Build(deps): Bump the minor-and-patch group with 6 updates by dependabot[bot] · Pull Request #168 · codesydney/bluehex

dependabot · 2026-10-11T10:08:27Z

Bumps the minor-and-patch group with 6 updates:

Package	From	To
next	`16.3.7`	`16.3.8`
@types/node	`26.6.3`	`26.6.4`
eslint-config-next	`16.3.7`	`16.3.8`
pg	`8.23.0`	`8.23.1`
supabase	`2.118.0`	`2.119.0`
vitest	`5.0.2`	`5.0.3`

Updates next from 16.3.7 to 16.3.8

Release notes

Sourced from next's releases.

v16.3.8

This release contains security fixes for the following advisories:

High:

Server-Side Request Forgery in Image Optimization

Medium:

Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass

Cache poisoning of SSG and ISR pages in self-hosted Next.js applications

Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service

Pending use cache fill can leak Draft Mode content into regular responses and persisted pages

Cache leak across root param values in nested 'use cache' functions

Low:

Information disclosure in the Next.js development server's Model Context Protocol endpoint

Commits

b0fad0d v16.3.8
719e4c6 [lts-active] Scope response cache keys to their source route (#218)
e92db45 [lts-active] Fix metadata propagation for deduplicated nested caches (#223)
40c2ba9 [lts-active] Match Next data paths case-sensitively (#196)
2d9f50a [lts-active] Fix MCP middleware DNS rebinding (#213)
bd9214f [lts-active] Fix draft mode leaks through cross-request 'use cache' dedupli...
8db4a62 [lts-active][webpack] Ensure dynamicParams is respected in `opengraph-image...
e002ad6 [lts-active] fix(next/image): Pin DNS resolution when fetching external image...
See full diff in compare view

Updates @types/node from 26.6.3 to 26.6.4

Commits

See full diff in compare view

Updates eslint-config-next from 16.3.7 to 16.3.8

Release notes

Sourced from eslint-config-next's releases.

v16.3.8

This release contains security fixes for the following advisories:

High:

Server-Side Request Forgery in Image Optimization

Medium:

Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass

Cache poisoning of SSG and ISR pages in self-hosted Next.js applications

Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service

Pending use cache fill can leak Draft Mode content into regular responses and persisted pages

Cache leak across root param values in nested 'use cache' functions

Low:

Information disclosure in the Next.js development server's Model Context Protocol endpoint

Commits

b0fad0d v16.3.8
See full diff in compare view

Updates pg from 8.23.0 to 8.23.1

Changelog

Sourced from pg's changelog.

All major and minor releases are briefly explained below.

For richer information consult the commit log on github with referenced pull requests.

We do not include break-fix version release in this file.

Commits

0980cef Publish
2759b2c fix(pg): run a named statement with an empty text more than once (#3781)
7feb7df fix(pg): expose detail and hint on errors from the native client (#3780)
9683053 fix(pg): do not treat Sync as connection ending (#3772)
4589038 fix: validate server certificate against host when connecting to an IP addres...
9808955 cleanup: Fix typo in comment
2b02f64 fix: avoid mutating query config (#3720)
0cef6af Reject portal based queries in pipeline mode instead of misrouting rows (#3737)
2991480 Deprecate serializing invalid Dates (#3731)
c940d7c Fail pipelined queries when the connection dies instead of hanging (#3736)
Additional commits viewable in compare view

Updates supabase from 2.118.0 to 2.119.0

Release notes

Sourced from supabase's releases.

v2.119.0

Supabase CLI v2.119.0 — 2026-09-30

This release delivers stability improvements for local development with 30+ fixes focused on Docker container management, networking, and connection handling. Key fixes address Docker Desktop compatibility on macOS and Windows, session persistence, and request routing. OrioleDB configuration graduates from experimental to stable.

