bomb.sh/tab globally npm install -g @bomb.sh/tab <h1>2. Wire up your package manager + shell (pnpm shown; swap in npm / yarn / bun):</h1> <p>echo 'source &lt;(tab pnpm zsh)' &gt;&gt; ~/.zshrc # zsh<br /> echo 'source &lt;(tab pnpm bash)' &gt;&gt; ~/.bashrc # bash<br /> tab pnpm fish &gt; ~/.config/fish/completions/pnpm.fish # fish<br /> tab pnpm powershell &gt; ~/.tab-pnpm.ps1 # PowerShell (then dot-source it from $PROFILE)<br /> </code></pre></p> <p><code>@bomb.sh/tab</code> delegates to any locally-installed CLI that ships completions, so <code>pnpm prisma &lt;TAB&gt;</code>, <code>pnpm exec prisma &lt;TAB&gt;</code>, <code>yarn prisma &lt;TAB&gt;</code>, and <code>bun x prisma &lt;TAB&gt;</code> all complete Prisma's commands, options, and values — no per-project setup. (<code>npx</code> and <code>bunx</code> don't support completion themselves; use <code>npm exec</code> and <code>bun x</code>.)</p> <p>If instead you have Prisma installed globally on your <code>PATH</code>, source its own completion directly: <code>source &lt;(prisma complete zsh)</code> (or the <code>bash</code> / <code>fish</code> / <code>powershell</code> variant).</p> <p>This is built on <a href="https://github.com/bombshell-dev/tab/"><code>@bomb.sh/tab</code></a>, the same completion library that powers other CLIs in the ecosystem — including Cloudflare, Nuxt, and Vitest — so the package-manager completions you enable for Prisma work for those tools too. A wonderful community contribution from <a href="https://github.com/AmirSa12"><code>@​AmirSa12</code></a> (<a href="https://redirect.github.com/prisma/prisma/pull/28351">#28351</a>) — thank you!</p> <p><a href="https://github.com/user-attachments/assets/1f916a60-ee4d-40be-bb7d-74035d48ca83">https://github.com/user-attachments/assets/1f916a60-ee4d-40be-bb7d-74035d48ca83</a></p> <h3>Prisma ORM, ready for AI agents</h3> <p>Coding agents are now a first-class audience for Prisma, and 7.9.0 brings the first wave of work to make Prisma projects safe and productive for them to work in.</p> <p><strong>Agent skills installed with <code>prisma init</code></strong> (<a href="https://redirect.github.com/prisma/prisma/pull/29689">#29689</a>)</p> <p><code>prisma init</code> now installs the <a href="https://github.com/prisma/skills">prisma/skills</a> catalog into freshly scaffolded projects. Agents such as Claude Code, Cursor, Codex, and Windsurf start out with current, version-relevant Prisma knowledge instead of relying on whatever happened to be in their training data. The install is best-effort and never blocks scaffolding; opt out at any time with <code>--no-skills</code>.</p> <pre lang="terminal"><code>&lt;/tr&gt;&lt;/table&gt; </code></pre> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/prisma/prisma/commit/b82985029d44349849dfbb4990bb19278178ee61"><code>b829850</code></a> ci: upgrade pnpm to 11 to restore pnpm audit (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/client/issues/29725">#29725</a>)</li> <li><a href="https://github.com/prisma/prisma/commit/280fd56f28c53f42fb2dfbc190c3d35d046e19fa"><code>280fd56</code></a> fix(client): mask each quoted string in maskQuery independently (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/client/issues/29723">#29723</a>)</li> <li><a href="https://github.com/prisma/prisma/commit/4da377494cc27bc0784d3629df21e94989abd153"><code>4da3774</code></a> fix(client): reject invalid raw dates (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/client/issues/29697">#29697</a>)</li> <li><a href="https://github.com/prisma/prisma/commit/a7cec97b204e734cf30049ee7a39c9b61da085de"><code>a7cec97</code></a> chore(deps): update engines to 7.9.0-1.e922089b7d7502aff4249d5da3420f6fa55fc6...</li> <li><a href="https://github.com/prisma/prisma/commit/58f8439d020d70bf7cc9a77cca62dfc95d9ddc0f"><code>58f8439</code></a> fix(client): pin pg-protocol in prisma-client-imports-postgres e2e test (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/client/issues/29687">#29687</a>)</li> <li><a href="https://github.com/prisma/prisma/commit/918cf5d72c1ba85ed0bb85c50c34d483b02a19e1"><code>918cf5d</code></a> fix(client): improve adapter-related Prisma 7 error messages (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/client/issues/29624">#29624</a>)</li> <li><a href="https://github.com/prisma/prisma/commit/93da6ea2dcd65b8b4b9d58daf2e2821f1a4e9320"><code>93da6ea</code></a> ci(e2e): shard client e2e suite across 3 jobs to fix chronic timeouts (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/client/issues/29619">#29619</a>)</li> <li><a href="https://github.com/prisma/prisma/commit/3937779e617c743966ebb50901d013167dd9171e"><code>3937779</code></a> fix: remove duplicate 'the the' in test comments (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/client/issues/29610">#29610</a>)</li> <li><a href="https://github.com/prisma/prisma/commit/fda8fbce23b3af6b1651bd539da09e62c863ed6e"><code>fda8fbc</code></a> chore(deps): bump <code>@​prisma/dev</code> to 0.24.9 (resolves hono GHSA-92pp-h63x-v22m) (...</li> <li><a href="https://github.com/prisma/prisma/commit/0036baf8c9bb0b53e18c04fb27de4acf0535a306"><code>0036baf</code></a> fix(client-engine-runtime): surface unmapped driver errors as user-facing P20...</li> <li>See full diff in <a href="https://github.com/prisma/prisma/commits/7.9.1/packages/client">compare view</a></li> </ul> </details> <br /> Updates `ioredis` from 5.11.1 to 6.0.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/redis/ioredis/releases">ioredis's releases</a>.</em></p> <blockquote> <h2>v6.0.0</h2> <h1><a href="https://github.com/redis/ioredis/compare/v5.11.1...v6.0.0">6.0.0</a> (2026-07-31)</h1> <ul> <li>Add RESP3 (<a href="https://redirect.github.com/redis/ioredis/issues/2127">#2127</a>) (<a href="https://github.com/redis/ioredis/commit/5d0862e078c1252470872fa3a96d7435bb34f078">5d0862e</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>clear stale socket timeout on reconnect (<a href="https://redirect.github.com/redis/ioredis/issues/2148">#2148</a>) (<a href="https://github.com/redis/ioredis/commit/6455dbe6c7dbbd801aae112c8be935aa2896d7ac">6455dbe</a>)</li> <li><strong>cluster:</strong> recreate stale connection on circular MOVED (<a href="https://redirect.github.com/redis/ioredis/issues/2135">#2135</a>) (<a href="https://github.com/redis/ioredis/commit/08c89671790d5121853e51ed3465dc6b248e8803">08c8967</a>)</li> <li><strong>cluster:</strong> validate MOVED slot to prevent Array.prototype pollution (<a href="https://redirect.github.com/redis/ioredis/issues/2151">#2151</a>) (<a href="https://github.com/redis/ioredis/commit/9618206b93d7022e9fb76f300503a53e1aefb4bc">9618206</a>), closes <a href="https://redirect.github.com/redis/ioredis/issues/1267">#1267</a></li> <li><strong>command:</strong> serialize large integer arguments in decimal notation (<a href="https://redirect.github.com/redis/ioredis/issues/2136">#2136</a>) (<a href="https://github.com/redis/ioredis/commit/09b8d04b62481e68521359a43cb3638e09e92565">09b8d04</a>)</li> <li><strong>redis:</strong> keep reconnecting when connection closes during client setup (<a href="https://redirect.github.com/redis/ioredis/issues/2099">#2099</a>) (<a href="https://redirect.github.com/redis/ioredis/issues/2123">#2123</a>) (<a href="https://github.com/redis/ioredis/commit/f9a66bc0d9022bb21c479ef5580c65e544aa6629">f9a66bc</a>)</li> <li><strong>sentinel:</strong> preserve zero preferred slave priority (<a href="https://redirect.github.com/redis/ioredis/issues/2129">#2129</a>) (<a href="https://github.com/redis/ioredis/commit/a3f9f2dded99f55a59713a8e8d3e395c015d51c1">a3f9f2d</a>)</li> <li><strong>tracing:</strong> redact values for GETSET and PSETEX (<a href="https://redirect.github.com/redis/ioredis/issues/2134">#2134</a>) (<a href="https://github.com/redis/ioredis/commit/832765dbe8c13d23b57392bdd3d88a0a37131732">832765d</a>)</li> <li><strong>types:</strong> export ScanStreamOptions, RedisStatus and ClusterStatus (<a href="https://redirect.github.com/redis/ioredis/issues/2158">#2158</a>) (<a href="https://github.com/redis/ioredis/commit/cf3bf7111bc3de71c6556d1d4897868ab0ec827f">cf3bf71</a>)</li> </ul> <h3>Features</h3> <ul> <li>add LMOVEM and BLMOVEM command support (<a href="https://redirect.github.com/redis/ioredis/issues/2144">#2144</a>) (<a href="https://github.com/redis/ioredis/commit/c26af46dc91874b1da58aec9da337822a4851d97">c26af46</a>)</li> <li>add Redis 8.10 set cardinality commands (<a href="https://redirect.github.com/redis/ioredis/issues/2143">#2143</a>) (<a href="https://github.com/redis/ioredis/commit/301099b77d059dfc47ec591e7f011790ed475a84">301099b</a>)</li> <li>himport managed fieldsets (<a href="https://redirect.github.com/redis/ioredis/issues/2159">#2159</a>) (<a href="https://github.com/redis/ioredis/commit/729f174fca093641d1788480369d00b64c6cc901">729f174</a>)</li> <li>improve default connection resilience (<a href="https://redirect.github.com/redis/ioredis/issues/2160">#2160</a>) (<a href="https://github.com/redis/ioredis/commit/6d0716ef9b3c7c5676c8d866388075e927f6b8b7">6d0716e</a>)</li> <li>support MAXCOUNT and MAXSIZE for stream reads (<a href="https://redirect.github.com/redis/ioredis/issues/2142">#2142</a>) (<a href="https://github.com/redis/ioredis/commit/ae5e41b231d9c1e6d6289848f58355f01f5ba6ec">ae5e41b</a>)</li> </ul> <h3>BREAKING CHANGES</h3> <ul> <li>ioredis now requires Node.js 20 or newer and uses RESP3 by default. Set <code>protocol: 2</code> to retain the v5 wire protocol.</li> </ul> <h2>v6.0.0-beta.1</h2> <h1><a href="https://github.com/redis/ioredis/compare/v5.11.1...v6.0.0-beta.1">6.0.0-beta.1</a> (2026-07-29)</h1> <ul> <li>Add RESP3 (<a href="https://redirect.github.com/redis/ioredis/issues/2127">#2127</a>) (<a href="https://github.com/redis/ioredis/commit/5d0862e078c1252470872fa3a96d7435bb34f078">5d0862e</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>clear stale socket timeout on reconnect (<a href="https://redirect.github.com/redis/ioredis/issues/2148">#2148</a>) (<a href="https://github.com/redis/ioredis/commit/6455dbe6c7dbbd801aae112c8be935aa2896d7ac">6455dbe</a>)</li> <li><strong>cluster:</strong> recreate stale connection on circular MOVED (<a href="https://redirect.github.com/redis/ioredis/issues/2135">#2135</a>) (<a href="https://github.com/redis/ioredis/commit/08c89671790d5121853e51ed3465dc6b248e8803">08c8967</a>)</li> <li><strong>cluster:</strong> validate MOVED slot to prevent Array.prototype pollution (<a href="https://redirect.github.com/redis/ioredis/issues/2151">#2151</a>) (<a href="https://github.com/redis/ioredis/commit/9618206b93d7022e9fb76f300503a53e1aefb4bc">9618206</a>), closes <a href="https://redirect.github.com/redis/ioredis/issues/1267">#1267</a></li> <li><strong>command:</strong> serialize large integer arguments in decimal notation (<a href="https://redirect.github.com/redis/ioredis/issues/2136">#2136</a>) (<a href="https://github.com/redis/ioredis/commit/09b8d04b62481e68521359a43cb3638e09e92565">09b8d04</a>)</li> <li><strong>redis:</strong> keep reconnecting when connection closes during client setup (<a href="https://redirect.github.com/redis/ioredis/issues/2099">#2099</a>) (<a href="https://redirect.github.com/redis/ioredis/issues/2123">#2123</a>) (<a href="https://github.com/redis/ioredis/commit/f9a66bc0d9022bb21c479ef5580c65e544aa6629">f9a66bc</a>)</li> <li><strong>sentinel:</strong> preserve zero preferred slave priority (<a href="https://redirect.github.com/redis/ioredis/issues/2129">#2129</a>) (<a href="https://github.com/redis/ioredis/commit/a3f9f2dded99f55a59713a8e8d3e395c015d51c1">a3f9f2d</a>)</li> <li><strong>tracing:</strong> redact values for GETSET and PSETEX (<a href="https://redirect.github.com/redis/ioredis/issues/2134">#2134</a>) (<a href="https://github.com/redis/ioredis/commit/832765dbe8c13d23b57392bdd3d88a0a37131732">832765d</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/redis/ioredis/blob/main/CHANGELOG.md">ioredis's changelog</a>.</em></p> <blockquote> <h1><a href="https://github.com/redis/ioredis/compare/v5.11.1...v6.0.0">6.0.0</a> (2026-07-31)</h1> <ul> <li>Add RESP3 (<a href="https://redirect.github.com/redis/ioredis/issues/2127">#2127</a>) (<a href="https://github.com/redis/ioredis/commit/5d0862e078c1252470872fa3a96d7435bb34f078">5d0862e</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>clear stale socket timeout on reconnect (<a href="https://redirect.github.com/redis/ioredis/issues/2148">#2148</a>) (<a href="https://github.com/redis/ioredis/commit/6455dbe6c7dbbd801aae112c8be935aa2896d7ac">6455dbe</a>)</li> <li><strong>cluster:</strong> recreate stale connection on circular MOVED (<a href="https://redirect.github.com/redis/ioredis/issues/2135">#2135</a>) (<a href="https://github.com/redis/ioredis/commit/08c89671790d5121853e51ed3465dc6b248e8803">08c8967</a>)</li> <li><strong>cluster:</strong> validate MOVED slot to prevent Array.prototype pollution (<a href="https://redirect.github.com/redis/ioredis/issues/2151">#2151</a>) (<a href="https://github.com/redis/ioredis/commit/9618206b93d7022e9fb76f300503a53e1aefb4bc">9618206</a>), closes <a href="https://redirect.github.com/redis/ioredis/issues/1267">#1267</a></li> <li><strong>command:</strong> serialize large integer arguments in decimal notation (<a href="https://redirect.github.com/redis/ioredis/issues/2136">#2136</a>) (<a href="https://github.com/redis/ioredis/commit/09b8d04b62481e68521359a43cb3638e09e92565">09b8d04</a>)</li> <li><strong>redis:</strong> keep reconnecting when connection closes during client setup (<a href="https://redirect.github.com/redis/ioredis/issues/2099">#2099</a>) (<a href="https://redirect.github.com/redis/ioredis/issues/2123">#2123</a>) (<a href="https://github.com/redis/ioredis/commit/f9a66bc0d9022bb21c479ef5580c65e544aa6629">f9a66bc</a>)</li> <li><strong>sentinel:</strong> preserve zero preferred slave priority (<a href="https://redirect.github.com/redis/ioredis/issues/2129">#2129</a>) (<a href="https://github.com/redis/ioredis/commit/a3f9f2dded99f55a59713a8e8d3e395c015d51c1">a3f9f2d</a>)</li> <li><strong>tracing:</strong> redact values for GETSET and PSETEX (<a href="https://redirect.github.com/redis/ioredis/issues/2134">#2134</a>) (<a href="https://github.com/redis/ioredis/commit/832765dbe8c13d23b57392bdd3d88a0a37131732">832765d</a>)</li> <li><strong>types:</strong> export ScanStreamOptions, RedisStatus and ClusterStatus (<a href="https://redirect.github.com/redis/ioredis/issues/2158">#2158</a>) (<a href="https://github.com/redis/ioredis/commit/cf3bf7111bc3de71c6556d1d4897868ab0ec827f">cf3bf71</a>)</li> </ul> <h3>Features</h3> <ul> <li>add LMOVEM and BLMOVEM command support (<a href="https://redirect.github.com/redis/ioredis/issues/2144">#2144</a>) (<a href="https://github.com/redis/ioredis/commit/c26af46dc91874b1da58aec9da337822a4851d97">c26af46</a>)</li> <li>add Redis 8.10 set cardinality commands (<a href="https://redirect.github.com/redis/ioredis/issues/2143">#2143</a>) (<a href="https://github.com/redis/ioredis/commit/301099b77d059dfc47ec591e7f011790ed475a84">301099b</a>)</li> <li>himport managed fieldsets (<a href="https://redirect.github.com/redis/ioredis/issues/2159">#2159</a>) (<a href="https://github.com/redis/ioredis/commit/729f174fca093641d1788480369d00b64c6cc901">729f174</a>)</li> <li>improve default connection resilience (<a href="https://redirect.github.com/redis/ioredis/issues/2160">#2160</a>) (<a href="https://github.com/redis/ioredis/commit/6d0716ef9b3c7c5676c8d866388075e927f6b8b7">6d0716e</a>)</li> <li>support MAXCOUNT and MAXSIZE for stream reads (<a href="https://redirect.github.com/redis/ioredis/issues/2142">#2142</a>) (<a href="https://github.com/redis/ioredis/commit/ae5e41b231d9c1e6d6289848f58355f01f5ba6ec">ae5e41b</a>)</li> </ul> <h3>BREAKING CHANGES</h3> <ul> <li>ioredis now requires Node.js 20 or newer and uses RESP3 by default. Set <code>protocol: 2</code> to retain the v5 wire protocol.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/redis/ioredis/commit/8ed2946504a36ae9b1e186b9dccc56afcd046d78"><code>8ed2946</code></a> chore(release): 6.0.0 [skip ci]</li> <li><a href="https://github.com/redis/ioredis/commit/3b410f80681d006ebef160493b85ce575aea0d8c"><code>3b410f8</code></a> docs: clarify managed HIMPORT fieldset behavior (<a href="https://redirect.github.com/redis/ioredis/issues/2161">#2161</a>)</li> <li><a href="https://github.com/redis/ioredis/commit/729f174fca093641d1788480369d00b64c6cc901"><code>729f174</code></a> feat: himport managed fieldsets (<a href="https://redirect.github.com/redis/ioredis/issues/2159">#2159</a>)</li> <li><a href="https://github.com/redis/ioredis/commit/6d0716ef9b3c7c5676c8d866388075e927f6b8b7"><code>6d0716e</code></a> feat: improve default connection resilience (<a href="https://redirect.github.com/redis/ioredis/issues/2160">#2160</a>)</li> <li><a href="https://github.com/redis/ioredis/commit/cf3bf7111bc3de71c6556d1d4897868ab0ec827f"><code>cf3bf71</code></a> fix(types): export ScanStreamOptions, RedisStatus and ClusterStatus (<a href="https://redirect.github.com/redis/ioredis/issues/2158">#2158</a>)</li> <li><a href="https://github.com/redis/ioredis/commit/aac171b02ee0fd0b959087e379eda97024b41ac6"><code>aac171b</code></a> ci: update Redis test image (<a href="https://redirect.github.com/redis/ioredis/issues/2156">#2156</a>)</li> <li><a href="https://github.com/redis/ioredis/commit/807bb1c8660fd47d27a2f19a9a5c08aabec1ca43"><code>807bb1c</code></a> chore(release): update repository URL (<a href="https://redirect.github.com/redis/ioredis/issues/2154">#2154</a>)</li> <li><a href="https://github.com/redis/ioredis/commit/6c889e75df8488246dcc234ff8b0e83dc9f78f75"><code>6c889e7</code></a> docs: add security policy (<a href="https://redirect.github.com/redis/ioredis/issues/2153">#2153</a>)</li> <li><a href="https://github.com/redis/ioredis/commit/6455dbe6c7dbbd801aae112c8be935aa2896d7ac"><code>6455dbe</code></a> fix: clear stale socket timeout on reconnect (<a href="https://redirect.github.com/redis/ioredis/issues/2148">#2148</a>)</li> <li><a href="https://github.com/redis/ioredis/commit/9618206b93d7022e9fb76f300503a53e1aefb4bc"><code>9618206</code></a> fix(cluster): validate MOVED slot to prevent Array.prototype pollution (<a href="https://redirect.github.com/redis/ioredis/issues/2151">#2151</a>)</li> <li>Additional commits viewable in <a href="https://github.com/redis/ioredis/compare/v5.11.1...v6.0.0">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details>
dependabot[bot] commented 2026-08-16 19:00:45 -05:00 (Migrated from github.com)
Copy link

Looks like these dependencies are updatable in another way, so this is no longer needed.

Looks like these dependencies are updatable in another way, so this is no longer needed.

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
auth

   
autorelease: pending

   
autorelease: tagged

   
bug
Something isn't working

  
dependencies
Pull requests that update a dependency file

  
devops

   
docker
Pull requests that update docker code

  
documentation
Improvements or additions to documentation

  
duplicate
This issue or pull request already exists

  
enhancement
New feature or request

  
github_actions
Pull requests that update GitHub Actions code

  
good first issue
Good for newcomers

  
help wanted
Extra attention is needed

  
invalid
This doesn't seem right

  
javascript
Pull requests that update javascript code

  
maintenance

   
question
Further information is requested

  
refactor

   
ui

   
wontfix
This will not be worked on

No labels
auth
autorelease: pending
autorelease: tagged
bug
dependencies
devops
docker
documentation
duplicate
enhancement
github_actions
good first issue
help wanted
invalid
javascript
maintenance
question
refactor
ui
wontfix
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
gitchegumi/GitchAlerts!148
No description provided.