Repository navigation
chore(deps): bump the production-minor-patch group across 1 directory with 9 updates - #282
Open
dependabot[bot] wants to merge 1 commit into
Open
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
… with 9 updates Bumps the production-minor-patch group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1146.0` | `3.1152.0` | | [@radix-ui/react-slot](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/slot) | `1.3.3` | `1.5.0` | | [next](https://github.com/vercel/next.js) | `16.3.8` | `16.4.2` | | [nodemailer](https://github.com/nodemailer/nodemailer) | `10.0.15` | `10.1.1` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.3.0` | `19.3.1` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.3.0` | `19.3.1` | | [zod](https://github.com/colinhacks/zod) | `4.6.5` | `4.6.7` | | [@prisma/adapter-pg](https://github.com/prisma/orm/tree/HEAD/packages/adapter-pg) | `7.10.0` | `7.10.1` | | [@prisma/client](https://github.com/prisma/orm/tree/HEAD/packages/client) | `7.10.0` | `7.10.1` | Updates `@aws-sdk/client-s3` from 3.1146.0 to 3.1152.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1152.0/clients/client-s3) Updates `@radix-ui/react-slot` from 1.3.3 to 1.5.0 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/slot/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/slot) Updates `next` from 16.3.8 to 16.4.2 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.3.8...v16.4.2) Updates `nodemailer` from 10.0.15 to 10.1.1 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v10.0.15...v10.1.1) Updates `react` from 19.3.0 to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react) Updates `react-dom` from 19.3.0 to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom) Updates `zod` from 4.6.5 to 4.6.7 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.6.5...v4.6.7) Updates `@prisma/adapter-pg` from 7.10.0 to 7.10.1 - [Release notes](https://github.com/prisma/orm/releases) - [Commits](https://github.com/prisma/orm/commits/7.10.1/packages/adapter-pg) Updates `@prisma/client` from 7.10.0 to 7.10.1 - [Release notes](https://github.com/prisma/orm/releases) - [Commits](https://github.com/prisma/orm/commits/7.10.1/packages/client) --- updated-dependencies: - dependency-name: "@aws-sdk/client-s3" dependency-version: 3.1152.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: "@radix-ui/react-slot" dependency-version: 1.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: next dependency-version: 16.4.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: nodemailer dependency-version: 10.1.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: react dependency-version: 19.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: react-dom dependency-version: 19.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: zod dependency-version: 4.6.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: "@prisma/adapter-pg" dependency-version: 7.10.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: "@prisma/client" dependency-version: 7.10.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
the
dependencies
|
Strix is installed on this repository, but we couldn't run this PR security review because this workspace's trial has ended. Add a card to resume code reviews here. So far, Strix has reviewed 50 pull requests and surfaced 1 security issue across this workspace. |
![graphify-labs[bot]](https://avatars.githubusercontent.com/in/4356270?s=60&v=4){kind=small}
There was a problem hiding this comment.
Graphify reviewed this change.
Worth a look — the grounded gate found no coupling regressions or blocking issues, but 1 advisory finding(s) below merit a look before merge.
Not checked: tests were not run; no formal proof of the changed code.
Graphify review — findings
Bumps routine dependency patch and minor versions across the web app, db, shared and ui packages, with the lockfile regenerated to match. The web app moves to next 16.4.2, react and react-dom 19.3.1, @radix-ui/react-slot 1.5.0, @aws-sdk/client-s3 3.1152.0 and nodemailer 10.1.1, while zod 4.6.7 is picked up in both apps/web and packages/shared. The db package moves @prisma/client and @prisma/adapter-pg to 7.10.1 but leaves the root prisma CLI pinned at 7.10.0, so the generated client and the CLI that generates it now run on different versions.
Worth a look
- @prisma/client bumped to 7.10.1 while prisma CLI stays at 7.10.0 —
pnpm-lock.yaml:210· Escalate · medium- agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
Review partial — this diff was larger than one review pass covers, so later files were not reviewed; some findings may be missing.
Analysis details — impact, health, verification
Impact & health
Graphify review
Impact — 162 functions depend on the 162 functions this change touches.
Health — grade A; no new coupling hotspots.
Verification — 162 functions in the blast radius were not formally verified this run (proofs are advisory here).
Gate & verification
graphify gate
PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.
Advisory (not blocking):
- verification_scope: 162 function(s) in the blast radius were not formally verified this run
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the production-minor-patch group with 9 updates in the / directory:
3.1146.03.1152.01.3.31.5.016.3.816.4.210.0.1510.1.119.3.019.3.119.3.019.3.14.6.54.6.77.10.07.10.17.10.07.10.1Updates
@aws-sdk/client-s3from 3.1146.0 to 3.1152.0Release notes
Sourced from @aws-sdk/client-s3's releases.
... (truncated)
Changelog
Sourced from @aws-sdk/client-s3's changelog.
Commits
3ce8aa7Publish v3.1152.0d6adfcbPublish v3.1151.04c9a334Publish v3.1150.0a960c14Publish v3.1149.05773a75chore(codegen): sync for endpoint cache fix and pre-schema error fallback (#8...1bc0425Publish v3.1148.0663046dPublish v3.1147.0Updates
@radix-ui/react-slotfrom 1.3.3 to 1.5.0Changelog
Sourced from @radix-ui/react-slot's changelog.
Commits
Updates
nextfrom 16.3.8 to 16.4.2Release notes
Sourced from next's releases.
... (truncated)
Commits
2864b17v16.4.2a42cb59Revert "[lts-active] Keep requests through middleware in a single OpenTelemet...f0760ec[lts-active] Backport additional documentation fixes since v16.4.0 (#100262)845007a[lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions (#100211)6a79d8a[lts-active] Backport docs fixes since v16.4.0 (#100246)a75a782[lts-active] Keep requests through middleware in a single OpenTelemetry trace...8ad8524[lts-active] Turbopack: Ignore realpath errors during module resolution, matc...29d030e[lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependenc...3e50b82[lts-active] fix(next-code-frame): snap visible window to char boundaries (#1...9458fb9[lts-active] Turbopack: backport Pages Router dev module graph chaining (#988...Updates
nodemailerfrom 10.0.15 to 10.1.1Release notes
Sourced from nodemailer's releases.
... (truncated)
Changelog
Sourced from nodemailer's changelog.
Commits
9396ccachore(master): release 10.1.1 (#1893)65d7498chore(deps): bump dev dependencies647ee44test(smtp-connection): pin connectionTimeout across all resolved addressesa15360cfix(fetch): strip credentials on any cross-origin redirectc8671c4Updated SECURITY.md formattingbe6fe72testing VUlnerability firm7bdaa77chore: Updated Security Policy0780032chore(master): release 10.1.0 (#1890)42b91d9fix(qp): encode a lone CR or LF in binary quoted-printable partsb9b8c84test(smtp-pool): fail the clear event test with the pool state instead of han...Updates
reactfrom 19.3.0 to 19.3.1Release notes
Sourced from react's releases.
Commits
61aa00d[19.3.x][Flight] Improve transport protocol (#37845)Updates
react-domfrom 19.3.0 to 19.3.1Release notes
Sourced from react-dom's releases.
Commits
61aa00d[19.3.x][Flight] Improve transport protocol (#37845)Updates
zodfrom 4.6.5 to 4.6.7Release notes
Sourced from zod's releases.
Commits
b500a2e4.6.79c21983ci: stage at verbose so a failed OIDC token exchange says why529f78d4.6.6a0ebf97fix(v4): check array, set and map size bounds before parsing elements (#6652)a2ba4a6fix(types): declare record output and input as members, not base type argumen...c42596brelease: hold the run on the release-approval environment until the staged ve...bacad51docs: square the Code for Japan logo to match the other bronze tiles8fb2fafdocs: crop the Code for Japan logo and list it first in bronzeb2ef983docs: add Code for Japan to bronze sponsors74304cerelease: stage npm versions instead of publishing them (#6622)Updates
@prisma/adapter-pgfrom 7.10.0 to 7.10.1Commits
312e543chore: update npm provenance repository (#30146)Updates
@prisma/clientfrom 7.10.0 to 7.10.1Commits
97ea359fix(client): stop nested $transaction from mutating the caller's options obje...3dcc5b3chore(deps): update engines to 8.1.0-1.d1b3f377ca835d73fd50954a5e22128b9ebdd6...9cb9c08test(e2e): run prisma init from the local tarball in the corepack test (#30183)312e543chore: update npm provenance repository (#30146)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions