Skip to content

chore(deps-dev): bump the development group across 1 directory with 11 updates - #72

Merged
PunGrumpy merged 2 commits into
mainfrom
dependabot/bun/development-c2ed142357
Oct 26, 2026
Merged

chore(deps-dev): bump the development group across 1 directory with 11 updates#72
PunGrumpy merged 2 commits into
mainfrom
dependabot/bun/development-c2ed142357

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 26, 2026

Copy link
Copy Markdown
Contributor

Bumps the development group with 11 updates in the / directory:

Package From To
oxfmt 0.73.0 0.74.0
oxlint 1.88.0 1.89.0
turbo 2.11.8 2.11.10
ultracite 8.0.1 8.0.2
postcss 8.5.30 8.5.31
@electric-sql/pglite 0.5.10 0.5.11
@electric-sql/pglite-pgvector 0.0.11 0.0.12
@pinecone-database/pinecone 9.0.0 9.1.0
@qdrant/js-client-rest 1.19.0 1.20.0
@supabase/supabase-js 2.117.3 2.118.0
@types/bun 1.4.3 1.4.4

Updates oxfmt from 0.73.0 to 0.74.0

Release notes

Sourced from oxfmt's releases.

oxfmt v0.74.0

🐛 Bug Fixes

  • e236de0 formatter_tests: Skip conformance spec calls with non-literal options (#27957) (leaysgur)
  • 782ab6e linter: Search string values without UTF-8 conversion (#26716) (Dunqing)
  • a5d8184 jsdoc: Parse code spans after quotes in descriptions (#27955) (leaysgur)
  • 2645d2c formatter_markdown: Treat link destinations and footnote references as opaque to code span fences (#27948) (leaysgur)
  • 4d8195c formatter_yaml: Keep a root plain scalar starting with a document marker verbatim (#27947) (leaysgur)
  • 529b057 formatter_core: Keep front matter verbatim when body starts with indented delimiter (#27946) (leaysgur)
  • c22a9b2 formatter: Treat static block with only empty statements as empty (#27945) (leaysgur)
  • d3ff3f6 formatter/jsdoc: Write descriptions as written to not close the comment (#27823) (leaysgur)
  • c4c1727 formatter/sort_imports: Keep comments after the last import (#27822) (leaysgur)
  • a64677e formatter: Print JSDoc embedded snippets with LF (#27821) (leaysgur)
  • 2c1cc20 formatter: Keep comment only Vue bindings as-is (#27820) (leaysgur)
  • 1bf236d formatter/sort_imports: Do not use comments as import source (#27819) (leaysgur)
  • 52ee29d formatter_yaml: Never start col-0 line with document marker or BOM (#27818) (leaysgur)
  • 81c75e7 formatter/css: Keep glued css-in-js statement placeholders glued (#27814) (leaysgur)
  • a1ef7f4 formatter: Keep typecast parens in same-operator binary and arrow chain (#27812) (leaysgur)
  • de110ce formatter: Keep more parens around TSInstantiationExpression (#27811) (leaysgur)
  • 8b02e90 formatter_json: Reject invalid JSON instead of dropping them (#27785) (leaysgur)
  • 6fe4c1b formatter: Treat lone CR in JSX text and argument blank lines (#27780) (leaysgur)
  • 5605362 oxfmt: Validate editorconfig as like oxfmtrc (#27778) (leaysgur)
  • 5b2acb0 formatter_core: Report error position releative to CRLF source (#27777) (leaysgur)
  • c78e80e formatter_core: Report parse error positions relative to the BOM-headed source (#27776) (leaysgur)
  • 3a980c9 formatter_toml: Handle BOM like other languages (#27775) (leaysgur)
  • 97c9fc4 oxfmt: Handle BOM in config JSON (#27774) (leaysgur)
  • 28eb4a7 oxfmt: Print trailing newline for --list-different (#27773) (leaysgur)
  • d2bea21 formatter: Glue comments to an opener in empty for-head slots and array holes (#27737) (leaysgur)
  • 6a95ec1 formatter: Keep comment position on holey array (#27730) (leaysgur)
  • 54769da formatter: Break after dangling line comment in holey array (#27729) (leaysgur)
  • 99077ef formatter_json: Reject unary expressions other than signed numbers (#27728) (leaysgur)
  • 22cd4cd formatter_json: Handle holey array and comments (#27727) (leaysgur)
  • 644ca1c formatter: Do not indent logical chains whose right sides all inline (#27667) (leaysgur)
  • a07a0fb formatter: Wrap comment-only JSX expression container in a group (#27666) (leaysgur)

⚡ Performance

  • e220293 formatter: Check only the operator suppression mark in is_quiet (#27952) (leaysgur)
  • e5fdc9c formatter_core: Write into one element stack through a concrete Formatter (#27559) (leaysgur)
  • a342f7e formatter: Skip comment handling for nodes with no comment near them (#27557) (leaysgur)
  • d8ce750 formatter: Write string literals with swapped quotes into the arena (#27558) (Yuji Sugiura)
  • 1c393c0 formatter_core: Skip scanning texts with nothing to rewrite (#27561) (leaysgur)
  • 1d3ef10 formatter_core: Keep the embedded IR when nothing in it is rewritten (#27673) (leaysgur)

📚 Documentation

  • 1325225 oxfmt: Update useless comment prefix (#27956) (leaysgur)
  • d0dd140 formatter: Note lossy cooked round-trip in template embeds (#27944) (leaysgur)
  • 8a3a6c8 oxfmt: Update stale notes on the JSDoc string-out channel and fixture origins (#27824) (leaysgur)
Changelog

Sourced from oxfmt's changelog.

Changelog

All notable changes to this package will be documented in this file.

The format is based on Keep a Changelog.

Commits

Updates oxlint from 1.88.0 to 1.89.0

Release notes

Sourced from oxlint's releases.

oxlint v1.89.0

💥 BREAKING CHANGES

  • e3c1b11 ast: [BREAKING] Preserve lone surrogates in static property names (#27095) (Dunqing)
  • a0a987c ast: [BREAKING] Preserve lone surrogates in static member names (#26677) (Dunqing)

🚀 Features

  • 770ada4 linter: Mark vue 3 rules as recommended (#27717) (Cam McHenry)
  • ba38c1d linter: Mark react/react-hooks rules as recommended (#27701) (Cam McHenry)
  • d85a3ba linter: Mark promise rules as recommended (#27693) (Cam McHenry)
  • e71c88a linter: Mark node rule as recommended (#27692) (Cam McHenry)
  • 7213f61 linter: Mark nextjs rules as recommended (#27691) (Cam McHenry)
  • d7c6b26 linter: Mark jsx-a11y rules as recommended (#27690) (Cam McHenry)
  • 199dfdc linter: Mark jsdoc rules as recommended (#27689) (Cam McHenry)
  • 780bff3 linter: Mark jest/vitest rules as recommended (#27672) (Cam McHenry)
  • 6ae6859 linter: Mark import rules as recommended (#27671) (Cam McHenry)
  • b7a1df3 linter: Mark unicorn rules as recommended (#27670) (Cam McHenry)
  • c44a355 linter: Mark typescript rules as recommended from upstream (#27634) (Cam McHenry)
  • 6b49dba linter: Mark eslint rules as recommended from upstream (#27632) (Cam McHenry)

🐛 Bug Fixes

  • 7c47246 linter: Check module specifiers and string values that contain lone surrogates (#26717) (Dunqing)
  • 782ab6e linter: Search string values without UTF-8 conversion (#26716) (Dunqing)
  • 326904f linter/unicorn/no-useless-undefined: Allow undefined in React.useRef (#25027) (Chris Dokurno)
  • f9cf165 linter/unicorn/prefer-spread: Ignore super method calls (#27868) (camc314)
  • 00484e1 linter/eslint/prefer-const: Report destructuring assignments inside blocks (#27856) (camc314)
  • 9c35461 linter/eslint/sort-vars: Report every out-of-order declaration (#27767) (camc314)
  • 01e1c5e linter/unicorn/prefer-string-replace-all: Resolve regex variables (#27769) (camc314)
  • 7f474d5 linter/eslint/no-loop-func: Detect writes after the loop (#27754) (camc314)
  • 4b7fea6 linter/eslint/block-scoped-var: Ignore declarations without writes (#27760) (camc314)
  • 2947917 linter/eslint/no-lonely-if: Check final else blocks in else-if chains (#27759) (camc314)
  • fc039b5 linter/eslint/sort-imports: Check imports after other statements (#27749) (camc314)
  • 1acba97 linter/unicorn/prefer-at: Report slice index reads once (#27762) (camc314)
  • 6190e26 linter/eslint/prefer-arrow-callback: Ignore functions used as conditional tests (#27533) (Anzal Husain Abidi)
  • b3cdaaf linter/eslint/sort-keys: Check computed identifier names (#27748) (camc314)
  • 170e608 linter/unicorn/prefer-native-coercion-functions: Check object methods and function properties (#27750) (camc314)
  • 9261df7 linter/unicorn/prefer-string-raw: Check object property values (#27758) (camc314)
  • ddea86b linter/eslint/prefer-template: Report separate nested concatenations (#27764) (camc314)
  • 2c67197 linter/eslint/no-unused-vars: Count conditional calls in sequences as uses (#27755) (camc314)
  • 7f22fa0 linter/unicorn/prefer-regexp-test: Check logical operands in boolean contexts (#27761) (camc314)
  • 3c44398 linter/eslint/class-methods-use-this: Count this in parameter defaults (#27756) (camc314)
  • d85923f linter/eslint/no-param-reassign: Report rest parameter writes (#27765) (camc314)
  • 8ea47bb linter/unicorn/prefer-type-error: Handle parenthesized type checks (#27766) (camc314)
  • e96856c linter/unicorn/catch-error-name: Check unused underscore-prefixed names (#27751) (camc314)
  • d8ca399 linter/unicorn/no-array-callback-reference: Ignore callback factory calls (#27763) (camc314)
  • 1267ab8 linter/eslint/max-params: Count rest parameters (#27757) (camc314)
  • 9ff25c3 linter/eslint/no-useless-assignment: Report dead stores to function parameters (#27735) (camc314)
  • ee5e730 linter/eslint/no-setter-return: Check setters in property descriptors (#27731) (camc314)

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.89.0] - 2026-10-19

🐛 Bug Fixes

  • 9a424c2 oxlint,oxfmt: Correct Node.js TypeScript support range (#27699) (camc314)
Commits

Updates turbo from 2.11.8 to 2.11.10

Release notes

Sourced from turbo's releases.

Turborepo v2.11.10

What's Changed

Changelog

Full Changelog: vercel/turborepo@v2.11.9...v2.11.10

Turborepo v2.11.9

What's Changed

Changelog

... (truncated)

Commits
  • e521641 publish 2.11.10 to registry
  • aaf5a3a fix: Distrust compromised eMudhra intermediate certificates (#14876)
  • 9816503 fix: Exit quietly when turbo ls output is piped to a closed reader (#14868)
  • af866e5 feat: Enable WebMCP for Turborepo docs (#14828)
  • b42cc68 chore: Remove CODEOWNERS file (#14810)
  • 921155f fix: Restore cached symlinks when outputs are already on disk (#14807)
  • 9330903 docs: Generate the sitemap from Geistdocs sources (#14865)
  • 6048038 fix: Keep task env vars in the hash when globalEnv excludes inferred vars (#1...
  • 57ecce3 fix: Parse pnpm 8 single-project lockfiles (#14806)
  • d926d6a fix: Match package configuration files and directory inputs in task-level aff...
  • Additional commits viewable in compare view

Updates ultracite from 8.0.1 to 8.0.2

Release notes

Sourced from ultracite's releases.

ultracite@8.0.2

Patch Changes

  • 9f80955: Make ultracite fix --claude and --codex judge each retry by what the previous edit actually did. An issue that's still reported gets the old note asking for a structurally different approach, but one that only appeared after the edit is now handed back as new, with the agent told to build on the fix rather than undo it. Before, a correct ARIA button pattern that then tripped prefer-tag-over-role, or a correct <button> missing its type, was treated as a failed fix and thrown away. When an issue needs a person's decision, the agent now lists it at the end of its final message. Ultracite stops retrying it and shows the agent's explanation in the summary, where it used to be discarded. The handoff also gets three fixes. Biome's a11y rules now reach the agent with their help text and documentation link, which a pattern that didn't allow digits in a rule group had dropped. A path Oxlint has no files to lint, such as a Markdown file, no longer crashes the run. And Biome's internal errors, such as internalError/io for a file it can't write, are no longer handed to the agent as lint issues.
  • 30e03ef: Give jsx-a11y/label-has-associated-control in ultracite/oxlint/react the options the ESLint react preset already sets: <Label> counts as a label, <Input>, <Select>, <Textarea>, <Checkbox> and <Radio> count as controls, and a control is found up to three levels deep. Oxlint used to miss a <Label> with no control, and flagged an <Input> inside a <label>, or an input nested three deep, as unlabelled. Biome's noLabelWithoutControl in ultracite/biome/core gets the same label and control components.
  • 947ca03: Turn off promise/prefer-await-to-then in ultracite/oxlint/core and ultracite/eslint/core, and github/no-then in ultracite/oxlint/js-plugins and ultracite/eslint/core. Both rules match .then(), .catch() and .finally() by method name, without type information, so they flagged APIs that aren't promises, such as Zod's .catch() fallback. They also flagged a fire-and-forget promise given a .catch() handler. Oxlint closed the false positive as not planned. promise/always-return and promise/catch-or-return are now on in both presets, so an unhandled promise chain is still reported. In ESLint, unicorn/prefer-await moves to ultracite/eslint/type-aware, where it uses type information to skip calls that aren't on a promise. The test-file overrides that turned promise/prefer-await-to-then off in the jest and vitest presets are gone, since the rule is off everywhere.
  • c198d06: Stop unicorn/no-useless-undefined in ultracite/oxlint/core from checking function call arguments. A required parameter typed string | undefined has to be passed undefined explicitly, but Oxlint flagged consume(undefined) and ultracite fix rewrote it to consume(), which TypeScript rejects with TS2554. The rule can't see parameter types, so it now runs with checkArguments: false. It still reports let value = undefined, return undefined and the rest of its checks. ultracite/eslint/core sets the same option. eslint-plugin-unicorn already skipped arguments in TypeScript files, and now skips them in JavaScript too. Biome's noUselessUndefined never checked arguments.
Commits
  • 2077efd Version Packages (#852)
  • 947ca03 Turn off name-only promise chain rules
  • c198d06 Skip call arguments in no-useless-undefined
  • a1da2b9 Escape pipes in sort-keys table code spans safely
  • c95c3f2 Publish the sort-keys research post
  • f8960ac Publish the TODO comments research post
  • a74ed7a Remove the video package (#853)
  • 3efbc33 Mirror the new agent-fix retry loop in the research harness
  • da6f772 Say which presets carry the accessibility rules
  • 30e03ef Give Oxlint and Biome the label components ESLint already uses
  • Additional commits viewable in compare view

Updates postcss from 8.5.30 to 8.5.31

Release notes

Sourced from postcss's releases.

8.5.31

Changelog

Sourced from postcss's changelog.

8.5.31

Commits

Updates @electric-sql/pglite from 0.5.10 to 0.5.11

Release notes

Sourced from @​electric-sql/pglite's releases.

@​electric-sql/pglite-prepopulatedfs@​0.5.11

Patch Changes

  • Updated dependencies [5573bb0]
  • Updated dependencies [2372f39]
  • Updated dependencies [4321a41]
    • @​electric-sql/pglite@​0.5.11

@​electric-sql/pglite@​0.5.11

Patch Changes

  • 5573bb0: bug fix: check ready before close
  • 2372f39: Update submodule
  • 4321a41: Fix premature ReadyForQuery responses after extended-query errors, preventing PostgreSQL clients from desynchronizing before Sync.
Changelog

Sourced from @​electric-sql/pglite's changelog.

0.5.11

Patch Changes

  • 5573bb0: bug fix: check ready before close
  • 2372f39: Update submodule
  • 4321a41: Fix premature ReadyForQuery responses after extended-query errors, preventing PostgreSQL clients from desynchronizing before Sync.
Commits

Updates @electric-sql/pglite-pgvector from 0.0.11 to 0.0.12

Release notes

Sourced from @​electric-sql/pglite-pgvector's releases.

@​electric-sql/pglite-pgvector@​0.0.12

Patch Changes

  • Updated dependencies [5573bb0]
  • Updated dependencies [2372f39]
  • Updated dependencies [4321a41]
    • @​electric-sql/pglite@​0.5.11
Changelog

Sourced from @​electric-sql/pglite-pgvector's changelog.

0.0.12

Patch Changes

  • Updated dependencies [5573bb0]
  • Updated dependencies [2372f39]
  • Updated dependencies [4321a41]
    • @​electric-sql/pglite@​0.5.11
Commits

Updates @pinecone-database/pinecone from 9.0.0 to 9.1.0

Release notes

Sourced from @​pinecone-database/pinecone's releases.

Release v9.1.0

v9.1.0 lets a document index embed text for you, so Pinecone can embed a field's text on write and your query text on search. Read responses now report billed egress, the client retries transient connection failures, and HTTP 413 has its own error class. It targets the same 2026-07 API as v9.0.0, and nothing is removed or renamed.

What's new

Integrated embedding in document indexes

Declare embed (dense) or sparseEmbed (sparse) on a string field, upsert plain text, and search with query text. Pinecone embeds documents and queries with the same hosted model. (guide, e06adb9)

import { Pinecone } from '@pinecone-database/pinecone';
const pc = new Pinecone();
// Declare a string field that Pinecone embeds for you.
await pc.indexes.create({
name: 'articles',
schema: { fields: { body: { type: 'string', embed: {} } } },
waitUntilReady: true,
});
// Write plain-text documents; Pinecone embeds each body.
const documents = pc.index('articles').namespace('en').documents;
await documents.upsert({
documents: [
{ _id: 'a1', body: 'Aqueducts carried water by gravity' },
{ _id: 'a2', body: 'The Colosseum seated 50,000 people' },
{ _id: 'a3', body: 'Hypocausts heated the public baths' },
],
});
// Search with plain text; Pinecone embeds the query too.
const results = await documents.search({
scoreBy: [{ type: 'embed', field: 'body', query: 'how did Rome move water' }],
topK: 2,
});
console.log(results.matches);

  • Choose a model with embed: { model: 'llama-text-embed-v2', dimension: 1024 }. Omitted keys use the model's defaults, and pc.indexes.describe reports the resolved configuration.
  • An embed or sparse_embed clause must be the only clause in scoreBy.
  • Send at most 96 documents per upsert or update, instead of the usual 1,000. Requests over a size limit throw Errors.PineconePayloadTooLargeError (see below).
  • Text is stored and indexed for full-text search by default. Set storeText: false to embed text without storing it. You can't return unstored fields or search them with text/query_string clauses.
  • Responses report embedding tokens in usage.embedTotalTokens.
  • New exported types: IntegratedEmbeddingStringField, CreateEmbedConfig, CreateSparseEmbedConfig, ResponseEmbedConfig, and ResponseSparseEmbedConfig.

Read responses report egress bytes

query, fetch, fetchByMetadata, listPaginated, searchRecords, and documents.search/fetch/list now report usage.egressBytes, the billed size of the response in bytes. The field is omitted when the server doesn't report it. (1e25972)

... (truncated)

Commits
  • 21a1c9a [skip ci] Publish release v9.1.0
  • e40c44b fix: resolve legacy getters for string-field embed and map HTTP 413 (#213)
  • d329e1b build(deps-dev): bump the npm-minor-and-patch group across 1 directory with 6...
  • 6bcfde0 build(deps-dev): bump handlebars from 4.7.9 to 4.7.10 (#205)
  • 0939cf1 build(deps-dev): bump the npm-minor-and-patch group with 2 updates (#206)
  • 21520ac build(deps-dev): bump dotenv from 17.4.2 to 18.0.7 (#207)
  • 9fb9328 Improve field vs fields validation test coverage (#210)
  • e9144b9 Regenerate 2026-07 for BYOC docs changes, keep public types stable (#209)
  • b1fc03a ci: publish release candidates as the intended release version (#204)
  • 155f537 fix: retry transient connection failures (from public #434) (#203)
  • Additional commits viewable in compare view

Updates @qdrant/js-client-rest from 1.19.0 to 1.20.0

Changelog

Sourced from @​qdrant/js-client-rest's changelog.

v1.20.0

Minor Changes

  • Qdrant v1.20.0 API
  • BM25 ranking over text indexes: scoring on text index params, and a text query for query/queryBatch/queryGroups (field named by using)
  • substring match condition for keyword fields
  • nested option on payload index params, to index every object of an array as its own entry
  • max, min and acosh formula expressions
  • turbo8 and turbo16 vector datatypes, bits8 TurboQuant bit size
  • Added id_tracker (point id tracker params) to createCollection and recreateCollection; collection info now reports created_at
  • code tokenizer for text indexes (source-code identifier splitting)
Commits

Updates @supabase/supabase-js from 2.117.3 to 2.118.0

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.118.0

2.118.0 (2026-10-15)

🚀 Features

  • postgrest: leave computed fields out of select('*') and resolve no-argument rpc overloads for postgrest-typegen output (#2730)
  • storage: add content-encoding support for uploads (#1949)

🩹 Fixes

  • ci: patch next and sharp advisories and pin node-browser playwright (#2753)

❤️ Thank You

  • Atharv Gaur @​Athaxv
  • Ferhat Elmas
  • Lukas Klingsbo

v2.118.0-canary.2

2.118.0-canary.2 (2026-10-12)

This was a version bump only, there were no code changes.

v2.118.0-canary.1

2.118.0-canary.1 (2026-10-12)

This was a version bump only, there were no code changes.

v2.118.0-canary.0

2.118.0-canary.0 (2026-10-09)

🚀 Features

  • postgrest: leave computed fields out of select('*') and resolve no-argument rpc overloads for postgrest-typegen output (#2730)

🩹 Fixes

  • ci: patch next and sharp advisories and pin node-browser playwright (#2753)

❤️ Thank You

  • Lukas Klingsbo
Changelog

Sourced from @​supabase/supabase-js's changelog.

2.118.0 (2026-10-15)

🚀 Features

  • postgrest: leave computed fields out of select('*') and resolve no-argument rpc overloads for postgrest-typegen output (#2730)

❤️ Thank You

  • Lukas Klingsbo
Commits
  • b9753a1 feat(postgrest): leave computed fields out of select('*') and resolve no-argu...
  • 88faa11 fix(ci): patch next and sharp advisories and pin node-browser playwright (#2753)
  • aac9d32 chore(release): version 2.117.3 changelogs (#2744)
  • See full diff in compare view

Updates @types/bun from 1.4.3 to 1.4.4

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps-dev): bump the development group across 1 directory with 1…
abb664b 
…1 updates

Bumps the development group with 11 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) | `0.73.0` | `0.74.0` |
| [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.88.0` | `1.89.0` |
| [turbo](https://github.com/vercel/turborepo) | `2.11.8` | `2.11.10` |
| [ultracite](https://github.com/haydenbleasel/ultracite) | `8.0.1` | `8.0.2` |
| [postcss](https://github.com/postcss/postcss) | `8.5.30` | `8.5.31` |
| [@electric-sql/pglite](https://github.com/electric-sql/pglite/tree/HEAD/packages/pglite) | `0.5.10` | `0.5.11` |
| [@electric-sql/pglite-pgvector](https://github.com/electric-sql/pglite/tree/HEAD/packages/pglite-pgvector) | `0.0.11` | `0.0.12` |
| [@pinecone-database/pinecone](https://github.com/pinecone-io/pinecone-ts-client) | `9.0.0` | `9.1.0` |
| [@qdrant/js-client-rest](https://github.com/qdrant/qdrant-js/tree/HEAD/packages/js-client-rest) | `1.19.0` | `1.20.0` |
| [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.117.3` | `2.118.0` |
| [@types/bun](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/bun) | `1.4.3` | `1.4.4` |



Updates `oxfmt` from 0.73.0 to 0.74.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxfmt/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxfmt_v0.74.0/npm/oxfmt)

Updates `oxlint` from 1.88.0 to 1.89.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.89.0/npm/oxlint)

Updates `turbo` from 2.11.8 to 2.11.10
- [Release notes](https://github.com/vercel/turborepo/releases)
- [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md)
- [Commits](vercel/turborepo@v2.11.8...v2.11.10)

Updates `ultracite` from 8.0.1 to 8.0.2
- [Release notes](https://github.com/haydenbleasel/ultracite/releases)
- [Commits](https://github.com/haydenbleasel/ultracite/compare/ultracite@8.0.1...ultracite@8.0.2)

Updates `postcss` from 8.5.30 to 8.5.31
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.30...8.5.31)

Updates `@electric-sql/pglite` from 0.5.10 to 0.5.11
- [Release notes](https://github.com/electric-sql/pglite/releases)
- [Changelog](https://github.com/electric-sql/pglite/blob/main/packages/pglite/CHANGELOG.md)
- [Commits](https://github.com/electric-sql/pglite/commits/@electric-sql/pglite@0.5.11/packages/pglite)

Updates `@electric-sql/pglite-pgvector` from 0.0.11 to 0.0.12
- [Release notes](https://github.com/electric-sql/pglite/releases)
- [Changelog](https://github.com/electric-sql/pglite/blob/@electric-sql/pglite-pgvector@0.0.12/packages/pglite-pgvector/CHANGELOG.md)
- [Commits](https://github.com/electric-sql/pglite/commits/@electric-sql/pglite-pgvector@0.0.12/packages/pglite-pgvector)

Updates `@pinecone-database/pinecone` from 9.0.0 to 9.1.0
- [Release notes](https://github.com/pinecone-io/pinecone-ts-client/releases)
- [Commits](pinecone-io/pinecone-ts-client@v9.0.0...v9.1.0)

Updates `@qdrant/js-client-rest` from 1.19.0 to 1.20.0
- [Release notes](https://github.com/qdrant/qdrant-js/releases)
- [Changelog](https://github.com/qdrant/qdrant-js/blob/master/packages/js-client-rest/CHANGELOG.md)
- [Commits](https://github.com/qdrant/qdrant-js/commits/v1.20.0/packages/js-client-rest)

Updates `@supabase/supabase-js` from 2.117.3 to 2.118.0
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.118.0/packages/core/supabase-js)

Updates `@types/bun` from 1.4.3 to 1.4.4
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/bun)

---
updated-dependencies:
- dependency-name: oxfmt
  dependency-version: 0.74.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development
- dependency-name: oxlint
  dependency-version: 1.89.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development
- dependency-name: turbo
  dependency-version: 2.11.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development
- dependency-name: ultracite
  dependency-version: 8.0.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development
- dependency-name: postcss
  dependency-version: 8.5.31
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development
- dependency-name: "@electric-sql/pglite"
  dependency-version: 0.5.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development
- dependency-name: "@electric-sql/pglite-pgvector"
  dependency-version: 0.0.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development
- dependency-name: "@pinecone-database/pinecone"
  dependency-version: 9.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development
- dependency-name: "@qdrant/js-client-rest"
  dependency-version: 1.20.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development
- dependency-name: "@supabase/supabase-js"
  dependency-version: 2.118.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development
- dependency-name: "@types/bun"
  dependency-version: 1.4.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 26, 2026
@vercel

vercel Bot commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
vecstore-sdk Ready Ready Preview Oct 26, 2026 2:25am UTC

@changeset-bot

changeset-bot Bot commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 5d6ffd3

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@socket-security

socket-security Bot commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updated@​types/​bun@​1.4.3 ⏵ 1.4.41001004892 -2100
Updated@​electric-sql/​pglite-pgvector@​0.0.11 ⏵ 0.0.12100 +11006596 +2100
Updated@​pinecone-database/​pinecone@​9.0.0 ⏵ 9.1.076 +1100100 +195 +5100
Updated@​electric-sql/​pglite@​0.5.10 ⏵ 0.5.1194 -61009997 +180
Updatedpostcss@​8.5.30 ⏵ 8.5.31100 +110082 +195100
Updatedturbo@​2.11.8 ⏵ 2.11.1010010085 +197100
Updatedoxfmt@​0.73.0 ⏵ 0.74.087 -71008896100
Updated@​supabase/​supabase-js@​2.117.3 ⏵ 2.118.08810010098 +1100
Updated@​qdrant/​js-client-rest@​1.19.0 ⏵ 1.20.096 -410010091 +1100
Updatedoxlint@​1.88.0 ⏵ 1.89.099 +110091 +196100
Updatedultracite@​8.0.1 ⏵ 8.0.298 +110099 +196100

View full report

@coderabbitai

coderabbitai Bot commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 60ee54d8-9e42-4c3f-878c-1b17789c74be

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@pkg-pr-new

pkg-pr-new Bot commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown

Open in StackBlitz

npm i https://pkg.pr.new/vecstore-sdk@72

commit: 5d6ffd3

@baymiai

baymiai Bot commented Oct 26, 2026

Copy link
Copy Markdown

Security review: nothing new to raise.

All version bumps are development dependencies, and the updated lockfile does not introduce any new known-vulnerable versions.

Reviewed at 5d6ffd3.

@PunGrumpy
PunGrumpy merged commit 895dcec into main Oct 26, 2026
14 checks passed
@dependabot
dependabot Bot deleted the dependabot/bun/development-c2ed142357 branch October 26, 2026 02:56

This branch was successfully deployed

1 active deployment
Preview — 5d6ffd3a Deployed Oct 26, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@PunGrumpy