Highlights

Storage uploads fixed on Docker Desktop for macOS — Resumable uploads and S3 endpoints now work through the gateway. (#6921)

Stack connection details visible on start — Database URL, MCP endpoint, and other connection info show immediately after launch for easier debugging. (#6894)

OrioleDB configuration is now stable — Move from experimental_oriole to standard oriole config. (#6828)

New features

Type generation languages from registry — gen types automatically picks up new language targets as Supabase adds them. (#6822)

Studio MCP server at /mcp — Serve Studio's Model Context Protocol server for AI agent and third-party tool integration. (#6898)

Edge function testing improvements — New testing entrypoint and Promise-based API. (#6841)

Improvements

Docker preferred over Podman for automatic runtime selection. (#6859)

Containers named by project and service for visibility. (#6867, #6870)

Studio stays active 5 minutes after last request. (#6866)

Function deno.json files loaded as Deno configuration. (#6907)

Bug fixes

Storage and network connectivity on Docker Desktop (macOS and Windows). (#6921, #6887)

Stacks clean up when Docker is unavailable. (#6825)

Migra session settings persist through database reconnects. (#6884)

Local functions read request bodies before responding. (#6830)

Escape sequences in quoted strings no longer split incorrectly. (#6906)

Yes/no prompts reject unrecognized answers. (#6910)

Database socket connections require authentication. (#6833)

Postgres containers stop cleanly. (#6834)

Upstream connections reused across proxied requests. (#6925)

Image pulls retry on transient registry failures. (#6879)

Mailpit database isolated per stack. (#6901)

SMS provider configuration handled when unset. (#6685)

Plus internal improvements and dependency updates.

Full changelog: supabase/cli@v2.118.0...v2.119.0

v2.119.0-beta.35

No release notes provided.

v2.119.0-beta.34

No release notes provided.

... (truncated)

Commits

62aac0f feat(stack): pin slim artifacts by revision and make the catalog the single v...
481cb3f fix(stack): serve Storage S3 and resumable uploads behind the gateway (#6917)
a0711c0 fix(stack): keep Storage uploads working on Docker Desktop for macOS (#6921)
3704383 fix(cli): skip the contrib_regression clone on pg-delta shadows (#6920)
c877778 fix(cli): reject test new names that escape supabase/tests (CLI-2480) (#6790)
b29e743 fix(cli): decline unrecognised yes/no prompt answers (CLI-2524) (#6910)
26dc09a feat(cli): report stack MCP at the API URL and include connection env in JSON...
b202ba6 refactor(cli): cover shared/output with effect lint (CLI-2561) (#6912)
233d145 fix(cli): stop splitting escape strings on escaped quotes (CLI-2537) (#6906)
eb0c3ff fix(config): ignore unset sms provider (CLI-2463) (#6685)
Additional commits viewable in compare view

Updates vitest from 5.0.2 to 5.0.3

Release notes

Sourced from vitest's releases.

v5.0.3

🐞 Bug Fixes

Isolate result.status between repeats runs - by @hi-ogawa, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11218 (5dbeb)

Don't print an interceptor warning in browser mode - by @sheremet-va in vitest-dev/vitest#11377 (15cc0)

Don't retry when test.fails expectedly failed - by @hi-ogawa, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11219 (b2458)

Scope cache key generators to projects - by @ecoyoung in vitest-dev/vitest#11281 and vitest-dev/vitest#11301 (92ba7)

browser:

Delay server listen until tests start running - by @sheremet-va in vitest-dev/vitest#11366 (7d8ed)

Check mock path boundaries - by @saryn17, Ryosei Sato and @sheremet-va in vitest-dev/vitest#11361 and vitest-dev/vitest#11362 (1c388)

Keep config of browser-consumed environments - by @kasperpeulen and Claude in vitest-dev/vitest#11378 (aafc0)

Ignore page crash while cancelling - by @sheremet-va in vitest-dev/vitest#11386 (7c367)

toMatchScreenshot uses wrong reference on retried tests - by @macarie in vitest-dev/vitest#11393 (c22ab)

cache:

Revalidate imports of cached modules - by @sheremet-va in vitest-dev/vitest#11381 (38f98)

deps:

Pin why-is-node-running to 3.2.1 to avoid users running into ERR_PNPM_TRUST_DOWNGRADE - by @AriPerkkio in vitest-dev/vitest#11403 (f6c9a)

expect:

Pass current equality testers to expect.extend asymmetric matchers - by @hi-ogawa, Hiroshi Ogawa and Claude in vitest-dev/vitest#11401 (3e794)

jsdom:

Support Blob on jsdom 30.1 - by @sheremet-va in vitest-dev/vitest#11379 (6c49b)

pool:

Preserve unique pool ids when groupOrder is set - by @mtorp in vitest-dev/vitest#11392 (50312)

ui:

Split-pane handle overlapping iframe - by @macarie in vitest-dev/vitest#11221 (f91db)

vitest:

Remove root temp dir on close - by @abhinav-phi in vitest-dev/vitest#11248 (7c711)

vm:

Do not optimize deps from index.html - by @ezefernandezyf, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11329 and vitest-dev/vitest#11360 (caf28)

Don't reuse scripts across vite environments - by @MO2k4, Martin Oehlert and Claude in vitest-dev/vitest#11395 (346d3)

View changes on GitHub

Commits

33cadea chore: release v5.0.3 (#11409)
346d389 fix(vm): don't reuse scripts across vite environments (#11395)
f6c9a49 fix(deps): pin why-is-node-running to 3.2.1 to avoid users running into `...
062c75d chore: fix standalone docs build, update exports maps (#11394)
caf2887 fix(vm): do not optimize deps from index.html (fix #11329) (#11360)
50312eb fix(pool): preserve unique pool ids when groupOrder is set (#11392)
7c36748 fix(browser): ignore page crash while cancelling (#11386)
92ba7fc fix: scope cache key generators to projects (fix #11281) (#11301)
38f9885 fix(cache): revalidate imports of cached modules (#11381)
b24585f fix: don't retry when test.fails expectedly failed (#11219)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the minor-and-patch group with 6 updates: | Package | From | To | | --- | --- | --- | | [next](https://github.com/vercel/next.js) | `16.3.7` | `16.3.8` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.3` | `26.6.4` | | [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.3.7` | `16.3.8` | | [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.23.0` | `8.23.1` | | [supabase](https://github.com/supabase/cli/tree/HEAD/apps/cli) | `2.118.0` | `2.119.0` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.2` | `5.0.3` | Updates `next` from 16.3.7 to 16.3.8 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.3.7...v16.3.8) Updates `@types/node` from 26.6.3 to 26.6.4 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `eslint-config-next` from 16.3.7 to 16.3.8 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.8/packages/eslint-config-next) Updates `pg` from 8.23.0 to 8.23.1 - [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md) - [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.1/packages/pg) Updates `supabase` from 2.118.0 to 2.119.0 - [Release notes](https://github.com/supabase/cli/releases) - [Changelog](https://github.com/supabase/cli/blob/develop/apps/cli/docs/release-process.md) - [Commits](https://github.com/supabase/cli/commits/v2.119.0/apps/cli) Updates `vitest` from 5.0.2 to 5.0.3 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.3/packages/vitest) --- updated-dependencies: - dependency-name: next dependency-version: 16.3.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@types/node" dependency-version: 26.6.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: eslint-config-next dependency-version: 16.3.8 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: pg dependency-version: 8.23.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: supabase dependency-version: 2.119.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: vitest dependency-version: 5.0.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 11, 2026

Navigation Menu

Repository navigation

Build(deps): Bump the minor-and-patch group with 6 updates - #168

Build(deps): Bump the minor-and-patch group with 6 updates#168
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-2f1fbcbd4a

dependabot Bot commented on behalf of github Oct 11, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 11, 2026

v16.3.8

v16.3.8

v2.119.0

Supabase CLI v2.119.0 — 2026-09-30

Highlights

New features

Improvements

Bug fixes

v2.119.0-beta.35

v2.119.0-beta.34

v5.0.3

🐞 Bug Fixes

View changes on GitHub

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants