chore(deps): bump the production-minor-patch group across 1 directory with 8 updates

[dependabot]

Bumps the production-minor-patch group with 8 updates in the / directory:

Package	From	To
posthog-node	5.49.1	5.50.0
jose	6.2.9	6.2.10
@rollup/rollup-linux-x64-gnu	4.62.4	4.62.5
uuid	14.0.1	14.0.2
@anthropic-ai/claude-agent-sdk	0.3.234	0.3.241
@anthropic-ai/sdk	0.117.1	0.120.0
@clerk/nextjs	7.7.7	7.8.0
vite	8.2.1	8.2.2

Updates posthog-node from 5.49.1 to 5.50.0

Release notes

Sourced from posthog-node's releases.

posthog-node@5.50.0

5.50.0

Minor Changes

• #4484 557140e Thanks @​posthog! - FeatureFlagEvaluations.isEnabled() now accepts an optional defaultValue option, returned whenever the flag has no value (missing key, not loaded, or a failed request). A flag with a present value — including false and variant strings — always wins over defaultValue. Purely additive; omitting the option preserves the existing false-on-miss behavior. (2026-08-21)

posthog-node@5.49.4

5.49.4

Patch Changes

• #4569 00d22ea Thanks @​v11t! - fix getFeatureFlagResult returning null variant instead of undefined when remotely evaluated (2026-08-21)

posthog-node@5.49.3

5.49.3

Patch Changes

• #4583 6322f09 Thanks @​turnipdabeets! - Fix logs and metrics being silently dropped when an attribute holds a very large integer, a function, a symbol, a sparse array, or a truncated emoji. Cap log and metric attributes at 20 levels of nesting, 1,000 entries per object and 10,000 values in total, marking anything beyond as [Truncated]. Type OtlpAnyValue.intValue as string | number — code reading that field must handle both. (2026-08-21)
• Updated dependencies [6322f09]:
  • @​posthog/core@​1.48.7

posthog-node@5.49.2

5.49.2

Patch Changes

• #4578 bae46bf Thanks @​marandaneto! - Drop events when a before-send hook throws instead of sending the unmodified event. (2026-08-20)
• Updated dependencies [bae46bf, aef2f49]:
  • @​posthog/core@​1.48.6

Changelog

Sourced from posthog-node's changelog.

5.50.0

Minor Changes

• #4484 557140e Thanks @​posthog! - FeatureFlagEvaluations.isEnabled() now accepts an optional defaultValue option, returned whenever the flag has no value (missing key, not loaded, or a failed request). A flag with a present value — including false and variant strings — always wins over defaultValue. Purely additive; omitting the option preserves the existing false-on-miss behavior. (2026-08-21)

5.49.4

Patch Changes

• #4569 00d22ea Thanks @​v11t! - fix getFeatureFlagResult returning null variant instead of undefined when remotely evaluated (2026-08-21)

5.49.3

Patch Changes

• #4583 6322f09 Thanks @​turnipdabeets! - Fix logs and metrics being silently dropped when an attribute holds a very large integer, a function, a symbol, a sparse array, or a truncated emoji. Cap log and metric attributes at 20 levels of nesting, 1,000 entries per object and 10,000 values in total, marking anything beyond as [Truncated]. Type OtlpAnyValue.intValue as string | number — code reading that field must handle both. (2026-08-21)
• Updated dependencies [6322f09]:
  • @​posthog/core@​1.48.7

5.49.2

Patch Changes

• #4578 bae46bf Thanks @​marandaneto! - Drop events when a before-send hook throws instead of sending the unmodified event. (2026-08-20)
• Updated dependencies [bae46bf, aef2f49]:
  • @​posthog/core@​1.48.6

Commits

• 3508c05 chore: update versions and lockfile [version bump]
• 557140e feat(node): isEnabled() accepts a caller-supplied default value (#4484)
• 6ccc78e chore: update versions and lockfile [version bump]
• 00d22ea fix(node): return undefined instead of null variant in getFeatureFlagResult (...
• 0832e6e chore: update versions and lockfile [version bump]
• 960cef8 chore: update versions and lockfile [version bump]
• bae46bf fix: drop events when beforeSend hooks throw (#4578)
• 9e7a421 test(node): add server SDK wire snapshots (#4544)
• See full diff in compare view

Updates jose from 6.2.9 to 6.2.10

Release notes

Sourced from jose's releases.

v6.2.10

Fixes

• jose: consume serialization members once (9bee285)
• jose: reject empty protected and JWE AAD members (8da4145)
• jose: validate serialized header values (b711d8f)
• jwe: conceal invalid decrypted CEK lengths (41fafe0)
• jwe: enforce AES-GCM tag boundaries (9a5b744)
• jwe: validate explicit encryption parameters (7a02697)
• jwk: accept empty octet-sequence keys (3f871e7)
• jwk: normalize key resolution inputs (f54ee7b)
• jwks: enforce verification key metadata (f9ba510)
• jwks: order overlapping remote reloads (9a1a913)
• jwks: reject invalid remote duration values (7bdb9e5)
• jwk: validate ext and key_ops parameters (4d91c37)
• jws: reject mixed payload encoding modes (dc69713)
• jws: validate unencoded payload strings (541f282)
• jwt: enforce explicit verification policies (b347182)
• jwt: prevent replacing protected headers (ae07d09)
• jwt: reject invalid duration inputs (282f9aa)
• jwt: validate builder claim values (ea03f83)
• jwt: validate unsecured protected headers (230c14e)
• key: validate generation and import options (15d880e)
• reject mixed b64 modes for empty General JWS payloads (61a2ef7)
• x509: reject DER truncated past its outer length (d8db9f6)

Documentation

• jwks: correct cache timestamp units (01a44d9)

Refactor

• jose: share binary input validation (eedb124)
• jose: share compact token processing internals (85e30ed)
• jwe: consolidate CBC decryption failures (1ee6f61)
• jwe: specialize compact processing (a998927)
• jwe: streamline single-recipient encryption (290aaa6)
• jwks: compact JWK Set shape validation (930c7df), references Array#every
• jwks: compact local key selection (4cb5ae5)
• jwks: compact remote resolver state (ef5eaf4)
• jws: specialize compact processing (021abf4)
• jwt: compact claim validation helpers (f390683)
• jwt: consolidate replicated claim checks (7dd5591)
• jwt: share producer claim state (52ba159)
• key: compact JWK algorithm selection (a6b29da)
• key: compact secret length parsing (cc03be8)

Changelog

Sourced from jose's changelog.

6.2.10 (2026-08-21)

Fixes

• jose: consume serialization members once (9bee285)
• jose: reject empty protected and JWE AAD members (8da4145)
• jose: validate serialized header values (b711d8f)
• jwe: conceal invalid decrypted CEK lengths (41fafe0)
• jwe: enforce AES-GCM tag boundaries (9a5b744)
• jwe: validate explicit encryption parameters (7a02697)
• jwk: accept empty octet-sequence keys (3f871e7)
• jwk: normalize key resolution inputs (f54ee7b)
• jwks: enforce verification key metadata (f9ba510)
• jwks: order overlapping remote reloads (9a1a913)
• jwks: reject invalid remote duration values (7bdb9e5)
• jwk: validate ext and key_ops parameters (4d91c37)
• jws: reject mixed payload encoding modes (dc69713)
• jws: validate unencoded payload strings (541f282)
• jwt: enforce explicit verification policies (b347182)
• jwt: prevent replacing protected headers (ae07d09)
• jwt: reject invalid duration inputs (282f9aa)
• jwt: validate builder claim values (ea03f83)
• jwt: validate unsecured protected headers (230c14e)
• key: validate generation and import options (15d880e)
• reject mixed b64 modes for empty General JWS payloads (61a2ef7)
• x509: reject DER truncated past its outer length (d8db9f6)

Documentation

• jwks: correct cache timestamp units (01a44d9)

Refactor

• jose: share binary input validation (eedb124)
• jose: share compact token processing internals (85e30ed)
• jwe: consolidate CBC decryption failures (1ee6f61)
• jwe: specialize compact processing (a998927)
• jwe: streamline single-recipient encryption (290aaa6)
• jwks: compact JWK Set shape validation (930c7df), references Array#every
• jwks: compact local key selection (4cb5ae5)
• jwks: compact remote resolver state (ef5eaf4)
• jws: specialize compact processing (021abf4)
• jwt: compact claim validation helpers (f390683)
• jwt: consolidate replicated claim checks (7dd5591)
• jwt: share producer claim state (52ba159)
• key: compact JWK algorithm selection (a6b29da)
• key: compact secret length parsing (cc03be8)

Commits

• 3eab152 chore(release): 6.2.10
• 021abf4 refactor(jws): specialize compact processing
• a998927 refactor(jwe): specialize compact processing
• eedb124 refactor(jose): share binary input validation
• 52ba159 refactor(jwt): share producer claim state
• 85e30ed refactor(jose): share compact token processing internals
• 0bd81d2 test(jose): cover hidden critical-header options
• 9cf7876 test(jose): reject callable object impostors
• f23cafd test(jose): preserve resolved key data properties
• 1ee6f61 refactor(jwe): consolidate CBC decryption failures
• Additional commits viewable in compare view

Updates @rollup/rollup-linux-x64-gnu from 4.62.4 to 4.62.5

Release notes

Sourced from @​rollup/rollup-linux-x64-gnu's releases.

v4.62.5

4.62.5

2026-08-20

Bug Fixes

• Resolve an issue where compact mode could result in invalid module concatenations (#6468)

Pull Requests

• #6468: Keep the semicolon added after a replaced default export (@​Jaybhade, @​lukastaegert)
• #6469: fix(deps): update minor/patch updates (@​renovate[bot])
• #6470: fix(deps): update swc monorepo (major) (@​renovate[bot])
• #6471: chore(deps): lock file maintenance (@​renovate[bot])
• #6472: chore(deps): update dependency eslint-plugin-unicorn to v73 (@​renovate[bot])
• #6476: chore(deps): update dtolnay/rust-toolchain digest to 4360b52 (@​renovate[bot])
• #6477: fix(deps): update minor/patch updates (@​renovate[bot])
• #6478: chore(deps): lock file maintenance (@​renovate[bot])
• #6479: chore(deps): lock file maintenance (@​renovate[bot])
• #6480: chore(deps): lock file maintenance (@​renovate[bot])

Changelog

Sourced from @​rollup/rollup-linux-x64-gnu's changelog.

4.62.5

2026-08-20

Bug Fixes

• Resolve an issue where compact mode could result in invalid module concatenations (#6468)

Pull Requests

• #6468: Keep the semicolon added after a replaced default export (@​Jaybhade, @​lukastaegert)
• #6469: fix(deps): update minor/patch updates (@​renovate[bot])
• #6470: fix(deps): update swc monorepo (major) (@​renovate[bot])
• #6471: chore(deps): lock file maintenance (@​renovate[bot])
• #6472: chore(deps): update dependency eslint-plugin-unicorn to v73 (@​renovate[bot])
• #6476: chore(deps): update dtolnay/rust-toolchain digest to 4360b52 (@​renovate[bot])
• #6477: fix(deps): update minor/patch updates (@​renovate[bot])
• #6478: chore(deps): lock file maintenance (@​renovate[bot])
• #6479: chore(deps): lock file maintenance (@​renovate[bot])
• #6480: chore(deps): lock file maintenance (@​renovate[bot])

Commits

• c20402e 4.62.5
• e24957a Keep the semicolon added after a replaced default export (#6468)
• 4b6bc39 chore(deps): update dtolnay/rust-toolchain digest to 4360b52 (#6476)
• 62efc42 fix(deps): update swc monorepo (major) (#6470)
• c937289 chore(deps): update dependency eslint-plugin-unicorn to v73 (#6472)
• d652a69 chore(deps): lock file maintenance (#6480)
• bd116c7 chore(deps): lock file maintenance (#6479)
• 10edaf7 chore(deps): lock file maintenance (#6478)
• d42b0d6 fix(deps): update minor/patch updates (#6477)
• bfda94f fix(deps): update minor/patch updates (#6469)
• Additional commits viewable in compare view

Updates uuid from 14.0.1 to 14.0.2

Release notes

Sourced from uuid's releases.

v14.0.2

14.0.2 (2026-08-18)

Bug Fixes

• v1: carry nsecs overflow into the timestamp's high bits (#972) (6adcc1d)
• v1: set the multicast bit on v1Bytes's own randomly-generated node (#973) (b1da338)
• v7: align default seq formula in v7Bytes with updateV7State (#965) (a67db57)

Changelog

Sourced from uuid's changelog.

14.0.2 (2026-08-18)

Bug Fixes

• v1: carry nsecs overflow into the timestamp's high bits (#972) (6adcc1d)
• v1: set the multicast bit on v1Bytes's own randomly-generated node (#973) (b1da338)
• v7: align default seq formula in v7Bytes with updateV7State (#965) (a67db57)

Commits

• fd59f02 chore(main): release 14.0.2 (#967)
• f3c564e docs: point the Node support permalink at the CI version matrix (#974)
• b1da338 fix(v1): set the multicast bit on v1Bytes's own randomly-generated node (#973)
• 6adcc1d fix(v1): carry nsecs overflow into the timestamp's high bits (#972)
• ea83515 docs: cleanup API summary (#968)
• ac36860 chore: pin publint version in CI (#966)
• a67db57 fix(v7): align default seq formula in v7Bytes with updateV7State (#965)
• See full diff in compare view

Updates @anthropic-ai/claude-agent-sdk from 0.3.234 to 0.3.241

Release notes

Sourced from @​anthropic-ai/claude-agent-sdk's releases.

v0.3.241

What's changed

• Updated to parity with Claude Code v2.1.241

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.241
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.241
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.241
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.241

v0.3.240

What's changed

• Updated to parity with Claude Code v2.1.240

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.240
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.240
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.240
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.240

v0.3.239

What's changed

• total_cost_usd / modelUsage.costUSD now include the 1.1× US-only-inference (data residency) multiplier when the response reports inference_geo: "us"
• A result held back for background subagents in one-shot mode now reports total_cost_usd, duration_api_ms and modelUsage as of its release, not the turn-end snapshot
• Fixed SYSTEM_PROMPT_DYNAMIC_BOUNDARY in an array systemPrompt being sent to the model as literal text on Bedrock, Vertex, Foundry, and gateway providers
• A repeated initialize on a running process is now followed by a background_tasks_changed snapshot of the live background tasks, so reconnecting hosts see work that is still running

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.239
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.239
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.239
</tr></table> 

... (truncated)

Changelog

Sourced from @​anthropic-ai/claude-agent-sdk's changelog.

0.3.241

• Updated to parity with Claude Code v2.1.241

0.3.240

• Updated to parity with Claude Code v2.1.240

0.3.239

• total_cost_usd / modelUsage.costUSD now include the 1.1× US-only-inference (data residency) multiplier when the response reports inference_geo: "us"
• A result held back for background subagents in one-shot mode now reports total_cost_usd, duration_api_ms and modelUsage as of its release, not the turn-end snapshot
• Fixed SYSTEM_PROMPT_DYNAMIC_BOUNDARY in an array systemPrompt being sent to the model as literal text on Bedrock, Vertex, Foundry, and gateway providers
• A repeated initialize on a running process is now followed by a background_tasks_changed snapshot of the live background tasks, so reconnecting hosts see work that is still running

0.3.238

• Added is_backgrounded and spawn_depth to task_started events for subagent tasks (is_backgrounded also on background Bash tasks)
• Added suppressOriginalPrompt to UserPromptExpansion hook output, matching UserPromptSubmit
• Added command_lifecycle state refused: a cross-session peer message the session's receive-side policy declines now reports this terminal state instead of producing no lifecycle frames
• Fixed SDK hook callbacks silently not applying after a host re-sends initialize to an already-running CLI; the response now reports hooks_applied
• Fixed CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION=true not keeping prompt_suggestion messages on when the account is near, but not over, its usage limit
• Changed vcs_state_changed push events to emit one event per pushed branch

0.3.237

• Updated to parity with Claude Code v2.1.237

0.3.236

• PostToolUse hooks can return hookSpecificOutput.classifierContext, a short host-asserted note about a tool call's result that the auto mode permission classifier reads alongside that result

0.3.235

• Updated to parity with Claude Code v2.1.235

Commits

• 4827507 chore: Update CHANGELOG.md
• bfa6b84 chore: Update CHANGELOG.md
• ae7e3dd chore: Update CHANGELOG.md
• c4fdbe3 chore: Update CHANGELOG.md
• 591a180 chore: Update CHANGELOG.md
• d933c99 chore: Update CHANGELOG.md
• 076593f chore: Update CHANGELOG.md
• See full diff in compare view

Updates @anthropic-ai/sdk from 0.117.1 to 0.120.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk: v0.120.0

0.120.0 (2026-08-19)

Full Changelog: sdk-v0.119.0...sdk-v0.120.0

Features

• api: managed agents web search config and self hosted sandbox memory (ba8ec50)

Chores

• internal: use a single pnpm workspace lockfile (#359) (3c32145)

sdk: v0.119.0

0.119.0 (2026-08-19)

Full Changelog: sdk-v0.118.0...sdk-v0.119.0

Features

• api: Files and Skills APIs are now GA; add computer use and browser use toolsets (ab41aa3)

sdk: v0.118.0

0.118.0 (2026-08-18)

Full Changelog: sdk-v0.117.1...sdk-v0.118.0

Features

• api: additions to files and memory stores (fdc0379)
• api: updates to skill, files, and user profiles (671e6b1)
• client: add helpers for accessing the workspace ID in response headers (28aa5af)

Bug Fixes

• api: remove unsupported mid_conv_system content block (ae6ca94)
• session-runner: retry tool-result sends for at least the lease TTL (#339) (7dc6325)

Chores

• internal: bump zod to 4.4.3 (#334) (faa5b7b)
• internal: remove leftover prism references (a163b96)
• stop shipping the v0.50 migration guide and migrate CLI (53992d7)

Documentation

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.120.0 (2026-08-19)

Full Changelog: sdk-v0.119.0...sdk-v0.120.0

Features

• api: managed agents web search config and self hosted sandbox memory (ba8ec50)

Chores

• internal: use a single pnpm workspace lockfile (#359) (3c32145)

0.119.0 (2026-08-19)

Full Changelog: sdk-v0.118.0...sdk-v0.119.0

Features

• api: Files and Skills APIs are now GA; add computer use and browser use toolsets (ab41aa3)

0.118.0 (2026-08-18)

Full Changelog: sdk-v0.117.1...sdk-v0.118.0

Features

• api: additions to files and memory stores (fdc0379)
• api: updates to skill, files, and user profiles (671e6b1)
• client: add helpers for accessing the workspace ID in response headers (28aa5af)

Bug Fixes

• api: remove unsupported mid_conv_system content block (ae6ca94)
• session-runner: retry tool-result sends for at least the lease TTL (#339) (7dc6325)

Chores

• internal: bump zod to 4.4.3 (#334) (faa5b7b)
• internal: remove leftover prism references (a163b96)
• stop shipping the v0.50 migration guide and migrate CLI (53992d7)

Documentation

• tools: warn that blocking tool bodies stall the worker heartbeat (#299) (908fdb5)

Commits

• bfa9197 chore: release main
• bc167f3 feat(api): managed agents web search config and self hosted sandbox memory
• 83fd898 chore(internal): use a single pnpm workspace lockfile (#359)
• 7fe6dd5 remove internal ticket references from changelog- #360
• c67e4e2 chore: release main
• 50fc0db feat(api): Files and Skills APIs are now GA; add computer use and browser use...
• 18ea26d chore: release main
• 6ed9ddd feat(api): updates to skill, files, and user profiles
• 91921f5 fix(session-runner): retry tool-result sends for at least the lease TTL (#339)
• 142adcc docs(tools): warn that blocking tool bodies stall the worker heartbeat (#299)
• Additional commits viewable in compare view

Updates @clerk/nextjs from 7.7.7 to 7.8.0

Release notes

Sourced from @​clerk/nextjs's releases.

@​clerk/nextjs@​7.8.0

Minor Changes

• In development, missing Clerk keys no longer activate keyless mode. When NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY and CLERK_SECRET_KEY are not set, the SDK now throws an error directing you to run npx clerk@latest init, which provisions a Clerk application and writes the keys to .env.local. Keyless credentials stored in the development keyless cookie are no longer read. Existing apps with configured or claimed keys are unaffected. (#9493) by @​djgould

Patch Changes

• Updated dependencies [ea8cb05, f541dbf]:
  • @​clerk/shared@​4.29.3
  • @​clerk/backend@​3.16.10
  • @​clerk/react@​6.14.5

@​clerk/nextjs@​7.7.9

Patch Changes

• Updated dependencies [10615ea]:
  • @​clerk/backend@​3.16.9
  • @​clerk/react@​6.14.4

@​clerk/nextjs@​7.7.8

Patch Changes

• Allow Clerk's abuse and fraud protection hosts on all ports in the generated connect-src directive. The contentSecurityPolicy option previously emitted https://*.protect.clerk.com, which matches port 443 only, so requests to those hosts on other ports were blocked by the resulting policy. (#9458) by @​mwickett

• Updated dependencies [4ebcff3]:

  • @​clerk/backend@​3.16.8

Changelog

Sourced from @​clerk/nextjs's changelog.

7.8.0

Minor Changes

• In development, missing Clerk keys no longer activate keyless mode. When NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY and CLERK_SECRET_KEY are not set, the SDK now throws an error directing you to run npx clerk@latest init, which provisions a Clerk application and writes the keys to .env.local. Keyless credentials stored in the development keyless cookie are no longer read. Existing apps with configured or claimed keys are unaffected. (#9493) by @​djgould

Patch Changes

• Updated dependencies [ea8cb05, f541dbf]:
  • @​clerk/shared@​4.29.3
  • @​clerk/backend@​3.16.10
  • @​clerk/react@​6.14.5

7.7.9

Patch Changes

• Updated dependencies [10615ea]:
  • @​clerk/backend@​3.16.9
  • @​clerk/react@​6.14.4

7.7.8

Patch Changes

• Allow Clerk's abuse and fraud protection hosts on all ports in the generated connect-src directive. The contentSecurityPolicy option previously emitted https://*.protect.clerk.com, which matches port 443 only, so requests to those hosts on other ports were blocked by the resulting policy. (#9458) by @​mwickett

• Updated dependencies [4ebcff3]:

  • @​clerk/backend@​3.16.8

Commits

• 297c03d ci(repo): Version packages (#9514)
• f541dbf feat(nextjs): throw missing-env error instead of keyless bootstrap (#9493)
• 99082cb ci(repo): Version packages (#9495)
• ff25005 ci(repo): Version packages (#9477)
• 75ec072 fix(nextjs): allow Clerk protection hosts on all ports in connect-src (#9458)
• See full diff in compare view

Updates vite from 8.2.1 to 8.2.2

Release notes

Sourced from vite's releases.

plugin-legacy@8.2.2

Please refer to CHANGELOG.md for details.

v8.2.2

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.2.2 (2026-08-20)

Features

• deps: widen @vitejs/devtools peer range to v0.5.0 (#23302) (495d9ff)

Bug Fixes

• bundled-dev: handle lazy request error (#23291) (3ba026d)
• bundled-dev: hot update through circular imports instead of reloading (#23259) (3dbddef)
• config: resolve sourcemap paths against sourcemap location (#23239) (05a003e)
• css: don't pass empty targets to lightningcss (#23295) (2804636)
• define: fix match escaped dots to support $-prefixed define keys (#23249) (dcf88bd)
• deps: update all non-major dependencies (#23217) (ba958bd)
• deps: update rolldown-related dependencies (#23218) (83ecb2c)
• module-runner: exclude completed modules from in-flight cycle detection (fix #22999) (#23009) (d9b10a9)
• optimizer: close custom extension analysis bundles (#23207) (8fb7675)
• reduce Windows 8.3-short-name detection false-positives (#23066) (02cffa9)
• respect resolve.preserveSymlinks when resolving root (fix #23197) (#23198) (8413052)
• ssr: rewrite computed key of destructing parameter (#23307) (9db0b61)
• vite: update outdated upstream file links in license comments (#23285) (c0f2fc6)

Documentation

• build: note cssTarget precedence (#23200) (a20a35e)

Miscellaneous Chores

• fix ts errors in build test cases (#23209) (a0cfcf7)

Code Refactoring

• use JSON import attributes i...

  Description has been truncated

[dependabot]

Labels

The following labels could not be found: supply-chain. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[changeset-bot]

⚠️ No Changeset found

Latest commit: da491fb

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[freshtonic]

Approving the dependency changes; do not merge until the red CI is resolved — the failure is not caused by this PR.

The content is clean: grouped minor/patch bumps only, touching manifests, the lockfile, and (in the production group) catalog version strings in pnpm-workspace.yaml. No onlyBuiltDependencies additions, no overrides changes, no script or .npmrc changes.

The failing Drizzle v3 integration jobs fail identically on this PR and its sibling, at integration/lock-context.integration.test.ts, with:

Integration suite cannot run — missing CLERK_MACHINE_TOKEN … This suite FAILS rather than skips: a green skip would hide a real regression.

That is a secrets-availability condition on Dependabot-actor runs (Dependabot workflows read the separate Dependabot secrets store — the CS_* values are evidently there, since the require-cs-secrets pre-flight passed, but CLERK_MACHINE_TOKEN / CLERK_MACHINE_TOKEN_B are not). A dev-tooling or minor-dep bump cannot remove a Clerk credential from a runner; the same job passed on the 26 Aug Dependabot round, so either the token left the Dependabot store since, or the lock-context suite's deliberate fail-rather-than-skip landed in between and is now correctly surfacing a token that was never in that store.

Fix path: add CLERK_MACHINE_TOKEN (and _B) to the repo's Dependabot secrets (Settings → Secrets → Dependabot), then re-run the failed jobs. If instead the intent is that Dependabot runs skip the Clerk-dependent suite, that's a workflow decision to make explicitly — not a reason to hold these bumps.

[freshtonic]

Re-approved after the Dependabot regeneration — same production minor/patch group, catalog-only pnpm-workspace.yaml change, no supply-chain deltas. Same known CI blocker as #955: the Drizzle lock-context suite fail-hard on CLERK_MACHINE_TOKEN missing from the Dependabot secrets store, unrelated to the bumps. Merge once the secret is added and the jobs re-run green.

[freshtonic]

Re-approved at da491fb — the regeneration picked up slightly newer versions within the same minor/patch group (posthog-node 5.50.0, rollup 4.62.5, jose 6.2.10, uuid 14.0.2, Anthropic SDKs), same file scope (manifests + lockfile + catalog strings), no supply-chain deltas. Same standing CI blocker: empty CLERK_MACHINE_TOKEN on Dependabot-actor runs, unrelated to the bumps.