Skip to content

deps(deps): bump the production-minor-patch group across 1 directory with 21 updates - #23

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/production-minor-patch-1159f41b20
Open

deps(deps): bump the production-minor-patch group across 1 directory with 21 updates#23
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/production-minor-patch-1159f41b20

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 5, 2026

Copy link
Copy Markdown
Contributor

Bumps the production-minor-patch group with 21 updates in the / directory:

Package From To
@cloudflare/puppeteer 1.1.0 1.2.0
@cloudflare/workers-oauth-provider 0.8.1 0.8.3
agents 0.17.4 0.20.1
hono 4.12.25 4.12.33
@rspress/core 2.0.14 2.0.19
@modelcontextprotocol/sdk 1.29.0 1.30.0
@fontsource/fraunces 5.2.9 5.3.0
@fontsource/public-sans 5.2.7 5.3.0
@isomorphic-git/lightning-fs 4.6.2 4.7.0
@supabase/supabase-js 2.106.2 2.111.0
@tsparticles/engine 4.3.0 4.3.2
@tsparticles/plugin-emitters 4.3.0 4.3.2
@tsparticles/react 4.3.0 4.3.2
@tsparticles/shape-text 4.3.0 4.3.2
@tsparticles/slim 4.3.0 4.3.2
isomorphic-git 1.38.7 1.40.0
lucide-react 1.24.0 1.28.0
radix-ui 1.6.2 1.6.7
react-i18next 17.0.10 17.0.11
react-router-dom 7.16.0 7.18.2
fuse.js 7.4.0 7.5.0

Updates @cloudflare/puppeteer from 1.1.0 to 1.2.0

Release notes

Sourced from @​cloudflare/puppeteer's releases.

v1.2.0

What's Changed

Full Changelog: cloudflare/puppeteer@v1.1.0...v1.2.0

Commits
  • fb2979b Merge pull request #223 from cloudflare/ruskin/brapi-cdp-types
  • f0aee62 fix(types): make Cloudflare.* CDP commands type-check correctly
  • e4b373c chore(lint): fix pre-existing prettier violations blocking CI
  • 27a7bb7 style: fix pre-existing prettier violation in PuppeteerWorkers.ts
  • f0918b8 fix(cloudflare): satisfy lint on Cloudflare.* CDP types
  • e26649b fix(cloudflare): drop unused ProtocolMapping import
  • e90036e feat(cloudflare): add typed Cloudflare.* CDP command definitions
  • fccf2b7 Merge pull request #200 from cloudflare/ruskin/rename-browser-run
  • b3fc6e3 Rename Browser Rendering to Browser Run in README and package.json
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​cloudflare/puppeteer since your current version.


Updates @cloudflare/workers-oauth-provider from 0.8.1 to 0.8.3

Release notes

Sourced from @​cloudflare/workers-oauth-provider's releases.

v0.8.3

Patch Changes

  • #240 0061270 Thanks @​agent-think! - Fix worker crash (HTTP 500) when the /token request sends a malformed Content-Type header. The endpoint previously used a loose includes() check, so a header such as application/json, application/x-www-form-urlencoded passed validation and then caused request.formData() to throw. The media type is now parsed strictly (parameters are stripped and the exact media type is compared), and form parsing is guarded so invalid bodies return a 400 invalid_request instead of crashing the worker.

  • #246 771a207 Thanks @​agent-think! - Validate the RFC 8707 resource parameter before consuming an authorization code, so a token request rejected with invalid_target can be retried with an allowed resource.

  • #249 f0f5dc0 Thanks @​mattzcarey! - Preserve a subject access token's scope when issuing tokens through OAuth 2.0 Token Exchange.

v0.8.2

Patch Changes

  • #241 76d2fcd Thanks @​mattzcarey! - Allow EMA ID-JAG assertions to omit the optional resource claim, falling back to the provider's configured protected resource.
Changelog

Sourced from @​cloudflare/workers-oauth-provider's changelog.

0.8.3

Patch Changes

  • #240 0061270 Thanks @​agent-think! - Fix worker crash (HTTP 500) when the /token request sends a malformed Content-Type header. The endpoint previously used a loose includes() check, so a header such as application/json, application/x-www-form-urlencoded passed validation and then caused request.formData() to throw. The media type is now parsed strictly (parameters are stripped and the exact media type is compared), and form parsing is guarded so invalid bodies return a 400 invalid_request instead of crashing the worker.

  • #246 771a207 Thanks @​agent-think! - Validate the RFC 8707 resource parameter before consuming an authorization code, so a token request rejected with invalid_target can be retried with an allowed resource.

  • #249 f0f5dc0 Thanks @​mattzcarey! - Preserve a subject access token's scope when issuing tokens through OAuth 2.0 Token Exchange.

0.8.2

Patch Changes

  • #241 76d2fcd Thanks @​mattzcarey! - Allow EMA ID-JAG assertions to omit the optional resource claim, falling back to the provider's configured protected resource.
Commits

Updates agents from 0.17.4 to 0.20.1

Release notes

Sourced from agents's releases.

agents@0.20.1

Patch Changes

  • #1987 ad015c2 Thanks @​mattzcarey! - Update the MCP dependencies to stable @modelcontextprotocol/client@2.0.0 and @modelcontextprotocol/server@2.0.0, and update the retained SDK v1 compatibility dependency to @modelcontextprotocol/sdk@1.30.0. Delegate SDK-backed SSE keepalives to the upstream transports so each stream has one timer, while preserving the Agents-owned keepalive on the legacy McpAgent WebSocket bridge.

  • #1982 e983026 Thanks @​mattzcarey! - Fix AI SDK v7 telemetry, which produced spans with no token counts, no finish reason, no tool results and zero durations.

    Spans that must not outlive their invocation now close at the end of it rather than at the first await. Closing at the handoff ended every WebSocket-turn span before its result existed, so every finish-time attribute was dropped. A span still open when its invocation ends is closed and marked cloudflare.agents.span.truncated instead of passing as complete, approval spans decided asynchronously included. A chat turn owns its own boundary rather than its caller's, so a turn that is not awaited — an ack-and-return submit, or an auto-continuation fired from a timer — is no longer cut short by the handler that started it. generateText is bounded on the same terms as streamText, and a turn that fails or is cancelled keeps the usage it already reported.

    chat and execute_tool spans sit under their invoke_agent operation span on v7, where they were previously emitted as unrelated roots, and tool_approval segments sit under execute_tool.

    v7 has no telemetry metadata bag, so identity and turn context arrive through runtimeContext and telemetry.includeRuntimeContext. Reserved keys project onto the attributes v6 already emits, so a query written against v6 traces still matches v7 ones; other included keys pass through as cloudflare.agents.runtime_context.{key}, and context the caller did not mark stays off the span.

agents@0.20.0

Minor Changes

  • #1557 447013d Thanks @​mattzcarey! - Add MCP SDK v2 client and server support. MCPClientConnection now uses the exact-pinned @modelcontextprotocol/client@2.0.0-beta.5. It probes for stateless MCP with server/discover, then falls back to the legacy initialize handshake on the same connection when needed. The SDK auto-fulfills stateless elicitation input_required results through the existing form and URL elicitation handlers while callTool, getPrompt, and readResource remain pending. OAuth reauthorization discards redirect-scoped discovery after token issuance and preserves discovery-triggered authentication, allowing a changed authorization server to be rediscovered and registered without reusing the prior issuer's credentials. Legacy pushed elicitation, Streamable HTTP, SSE, RPC, OAuth, and hibernation recovery remain supported. Codemode's MCP connector now uses an SDK-neutral structural boundary compatible with both MCP client generations.

    Add MCP SDK v2 support to createMcpHandler. Pass a factory returning McpServer or Server from the exact-pinned @modelcontextprotocol/server@2.0.0-beta.5 peer dependency to serve stateless MCP with legacy compatibility by default. The new agents/mcp/server entry exports the stateless Agents handler without retaining McpAgent, WorkerTransport, MCP client transports, PartyServer, or SDK v1 modules. The returned handler remains callable for Worker dispatch and exposes the lower-level SDK fetch(request, options?) method plus typed notify methods; upstream close and event-bus internals are not part of the Agents surface. The retained v1 server APIs use the exact-pinned @modelcontextprotocol/sdk@1.29.0 peer dependency.

    The legacy compatibility fallback now uses SDK v2's web-standard transport, including fail-fast handling for unsupported server-to-client requests, active-request teardown, and the same 25-second Cloudflare SSE keepalive previously supplied by WorkerTransport. It returns 405 for session-only GET and DELETE requests without constructing an application server. createLegacyMcpHandler remains an explicit public API for SDK v1 servers and complete WorkerTransport options.

    The MCP client storage codec now preserves stateless discovery data with resumed HTTP sessions and preserves the binding name and props required to restore RPC servers. Stored HTTP session IDs from older Agents versions have no associated protocol version. The upgraded client discards those IDs and reconnects instead of sending an unsafe resumed request, so in-flight work tied to an old remote session does not resume.

    The v2 callable handler maps verified provider-issued metadata from compatible @cloudflare/workers-oauth-provider releases to standard MCP AuthInfo while preserving getMcpAuthContext().props.

    The Workers handler rejects malformed, opaque, and non-HTTP browser Origins. Its default allowlist includes localhost-class Origins, the endpoint's workers.dev hostname, and a concrete corsOptions.origin hostname. It applies matching Host checks to localhost and workers.dev endpoints. Custom-domain deployments with wildcard CORS can set allowedHostnames and allowedOriginHostnames explicitly, or set allowedOriginHostnames: "*" when trusted upstream middleware already enforces the required Origin policy. Requests without Origin remain valid for non-browser MCP clients. Default CORS preflights allow the stateless Mcp-Method and Mcp-Name request headers.

    @cloudflare/codemode is now an optional peer. Applications that import agents/skills or agents/browser install Codemode explicitly; MCP-only applications no longer install it transitively.

    Deprecations in this release:

    • McpAgent is deprecated and feature-frozen as a stateful SDK v1 path. New servers should use an SDK v2 factory with createMcpHandler from agents/mcp/server.
    • Passing an SDK v1 server to the overloaded createMcpHandler is deprecated for removal in the next major release. Move the server to an SDK v2 factory. Use createLegacyMcpHandler only to temporarily retain sessionful SDK v1 behavior while migrating.
    • The explicit result-schema overloads MCPClientManager.callTool(params, resultSchema, options) and withX402Client(...).callTool(confirm, params, resultSchema, options) are deprecated. Use callTool(params, options) or callTool(confirm, params, options) instead.

    experimental_createMcpHandler was already deprecated and remains scheduled for removal in the next major release. Its warning now directs users to an SDK v2 factory first and names createLegacyMcpHandler only as a temporary bridge for sessionful SDK v1 behavior.

Patch Changes

  • #1981 6c01c8d Thanks @​agent-think! - Recycle reusable Browser Run sessions after the platform reports HTTP 410 for an expired session.

agents@0.19.0

Minor Changes

  • #1922 cb4c1c7 Thanks @​cjol! - Support both AI SDK v6 and v7.

    The ai peer range is ai@^6 || ^7 (and @ai-sdk/react is @^3 || ^4) across agents, @cloudflare/ai-chat, @cloudflare/codemode, and @cloudflare/think. Consumers can adopt AI SDK v7 or stay on v6 — no forced AI SDK upgrade when

... (truncated)

Changelog

Sourced from agents's changelog.

0.20.1

Patch Changes

  • #1987 ad015c2 Thanks @​mattzcarey! - Update the MCP dependencies to stable @modelcontextprotocol/client@2.0.0 and @modelcontextprotocol/server@2.0.0, and update the retained SDK v1 compatibility dependency to @modelcontextprotocol/sdk@1.30.0. Delegate SDK-backed SSE keepalives to the upstream transports so each stream has one timer, while preserving the Agents-owned keepalive on the legacy McpAgent WebSocket bridge.

  • #1982 e983026 Thanks @​mattzcarey! - Fix AI SDK v7 telemetry, which produced spans with no token counts, no finish reason, no tool results and zero durations.

    Spans that must not outlive their invocation now close at the end of it rather than at the first await. Closing at the handoff ended every WebSocket-turn span before its result existed, so every finish-time attribute was dropped. A span still open when its invocation ends is closed and marked cloudflare.agents.span.truncated instead of passing as complete, approval spans decided asynchronously included. A chat turn owns its own boundary rather than its caller's, so a turn that is not awaited — an ack-and-return submit, or an auto-continuation fired from a timer — is no longer cut short by the handler that started it. generateText is bounded on the same terms as streamText, and a turn that fails or is cancelled keeps the usage it already reported.

    chat and execute_tool spans sit under their invoke_agent operation span on v7, where they were previously emitted as unrelated roots, and tool_approval segments sit under execute_tool.

    v7 has no telemetry metadata bag, so identity and turn context arrive through runtimeContext and telemetry.includeRuntimeContext. Reserved keys project onto the attributes v6 already emits, so a query written against v6 traces still matches v7 ones; other included keys pass through as cloudflare.agents.runtime_context.{key}, and context the caller did not mark stays off the span.

0.20.0

Minor Changes

  • #1557 447013d Thanks @​mattzcarey! - Add MCP SDK v2 client and server support. MCPClientConnection now uses the exact-pinned @modelcontextprotocol/client@2.0.0-beta.5. It probes for stateless MCP with server/discover, then falls back to the legacy initialize handshake on the same connection when needed. The SDK auto-fulfills stateless elicitation input_required results through the existing form and URL elicitation handlers while callTool, getPrompt, and readResource remain pending. OAuth reauthorization discards redirect-scoped discovery after token issuance and preserves discovery-triggered authentication, allowing a changed authorization server to be rediscovered and registered without reusing the prior issuer's credentials. Legacy pushed elicitation, Streamable HTTP, SSE, RPC, OAuth, and hibernation recovery remain supported. Codemode's MCP connector now uses an SDK-neutral structural boundary compatible with both MCP client generations.

    Add MCP SDK v2 support to createMcpHandler. Pass a factory returning McpServer or Server from the exact-pinned @modelcontextprotocol/server@2.0.0-beta.5 peer dependency to serve stateless MCP with legacy compatibility by default. The new agents/mcp/server entry exports the stateless Agents handler without retaining McpAgent, WorkerTransport, MCP client transports, PartyServer, or SDK v1 modules. The returned handler remains callable for Worker dispatch and exposes the lower-level SDK fetch(request, options?) method plus typed notify methods; upstream close and event-bus internals are not part of the Agents surface. The retained v1 server APIs use the exact-pinned @modelcontextprotocol/sdk@1.29.0 peer dependency.

    The legacy compatibility fallback now uses SDK v2's web-standard transport, including fail-fast handling for unsupported server-to-client requests, active-request teardown, and the same 25-second Cloudflare SSE keepalive previously supplied by WorkerTransport. It returns 405 for session-only GET and DELETE requests without constructing an application server. createLegacyMcpHandler remains an explicit public API for SDK v1 servers and complete WorkerTransport options.

    The MCP client storage codec now preserves stateless discovery data with resumed HTTP sessions and preserves the binding name and props required to restore RPC servers. Stored HTTP session IDs from older Agents versions have no associated protocol version. The upgraded client discards those IDs and reconnects instead of sending an unsafe resumed request, so in-flight work tied to an old remote session does not resume.

    The v2 callable handler maps verified provider-issued metadata from compatible @cloudflare/workers-oauth-provider releases to standard MCP AuthInfo while preserving getMcpAuthContext().props.

    The Workers handler rejects malformed, opaque, and non-HTTP browser Origins. Its default allowlist includes localhost-class Origins, the endpoint's workers.dev hostname, and a concrete corsOptions.origin hostname. It applies matching Host checks to localhost and workers.dev endpoints. Custom-domain deployments with wildcard CORS can set allowedHostnames and allowedOriginHostnames explicitly, or set allowedOriginHostnames: "*" when trusted upstream middleware already enforces the required Origin policy. Requests without Origin remain valid for non-browser MCP clients. Default CORS preflights allow the stateless Mcp-Method and Mcp-Name request headers.

    @cloudflare/codemode is now an optional peer. Applications that import agents/skills or agents/browser install Codemode explicitly; MCP-only applications no longer install it transitively.

    Deprecations in this release:

    • McpAgent is deprecated and feature-frozen as a stateful SDK v1 path. New servers should use an SDK v2 factory with createMcpHandler from agents/mcp/server.
    • Passing an SDK v1 server to the overloaded createMcpHandler is deprecated for removal in the next major release. Move the server to an SDK v2 factory. Use createLegacyMcpHandler only to temporarily retain sessionful SDK v1 behavior while migrating.
    • The explicit result-schema overloads MCPClientManager.callTool(params, resultSchema, options) and withX402Client(...).callTool(confirm, params, resultSchema, options) are deprecated. Use callTool(params, options) or callTool(confirm, params, options) instead.

    experimental_createMcpHandler was already deprecated and remains scheduled for removal in the next major release. Its warning now directs users to an SDK v2 factory first and names createLegacyMcpHandler only as a temporary bridge for sessionful SDK v1 behavior.

Patch Changes

  • #1981 6c01c8d Thanks @​agent-think! - Recycle reusable Browser Run sessions after the platform reports HTTP 410 for an expired session.

0.19.0

Minor Changes

... (truncated)

Commits

Updates hono from 4.12.25 to 4.12.33

Release notes

Sourced from hono's releases.

v4.12.33

What's Changed

Full Changelog: honojs/hono@v4.12.32...v4.12.33

v4.12.32

What's Changed

  • ci: enable reports for type & bundle size check in honojs/hono#5148
  • fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 in honojs/hono#5142
  • fix(sse): emit empty id field to reset Last-Event-ID in honojs/hono#5138
  • test(cloudflare-workers): add coverage for onClose, onError, send, and close in Cloudflare Workers websocket adapter in honojs/hono#5145
  • fix: use Object.create(null) when parsing query, headers, and params in honojs/hono#5161
  • fix(secure-headers): keep CSP callbacks scoped to their header in honojs/hono#5147

Full Changelog: honojs/hono@v4.12.31...v4.12.32

v4.12.31

What's Changed

Full Changelog: honojs/hono@v4.12.30...v4.12.31

v4.12.30

What's Changed

Full Changelog: honojs/hono@v4.12.29...v4.12.30

v4.12.29

What's Changed

... (truncated)

Commits
  • 51db313 4.12.33
  • aed1463 chore: remove undici in favor of global fetch (#5168)
  • 224d2f5 fix(jsx): handle useSyncExternalStore subscription and snapshot changes (#5166)
  • df653ce chore: bump @hono/node-server (#5167)
  • 09cf01c fix(cookie): relax name validation when parsing Cookie header (#5164)
  • 26d8e42 4.12.32
  • 402eb3a fix(secure-headers): keep CSP callbacks scoped to their header (#5147)
  • c85aead fix: use Object.create(null) when parsing query, headers, and params (#5161)
  • a88c89d test(cloudflare-workers): add coverage for onClose, onError, send, and close ...
  • 44f8843 fix(sse): emit empty id field to reset Last-Event-ID (#5138)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hono since your current version.


Updates @rspress/core from 2.0.14 to 2.0.19

Release notes

Sourced from @​rspress/core's releases.

v2.0.19

Highlights

🤖 Guide AI agents from generated Markdown

When SSG-MD is enabled, every generated Markdown page now starts with an agent-readable directive pointing to llms.txt, llms-full.txt, and the Markdown version of the current page:

> For AI agents: the complete documentation index is available at https://example.com/llms.txt, the full documentation bundle is available at https://example.com/llms-full.txt, and this page is available as Markdown at https://example.com/guide/index.md.

This extends the existing HTML hint to Markdown output. Its URLs automatically respect siteOrigin, base, locale, and version prefixes, helping agents discover the right machine-readable content from either format.

Documentation: SSG-MD · injectLlmsHint

Related PR: #3544

🎨 Add icons to generated sidebars and navigation

Use icon to display an image, inline SVG, emoji, external URL, or data URL before sidebar and navbar labels. Auto-generated sidebars support icons on groups, items, and section headers through _meta.json or page frontmatter, while navigation icons can be configured through _nav.json or themeConfig.nav.

For a local image, place it in public and reference it with an absolute path:

[
  {
    "type": "file",
    "name": "introduction",
    "label": "Introduction",
    "icon": "/icon.png",
    "tag": "new"
  }
]

Icons render before the label, while an existing tag remains on the right.

Documentation: Sidebar icons and tags · nav · sidebar

Related PR: #3554

⚡ Speed up lastUpdated on large sites

Rspress now resolves Git history for all documentation pages in one batched pass instead of spawning one git log process per page. Existing lastUpdated configuration remains unchanged:

... (truncated)

Commits
  • 5efbc5d Release v2.0.19 (#3566)
  • 58fede3 feat(auto-nav-sidebar): support icon field in sidebar and navbar (#3554)
  • 47cfb12 perf(core): resolve lastUpdated with a single git process (#3545)
  • 138fdb9 fix(theme/llmsUI): warn when copying Markdown in dev (#3563)
  • eee3d23 fix(ssg-md): preserve MDX exports (#3562)
  • 8a8d01c fix(plugin-playground): scope Monaco preloads to playground pages (#3559)
  • bd730a1 refactor(core): remove redundant AST filtering (#3558)
  • c1003da chore(deps): update dependency memfs to ^4.64.0 (#3552)
  • 4841ded chore(core): remove redundant dependencies (#3557)
  • 7ed7163 fix(theme/outline): hide dividers without content (#3556)
  • Additional commits viewable in compare view

Updates @modelcontextprotocol/sdk from 1.29.0 to 1.30.0

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.30.0

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0

Commits
  • 2d889f2 chore: bump version to 1.30.0 (#2563)
  • e3f3daa Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x)...
  • bb5a718 fix(deps): widen @​hono/node-server past GHSA-frvp-7c67-39w9 (#2549)
  • 1dad263 fix: send SSE keep-alive comment frames from Streamable HTTP server transport...
  • 69749aa Validate Content-Type by parsed media type instead of substring match (v1.x) ...
  • 369513d fix: support Zod 3.25 method literals (#2368)
  • e7ee57c v1 stdio buffer limit (#2239)
  • c36e1ef Add end-to-end test suite (#2167)
  • bf1e022 chore(ci): switch publish to OIDC trusted publishing (#1839)
  • 9edbab7 fix(server): prioritize zod issues and format them (#1503)
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​modelcontextprotocol/sdk since your current version.


Updates @fontsource/fraunces from 5.2.9 to 5.3.0

Commits

Updates @fontsource/public-sans from 5.2.7 to 5.3.0

Commits

Updates @isomorphic-git/lightning-fs from 4.6.2 to 4.7.0

Release notes

Sourced from @​isomorphic-git/lightning-fs's releases.

v4.7.0

4.7.0 (2026-07-25)

Features

v4.6.3

4.6.3 (2026-07-20)

Bug Fixes

Commits
Maintainer changes

This version was pushed to npm by jcubic, a new releaser for @​isomorphic-git/lightning-fs since your current version.


Updates @supabase/supabase-js from 2.106.2 to 2.111.0

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.111.0

2.111.0 (2026-07-28)

🚀 Features

  • auth: store PKCE verifiers in per-flow slots to survive overlapping flows (#2569)

❤️ Thank You

v2.111.0-canary.0

2.111.0-canary.0 (2026-07-28)

🚀 Features

  • auth: store PKCE verifiers in per-flow slots to survive overlapping flows (#2569)

❤️ Thank You

v2.110.9

2.110.9 (2026-07-27)

🩹 Fixes

  • auth: downgrade stale refresh token console noise (#2559)
  • realtime: preserve presence refs (#2566)
  • repo: override sharp to >=0.35.0 to clear libvips advisory (#2548)
  • repo: populate symbols in sdk-compliance so capabilities are verifiable (#2547)
  • repo: bump postcss, babel, next to clear audit advisories (#2561)

❤️ Thank You

v2.110.9-canary.3

2.110.9-canary.3 (2026-07-27)

🩹 Fixes

  • realtime: preserve presence refs (#2566)

❤️ Thank You

v2.110.9-canary.2

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.111.0 (2026-07-28)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.110.9 (2026-07-27)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.110.8 (2026-07-21)

🩹 Fixes

  • supabase: skip Node warning in Deno (#2541)

❤️ Thank You

2.110.7 (2026-07-16)

🩹 Fixes

  • realtime: trigger set auth on INITIAL_SESSION event (#2531)

❤️ Thank You

2.110.6 (2026-07-15)

🩹 Fixes

  • supabase: warn instead of throw for unrecognized sb_ API key subtypes (#2526)

❤️ Thank You

2.110.5 (2026-07-14)

🩹 Fixes

  • supabase: avoid edge runtime warning (#2522)

❤️ Thank You

2.110.4 (2026-07-14)

... (truncated)

Commits
  • 18b5bb2 chore(release): version 2.110.9 changelogs (#2567)
  • fc2e61e chore(repo): bump postcss override and fix playwright 1.62 tsconfig failure (...
  • 22050de chore(release): version 2.110.8 changelogs (

@dependabot
deps(deps): bump the production-minor-patch group across 1 directory …
bb25cec 
…with 21 updates

Bumps the production-minor-patch group with 21 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@cloudflare/puppeteer](https://github.com/cloudflare/puppeteer) | `1.1.0` | `1.2.0` |
| [@cloudflare/workers-oauth-provider](https://github.com/cloudflare/workers-oauth-provider) | `0.8.1` | `0.8.3` |
| [agents](https://github.com/cloudflare/agents/tree/HEAD/packages/agents) | `0.17.4` | `0.20.1` |
| [hono](https://github.com/honojs/hono) | `4.12.25` | `4.12.33` |
| [@rspress/core](https://github.com/web-infra-dev/rspress/tree/HEAD/packages/core) | `2.0.14` | `2.0.19` |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.29.0` | `1.30.0` |
| [@fontsource/fraunces](https://github.com/fontsource/font-files/tree/HEAD/fonts/google/fraunces) | `5.2.9` | `5.3.0` |
| [@fontsource/public-sans](https://github.com/fontsource/font-files/tree/HEAD/fonts/google/public-sans) | `5.2.7` | `5.3.0` |
| [@isomorphic-git/lightning-fs](https://github.com/isomorphic-git/lightning-fs) | `4.6.2` | `4.7.0` |
| [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.106.2` | `2.111.0` |
| [@tsparticles/engine](https://github.com/tsparticles/tsparticles/tree/HEAD/engine) | `4.3.0` | `4.3.2` |
| [@tsparticles/plugin-emitters](https://github.com/tsparticles/tsparticles/tree/HEAD/plugins/emitters) | `4.3.0` | `4.3.2` |
| [@tsparticles/react](https://github.com/tsparticles/tsparticles/tree/HEAD/wrappers/react) | `4.3.0` | `4.3.2` |
| [@tsparticles/shape-text](https://github.com/tsparticles/tsparticles/tree/HEAD/shapes/text) | `4.3.0` | `4.3.2` |
| [@tsparticles/slim](https://github.com/tsparticles/tsparticles/tree/HEAD/bundles/slim) | `4.3.0` | `4.3.2` |
| [isomorphic-git](https://github.com/isomorphic-git/isomorphic-git) | `1.38.7` | `1.40.0` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.24.0` | `1.28.0` |
| [radix-ui](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/radix-ui) | `1.6.2` | `1.6.7` |
| [react-i18next](https://github.com/i18next/react-i18next) | `17.0.10` | `17.0.11` |
| [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `7.16.0` | `7.18.2` |
| [fuse.js](https://github.com/krisk/Fuse) | `7.4.0` | `7.5.0` |



Updates `@cloudflare/puppeteer` from 1.1.0 to 1.2.0
- [Release notes](https://github.com/cloudflare/puppeteer/releases)
- [Commits](cloudflare/puppeteer@v1.1.0...v1.2.0)

Updates `@cloudflare/workers-oauth-provider` from 0.8.1 to 0.8.3
- [Release notes](https://github.com/cloudflare/workers-oauth-provider/releases)
- [Changelog](https://github.com/cloudflare/workers-oauth-provider/blob/main/CHANGELOG.md)
- [Commits](cloudflare/workers-oauth-provider@v0.8.1...v0.8.3)

Updates `agents` from 0.17.4 to 0.20.1
- [Release notes](https://github.com/cloudflare/agents/releases)
- [Changelog](https://github.com/cloudflare/agents/blob/main/packages/agents/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/agents/commits/agents@0.20.1/packages/agents)

Updates `hono` from 4.12.25 to 4.12.33
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.25...v4.12.33)

Updates `@rspress/core` from 2.0.14 to 2.0.19
- [Release notes](https://github.com/web-infra-dev/rspress/releases)
- [Commits](https://github.com/web-infra-dev/rspress/commits/v2.0.19/packages/core)

Updates `@modelcontextprotocol/sdk` from 1.29.0 to 1.30.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0)

Updates `@fontsource/fraunces` from 5.2.9 to 5.3.0
- [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md)
- [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/google/fraunces)

Updates `@fontsource/public-sans` from 5.2.7 to 5.3.0
- [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md)
- [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/google/public-sans)

Updates `@isomorphic-git/lightning-fs` from 4.6.2 to 4.7.0
- [Release notes](https://github.com/isomorphic-git/lightning-fs/releases)
- [Commits](isomorphic-git/lightning-fs@v4.6.2...v4.7.0)

Updates `@supabase/supabase-js` from 2.106.2 to 2.111.0
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.111.0/packages/core/supabase-js)

Updates `@tsparticles/engine` from 4.3.0 to 4.3.2
- [Release notes](https://github.com/tsparticles/tsparticles/releases)
- [Changelog](https://github.com/tsparticles/tsparticles/blob/main/engine/CHANGELOG.md)
- [Commits](https://github.com/tsparticles/tsparticles/commits/v4.3.2/engine)

Updates `@tsparticles/plugin-emitters` from 4.3.0 to 4.3.2
- [Release notes](https://github.com/tsparticles/tsparticles/releases)
- [Changelog](https://github.com/tsparticles/tsparticles/blob/main/plugins/emitters/CHANGELOG.md)
- [Commits](https://github.com/tsparticles/tsparticles/commits/v4.3.2/plugins/emitters)

Updates `@tsparticles/react` from 4.3.0 to 4.3.2
- [Release notes](https://github.com/tsparticles/tsparticles/releases)
- [Changelog](https://github.com/tsparticles/tsparticles/blob/main/wrappers/react/CHANGELOG.md)
- [Commits](https://github.com/tsparticles/tsparticles/commits/v4.3.2/wrappers/react)

Updates `@tsparticles/shape-text` from 4.3.0 to 4.3.2
- [Release notes](https://github.com/tsparticles/tsparticles/releases)
- [Changelog](https://github.com/tsparticles/tsparticles/blob/main/shapes/text/CHANGELOG.md)
- [Commits](https://github.com/tsparticles/tsparticles/commits/v4.3.2/shapes/text)

Updates `@tsparticles/slim` from 4.3.0 to 4.3.2
- [Release notes](https://github.com/tsparticles/tsparticles/releases)
- [Changelog](https://github.com/tsparticles/tsparticles/blob/main/bundles/slim/CHANGELOG.md)
- [Commits](https://github.com/tsparticles/tsparticles/commits/v4.3.2/bundles/slim)

Updates `isomorphic-git` from 1.38.7 to 1.40.0
- [Release notes](https://github.com/isomorphic-git/isomorphic-git/releases)
- [Commits](isomorphic-git/isomorphic-git@v1.38.7...v1.40.0)

Updates `lucide-react` from 1.24.0 to 1.28.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.28.0/packages/lucide-react)

Updates `radix-ui` from 1.6.2 to 1.6.7
- [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/radix-ui/CHANGELOG.md)
- [Commits](https://github.com/radix-ui/primitives/commits/1.6.7/packages/react/radix-ui)

Updates `react-i18next` from 17.0.10 to 17.0.11
- [Changelog](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/react-i18next@v17.0.10...v17.0.11)

Updates `react-router-dom` from 7.16.0 to 7.18.2
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/react-router-dom@7.18.2/packages/react-router-dom/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.18.2/packages/react-router-dom)

Updates `fuse.js` from 7.4.0 to 7.5.0
- [Release notes](https://github.com/krisk/Fuse/releases)
- [Changelog](https://github.com/krisk/Fuse/blob/main/CHANGELOG.md)
- [Commits](krisk/Fuse@v7.4.0...v7.5.0)

---
updated-dependencies:
- dependency-name: "@cloudflare/puppeteer"
  dependency-version: 1.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: "@cloudflare/workers-oauth-provider"
  dependency-version: 0.8.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: agents
  dependency-version: 0.20.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: hono
  dependency-version: 4.12.33
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: "@rspress/core"
  dependency-version: 2.0.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: "@fontsource/fraunces"
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: "@fontsource/public-sans"
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: "@isomorphic-git/lightning-fs"
  dependency-version: 4.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: "@supabase/supabase-js"
  dependency-version: 2.111.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: "@tsparticles/engine"
  dependency-version: 4.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: "@tsparticles/plugin-emitters"
  dependency-version: 4.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: "@tsparticles/react"
  dependency-version: 4.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: "@tsparticles/shape-text"
  dependency-version: 4.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: "@tsparticles/slim"
  dependency-version: 4.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: isomorphic-git
  dependency-version: 1.40.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: lucide-react
  dependency-version: 1.28.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: radix-ui
  dependency-version: 1.6.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: react-i18next
  dependency-version: 17.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: react-router-dom
  dependency-version: 7.18.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: fuse.js
  dependency-version: 7.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 5, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants