Skip to content

chore(deps): bump the production group with 8 updates - #19

Closed
dependabot[bot] wants to merge 0 commit into
mainfrom
dependabot/bun/production-677e8ba696
Closed

chore(deps): bump the production group with 8 updates#19
dependabot[bot] wants to merge 0 commit into
mainfrom
dependabot/bun/production-677e8ba696

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production group with 8 updates:

Package From To
@vgpu/wgsl 0.4.1 0.5.0
cn 0.2.6 0.3.0
fumadocs-core 16.15.8 16.15.10
fumadocs-ui 16.15.8 16.15.10
next 16.3.4 16.3.5
react 19.2.8 19.3.0
react-dom 19.2.8 19.3.0
vgpu 0.4.1 0.5.0

Updates @vgpu/wgsl from 0.4.1 to 0.5.0

Release notes

Sourced from @​vgpu/wgsl's releases.

vgpu 0.5.0 promotes the API and defaults from 0.5.0-rc.1 to the stable channel. All eight public packages version together. The optional native tooling remains beta.

Highlights

  • Explicit texture shapes and usage, immutable allocations, and mip/region readback across core and public APIs.
  • Safer target/texture-pair replacement, destroyed-resource validation, and stale-bundle detection.
  • Vulkan by default for Node/Linux, including hosts with X11 or Wayland.
  • Intrinsic WGSL host layouts, authored entry-point metadata, and strict JavaScript-owned binding values.
  • Optional @vgpu/native tooling for generating Swift/Metal packages, with a pinned, authenticated Tint worker bundled at installation.
  • Versioned migration guides available in CLI and MCP documentation.

Upgrade

npm install vgpu@0.5.0

Update directly installed public @vgpu/* packages to the matching version. Read the 0.5.0 migration guide before upgrading from 0.4.x or RC0. RC1 adopters need no additional API migration; retain the adaptations already made and update package versions.

For optional native generation:

npm install --save-dev --save-exact vgpu@0.5.0 @vgpu/native@0.5.0

Native tooling remains beta and requires an Apple Silicon build host, Node.js 22, and Xcode with its Metal compiler component. The worker is ad hoc signed, not Developer ID signed or notarized. This release does not broaden RC1's platform or distribution qualification. Regenerate and verify native output with the matching tools.

vgpu 0.5.0-rc.1 — native beta

Release candidate for npm next; this does not move latest or promote main.

Native beta

The first functional @vgpu/native release provides optional build-time WGSL → Swift/Metal tooling through vgpu native doctor, check, build and verify. The npm package includes the pinned, hash-authenticated Tint worker, schemas, C helpers and license notices. Consumers do not build or download Tint at installation. The generated application receives Swift and compiled Metal resources, not Node or Tint runtime dependencies.

Install matching exact versions:

npm install --save-dev --save-exact vgpu@0.5.0-rc.1 @vgpu/native@0.5.0-rc.1

Use Node.js 22 and an Apple Silicon Mac with Xcode's Metal compiler component. This is a beta: APIs, generated Swift, configuration and toolchain requirements may change. The worker is ad hoc signed, not Developer ID signed or notarized. Validate your environment without disabling system security. Intel GPU, minimum-OS and broad end-user distribution qualification are not claimed. @vgpu/native@0.0.1 remains an empty name-reservation package.

... (truncated)

Changelog

Sourced from @​vgpu/wgsl's changelog.

0.5.0

Minor Changes

  • 632a908: Add public vgpu native doctor, check, build, and verify command routing and guides for generating self-contained Swift/Metal shader packages. Commands load the optional companion lazily; help does not require it or a native toolchain. The optional @vgpu/native companion is published as a beta in this release; its platform and distribution qualifications remain unchanged from rc.1.

    Expose captured WGSL source graphs and authored entry-point declaration spans for consistent build-time validation and generation. Imports are resolved once per captured graph, and snapshot resolution retains the captured source and edges.

    Breaking changes for this pre-1.0 minor: reflected host-shareable layouts now use intrinsic WGSL alignment and size, with layoutMode: "wgsl-host-shareable-v1". Read address space from the binding, not the removed HostShareableLayout.addressSpace field. Code relying on the previous "naga-standard" mode or padded uniform layout sizes must migrate.

    JavaScript-owned binding values now require the reflected shape, exact component counts, and in-range integers instead of silent coercion, truncation, or filling. Invalid values produce VGPU-SET-VALUE-INVALID with structured reason/path and expected/actual details. Binding ownership and stored values are retained when candidate validation fails; this is a per-candidate guarantee, not an atomic transaction across set({ a, b }) or a rollback of arbitrary GPU errors. Shared uniform updates preserve the previous accepted value on validation failure, and half-float packing uses round-to-nearest, ties-to-even.

    Migrate the rendered examples' initial uniform values to the strict contract: provide every reflected member, including explicit shader padding, and use actual render-target dimensions for initial resolution and bloom texel size. Retain partial updates for animation and resizing without resetting their state.

    The strict binding checks and candidate handling add approximately 1.4 KB gzip to the measured full client entry; init-only is unchanged. The changed WGSL runtime modules add approximately 2.8 KB gzip to the tooling entry. Captured-graph modules are absent from the measured browser entries. Only the six affected package bundle ceilings are updated to the existing 512-byte convention; audiences, growth thresholds, and unrelated ceilings are unchanged.

    Migration guide.

Patch Changes

  • @​vgpu/wgsl-std@​0.5.0

0.5.0-rc.1

Minor Changes

... (truncated)

Commits
  • 57cf9a4 chore(release): prepare 0.5.0 stable from rc.1
  • d163bad release: prepare 0.5.0-rc.1 with native beta
  • 4f4a25a Merge latest canary into native-macos-vgpu
  • b31a52e chore(release): 0.5.0-rc.0
  • da57183 chore: record reviewed canary bundle costs
  • 4932f44 merge canary into native Metal integration
  • 5c48398 Merge origin/canary and migrate the new prism readback test
  • 588a94e feat: finalize explicit texture API and canonical Vulkan snapshots
  • 20d1a63 feat(native): compile immutable captured shader graphs
  • 1541600 feat(wgsl): capture and replay immutable shader source graphs
  • Additional commits viewable in compare view

Updates cn from 0.2.6 to 0.3.0

Release notes

Sourced from cn's releases.

cn@0.3.0

Minor Changes

  • #137 9a9c9b5 Thanks @​shadcn! - Add cn/build, the library behind cn build. The CLI now parses arguments and prints; scanning, subsetting, compiling, and writing run in build(options) so build scripts and bundler plugins can call it directly.

  • #139 829b6e1 Thanks @​shadcn! - Add cn/vite and cn/next.

Changelog

Sourced from cn's changelog.

0.3.0

Minor Changes

  • #137 9a9c9b5 Thanks @​shadcn! - Add cn/build, the library behind cn build. The CLI now parses arguments and prints; scanning, subsetting, compiling, and writing run in build(options) so build scripts and bundler plugins can call it directly.

  • #139 829b6e1 Thanks @​shadcn! - Add cn/vite and cn/next.

Commits

Updates fumadocs-core from 16.15.8 to 16.15.10

Release notes

Sourced from fumadocs-core's releases.

fumadocs@16.15.10

  • @​fumadocs/base-ui@​16.15.10
  • fumadocs-core@16.15.10
  • fumadocs-ui@16.15.10

Fix language switching with hidden locale prefixes

Root Provider's i18n option now accepts defaultLanguage and hideLocale. The language switcher uses these options instead of guessing from the current URL, so switching from /zh/docs to the default language en with hideLocale: 'default-locale' navigates to /docs.

i18nProvider() and defineI18nUI() pass these options from your i18n config automatically.

Fix same-page anchors on Tanstack Start

Tanstack Router's Link takes a pathname in to and reads the hash from a separate hash prop, so a same-page anchor like [link](https://github.com/fuma-nama/fumadocs/blob/HEAD/#installation) was rendered as a link to the current page with the hash dropped, clicking it did nothing. The Tanstack adapter now renders a native <a> for those hrefs:

Jump to [Installation](https://github.com/fuma-nama/fumadocs/blob/HEAD/#installation).

fumadocs@16.15.9

  • @​fumadocs/base-ui@​16.15.9
  • fumadocs-core@16.15.9
  • fumadocs-ui@16.15.9

getPageByUrl() on the loader

Look up a page by its URL:

source.getPageByUrl('/docs/getting-started');
source.getPageByUrl('/cn/docs/getting-started', 'cn');

Without the language argument every language is looked up, unlike getPageByHref() which resolves the default language only.

llms() renders pages

llms() used to build the llms.txt index only, turning a page into Markdown was left to your own getLLMText(). Pass renderPage and it covers both:

import { llms } from 'fumadocs-core/source';
export const docsLlms = llms(source, {
renderPage: async (page) => `# ${page.data.title} (${page.url})
${await page.data.getText('processed')}`,
});

  • page(page) renders one page, for the per-page Markdown route.

... (truncated)

Commits

Updates fumadocs-ui from 16.15.8 to 16.15.10

Release notes

Sourced from fumadocs-ui's releases.

fumadocs@16.15.10

  • @​fumadocs/base-ui@​16.15.10
  • fumadocs-core@16.15.10
  • fumadocs-ui@16.15.10

Fix language switching with hidden locale prefixes

Root Provider's i18n option now accepts defaultLanguage and hideLocale. The language switcher uses these options instead of guessing from the current URL, so switching from /zh/docs to the default language en with hideLocale: 'default-locale' navigates to /docs.

i18nProvider() and defineI18nUI() pass these options from your i18n config automatically.

Fix same-page anchors on Tanstack Start

Tanstack Router's Link takes a pathname in to and reads the hash from a separate hash prop, so a same-page anchor like [link](https://github.com/fuma-nama/fumadocs/blob/HEAD/#installation) was rendered as a link to the current page with the hash dropped, clicking it did nothing. The Tanstack adapter now renders a native <a> for those hrefs:

Jump to [Installation](https://github.com/fuma-nama/fumadocs/blob/HEAD/#installation).

fumadocs@16.15.9

  • @​fumadocs/base-ui@​16.15.9
  • fumadocs-core@16.15.9
  • fumadocs-ui@16.15.9

getPageByUrl() on the loader

Look up a page by its URL:

source.getPageByUrl('/docs/getting-started');
source.getPageByUrl('/cn/docs/getting-started', 'cn');

Without the language argument every language is looked up, unlike getPageByHref() which resolves the default language only.

llms() renders pages

llms() used to build the llms.txt index only, turning a page into Markdown was left to your own getLLMText(). Pass renderPage and it covers both:

import { llms } from 'fumadocs-core/source';
export const docsLlms = llms(source, {
renderPage: async (page) => `# ${page.data.title} (${page.url})
${await page.data.getText('processed')}`,
});

  • page(page) renders one page, for the per-page Markdown route.

... (truncated)

Commits

Updates next from 16.3.4 to 16.3.5

Release notes

Sourced from next's releases.

v16.3.5

The following bug fixes have been backported. It does not include all pending features/changes on canary.

  • next/image: Skip 0-byte entries when initializing disk LRU cache (#98185)
  • next/image: Reject empty images when reading/writing to the disk cache (#98186)
  • Emit whole-app server NFTs when output: 'standalone' is used with an adapter (#98167)
  • Add CSP nonce to script tags of loading and template files (#98403)
  • Fix use cache prerender signal retention (#98448)
Commits
  • ca2c75e v16.3.5
  • 14fb290 [backport] Fix use cache prerender signal retention (#98448)
  • 2b1f28d [16.3.x] Add CSP nonce to script tags of loading and template files (#98403)
  • 4b56cee [16.3.x] Backport docs fixes (#98317)
  • 5568a02 [backport] docs: local development: Rewrite docker section, add Windows Dev D...
  • 93249ab [16.3.X] Emit whole-app server NFTs when output: 'standalone' is used with ...
  • 6549fd7 [16.3.x] next/image: reject empty image on read/write to disk cache (#98186)
  • d9eac96 [16.3.x] next/image: skip 0-byte entries when initializing disk LRU cache (#9...
  • 84b35fe [test] Fix 16.3 deploy test assertions (#98133)
  • 14f9c1a [16.3.x][ci] Run flake detection and new deploy tests when merged and on back...
  • See full diff in compare view

Updates react from 19.2.8 to 19.3.0

Release notes

Sourced from react's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

New React DOM Features

  • browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
    • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

All Changes

React

... (truncated)

Changelog

Sourced from react's changelog.

19.3.0 (September 9, 2026)

New React Features

New React DOM Features

  • browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
    • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

All Changes

React

... (truncated)

Commits

Updates react-dom from 19.2.8 to 19.3.0

Release notes

Sourced from react-dom's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 17, 2026
@vercel

vercel Bot commented Sep 17, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
vecstore-sdk Ready Ready Preview Sep 18, 2026 6:28pm UTC

@changeset-bot

changeset-bot Bot commented Sep 17, 2026 •
edited
Loading

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 2cc7631

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@coderabbitai

coderabbitai Bot commented Sep 17, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: b93beec1-afb9-4375-b856-b471103329b8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@socket-security

socket-security Bot commented Sep 17, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatednext@​16.3.4 ⏵ 16.3.56110090 +19970
Updated@​types/​react-dom@​19.2.7 ⏵ 19.3.01001007592100
Updatedfumadocs-core@​16.15.8 ⏵ 16.15.109810077 +196100
Updatedfumadocs-ui@​16.15.8 ⏵ 16.15.10981007796100
Updated@​types/​react@​19.2.18 ⏵ 19.3.01001007993100
Updatedreact@​19.2.8 ⏵ 19.3.0100 +110084 +197100
Addedcn@​0.3.0861009993100
Updatedreact-dom@​19.2.8 ⏵ 19.3.010010092 +198100
Updatedvgpu@​0.4.1 ⏵ 0.5.0100 +1100100 +196 +1100
Updated@​vgpu/​wgsl@​0.4.1 ⏵ 0.5.0100 +1100100 +196 +1100

View full report

@PunGrumpy

PunGrumpy commented Sep 18, 2026

Copy link
Copy Markdown
Owner

@dependabot rebase

@dependabot @github

dependabot Bot commented on behalf of github Sep 18, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot encountered an unknown error. Because of this, Dependabot cannot update this pull request.

@PunGrumpy
PunGrumpy force-pushed the dependabot/bun/production-677e8ba696 branch from cdad3aa to c737c7c Compare September 18, 2026 18:27
@pkg-pr-new

pkg-pr-new Bot commented Sep 18, 2026

Copy link
Copy Markdown

Open in StackBlitz

npm i https://pkg.pr.new/vecstore-sdk@19

commit: c737c7c

@PunGrumpy PunGrumpy closed this Sep 18, 2026
@PunGrumpy
PunGrumpy force-pushed the dependabot/bun/production-677e8ba696 branch from c737c7c to 2cc7631 Compare September 18, 2026 18:31
@dependabot
dependabot Bot deleted the dependabot/bun/production-677e8ba696 branch September 18, 2026 18:31
@PunGrumpy PunGrumpy mentioned this pull request Sep 18, 2026
Merged
4 tasks

This branch was successfully deployed

1 active deployment
Preview — 2cc7631e Deployed Sep 18, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@PunGrumpy