[dependabot]

Bumps the production-dependencies group with 5 updates:

Package	From	To
@supabase/supabase-js	2.118.0	2.119.0
express-rate-limit	8.7.2	8.7.3
glob	14.0.3	14.0.4
node-forge	1.4.2	1.4.3
tslib	2.8.1	2.9.1

Updates @supabase/supabase-js from 2.118.0 to 2.119.0

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.119.0

2.119.0 (2026-11-04)

🚀 Features

• postgrest: expose query builder options to .from method - custom fetch per request (#1570)
• realtime: broadcast persistence (#2690)

🩹 Fixes

• auth: deleteUser miscast empty object to User (#2773)
• auth: global sign out cleared the local session when the server failed to log out (#2786)
• realtime: include vsn in the unsupported serializer error (#2812)
• storage: exists reports invalid JWT or missing bucket as missing file (#2783)
• storage: ignore undefined FileOptions during upload (#2789)

❤️ Thank You

• 7vignesh
• 7vignesh vigneshgopikrishnan7@gmail.com and stenlan @​stenlan
• Christian Melchior
• Claude Opus 5.5
• Guilherme Souza
• Katerina Skroumpelou
• Leandro Pereira @​leandrocp
• Pintu Kumar @​pintu544
• Rami Hersonsky @​ramiscaleai
• stenlan @​stenlan
• Vignesh

v2.119.0-canary.6

2.119.0-canary.6 (2026-11-04)

This was a version bump only, there were no code changes.

v2.119.0-canary.5

2.119.0-canary.5 (2026-11-03)

🚀 Features

• realtime: broadcast persistence (#2690)

🩹 Fixes

• realtime: include vsn in the unsupported serializer error (#2812)

❤️ Thank You

• Claude Opus 5.5
• Guilherme Souza

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.119.0 (2026-11-04)

🚀 Features

• postgrest: expose query builder options to .from method - custom fetch per request (#1570)

❤️ Thank You

• 7vignesh
• 7vignesh vigneshgopikrishnan7@gmail.com and stenlan @​stenlan
• Katerina Skroumpelou
• stenlan @​stenlan
• Vignesh

Commits

• d2090f3 ci(repo): migrate test configs to supabase cli v3 (#2811)
• ecab7fb docs(misc): document SDK compatibility with Platform Services (#2798)
• 8181a4d chore(deps): bump playwright to 1.64.0 (#2777)
• bb56484 feat(postgrest): expose query builder options to .from method - custom fetch ...
• e428dfe chore(release): version 2.118.0 changelogs (#2766)
• See full diff in compare view

Updates express-rate-limit from 8.7.2 to 8.7.3

Release notes

Sourced from express-rate-limit's releases.

v8.7.3

You can view the changelog here.

Commits

• b0d0c1f 8.7.3
• 307ca31 v8.7.3 changelog
• 34729c8 fix: forward async rate limit handler errors (#708)
• See full diff in compare view

Updates glob from 14.0.3 to 14.0.4

Commits

• 240dbb7 14.0.4
• c6105eb minimatch@11.0.5
• 81544ff minimatch@11.0.3
• 0159413 more readme formatting/typo fixing
• 8652101 fix typo in JSDoc of the "cwd" option
• See full diff in compare view

Updates node-forge from 1.4.2 to 1.4.3

Changelog

Sourced from node-forge's changelog.

1.4.3 - 2026-11-03

Security

• HIGH: X.509 certificate chain verification ignores name constraints.
  • pki.verifyCertificateChain() does not check the nameConstraints extension (RFC 5280 4.2.1.10). A non-critical nameConstraints extension in a CA certificate is ignored, so a name-constrained intermediate CA can issue certificates for names outside its permitted subtrees, or inside its excluded subtrees, and the chain verifies. Exploitation requires the private key of a name-constrained CA that chains to a trusted root. A critical nameConstraints extension is rejected as an unsupported critical extension.
  • Reported by @​bhaswanthc.
  • CVE ID: CVE-TBD
  • GHSA ID: GHSA-3cc4-3294-vgjf
• MODERATE: TLS client crash on a handshake record without a session.
  • A TLS client throws an uncaught TypeError from process() when it receives a ServerHello while it has no session: after a close_notify alert or a call to close(), or before handshake() is called. A malicious server, or an on-path attacker, can terminate a Node.js process that passes socket data to process() without catching exceptions. Servers are not affected.
  • Reported by @​manus-use.
  • CVE ID: CVE-TBD
  • GHSA ID: GHSA-j8rw-jp99-435v
• MODERATE: ReDoS in forge.http response header parsing.
  • forge.http trims response header and Set-Cookie values with a regular expression that takes quadratic time on a long run of whitespace followed by another character. A server, or an on-path attacker, can block a forge.http client for minutes with one large header.
  • Reported by @​manus-pi.
  • CVE ID: CVE-TBD
  • GHSA ID: GHSA-6cv4-p8m7-4r25
• MODERATE: TLS client crash on an unsupported ServerHello compression method.
  • A TLS client accepts any compression method in the ServerHello, although it only offers no compression. An unknown method makes process() throw an uncaught Error at ServerHelloDone, before the server is authenticated. A malicious server, or an on-path attacker, can terminate a Node.js process that passes socket data to process() without catching exceptions, including through forge.tls.wrapSocket. Servers are not affected.
  • Reported by @​alienkeric.
  • CVE ID: CVE-TBD
  • GHSA ID: GHSA-w4xr-hqv8-ch44
• LOW: Ed25519 signature verification accepts small-order public keys.
  • ed25519.verify() does not reject public keys of small order, such as the identity point. Under such a key, a signature with S = 0 and a small-order R verifies for many or, with the identity key, all messages, without any private key. Applications are affected only if

... (truncated)

Commits

• 936b24d Release 1.4.3.
• 4d8f79a Update changelog.
• 1d9816d Check the ServerHello compression method.
• 326a4d0 Trim forge.http header values in linear time.
• 2cfaeb5 Ignore handshake messages on a TLS client without a session.
• 6b23eae Complete nameConstraints enforcement.
• 862aa5f Enforce nameConstraints in verifyCertificateChain().
• 956f2b5 Document ed25519.verify() small-order key behavior.
• 1b77e6f Reject small-order Ed25519 public keys in verify.
• 2bd5146 Add GitHub usernames to credits.
• Additional commits viewable in compare view

Updates tslib from 2.8.1 to 2.9.1

Release notes

Sourced from tslib's releases.

tslib 2.9.1

What's Changed

• Update dependencies by @​jakebailey in microsoft/tslib#283
• Switch to new release pipeline by @​jakebailey in microsoft/tslib#289
• Port content mapper changes to rewriteRelativeImportExtension by @​andrewbranch in microsoft/tslib#295
• Stop requiring an ignored lockfile in release workflows by @​jakebailey in microsoft/tslib#296
• Bump tslib to 2.9.0 by @​typescript-automation[bot] in microsoft/tslib#297
• Stop running tests in the Azure release pipeline by @​jakebailey in microsoft/tslib#298
• Bump tslib to 2.9.1 by @​typescript-automation[bot] in microsoft/tslib#299

Full Changelog: microsoft/tslib@v2.8.1...v2.9.1

Commits

• f167789 Bump tslib to 2.9.1 (#299)
• 5d4a32e Stop running tests in the Azure release pipeline (#298)
• 8d6f9cd Bump tslib to 2.9.0 (#297)
• 8fe15be Stop requiring an ignored lockfile in release workflows (#296)
• 430ef31 Port content mapper changes to rewriteRelativeImportExtension (#295)
• 6ac5f2b Switch to new release pipeline (#289)
• 12bd8a7 Update dependencies (#283)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for tslib since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: automated. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 04eeb8b3-e99f-406b-9b61-f3a722bdd1cd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn