Skip to content

fix(deps): update all non-major dependencies - #362

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

fix(deps): update all non-major dependencies#362
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Jun 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@hookform/resolvers (source) 5.7.1 → 5.9.2 age confidence
@prisma/adapter-pg (source) 7.9.1 → 7.10.1 age confidence
@prisma/client (source) 7.9.1 → 7.10.1 age confidence
@radix-ui/react-toast (source) 1.2.23 → 1.3.1 age confidence
@radix-ui/react-tooltip (source) 1.2.16 → 1.4.1 age confidence
@trpc/client (source) 11.18.0 → 11.19.0 age confidence
@trpc/react-query (source) 11.18.0 → 11.19.0 age confidence
@trpc/server (source) 11.18.0 → 11.19.0 age confidence
@vercel/functions (source) 3.7.7 → 3.10.2 age confidence
camelcase-keys 10.0.2 → 10.0.3 age confidence
jotai 2.20.2 → 2.20.3 age confidence
next (source) 16.3.8 → 16.4.2 age confidence
next-intl (source) 4.13.4 → 4.14.9 age confidence
pnpm (source) 11.20.0 → 11.28.6 age confidence
react (source) 19.2.8 → 19.3.1 age confidence
react-dom (source) 19.2.8 → 19.3.1 age confidence
react-hook-form (source) 7.84.0 → 7.90.0 age confidence
remeda (source) 2.39.0 → 2.52.0 age confidence

Release Notes

react-hook-form/resolvers (@​hookform/resolvers)

v5.9.2

Compare Source

Bug Fixes
  • ajv: preserve escaped field names in validation errors (#​879) (71e6052)

v5.9.1

Compare Source

Bug Fixes
  • isNameInFieldArray fails to recognise bracket-notation array paths causing nested errors overwriting (#​876) (f18ddfb)

v5.9.0

Compare Source

Features

v5.8.0

Compare Source

Features
prisma/orm (@​prisma/adapter-pg)

v7.10.1

Compare Source

Prisma ORM 7.10.1 is a patch release. It fixes a bug where a nested interactive transaction could make later, unrelated transactions run inside the wrong transaction. It also updates dependencies that had security advisories.

Fixes

Prisma Client: nested $transaction no longer changes the options object you pass in

If you passed the same options object to a nested tx.$transaction(...) and later to a top-level prisma.$transaction(...), the nested call wrote the outer transaction's id into that object. Every later top-level transaction that used the object was then treated as nested inside that old transaction:

  • if the old transaction had committed, the new one failed with P2028;
  • if the old transaction was still open, the new one silently ran as a savepoint inside another request's transaction.
const TX_OPTIONS = { timeout: 30_000, maxWait: 10_000 }

await prisma.$transaction(async (tx) => {
  await tx.$transaction(async (inner) => { /* ... */ }, TX_OPTIONS)
})

// Before 7.10.1, this call could fail with P2028 or join another transaction.
await prisma.$transaction(async (tx) => { /* ... */ }, TX_OPTIONS)

Prisma Client no longer modifies the options object. (#​30368, thanks @​lazerg)

Prisma Migrate: refuse a shadow database that is the main database

Prisma Migrate now refuses to run with error P3025 when the shadow database URL points at the same database as the main database URL. Before, prisma migrate diff --from-migrations with that setup dropped the real schema, rebuilt it from the migrations, and reported an empty diff. (prisma/prisma-engines#5851)

MariaDB adapter: updated to mariadb 3.5.4

@prisma/adapter-mariadb now depends on mariadb 3.5.4, which fixes several security advisories in 3.5.3. The adapter no longer rewrites IPv6 hosts in connection strings, because mariadb 3.5.4 accepts them as written. IPv6 connection strings keep working without changes. (#​30668)

Dependency updates

Dependencies with security advisories were updated: mysql2, fast-uri, deepmerge-ts, mariadb and source-map-js. (#​30314, #​30189, #​30668)

v7.10.0

Compare Source

Prisma ORM 7.10.0

Prisma ORM 7.10.0 introduces a compatibility package for running Prisma 7 alongside newer Prisma versions, secures Prisma Studio's local server, and includes fixes across Prisma Client and the PostgreSQL, MariaDB, Neon, SQLite, and Prisma Postgres Serverless adapters.

Highlights

Run Prisma 7 alongside Prisma 8

This release introduces @prisma/prisma7, a compatibility package that lets you retain a matching Prisma 7 CLI and configuration while installing Prisma 8 in the same project.

Once 7.10.0 is released, a side-by-side installation can use:

npm install --save-dev prisma@8 @prisma/[email protected]
npm install @prisma/[email protected]

Use prisma for the directly installed Prisma 8 CLI and prisma7 for Prisma 7:

npx prisma --version
npx prisma7 --version

npx prisma7 generate
npx prisma7 migrate dev
npx prisma7 db push

Prisma 7 now prefers version-specific configuration files, allowing its configuration to coexist with Prisma 8's prisma.config.* files:

// prisma7.config.ts
import { defineConfig } from '@prisma/prisma7/config'

export default defineConfig({
  schema: 'prisma/schema.prisma',
  migrations: {
    path: 'prisma/migrations',
  },
})

Without an explicit --config option, Prisma 7 searches for:

  1. Root-level prisma7.config.* files.
  2. .config/prisma7.* files.
  3. Existing prisma.config.* files as a backwards-compatible fallback.

The supported extensions are .js, .ts, .mjs, .cjs, .mts, and .cts. An explicit config path always takes precedence:

npx prisma7 generate --config ./custom/prisma7.config.ts

New projects initialized by the Prisma 7 CLI use prisma7.config.ts. Existing projects containing only prisma.config.* continue to work without migration or additional warnings. If a prisma7.config.* file exists but cannot be loaded, Prisma reports the error rather than silently falling back to another configuration.

The prisma7 identity is carried through CLI help, version output, shell completion, initialization, migration, database, and generation guidance. Stable Prisma concepts such as schema.prisma, Prisma Migrate, @prisma/client, and PRISMA_* environment variables remain unchanged.

Together, the separate executable and configuration namespace make it possible to operate Prisma 7 and Prisma 8 side by side without command or config-file collisions.

#​29949, #​29969, #​29994, #​30000, #​30002, #​30020

Prisma Studio security hardening

Prisma Studio's local HTTP server now:

  • Binds explicitly to 127.0.0.1 instead of all network interfaces.
  • Rejects browser requests from origins other than the active localhost or 127.0.0.1 Studio URL.
  • No longer returns wildcard CORS headers.
  • Applies the same protections across Node.js, Bun, and Deno.

This prevents network clients or malicious websites from accessing Studio's database endpoints while Studio is running.

#​29890

Prisma Client

  • Fixed P2002 errors from nested writes so meta.modelName identifies the model where the unique constraint violation occurred, including models using @@map and @@schema. #​29628
  • Fixed automatically batched findUniqueOrThrow() calls so every missing record rejects with P2025; later misses no longer resolve to undefined. #​29654
  • Parameter-chunked statements are now executed atomically in a transaction and rolled back if a later chunk fails. #​29771
  • Improved interactive transaction cleanup during $disconnect(), including transactions whose driver-level startup is still in progress. #​28768
  • Prevented transaction cleanup failures after a timeout or backend termination from becoming unhandled promise rejections. #​29611
  • Fixed fluent relation queries when relation fields are literally named select or include. #​29683
  • Fixed handling of Date and Uint8Array values created in other JavaScript realms, such as iframes, jsdom, and Node.js vm contexts. #​29177
  • Invalid Date values passed to $queryRaw or $executeRaw now throw PrismaClientValidationError instead of a generic error. #​29718
  • Fixed moduleFormat inference for the prisma-client generator in TypeScript projects using module: "node16" or "nodenext". Generated output now follows the nearest package.json type, defaulting to CommonJS when absent. #​29712
  • Deserialized Bytes values now own standalone ArrayBuffers rather than exposing unrelated contents from Node.js's shared Buffer pool. This applies to both regular and raw query results. #​29701
  • Fixed an incorrect logging context in the remote executor, including Accelerate-backed query execution. #​28892

Client extensions and observability

  • Result-extension compute callbacks now receive the current model name as a typed second argument:

    compute(data, modelName) {
  // ...
}

    The model name is also preserved when multiple extensions compose the same computed field. #​29782

  • Improved OpenTelemetry context for remotely executed queries:

    • $on('query') callbacks run within the matching db_query span.
    • Events from one operation share the same trace.
    • Error events are recorded as span exceptions.
    • Log events continue to be emitted when tracing is disabled or their reported span is unavailable.

    #​28892

Driver adapters

MariaDB
  • @prisma/adapter-mariadb now accepts an existing mariadb pool. External pools remain caller-owned unless disposeExternalPool: true is supplied. #​27992
  • Fixed pooled connection leaks during commit, rollback, and failed transaction startup. Connections are now returned with release() and transaction-specific listeners are removed before reuse. #​29612
  • Added support for bracketed IPv6 addresses in both mysql:// and mariadb:// connection strings. #​29026
  • Prevented malformed connection strings from exposing embedded passwords in retained debug output and diagnostic reports. #​27992
PostgreSQL, Neon, and Prisma Postgres Serverless
  • PostgreSQL deadlocks using SQLSTATE 40P01 are now reported as P2034 transaction write conflicts. #​29717
  • PostgreSQL RESTRICT violations using SQLSTATE 23001 are now reported as P2003, preserving an available field or constraint name. #​29554
  • @prisma/adapter-pg now preserves database constraint names when reporting unique constraint violations through P2002. #​29587
  • Prisma Postgres Serverless now prefers the named constraint for P2002, falling back to parsed field names when no constraint name is available. #​29801
  • Fixed Neon HTTP adapter serialization for typed parameters such as Bytes and DateTime. #​29747
SQLite
  • @prisma/adapter-better-sqlite3 now converts previously unhandled SQLite result codes into typed database errors instead of exposing raw driver errors.
  • The complete SQLITE_BUSY family is now mapped to socket timeout errors, with numeric extended result codes preserved where available.

#​29794

CLI and Migrate

  • prisma generate can now offer to install Prisma's agent skills. The opt-in prompt:

    • Is shown at most once per machine.
    • Is skipped in CI, containers, Git hooks, npm lifecycle scripts, and watch mode.
    • Is skipped when --no-hints is used or Prisma skills are already installed.
    • Times out after 30 seconds.
    • Never causes generation to fail if installation is unsuccessful.

    #​29690

  • A globally installed CLI now warns during prisma generate when its version differs from the project's local prisma or @prisma/client, and recommends running the local CLI. The check is best-effort and does not fail generation. #​29593

  • prisma version and prisma version --json now include the resolved Prisma CLI package path, making global-versus-local installation issues easier to diagnose. #​29573

  • Empty or generator-only schema files now report Schema must contain a datasource block from db pull, db push, and migrate dev, rather than reaching the schema engine and potentially producing inconsistent errors. #​29657

  • CLI commands now tolerate corrupt, unreadable, or unwritable command-state files. Invalid state is reinitialized, writes are atomic, and persistence failures fall back to in-memory state. #​29609

  • Studio now recognizes semicolon-delimited sqlserver:// connection strings before reporting the existing explicit message that SQL Server is not supported by Studio. #​29623

  • The AI-agent safety checkpoint now also covers interactive prisma db push confirmations involving data-loss warnings, rather than only invocations using --accept-data-loss. #​29793

Performance and reliability

  • Optimized query-plan execution by eagerly evaluating plans with one unconditional database operation and synchronously interpreting the remaining pure plan. Cached plans remain immutable. #​29004
  • Prevented call-stack overflows when rendering very large parameter lists or combining chunked results containing hundreds of thousands of rows. #​29751
  • Reduced ordinary query setup overhead by constructing fluent-relation field maps lazily and in linear time. Non-fluent queries no longer build this map. #​29752

Dependencies

  • Updated the transitive fast-uri dependency to a patched release addressing production audit advisories affecting versions through 3.1.3. #​29758
radix-ui/primitives (@​radix-ui/react-toast)

v1.3.1

  • Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.
  • Updated dependencies: @radix-ui/[email protected]

v1.3.0

v1.2.24

radix-ui/primitives (@​radix-ui/react-tooltip)

v1.4.1

  • Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.
  • Updated dependencies: @radix-ui/[email protected], @radix-ui/[email protected]

v1.4.0

v1.3.0

trpc/trpc (@​trpc/client)

v11.19.0

Compare Source

What's Changed
New Contributors

Full Changelog: trpc/trpc@v11.18.0...v11.19.0

vercel/vercel (@​vercel/functions)

v3.9.5

Patch Changes
  • 282f1c0: Use the current invocation deadline when waiting for database pool idle timers.

v3.9.3

Patch Changes

v3.9.2

Patch Changes

v3.9.1

Patch Changes
  • d72826e: Prevented unit tests and generated outputs from changing Turborepo task inputs during CI, and removed the redundant affected Unit test retry.

v3.9.0

Minor Changes
  • 0b0a4a8: Add a metric() helper for reporting custom metrics from Vercel Functions.

v3.8.0

Minor Changes
sindresorhus/camelcase-keys (camelcase-keys)

v10.0.3

Compare Source

  • Fix stopPaths TypeScript types across array boundaries 6c03c8e
pmndrs/jotai (jotai)

v2.20.3

Compare Source

A fix in a util.

What's Changed

New Contributors

Full Changelog: pmndrs/jotai@v2.20.2...v2.20.3

vercel/next.js (next)

v16.4.2

Compare Source

What's Changed

Full Changelog: vercel/next.js@v16.4.1...v16.4.2

v16.4.1

Compare Source

This release contains security fixes for the following advisories:

Critical:

High:

v16.4.0

Compare Source

Check out the 16.4 announcement post to get an overview of the changes.

Core Changes
  • Show compiler plugin warning in more situations: #​75682
  • fix(scripts): correct typo in rm.mjs error message: #​87015
  • docs: improve clarity and punctuation in README: #​86096
  • Fix debug build paths Pages Router support entries: #​93529
  • bundle-analyzer: record historical snapshots on each analyze run: #​93520
  • fix: detect proxy.ts correctly with compound pageExtensions: #​93246
  • feat(turbopack): support false values for resolveAlias config: #​93331
Misc Changes
  • docs: correction to dynamicParams migration: #​96624
  • docs: proxy event argument: #​96435
  • docs: remove experimental note from runtime prefetching: #​96615
  • Preserve per-segment prefetching after dynamic navigation: #​96583
  • Rename static generation stream option to waitForAllReady: #​96564
  • Remove obsolete static generation plumbing: #​96563
  • [turbopack] Drop dead writes to exports: #​96381
  • [turbopack] Ignore writes to exports after a module.exports = {} writes: #​96380
  • [turbopack] Add test for sideEffects with optimizePackageImports: #​96549
  • [turbopack] Strip leading BOM before parsing CSS: #​96678
  • Upgrade React from cbb046ab-20260731 to 7dfc7ccd-20260803: #​96550
  • docs: use relative doc links in instant-navigation error pages: #​96672
  • Turbopack: terminate failed plugin worker threads: #​96592
  • Fix HTML-limited bot matching in prerender bypass rules: #​96584
  • [ci] Fix create_release_branch for new repo permissions: #​96641
  • test: skip action module instance deploy test: #​96629
  • docs: quote the dynamicParams build error in a blockquote: #​96633
  • [react-sync] Open pull requests as the bot that authors the commits: #​96682
  • [Bench] Fixes for pure Fizz bench: #​96771
  • Derive foreground cache revalidation from the consumer: #​96731
  • Fix race when navigating Back before hydration: #​96252
  • docs: present each Skill as steps in the AI agents guide: #​96751
  • Reuse completed cache entries for the rest of a request: #​96727
  • Upgrade React from 7dfc7ccd-20260803 to 11eddecd-20260805: #​96735
  • Remove WorkStore execution mode: #​96674
  • Remove cache revalidation execution mode reads: #​96670
  • Separate App Route render and prerender pipelines: #​96662
  • Remove App Page execution mode reads: #​96660
  • test: fix missing await in css-chunking test: #​96725
  • docs (Skills): stop assuming app/ at the root and port 3000: #​96696
  • Implement next/font BeforeResolvePlugins as ImportMappingReplacement: #​95808
  • Use Tailwind Turbopack loader in create-next-app: #​96606
  • docs: instant navigation quick start with an adoption prompt: #​96663
  • Separate App Page render and prerender pipelines: #​96659
  • Move App Router execution intent to entrypoints: #​96640
  • Pass explicit render capabilities through App Render: #​96576
  • Pass explicit prefetch hint policy through App Render: #​96572
  • Replace WorkStore isStaticGeneration with executionMode: #​96570
  • docs: document ! exclusion and src/ prefix for --debug-build-paths: #​96703
  • Change loadManifest to return undefined with handleMissing: #​96530
  • Refactor server from CacheNodeSeedData -> TransportData: #​96679
  • Unify full/partial navigation response types: #​96439
  • Unify RouteTree and CacheNodeSeedData on the client: #​96406
  • Consolidate Promise.withResolvers polyfills: #​96772
  • [ci] Open automated update pull requests with nextjs-bot: #​96683
  • Require Cache Components for Instant Navigation testing: #​96745
  • Fix use cache over- and under-invalidation in dev: #​96235
  • Fix which pages the dev server announces, and when: #​96250
  • docs: update redirected links to current targets: #​96723
  • Fix(deployment-id): prevent exception on old webkit: #​94604
  • [fragment-scroll] Remove config.experimental.appNewScrollHandler: #​95602
  • [turbopack] Enable reexport-unknown execution test: #​96774
  • ci: stop publishing @​vercel/devlow-bench: #​96887
  • fix(turbopack): name the module in the non-ESM-placeable error, and stop duplicating the importer in traces: #​96560
  • fix(turbopack): support type: 'text' in rules, and error on binding imports of non-ESM modules: #​96558
  • Lint devlow-bench with the root eslint config: #​96871
  • Remove turbopack/packages and relocate devlow to packages/: #​96860
  • Flush pending revalidations for forwarded action error responses: #​96945
  • Handle Server Actions on dynamic PPR fallback routes: #​96932
  • Turbopack: Improve how DiskWatcher is configured and fix polling watcher bugs: #​96440
  • Turbopack: Allow DiskWatcher to use a mocked DiskFileSystem, add a small unit test: #​96353
  • [turbopack] Add e2e test that uses component chunks + workers: #​96556
  • [turbopack] Support experimental.serverMinification & expand experimental.turbopackMinify: #​96578
  • Add a turbopackChunking documentation page for pages router: #​96698
  • [turbopack] Don't run Webpack tests on Turbopack-only changes: #​96656
  • [turbopack] Enable the shared runtime by default: #​96778
  • [turbopack] Enable CJS tree shaking by default: #​96779
  • refactor: clean up places that needlessly list all RenderStages: #​96907
  • Fix the documented invocation for generating tests non-interactively: #​96896
  • Make NextConfigComplete typing more accurate: #​96700
  • Upgrade to swc 75: #​96702
  • docs: link View Transitions skill on skills.sh and clarify the example prompt: #​96863
  • [ci] Reset the turbopack deploy test project in the weekly cron: #​96822
  • docs: add authentication with Cache Components guide and iron-session example: #​95802
  • [turbopack] Fix a potential deadlock in scope_and_block: #​95695
  • Remove the turbopack-build-events trace span, use next build instead: #​96746
  • docs: add export const dynamic = 'force-static' to Route Handlers example on Static Exports: #​96964
  • [turbopack] Follow re-exports for side-effect free async modules: #​95993
  • [turbopack] Treat constants with values referencing other values as unsafe: #​96190
  • [refactor] Rename encodeCacheTag to encodeHeaderSafe: #​96936
  • Fix formatting of Google Fonts section in documentation: #​88447
  • Fixing a bug - typo issue fixed: #​97141
  • examples: fix Webiny API env variable name: #​97134
  • docs: fix Link prefetch grammar and Client Components wording: #​97132
  • Use emitted app entries for post-build processing: #​97139
  • docs(mdx): fix package name in .md handling section: #​97131
  • [turbopack] Reduce native React Compiler work: #​96820
  • docs: rename repo to repository for consistency: #​87849
  • Fix typo in Data Access Layer section: #​87202
  • docs: runtime prefetching -> optimizing prefetching: #​96934
  • [CC] Track APIs that cause incompatible static/app shells: #​97040
  • Fix client component loading span timing: #​96455
  • Trace development route compilation: #​96454
  • Prefix 'use cache' debug logs with the full directive: #​97037
  • Revert "[turbopack] Enable CJS tree shaking by default (#​96779)": #​97018
  • Revert "[turbopack] Follow re-exports for side-effect free async modules": #​97009
  • [fragment-scroll] Rename ScrollAndMaybeFocusHandler to ScrollHandler: [#​96828](https://redirect.github

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 7 times, most recently from 6f7d599 to 77b4d3a Compare June 23, 2026 04:58
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 77b4d3a to fd87f59 Compare June 26, 2026 02:02
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 1471ea1 to 0a5663c Compare July 4, 2026 21:59
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 11 times, most recently from 1cb820c to 5f21061 Compare August 13, 2026 22:16
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from b80850d to 190a573 Compare August 17, 2026 00:50
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from 75fb07d to ce5ca1e Compare August 27, 2026 08:04
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 8 times, most recently from 36c354a to ecd7b4f Compare September 11, 2026 11:35
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 13 times, most recently from e08200f to a5d1704 Compare September 17, 2026 19:36
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 8 times, most recently from f72de28 to 679b98c Compare September 25, 2026 20:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants