fix(deps): update all non-major dependencies - #252
Conversation
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
ApprovabilityVerdict: Not approved Macroscope's review found this PR not approvable — The PR is confined to ignored dependency manifest and lockfile paths, but those files determine the production dependency graph and their contents cannot be fully verified here. Both changed files are owned by another user, so the dependency updates warrant human review. Notes:
You can add or adjust custom eligibility rules. Learn more. |
7c3c912 to
4e34e61
Compare
renovate
Bot
changed the title
6d189a3 to
fa7414b
Compare
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
fa7414b to
24a3267
Compare
![macroscopeapp[bot]](https://avatars.githubusercontent.com/in/900172?s=60&v=4){kind=small}
d52b196 to
93bc04f
Compare
93bc04f to
f71b20b
Compare
This PR contains the following updates:
^7.9.1→^7.10.0^7.9.1→^7.10.05.5.0→5.5.1^10.70.0→^10.72.0^8.21.0→^8.23.1^4.1.10→^4.1.11^2.26.0→^2.27.1^26.3.6→^26.4.0^17.3.0→^17.4.1^0.63.0→^0.65.0^1.78.0→^1.80.011.21.0→11.24.0^7.9.1→^7.10.0^4.1.10→^4.1.11Release Notes
prisma/prisma (@prisma/adapter-pg)
v7.10.0Compare Source
Prisma ORM 7.10.0
Prisma ORM 7.10.0 introduces a compatibility package for running Prisma 7 alongside newer Prisma versions, secures Prisma Studio's local server, and includes fixes across Prisma Client and the PostgreSQL, MariaDB, Neon, SQLite, and Prisma Postgres Serverless adapters.
Highlights
Run Prisma 7 alongside Prisma 8
This release introduces
@prisma/prisma7, a compatibility package that lets you retain a matching Prisma 7 CLI and configuration while installing Prisma 8 in the same project.Once 7.10.0 is released, a side-by-side installation can use:
Use
prismafor the directly installed Prisma 8 CLI andprisma7for Prisma 7:Prisma 7 now prefers version-specific configuration files, allowing its configuration to coexist with Prisma 8's
prisma.config.*files:Without an explicit
--configoption, Prisma 7 searches for:prisma7.config.*files..config/prisma7.*files.prisma.config.*files as a backwards-compatible fallback.The supported extensions are
.js,.ts,.mjs,.cjs,.mts, and.cts. An explicit config path always takes precedence:New projects initialized by the Prisma 7 CLI use
prisma7.config.ts. Existing projects containing onlyprisma.config.*continue to work without migration or additional warnings. If aprisma7.config.*file exists but cannot be loaded, Prisma reports the error rather than silently falling back to another configuration.The
prisma7identity is carried through CLI help, version output, shell completion, initialization, migration, database, and generation guidance. Stable Prisma concepts such asschema.prisma, Prisma Migrate,@prisma/client, andPRISMA_*environment variables remain unchanged.Together, the separate executable and configuration namespace make it possible to operate Prisma 7 and Prisma 8 side by side without command or config-file collisions.
#29949, #29969, #29994, #30000, #30002, #30020
Prisma Studio security hardening
Prisma Studio's local HTTP server now:
127.0.0.1instead of all network interfaces.localhostor127.0.0.1Studio URL.This prevents network clients or malicious websites from accessing Studio's database endpoints while Studio is running.
#29890
Prisma Client
P2002errors from nested writes someta.modelNameidentifies the model where the unique constraint violation occurred, including models using@@mapand@@schema. #29628findUniqueOrThrow()calls so every missing record rejects withP2025; later misses no longer resolve toundefined. #29654$disconnect(), including transactions whose driver-level startup is still in progress. #28768selectorinclude. #29683DateandUint8Arrayvalues created in other JavaScript realms, such as iframes, jsdom, and Node.jsvmcontexts. #29177Datevalues passed to$queryRawor$executeRawnow throwPrismaClientValidationErrorinstead of a generic error. #29718moduleFormatinference for theprisma-clientgenerator in TypeScript projects usingmodule: "node16"or"nodenext". Generated output now follows the nearestpackage.jsontype, defaulting to CommonJS when absent. #29712Bytesvalues now own standaloneArrayBuffers rather than exposing unrelated contents from Node.js's sharedBufferpool. This applies to both regular and raw query results. #29701Client extensions and observability
Result-extension
computecallbacks now receive the current model name as a typed second argument:The model name is also preserved when multiple extensions compose the same computed field. #29782
Improved OpenTelemetry context for remotely executed queries:
$on('query')callbacks run within the matchingdb_queryspan.#28892
Driver adapters
MariaDB
@prisma/adapter-mariadbnow accepts an existingmariadbpool. External pools remain caller-owned unlessdisposeExternalPool: trueis supplied. #27992release()and transaction-specific listeners are removed before reuse. #29612mysql://andmariadb://connection strings. #29026PostgreSQL, Neon, and Prisma Postgres Serverless
40P01are now reported asP2034transaction write conflicts. #29717RESTRICTviolations using SQLSTATE23001are now reported asP2003, preserving an available field or constraint name. #29554@prisma/adapter-pgnow preserves database constraint names when reporting unique constraint violations throughP2002. #29587P2002, falling back to parsed field names when no constraint name is available. #29801BytesandDateTime. #29747SQLite
@prisma/adapter-better-sqlite3now converts previously unhandled SQLite result codes into typed database errors instead of exposing raw driver errors.SQLITE_BUSYfamily is now mapped to socket timeout errors, with numeric extended result codes preserved where available.#29794
CLI and Migrate
prisma generatecan now offer to install Prisma's agent skills. The opt-in prompt:--no-hintsis used or Prisma skills are already installed.#29690
A globally installed CLI now warns during
prisma generatewhen its version differs from the project's localprismaor@prisma/client, and recommends running the local CLI. The check is best-effort and does not fail generation. #29593prisma versionandprisma version --jsonnow include the resolved Prisma CLI package path, making global-versus-local installation issues easier to diagnose. #29573Empty or generator-only schema files now report
Schema must contain a datasource blockfromdb pull,db push, andmigrate dev, rather than reaching the schema engine and potentially producing inconsistent errors. #29657CLI commands now tolerate corrupt, unreadable, or unwritable command-state files. Invalid state is reinitialized, writes are atomic, and persistence failures fall back to in-memory state. #29609
Studio now recognizes semicolon-delimited
sqlserver://connection strings before reporting the existing explicit message that SQL Server is not supported by Studio. #29623The AI-agent safety checkpoint now also covers interactive
prisma db pushconfirmations involving data-loss warnings, rather than only invocations using--accept-data-loss. #29793Performance and reliability
Dependencies
fast-uridependency to a patched release addressing production audit advisories affecting versions through3.1.3. #29758sapphiredev/framework (@sapphire/framework)
v5.5.1Compare Source
🐛 Bug Fixes
getsentry/sentry-javascript (@sentry/node)
v10.72.0Compare Source
Important Changes
AI integrations no longer report errors that propagate to the caller (#23638, #23639, #23640)
Across all AI integrations (OpenAI, Anthropic, Google GenAI, LangChain, and LangGraph), the SDK no longer sends an event to Sentry for errors that the AI framework propagates to your code. Previously the instrumentation reported these as unhandled (
handled: false) before your own error handling ran, so an error your code caught still showed up in Sentry as an unhandled crash. The span is still marked as errored and the error still propagates, so reporting is left to your application: if your code does not handle the error, it reaches Sentry's global error handlers and is captured as unhandled, just like any other uncaught error. Errors that a provider surfaces as data on an otherwise successful response (such as Anthropic error-shaped responses or Google GenAI blocked content) are still captured, since your code never sees them propagate.feat(v10/cloudflare): Add
rpcTracePropagationBindings(#23737, #23738)The new
rpcTracePropagationBindingsoption names theenvbindings that outgoing RPC calls propagate trace context to. Strings match a binding name exactly, regular expressions match by pattern, and the default empty array propagates to nothing. RPC has no headers to carry trace context, so the SDK appends it as a trailing argument that only a Sentry-instrumented receiver removes again. List only the bindings whose receiver you know runs Sentry. Setting the option takes precedence overenableRpcTracePropagation, which is now deprecated. When you build with the Sentry Cloudflare Vite plugin, the bindings that resolve to this worker (its own Durable Objects and self service bindings) are derived from your wrangler config and added for you.Other Changes
_childSpanTimeoutID(#23673)Internal Changes
Work in this release was contributed by @ryanrho-mercor, @lux-in-tenebris-lucet, and @suhailopensource. Thank you for your contributions!
Bundle size 📦
v10.71.0Compare Source
Important Changes
The
enableLogsclient option now defaults totrue, so Sentry Logs work without any manual opt-in. Nothing is captured unless you call theSentry.logger.*APIs or add a log-forwarding integration (such asconsoleLoggingIntegration,pinoIntegration, or the winston transport), and you can setenableLogs: falseto opt out. Although a default change like this would normally land in a major release, we are shipping it in a minor after careful consideration, since it sends no data on its own and only takes effect once you actively use the logging APIs or a logging integration.Other Changes
scope.clear()method (#23231)Headersinstances (#23241)captureExceptionfrom scope, not fromClient(#23280)Internal Changes
Bundle size 📦
vitest-dev/vitest (@vitest/coverage-v8)
v4.1.11Compare Source
🐞 Bug Fixes
View changes on GitHub
HugoRCD/evlog (evlog)
v2.27.1Compare Source
What's Changed
Bug Fixes 🐞
Full Changelog: https://github.com/HugoRCD/evlog/compare/evlog@2.27.0...evlog@2.27.1
v2.27.0Compare Source
What's Changed
Features 🚀
Bug Fixes 🐞
Documentation 📚
Other Changes 🔨
Full Changelog: https://github.com/HugoRCD/evlog/compare/evlog@2.26.0...evlog@2.27.0
i18next/i18next (i18next)
v26.4.0Compare Source
toResolveHierarchyresults per(code, fallbackCode)pair. The hierarchy resolver runs on everyt()call and callsIntl.getCanonicalLocalesmultiple times, which showed up prominently when profiling render-heavy UIs (e.g. virtualized data grids); with the cache the per-call cost drops from ~886 ns to ~41 ns. The cache is invalidated automatically whenoptions.fallbackLngchanges (reassignment or in-place array mutation); if you mutate other resolution-relevant options at runtime (load,lowerCaseLng,cleanCode,nonExplicitSupportedLngs), calli18next.services.languageUtils.clearCache()afterwards. Function-valuedfallbackLngand per-call array/objectfallbackLngoptions are never cached, so dynamic fallbacks keep working as before. Thanks @equaterina (#2444).@rollup/plugin-babelsupports 8, eslint on 9.x for neostandard). Removed the unusedcoverallspackage (CI uses the Coveralls GitHub Action) and replacedsinonwithnise+vitest.spyOnin the v1 compatibility tests, which resolves all opennpm auditfindings (0 vulnerabilities) and should close the dependabot alerts on the lockfile.lint-staged/lint-staged (lint-staged)
v17.4.1Compare Source
Patch Changes
efe5b63- This is a version-bump-only release because the previous version17.4.0was not published to npmjs.com due to problems with GitHub Actions and Changesets.oxc-project/oxc (oxfmt)
v0.65.0Compare Source
v0.64.0Compare Source
🚀 Features
c07fe7coxfmt: SupportexperimentalOperatorPosition(#25643) (leaysgur)📚 Documentation
fed6681oxfmt: Skip expanding overrides options (#25572) (leaysgur)oxc-project/oxc (oxlint)
v1.80.0Compare Source
v1.79.0Compare Source
💥 BREAKING CHANGES
8c4552dlinter: [BREAKING] Split react/react-compiler into per-category rules (#25500) (Boshen)🐛 Bug Fixes
228e8e0linter: Resolve inactive React compiler rules (#25830) (Boshen)aa49d86linter: Allow spread rule options in config types (#25675) (ch3rry)36f8451linter/eslint/no-eval: Align indirect default with ESLint (#25656) (camc314)beb724dlinter/eslint/no-unused-vars: Report bare underscore parameters (#25663) (camc314)4004c10linter/eslint/no-irregular-whitespace: Check comments by default (#25660) (camc314)285820elinter/no-large-snapshots: Precompile and document allowed snapshot matchers (#25611) (Mikhail Baev)4df5835linter: Allow capitalized built-in calls (#25516) (Boshen)pnpm/pnpm (pnpm)
v11.24.0: pnpm 11.24Compare Source
Minor Changes
Patch Changes
Fixed pnpm v11 incorrectly reporting
confirmModulesPurgeas unrecognized when set inpnpm-workspace.yaml. The Rust CLI now identifies the unsupported option as a pnpm v11 setting instead of suggesting an unrelated setting.pnpm install --frozen-lockfileno longer fails withERR_PNPM_FROZEN_LOCKFILE_WITH_OUTDATED_LOCKFILEwhen the pinned pnpm version recorded inpnpm-lock.yamlhas to be re-resolved before it can be installed. It runs the pnpm version the lockfile pins and leaves the lockfile unchanged #14124.Under
nodeLinker: hoisted, peer-resolution variants of an injected directory dependency (afile:snapshot) are materialized as separate copies again instead of collapsing onto the first-seen variant. Each copy keeps its own peer-resolved dependency set, so a project pinning one peer version no longer resolves another project's variant — Bit root components with conflicting peers across injected copies rely on this.Fixed
pnpm install --merge-git-branch-lockfiles --frozen-lockfilefailing withERR_PNPM_OUTDATED_LOCKFILEwhen a branch lockfile predates the removal of a dependency, or its move to another dependency group #13966. A dependency that no project declares anymore is no longer reinstated by the merge, and the packages it was the only path to are dropped with it.Batch workspace publishing accepts a shared scope-specific credential, rejects mismatched credentials for a registry before publishing, and runs the
publishandpostpublishscripts after each completed registry group pnpm/pnpm#14101.The Rust CLI now honors five settings it recognized but ignored:
updateNotifier,legacyDirFiltering,initAuthorName/initAuthorEmail/initAuthorUrl,initLicense, andinitVersion.pnpm installandpnpm addcheck once a day for a newer pnpm and print how to get it (turn it off withupdateNotifier: false); a{<dir>}filter selector can go back to matching the subtree below the directory withlegacyDirFiltering: true; andpnpm initwrites the configured author, license, and version into thepackage.jsonit scaffolds.PNPM_CONFIG_INIT_VERSIONis now read as well.maxsockets, npm's spelling ofmaxSockets, is no longer ignored: both spellings are read frompnpm-workspace.yaml, the global config file, the environment, and the command line, in that increasing order of precedence — a value passed on the command line now wins even when the two sides spelled the setting differently.A
lastUpdateChecktimestamp dated in the future — after a clock change, a restored snapshot, or a hand-edited state file — no longer silences the update check until that time comes around.legacyDirFilteringno longer reaches the workspace-root selectors pnpm generates for itself: the!{<workspace-root>}exclusion a recursiverun/exec/add/testappends, and the{<workspace-root>}inclusion--workspace-rootappends. Read as subtree matches they named every project below the root, so a recursive command under the setting selected nothing at all, and--workspace-rootpulled in every project below the root instead of the root alone #14101.pnpm install --frozen-lockfileno longer fails whenpnpm-lock.yamlrecords the pinned pnpm version alongside an engine package the running pnpm does not install it from. An entry pinning another version is still refused, and a plain install rewrites the block #14124.v11.23.0: pnpm 11.23Compare Source
Minor Changes
pnpm config getandpnpm config listnow show the settings pnpm acts on under their documented names:registriesshows the registries pnpm resolves from, merged across every source (.npmrc,pnpm-workspace.yaml, the global config, CLI flags), in the shape the setting is written in: keyed by registry URL, with the default registry declared as the bare@scope. Built-in routes are included — the@jsrscope and thenpmjsandghprefixes — unless pointed elsewhere. Previouslypnpm config get registriesprintedundefined.updateandauditshow the effective sections, whichever spelling set them. The deprecated internal spellings (updateConfig,auditConfig,auditLevel) are no longer listed.catalogsshows the complete resolved catalog set — the singularcatalogblock is itsdefaultentry — whichever spelling declared it.registryand@scope:registryentries show the merged routes rather than raw.npmrcvalues, so they always agree with theregistriesview.Settings that no supported pnpm version recognizes get their own warning. A key in the global config file that this version of pnpm does not read is no longer reported with advice to move it to a project-level
pnpm-workspace.yaml(where it would be ignored too); the warning now says the setting is not recognized by this version of pnpm, names the pnpm version that does read it when there is one (for example,globalShimsis a pnpm v12 setting), and suggests the closest real setting name when the key looks like a typo. Unrecognized and non-camelCase keys in a project'spnpm-workspace.yaml, previously ignored silently, are now reported the same way.pnpm config get <key>andpnpm get <key>no longer print config-load warnings, so a script capturing the value gets the value alone.The
importPackagepnpmfile hook is deprecated. pnpm now prints a warning when a pnpmfile defines it, and the hook will be removed in the next major version. It also opts the installation out of the parallel package importer, making installation slower. If you rely on this hook, comment on #14101.node_modules/.modules.yamlno longer records the registries an install resolved from, and the recorded copy is dropped from the file on the first install that rewrites it.It dated from the lockfile format that spelled a dependency's path relative to its registry, where reading an installed tree meant knowing the registries it was installed with. Dependency paths have not carried a registry for several major versions, and the recorded copy outlived its use:
pnpm list,pnpm why, and single-project installs preferred it over the project's own configuration, so a project whose registry had changed since its last install was still read through the old one.They now use the configured registries
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.