Skip to content

deps: bump the minor-and-patch group with 6 updates - #121

Merged
finalerock44 merged 1 commit into
devfrom
dependabot/npm_and_yarn/dev/minor-and-patch-05c8359600
Aug 18, 2026
Merged

deps: bump the minor-and-patch group with 6 updates#121
finalerock44 merged 1 commit into
devfrom
dependabot/npm_and_yarn/dev/minor-and-patch-05c8359600

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 17, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 6 updates:

Package From To
@supabase/supabase-js 2.112.2 2.112.3
js-yaml 5.2.3 5.3.0
@types/node 26.1.2 26.2.0
eslint 10.8.0 10.8.1
tsx 4.23.11 4.23.12
typescript-eslint 8.66.0 8.67.0

Updates @supabase/supabase-js from 2.112.2 to 2.112.3

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.112.3 (2026-08-11)

🩹 Fixes

  • supabase: improve trace propagation sampling and diagnostics (#2604)
  • supabase: add trace context headers to canonical CORS allow-list (#2603)

❤️ Thank You

Commits
  • e44447c fix(supabase): improve trace propagation sampling and diagnostics (#2604)
  • 9f0358c fix(supabase): add trace context headers to canonical CORS allow-list (#2603)
  • 84beab1 chore(release): version 2.112.2 changelogs (#2599)
  • See full diff in compare view

Updates js-yaml from 5.2.3 to 5.3.0

Changelog

Sourced from js-yaml's changelog.

[5.3.0] - 2026-08-14

This release focuses on reworking the documentation and making small architectural improvements before moving forward.

Added

  • Added completely new documentation.
  • Exported DUMP_SCHEMA, the default schema used by the dumper.
  • Added YAMLException.throwAt() for throwing an error at a source position.

Changed

  • Changed flat constant exports to grouped exports: EVENT_ID, SCALAR_STYLE, COLLECTION_STYLE, and CHOMPING_MODE, along with their value types. The old exports are still preserved, but deprecated.
  • Made identify mandatory for custom tag definitions. Use identify: () => false for load-only tags.

Deprecated

  • Deprecated flat constant exports. Use grouped ones instead.

Removed

  • Removed the MERGE_KEY export (not used anymore after last fixes).

Fixed

  • Validate << sequence items at merge time, so aliased merge sources are checked too.
  • Resolve << outside of a mapping key as the plain string '<<', matching v4, instead of leaking an internal symbol into the result.
Commits
  • 04db458 5.3.0 released
  • 22ce0a0 Changelog update
  • fae37b8 fix: << outside a mapping key no longer leaks the internal merge symbol
  • b62ef83 fix: validate << sequence items at merge time, so aliased sources are check...
  • cc665ec docs: review and update annotations
  • 2aa24a6 Changelog update
  • eec6902 Restore deprecated parser constant exports
  • 03397ac Move throwErrorAt to YAMLException as throwAt
  • d9dd2c7 docs: new condensed theme
  • 0f898e6 docs: annotation tweaks
  • Additional commits viewable in compare view

Updates @types/node from 26.1.2 to 26.2.0

Commits

Updates eslint from 10.8.0 to 10.8.1

Commits

Updates tsx from 4.23.11 to 4.23.12

Commits
  • ed9d330 fix: shim import.meta when tokens are split by comments or newlines (#829)
  • 651f5be test: cover CommonJS TypeScript import.meta paths
  • See full diff in compare view

Updates typescript-eslint from 8.66.0 to 8.67.0

Changelog

Sourced from typescript-eslint's changelog.

8.67.0 (2026-08-10)

🚀 Features

  • typescript-eslint: export basic globs for using tseslint (#12105)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps: bump the minor-and-patch group with 6 updates
bc72fa1 
Bumps the minor-and-patch group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.112.2` | `2.112.3` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `5.2.3` | `5.3.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.2` | `26.2.0` |
| [eslint](https://github.com/eslint/eslint) | `10.8.0` | `10.8.1` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.11` | `4.23.12` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.66.0` | `8.67.0` |


Updates `@supabase/supabase-js` from 2.112.2 to 2.112.3
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.112.3/packages/core/supabase-js)

Updates `js-yaml` from 5.2.3 to 5.3.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@5.2.3...5.3.0)

Updates `@types/node` from 26.1.2 to 26.2.0
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `eslint` from 10.8.0 to 10.8.1
- [Commits](eslint/eslint@v10.8.0...v10.8.1)

Updates `tsx` from 4.23.11 to 4.23.12
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.23.11...v4.23.12)

Updates `typescript-eslint` from 8.66.0 to 8.67.0
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.67.0/packages/typescript-eslint)

---
updated-dependencies:
- dependency-name: "@supabase/supabase-js"
  dependency-version: 2.112.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: js-yaml
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@types/node"
  dependency-version: 26.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: eslint
  dependency-version: 10.8.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: tsx
  dependency-version: 4.23.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: typescript-eslint
  dependency-version: 8.67.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 17, 2026
@finalerock44
finalerock44 merged commit 1c07fc1 into dev Aug 18, 2026
6 checks passed
@finalerock44
finalerock44 deleted the dependabot/npm_and_yarn/dev/minor-and-patch-05c8359600 branch August 18, 2026 10:21
@dcd-cli-release-please dcd-cli-release-please Bot mentioned this pull request Aug 18, 2026
Open
@finalerock44 finalerock44 mentioned this pull request Aug 18, 2026
Merged
14 tasks
finalerock44 added a commit that referenced this pull request Aug 18, 2026
@finalerock44
chore: promote the grouped deps bump into 5.3.1 (#123)
19ca6bf 
* chore: promote the grouped deps bump into 5.3.1

Promote from dev to stable, picking up the one change that landed after the
5.3.1 promotion (#119) and so missed the pending release PR (#120):

* deps: bump the minor-and-patch group with 6 updates (#121) —
  @supabase/supabase-js 2.112.2 -> 2.112.3, js-yaml 5.2.3 -> 5.3.0,
  @types/node 26.1.2 -> 26.2.0, eslint 10.8.0 -> 10.8.1, tsx 4.23.11 ->
  4.23.12, typescript-eslint 8.66.0 -> 8.67.0.

Carries only `pnpm-lock.yaml`. Dependabot left `package.json` untouched — every
range already admitted the new versions — so this changes nothing for npm
consumers, who resolve from those ranges. It matters only for the bun-compiled
standalone binaries, which bake in the locked versions.

`Release-As: 5.3.1` keeps the pending release PR (#120) on 5.3.1 rather than
rolling it to 5.3.2. Release-please regenerates the 5.3.1 section from this
commit's bullet alongside #119's three, so the changelog ends up carrying all
four entries.

Verified locally, because CI cannot check this branch: `pnpm install
--frozen-lockfile` (the lockfile agrees with production's package.json), `pnpm
lint` (0 errors, the same 32 pre-existing warnings — the eslint 10.8.1 and
typescript-eslint 8.67.0 bumps add no findings), `pnpm typecheck`, `pnpm build`,
and `pnpm audit --audit-level moderate` (no known vulnerabilities). The
integration tests did NOT run: dcd#1036 deleted `mock-api/`, which is also what
fails CI's `lint-and-test`, at a step that runs before the linter.

Release-As: 5.3.1

* ci: stop reaching into the private dcd repo for the mock-api

`lint-and-test` has failed on every same-repo PR since dcd#1036 deleted
`mock-api/` from the private devicecloud-dev/dcd repo this morning. CI checked
that directory out over an SSH deploy key and ran `pnpm install` in it; the
sparse-checkout now matches nothing, so the job dies at that step — before the
linter — and takes #120, #122 and #123 down with it.

Rather than re-point at a mock, this removes the linkage. dcd-cli is PUBLIC and
was holding `DCD_SSH_DEPLOY_KEY`, a credential granting read access to the
private repo, and pulling the API's `swagger.json` onto the runner on every
same-repo PR. Deleting the checkout drops both.

* The `Checkout dcd (mock-api)` and `Install Mock API dependencies` steps are
  gone, along with the `HAS_PRIVATE_ACCESS` gate that existed only to keep them
  off fork and Dependabot PRs. Every PR now takes the same path, so forks stop
  being second-class.
* CI runs `pnpm test:unit` — a new script that is the existing runner with
  `--unit`. `test/unit/*` is pure and needs no backend, so unit coverage is kept
  rather than dropped along with the integration suite.
* `scripts/test-runner.mjs` no longer defaults `MOCK_API_DIR` to
  `../../dcd/mock-api`. With no mock available it degrades to the unit suite and
  says so, instead of the bare ENOENT it throws today. Set `MOCK_API_DIR` and
  the integration specs run exactly as before.

`DCD_SSH_DEPLOY_KEY` can now be deleted from the repo's secrets — nothing reads
it. That is a separate manual step, not something this commit can do.

Two things are genuinely lost, both worth stating plainly rather than
discovering later:

* `test/integration/*` no longer runs anywhere automatically.
* With it goes the CLI<->swagger contract-drift check. Drift used to surface as
  a Prism 422 — that is how the `googlePlay` multipart break and the `tempPath`
  missing-example break were both caught. Nothing replaces it yet.

Verified locally: `pnpm test:unit` and a bare `pnpm test` both run the unit
suite only and print the notice; 81 pass and the 7 `flow-paths` failures are
Windows-only, asserting POSIX paths against win32 `path`. The same specs ran
green on ubuntu in the last full CI run (job 94750122384, 2026-08-14), which is
the platform CI uses. `pnpm lint`, `pnpm typecheck`, `pnpm build` and `pnpm
audit --audit-level moderate` are all clean.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@finalerock44