[dependabot]

Bumps the minor-and-patch group with 44 updates in the /app directory:

Package	From	To
@modelcontextprotocol/server	2.1.0	2.3.1
@posthog/nextjs-config	1.11.1	1.11.3
@radix-ui/react-accordion	1.2.20	1.3.1
@radix-ui/react-alert-dialog	1.1.23	1.2.1
@radix-ui/react-avatar	1.2.6	1.3.1
@radix-ui/react-checkbox	1.3.11	1.4.1
@radix-ui/react-dialog	1.1.23	1.3.1
@radix-ui/react-dropdown-menu	2.1.24	2.2.1
@radix-ui/react-label	2.1.15	2.1.17
@radix-ui/react-popover	1.1.23	1.3.1
@radix-ui/react-progress	1.1.16	1.2.1
@radix-ui/react-slot	1.3.3	1.5.0
@radix-ui/react-switch	1.3.7	1.4.1
@radix-ui/react-tooltip	1.2.16	1.4.1
@serwist/next	9.5.12	9.5.13
@supabase/supabase-js	2.116.0	2.118.0
@tanstack/react-query	5.103.1	5.104.4
@tiptap/core	3.31.3	3.32.0
@tiptap/extension-bubble-menu	3.31.3	3.32.0
@tiptap/extension-document	3.31.3	3.32.0
@tiptap/extension-list	3.31.3	3.32.0
@tiptap/markdown	3.31.3	3.32.0
@tiptap/pm	3.31.3	3.32.0
@tiptap/react	3.31.3	3.32.0
@tiptap/starter-kit	3.31.3	3.32.0
@trigger.dev/sdk	4.5.16	4.7.4
frimousse	0.3.0	0.4.0
next	16.3.6	16.4.2
pino	10.3.1	10.4.0
pino-pretty	13.1.3	13.2.0
posthog-js	1.434.2	1.438.12
posthog-node	5.52.4	5.56.2
react	19.3.0	19.3.1
react-dom	19.3.0	19.3.1
react-hook-form	7.88.0	7.90.0
resend	6.28.1	6.34.1
scanic	1.6.0	1.7.1
zod	4.6.5	4.6.7
@biomejs/biome	2.5.14	2.5.15
@playwright/test	1.63.0	1.64.1
@storybook/addon-themes	10.6.0	10.6.2
@testcontainers/postgresql	12.1.0	12.2.1
@trigger.dev/build	4.5.16	4.7.4
serwist	9.5.12	9.5.13

Updates @modelcontextprotocol/server from 2.1.0 to 2.3.1

Release notes

Sourced from @​modelcontextprotocol/server's releases.

@​modelcontextprotocol/server-legacy@​2.3.1

Patch Changes

• #2952 5a18673 Thanks @​claude! - requireBearerAuth in @modelcontextprotocol/server-legacy takes the optional expectedResource that @modelcontextprotocol/server 2.3.0 and @modelcontextprotocol/sdk 1.32.0 added: the resource the token must be issued for (its audience), usually the server's URL. When it is set, a token is accepted only if the verifier reports that value in AuthInfo.resource; the two are compared as strings, ignoring a fragment and one trailing slash. A token reported for another value, or for none, is answered 401 invalid_token with the usual WWW-Authenticate challenge. When it is not set, nothing changes. The package stays frozen otherwise; this option is added so that its requireBearerAuth matches the 1.x middleware it is a copy of.

• Updated dependencies []:

  • @​modelcontextprotocol/core@​2.3.1

@​modelcontextprotocol/server@​2.3.1

Patch Changes

• Updated dependencies []:
  • @​modelcontextprotocol/core@​2.3.1

@​modelcontextprotocol/server-legacy@​2.3.0

Patch Changes

• #2908 633dd3e Thanks @​claude! - The license field of the package manifests is now Apache-2.0; the LICENSE file shipped in each package carries the full terms, including the MIT text for earlier contributions. No code change.

• Updated dependencies [633dd3e]:

  • @​modelcontextprotocol/core@​2.3.0

@​modelcontextprotocol/server@​2.3.0

Minor Changes

• #2929 40f8f4e Thanks @​claude! - requireBearerAuth and verifyBearerToken take a new optional expectedResource, which makes them accept only tokens issued for this resource (the token's audience). Set it to the value your authorization server puts into tokens meant for this server, usually the server's URL. When it is set, a token is accepted only if the verifier reports that value in AuthInfo.resource; the two are compared as strings, ignoring a fragment and one trailing slash. A token reported for another value, or for none, is answered 401 invalid_token with the usual WWW-Authenticate challenge. When it is not set, nothing changes. To use it, pass expectedResource and have verifyAccessToken fill AuthInfo.resource, for example from the aud claim. The option is declared on a new exported type, VerifyBearerTokenOptions, which extends BearerAuthOptions; BearerAuthOptions itself is unchanged. The Express requireBearerAuth passes the option through. With Express, @modelcontextprotocol/express has to be upgraded to this release as well: 2.0.1 does not pass the option on, so nothing is compared. Its options type does not have the option, so TypeScript reports an expectedResource written in a call to the 2.0.1 requireBearerAuth as an error.

• #2926 6d8dbc6 Thanks @​claude! - McpServer now accepts a maxToolInputElements option that limits the number of elements in tool-call arguments: the largest combined number of array elements and object members a single tools/call arguments payload may contain. It is off by default, so behavior is unchanged unless you set it. When it is set and a call exceeds it, that call is answered with an isError: true tool result that names the limit, before the input schema runs, and the server keeps serving. Set it above the largest arguments your tools legitimately accept; maxRequestBodySize remains the primary limit on request size. The value must be a number of at least 1, or Infinity for no limit; any other value is rejected at construction. The options type is exported as McpServerOptions.

• #2918 84804c2 Thanks @​claude! - A Server or McpServer now serves one connection at a time, and a Streamable HTTP server transport without sessions (sessionIdGenerator: undefined) serves one request. An app that uses one server object, or one stateless transport, for every HTTP request fails on the second request after this upgrade. Build the server and the transport per request instead.

  What keeps working without a change:

  • createMcpHandler(buildServer) and serveStdio(buildServer), where buildServer returns a new server on every call.
  • A handler that builds a new server and a new stateless transport for each request.
  • One server and one transport per session (a transport with a sessionIdGenerator).
  • Connecting a server again after close().
  • Client.

  What fails now, how it shows, and what to change:

  • One server object with a new stateless transport per request (const server = new McpServer(...) outside the handler, await server.connect(transport) inside it): the second HTTP request the process receives fails, and so does every later one. connect() rejects with an SdkError of code ALREADY_CONNECTED. If the handler closes the transport when the response ends, requests that arrive one after the other still work and a request that overlaps another one fails. Change: move new McpServer(...) and its registrations into the handler.
  • One stateless transport for every request (a transport built once with sessionIdGenerator: undefined): the second HTTP request fails. WebStandardStreamableHTTPServerTransport.handleRequest() rejects with Stateless transport cannot be reused across requests. Create a new transport per request., and NodeStreamableHTTPServerTransport.handleRequest() answers 500. Change: build the server and the transport inside the handler and connect them there.
  • createMcpHandler(() => server) with a server built once: a request that arrives after the previous response has been read to its end still works. A request that arrives while another one is being served is answered 500 with the JSON-RPC error -32603 (Internal server error); the reason is reported only through the onerror option. Change: pass a function that builds the server, as in createMcpHandler(buildServer).
  • One server object for every session: the initialize request of the second session fails with ALREADY_CONNECTED. Change: build a server per session.

  What the caller sees when connect() or handleRequest() rejects depends on the host. Express 5, Fastify and Hono answer 500. A plain node:http listener without its own error handling gets an unhandled rejection, which ends the process.

  The README examples of @modelcontextprotocol/express, @modelcontextprotocol/fastify, @modelcontextprotocol/hono and @modelcontextprotocol/node, and the handler examples in the JSDoc of WebStandardStreamableHTTPServerTransport and NodeStreamableHTTPServerTransport, now build a server and a transport per request.

• #2907 e55f9ac Thanks @​claude! - allowedOrigins and validateOriginHeader accept lowercase entries of the form <scheme>://*, such as moz-extension://* or chrome-extension://*, which admit every origin of that scheme. This lets a server admit MCP clients that run as a browser extension when the extension ID cannot be listed, as on Firefox, where it differs on every install. http://* and https://* are not honoured, and the defaults are unchanged.

... (truncated)

Commits

• fcef852 Version Packages (#2953)
• e8b7f05 docs: one opening note in the server and client package READMEs (#2955)
• 5a18673 feat(server-legacy): add expectedResource to requireBearerAuth (#2952)
• 3ab61c6 docs: update the README banners (#2940)
• 8aabbdc test(e2e): expect SdkHttpError after a second 401 from onUnauthorized (#2936)
• 33fecfb test(e2e): cover tools/call without arguments (#2933)
• 818f782 docs: state the principles in CLAUDE.md and shorten REVIEW.md (#2938)
• a202a36 Version Packages (#2896)
• 2d731fa fix(client): refresh again when an SSE retry failed for a reason other than 4...
• b6e5c55 test(e2e): cover prompts/get without arguments for prompts with a schema (#2928)
• Additional commits viewable in compare view

Updates @posthog/nextjs-config from 1.11.1 to 1.11.3

Release notes

Sourced from @​posthog/nextjs-config's releases.

@​posthog/nextjs-config@​1.11.3

1.11.3

Patch Changes

• #5282 9b7ef84 Thanks @​marandaneto! - Use the package’s own PostHog CLI to prevent sourcemap upload failures when an older CLI is installed elsewhere in a monorepo. (2026-10-13)

@​posthog/nextjs-config@​1.11.2

1.11.2

Patch Changes

• #5202 7199f24 Thanks @​hpouillot! - Support immutable Next.js 16 Turbopack sourcemaps without rewriting build assets, and require a compatible posthog-js runtime for native debug and release IDs. (2026-10-09)
• Updated dependencies [7199f24]:
  • @​posthog/plugin-utils@​2.0.1

Changelog

Sourced from @​posthog/nextjs-config's changelog.

1.11.3

Patch Changes

• #5282 9b7ef84 Thanks @​marandaneto! - Use the package’s own PostHog CLI to prevent sourcemap upload failures when an older CLI is installed elsewhere in a monorepo. (2026-10-13)

1.11.2

Patch Changes

• #5202 7199f24 Thanks @​hpouillot! - Support immutable Next.js 16 Turbopack sourcemaps without rewriting build assets, and require a compatible posthog-js runtime for native debug and release IDs. (2026-10-09)
• Updated dependencies [7199f24]:
  • @​posthog/plugin-utils@​2.0.1

Commits

• 4823ab4 chore: update versions and lockfile [version bump]
• 9b7ef84 fix(nextjs-config): use the package-local PostHog CLI (#5282)
• ddaaf68 chore: adopt Coherence (#5265)
• 789e588 chore: update versions and lockfile [version bump]
• 7199f24 fix(nextjs): support immutable Turbopack sourcemaps (#5202)
• e65d81f build: adopt stable native TypeScript with targeted legacy fallbacks (#4984)
• d14b608 chore: add semantic type checks for every SDK (#4985)
• 2b5a77d fix(webpack-plugin): preserve script integrity during sourcemap uploads (#4939)
• See full diff in compare view

Updates @radix-ui/react-accordion from 1.2.20 to 1.3.1

Changelog

Sourced from @​radix-ui/react-accordion's changelog.

1.3.1

• Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.
• Updated dependencies: @radix-ui/react-collapsible@1.2.1

1.3.0

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Migrated Accordion to an updated collection implementation. This is an implementation detail and does not affect the public API.
• Updated dependencies: @radix-ui/react-collection@1.2.0, @radix-ui/primitive@1.2.0, @radix-ui/react-collapsible@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-direction@1.2.0, @radix-ui/react-primitive@2.2.0, @radix-ui/react-use-controllable-state@1.3.0

1.2.21

• Updated dependencies: @radix-ui/react-collapsible@1.1.21, @radix-ui/react-direction@1.1.5, @radix-ui/react-primitive@2.1.11, @radix-ui/react-collection@1.1.16

Commits

• See full diff in compare view

Updates @radix-ui/react-alert-dialog from 1.1.23 to 1.2.1

Changelog

Sourced from @​radix-ui/react-alert-dialog's changelog.

1.2.1

• Updated dependencies: @radix-ui/react-dialog@1.3.1

1.2.0

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Updated dependencies: @radix-ui/primitive@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-dialog@1.3.0, @radix-ui/react-primitive@2.2.0

1.1.24

• Updated dependencies: @radix-ui/react-dialog@1.2.0, @radix-ui/react-primitive@2.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-avatar from 1.2.6 to 1.3.1

Changelog

Sourced from @​radix-ui/react-avatar's changelog.

1.3.1

• Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.

1.3.0

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Updated dependencies: @radix-ui/primitive@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-primitive@2.2.0, @radix-ui/react-use-callback-ref@1.1.5

1.2.7

• Updated dependencies: @radix-ui/react-primitive@2.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-checkbox from 1.3.11 to 1.4.1

Changelog

Sourced from @​radix-ui/react-checkbox's changelog.

1.4.1

• Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.

1.4.0

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Fixed bugs in form-nested control components where a user-driven change was treated as programmatic in some cases, preventing bubbled event handlers from being called.
• Updated dependencies: @radix-ui/primitive@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-primitive@2.2.0, @radix-ui/react-use-controllable-state@1.3.0

1.3.12

• Updated dependencies: @radix-ui/react-use-size@1.1.5, @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-dialog from 1.1.23 to 1.3.1

Changelog

Sourced from @​radix-ui/react-dialog's changelog.

1.3.1

• Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.
• Updated dependencies: @radix-ui/react-dismissable-layer@1.2.1, @radix-ui/react-focus-scope@1.3.1

1.3.0

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Updated dependencies: @radix-ui/primitive@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-dismissable-layer@1.2.0, @radix-ui/react-focus-guards@1.2.0, @radix-ui/react-focus-scope@1.3.0, @radix-ui/react-portal@1.2.0, @radix-ui/react-primitive@2.2.0, @radix-ui/react-slot@1.5.0, @radix-ui/react-use-controllable-state@1.3.0

1.2.0

• Added support for multiple aria-describedby attributes.
• Fixed nested, portalled layers being unusable inside a modal layer. A non-modal popover rendered inside a modal Dialog previously broke some user interactions because the modal layer's trapped FocusScope reclaimed focus, and its RemoveScroll only allowed scrolling within the modal content.
• Updated dependencies: @radix-ui/react-focus-scope@1.2.0, @radix-ui/react-slot@1.4.0, @radix-ui/react-dismissable-layer@1.1.20, @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11, @radix-ui/react-portal@1.1.18

Commits

• See full diff in compare view

Updates @radix-ui/react-dropdown-menu from 2.1.24 to 2.2.1

Changelog

Sourced from @​radix-ui/react-dropdown-menu's changelog.

2.2.1

• Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.
• Updated dependencies: @radix-ui/react-menu@2.2.1

2.2.0

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Updated dependencies: @radix-ui/primitive@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-menu@2.2.0, @radix-ui/react-primitive@2.2.0, @radix-ui/react-use-controllable-state@1.3.0

2.1.25

• Updated dependencies: @radix-ui/react-menu@2.1.25, @radix-ui/react-primitive@2.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-label from 2.1.15 to 2.1.17

Changelog

Sourced from @​radix-ui/react-label's changelog.

2.1.17

• Updated dependencies: @radix-ui/react-primitive@2.2.0

2.1.16

• Updated dependencies: @radix-ui/react-primitive@2.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-popover from 1.1.23 to 1.3.1

Changelog

Sourced from @​radix-ui/react-popover's changelog.

1.3.1

• Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.
• Updated dependencies: @radix-ui/react-dismissable-layer@1.2.1, @radix-ui/react-focus-scope@1.3.1

1.3.0

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Fixed aria-controls being set on Popover.Trigger while the popover is closed.
• Updated dependencies: @radix-ui/primitive@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-dismissable-layer@1.2.0, @radix-ui/react-focus-guards@1.2.0, @radix-ui/react-focus-scope@1.3.0, @radix-ui/react-popper@1.4.0, @radix-ui/react-portal@1.2.0, @radix-ui/react-primitive@2.2.0, @radix-ui/react-slot@1.5.0, @radix-ui/react-use-controllable-state@1.3.0

1.2.0

• Added Popover.Title and Popover.Description parts that provide accessible names and descriptions for popover content.
• Fixed nested, portalled layers being unusable inside a modal layer. A non-modal popover rendered inside a modal Dialog previously broke some user interactions because the modal layer's trapped FocusScope reclaimed focus, and its RemoveScroll only allowed scrolling within the modal content.
• Updated dependencies: @radix-ui/react-focus-scope@1.2.0, @radix-ui/react-slot@1.4.0, @radix-ui/react-dismissable-layer@1.1.20, @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11, @radix-ui/react-popper@1.3.8, @radix-ui/react-portal@1.1.18

Commits

• See full diff in compare view

Updates @radix-ui/react-progress from 1.1.16 to 1.2.1

Changelog

Sourced from @​radix-ui/react-progress's changelog.

1.2.1

• Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.

1.2.0

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Updated dependencies: @radix-ui/react-context@1.3.0, @radix-ui/react-primitive@2.2.0

1.1.17

• Updated dependencies: @radix-ui/react-primitive@2.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-slot from 1.3.3 to 1.5.0

Changelog

Sourced from @​radix-ui/react-slot's changelog.

1.5.0

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Fixed Slot throwing when an asChild child is a lazy reference whose resolved value is itself a lazy reference.

1.4.0

• Added support for multiple aria-describedby attributes.
• Fixed compatibility issues with React Server Components.

Commits

• See full diff in compare view

Updates @radix-ui/react-switch from 1.3.7 to 1.4.1

Changelog

Sourced from @​radix-ui/react-switch's changelog.

1.4.1

• Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.

1.4.0

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Fixed bugs in form-nested control components where a user-driven change was treated as programmatic in some cases, preventing bubbled event handlers from being called.
• Updated dependencies: @radix-ui/primitive@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-primitive@2.2.0, @radix-ui/react-use-controllable-state@1.3.0

1.3.8

• Updated dependencies: @radix-ui/react-use-size@1.1.5, @radix-ui/react-primitive@2.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-tooltip from 1.2.16 to 1.4.1

Changelog

Sourced from @​radix-ui/react-tooltip's changelog.

1.4.1

• Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.
• Updated dependencies: @radix-ui/react-dismissable-layer@1.2.1, @radix-ui/react-focus-scope@1.3.1

1.4.0

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Fixed a bug where tabbing away from a focusable tooltip trigger nested in a modal popover moved focus to the popover's root instead of the next element in the popover.
• Updated dependencies: @radix-ui/primitive@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-dismissable-layer@1.2.0, @radix-ui/react-focus-scope@1.3.0, @radix-ui/react-popper@1.4.0, @radix-ui/react-portal@1.2.0, @radix-ui/react-primitive@2.2.0, @radix-ui/react-slot@1.5.0, @radix-ui/react-use-controllable-state@1.3.0, @radix-ui/react-visually-hidden@1.2.13

1.3.0

• Added support for multiple aria-describedby attributes.
• Updated dependencies: @radix-ui/react-slot@1.4.0, @radix-ui/react-dismissable-layer@1.1.20, @radix-ui/react-visually-hidden@1.2.12, @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11, @radix-ui/react-popper@1.3.8, @radix-ui/react-portal@1.1.18

Commits

• See full diff in compare view

Updates @serwist/next from 9.5.12 to 9.5.13

Commits

• See full diff in compare view

Updates @supabase/supabase-js from 2.116.0 to 2.118.0

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.118.0

2.118.0 (2026-10-15)

🚀 Features

• postgrest: leave computed fields out of select('*') and resolve no-argument rpc overloads for postgrest-typegen output (#2730)
• storage: add content-encoding support for uploads (#1949)

🩹 Fixes

• ci: patch next and sharp advisories and pin node-browser playwright (#2753)

❤️ Thank You

• Atharv Gaur @​Athaxv
• Ferhat Elmas
• Lukas Klingsbo

v2.118.0-canary.2

2.118.0-canary.2 (2026-10-12)

This was a version bump only, there were no code changes.

v2.118.0-canary.1

2.118.0-canary.1 (2026-10-12)

This was a version bump only, there were no code changes.

v2.118.0-canary.0

2.118.0-canary.0 (2026-10-09)

🚀 Features

• postgrest: leave computed fields out of select('*') and resolve no-argument rpc overloads for postgrest-typegen output (#2730)

🩹 Fixes

• ci: patch next and sharp advisories and pin node-browser playwright (#2753)

❤️ Thank You

• Lukas Klingsbo

v2.117.3

2.117.3 (2026-10-07)

🩹 Fixes

• deps: bump next to patch RCE in realtime-js example (#2733)
• functions: send a Blob or File with its own content type (#2714)

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.118.0 (2026-10-15)

🚀 Features

• postgrest: leave computed fields out of select('*') and resolve no-argument rpc overloads for postgrest-typegen output (#2730)

❤️ Thank You

• Lukas Klingsbo

2.117.3 (2026-10-07)

🩹 Fixes

• storage: send multipart fields before files (#2736)

❤️ Thank You

• Ferhat Elmas
• Katerina Skroumpelou @​mandarini

2.117.2 (2026-09-25)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.117.1 (2026-09-23)

🩹 Fixes

• auth: return stored session when a refresh loses to another tab (#2698)

❤️ Thank You

• Katerina Skroumpelou @​mandarini

2.117.0 (2026-09-22)

🚀 Features

• auth: enable passkey API by default and deprecate experimental passkey opt-in (#2695)

❤️ Thank You

• fadymak

Commits

• b9753a1 feat(postgrest): leave computed fields out of select('*') and resolve no-argu...
• 88faa11 fix(ci): patch next and sharp advisories and pin node-browser playwright (#2753)
• aac9d32 chore(release): version 2.117.3 changelogs (#2744)
• 4d23055 fix(storage): send multipart fields before files (#2736)
• a684cf9 chore(release): version 2.117.2 changelogs (#2707)
• 54c225d chore(release): version 2.117.1 changelogs (#2700)
• 739b351 fix(auth): return stored session when a refresh loses to another tab (#2698)
• f34d428 chore(release): version 2.117.0 changelogs (#2697)
• cc45ccf feat(auth): enable passkey API by default and deprecate experimental passkey ...
• c511286 docs(realtime): document relationship of accessToken() and heartbeat (#2680)
• Additional commits viewable in compare view

Updates @tanstack/react-query from 5.103.1 to 5.104.4

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.104.4

Patch Changes

• #11722 0992a92 - fix(react-query-devtools): create the devtools instance only once instead of on every render

• #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency

• Updated dependencies [c8f5eac, c208861, b61abc2, a108398]:

  • @​tanstack/query-devtools@​5.104.4
  • @​tanstack/react-query@​5.104.4

@​tanstack/react-query-next-experimental@​5.104.4

Patch Changes

• #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency
• Updated dependencies [c208861, a108398]:
  • @​tanstack/react-query@​5.104.4

@​tanstack/react-query-persist-client@​5.104.4

Patch Changes

• #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency
• Updated dependencies [c208861, a108398]:
  • @​tanstack/react-query@​5.104.4
  • @​tanstack/query-persist-client-core@​5.104.4

@​tanstack/react-query@​5.104.4

Patch Changes

• #11328 c208861 - Allow queries with falsy errors to retry on mount when throwOnError returns false.

• #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency

• Updated dependencies [1fee044, fce89dd]:

  • @​tanstack/query-core@​5.104.4

@​tanstack/react-query-devtools@​5.104.3

Patch Changes

• Updated dependencies []:
  • @​tanstack/react-query@​5.104.3
  • @​tanstack/query-devtools@​5.104.3

@​tanstack/react-query-next-experimental@​5.104.3

Patch Changes

• Updated dependencies []:
  • @​tanstack/react-query@​5.104.3

@​tanstack/react-query-persist-client@​5.104.3

Patch Changes

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.104.4

Patch Changes

• #11328 c208861 - Allow queries with falsy errors to retry on mount when throwOnError returns false.

• #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency

• Updated dependencies [1fee044, fce89dd]:

  • @​tanstack/query-core@​5.104.4

5.104.3

Patch Changes

• Updated dependencies [0f15bc9]:
  • @​tanstack/query-core@​5.104.3

5.104.2

Patch Changes

• Updated dependencies [03e8c39]:
  • @​tanstack/query-core@​5.104.2

5.104.1

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.104.1

5.104.0

Minor Changes

• #11650 5279b05 - Build projects with Vite 8

Patch Changes

• Updated dependencies [5279b05]:
  • @​tanstack/query-core@​5.104.0

5.103.3

Patch Changes

• #11647 1c9693e - fix(codemods): avoid copying unnecessary files from codemods project
• Updated dependencies []:
  • @​tanstack/query-core@​5.103.3

... (truncated)

Commits

• 1219972 ci: Version Packages (#12062)
• 1fee044 fix(query-core): clear mutations before notifying subscribers (#11470)
• c208861 fix(react-query): retry queries with falsy errors on mount (#11328)
• a108398 fix(react-query*): declare '@​types/react' as an optional peer dependency (#11...
• ee47993 ci: Version Packages (#11998)
• 0f15bc9 fix(query-core): preserve union narrowing in setQueryData updaters (#11935)
• b699b52 ci: Version Packages (#11849)
• e22e7c4 chore: test TypeScript 7.1 preview and drop 5.6 (#11947)
• df78a9d chore(*): pass the root 'settings' to the package oxlint configs, which 'exte...
• 833062c chore: replace prettier with oxfmt (#11939)
• Additional commits viewable in compare view

Updates @tiptap/core from 3.31.3 to 3.32.0

Release notes

Sourced from @​tiptap/core's releases.

v3.32.0

@​tiptap/markdown

Patch Changes

• A literal ! directly before a link is now escaped when serializing to Markdown, so the link is no longer parsed back as an image.

@​tiptap/pm

Patch Changes

• Update ProseMirror dependencies to their latest versions.

@​tiptap/react

Patch Changes

• Fix useEditorState overflowing the stack when a selector returns a value with circular references, such as editor.state after one stored mark replaces another.

@​tiptap/core

Minor Changes

• Add the schemaSpec editor option to use an external ProseMirror schema structure with local extension behavior.

Patch Changes

• Fix list toggling between list types that use different item nodes. Nested lists are recursively converted when the target item schema supports nesting, and flattened into sibling items when it does not.

@​tiptap/y-tiptap

Patch Changes

• Keep relative text and node positions attached through structural edits, node moves, and undo or redo across collaborating clients.

• Improve TypeScript definitions for document synchronization, shared cursors, undo, redo, and document conversions.

• Improve collaboration performance and keep comments, highlights, caret positions, and remote caret details intact during remote edits.

• Preserve shared content when a client cannot display its nodes or marks, and pause that client's editing until compatible content is available.

  Headless document creation rejects empty content when the schema requires child nodes.

@​tiptap/extension-collaboration

Patch Changes

• Keep collaborative editing, cursor presence, and drag handles compatible with the updated @tiptap/y-tiptap binding.

@​tiptap/extension-collaboration-caret

Patch Changes

... (truncated)

Changelog

Sourced from @​tiptap/core's changelog.

3.32.0

Minor Changes

• 8e2a86f: Add the schemaSpec editor option to use an external ProseMirror schema structure with local extension behavior.

Patch Changes

• cc90cc5: Fix list toggling between list types that use different item nodes. Nested lists are recursively converted when the target item schema supports nesting, and flattened into sibling items when it does not.
• Updated dependencies [3b5560c]
  • @​tiptap/pm@​3.32.0

3.31.4

Patch Changes

• e1fb343: Fix a TypeError thrown when the source editor is destroyed right after dragging content into another editor.
• 8cb08c5: splitBlock no longer throws TransformError: Inserted content deeper than insertion position when the selection spans block boundaries (for example from the start of one paragraph into another block, or across an isolating node). The command now returns false when the split is not possible.
• 4d56526: Prevent extra CSS declarations from being rendered from editor content.
• 7c089f2: Atom block directives (:::name {…} :::) indented by up to 3 spaces are now tokenized, matching CommonMark indentation rules for block constructs.
• 6f14bee: Numeric HTML entities (&[#39](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/core/issues/39);, ') are now decoded when parsing markdown, instead of showing up as literal text in the editor.
• 45e1e85: The editor element keeps role="textbox" after setOptions() w...

  Description has been truncated

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
abode	Ignored	Preview	Oct 26, 2026 2:21pm UTC