fix(deps): bump the production-deps group across 1 directory with 11 updates by dependabot[bot] · Pull Request #142 · ipsec-dev/Article30

dependabot · 2026-09-07T22:51:41Z

Bumps the production-deps group with 11 updates in the / directory:

Package	From	To
@aws-sdk/client-s3	`3.1109.0`	`3.1127.0`
@prisma/adapter-pg	`7.9.1`	`7.10.0`
@prisma/client	`7.9.1`	`7.10.0`
nestjs-cls	`6.2.1`	`6.3.0`
pdfkit	`0.19.1`	`0.20.2`
pg	`8.22.0`	`8.23.0`
prisma	`7.9.1`	`7.10.0`
lucide-react	`1.31.0`	`1.41.0`
next	`16.3.0`	`16.3.4`
react-hook-form	`7.85.0`	`7.87.0`
sonner	`2.0.7`	`2.0.8`

Updates @aws-sdk/client-s3 from 3.1109.0 to 3.1127.0

Release notes

Sourced from @aws-sdk/client-s3's releases.

v3.1127.0

3.1127.0(2026-09-04)

New Features

client-mediatailor: Elemental MediaTailor now supports two new Monetization Functions lifecycle hooks, Post Ads Response and Pre Manifest Insertion, and a VAST Request function type that calls a VAST or VMAP ad server. This release also adds Yield Optimization with demand from Amazon Publisher Services. (c238a693)

client-service-quotas: Service Quotas adds the AdjustableAtLevel property to QuotaContext, indicating whether a quota is adjustable at the account or resource level. (f56bdf2c)

client-bedrock: New AWS REVIEW mode as supported data retention mode for Bedrock models (cbd9ea9a)

client-ec2: Adds support for ValidateSecurityGroupQuotasForInterface, an API that specifically authorized AWS services use to validate security group rule quotas before creating an elastic network interface. (f51c3b3e)

For list of updated packages, view updated-packages.md in assets-3.1127.0.zip

v3.1126.0

3.1126.0(2026-09-03)

Documentation Changes

client-sfn: Updates Step Functions API documentation around CloudTrail, Execution name reuse and sort order of ListExecutions API (8dda8b4b)

client-elastic-load-balancing-v2: This release adds support for sending TCP resets for Gateway Load Balancer when a flow's idle timeout expires, or when a target becomes unhealthy or is deregistered. This adds updates the CLI documentation. (a16f1659)

New Features

client-socialmessaging: Adding support for WhatsApp Flows with endpoints. (3a3a6205)

client-transfer: AWS Transfer Family SFTP Connectors now support specifying an ordered list of AWS Secrets Manager version stages for secret retrieval. This enables seamless credential rotation workflows where external partners may take time to update their systems with new credentials. (e4bf3ecc)

client-transcribe: Amazon Transcribe now supports specifying up to 29 PII entity types in the ContentRedaction configuration of a StartTranscriptionJob request, allowing all supported entity types to be redacted in a single batch transcription job. (5fb0b9a5)

client-connect: This release enables TagOnCreate for Rule resource on CreateRule API. It also introduces a new field called PreEvaluationFilters to Rule resource, thereby impacting all Create, Update, Describe and Search APIs for Rules (18bb14bc)

client-ecs: Adds a critical parameter to the Amazon ECS managed daemon APIs that controls whether a daemon task failure drains the container instance. Non-critical daemon failures no longer drain the instance or block instance registration. (2e6a07d5)

client-evs: Amazon EVS now allows users to set, update, and retrieve values for parameters that apply across all EVS Environments in their account at a regional level, such as the VCF License portability core count. (803b694c)

client-drs: AWS Elastic Disaster Recovery now includes source server architecture in SourceProperties to identify x86 and ARM64 systems. (20f19e0e)

client-bedrock-agentcore: Adds log group name prefix trace source selection, custom or source log group result destinations, and metrics namespace customization (823b2d33)

client-bedrock-agentcore-control: AgentCore Identity adds Consent Portal APIs to manage portals that let end users grant OAuth authorization for agents to access resources. AgentCore Evaluation adds trace source selection by log group prefix, custom or source log group result destinations, and metrics namespace customization. (2f826477)

client-eks: Deprecate EncryptionConfig resources field. Amazon EKS encrypts all Kubernetes API data with envelope encryption by default for clusters running Kubernetes version 1.28 or higher, so this field no longer affects which resources are encrypted. (c66ca41b)

client-guardduty: Adding support for Sequence Activities in GuardDuty Findings (5c12a0eb)

lib-transfer-manager: add download directory functionality (#8274) (6e591ee8)

For list of updated packages, view updated-packages.md in assets-3.1126.0.zip

v3.1125.0

3.1125.0(2026-09-02)

New Features

client-ec2: This release adds support to retain interruptible Capacity Reservations in an active state when all capacity is reclaimed. (336c7896)

client-sagemaker-featurestore-runtime: Amazon SageMaker Feature Store now supports the UpdateRecord API, enabling partial updates to individual feature values in an existing Online Store record without rewriting the entire record. This reduces write payloads and latency for high-frequency feature-level writes . (71920960)

... (truncated)

Changelog

Sourced from @aws-sdk/client-s3's changelog.

3.1127.0 (2026-09-04)

Note: Version bump only for package @aws-sdk/client-s3

3.1126.0 (2026-09-03)

Note: Version bump only for package @aws-sdk/client-s3

3.1125.0 (2026-09-02)

Note: Version bump only for package @aws-sdk/client-s3

3.1124.0 (2026-09-01)

Note: Version bump only for package @aws-sdk/client-s3

3.1123.0 (2026-08-31)

Note: Version bump only for package @aws-sdk/client-s3

3.1122.0 (2026-08-31)

Note: Version bump only for package @aws-sdk/client-s3

3.1121.0 (2026-08-28)

... (truncated)

Commits

8893344 Publish v3.1127.0
7131e74 Publish v3.1126.0
678282b Publish v3.1125.0
e80cab3 Publish v3.1124.0
49a1557 Publish v3.1123.0
e1cf460 Publish v3.1122.0
e53a25a Publish v3.1121.0
d6be6f8 Publish v3.1120.0
ba4e449 Publish v3.1119.0
c65dd65 Publish v3.1118.0
Additional commits viewable in compare view

Updates @prisma/adapter-pg from 7.9.1 to 7.10.0

Release notes

Sourced from @prisma/adapter-pg's releases.

7.10.0

Prisma ORM 7.10.0

Prisma ORM 7.10.0 introduces a compatibility package for running Prisma 7 alongside newer Prisma versions, secures Prisma Studio's local server, and includes fixes across Prisma Client and the PostgreSQL, MariaDB, Neon, SQLite, and Prisma Postgres Serverless adapters.

Highlights

Run Prisma 7 alongside Prisma 8

This release introduces @prisma/prisma7, a compatibility package that lets you retain a matching Prisma 7 CLI and configuration while installing Prisma 8 in the same project.

Once 7.10.0 is released, a side-by-side installation can use:
npm install --save-dev prisma@8 @prisma/prisma7@7.10.0
npm install @prisma/client@7.10.0
Use prisma for the directly installed Prisma 8 CLI and prisma7 for Prisma 7:
npx prisma --version
npx prisma7 --version
npx prisma7 generate
npx prisma7 migrate dev
npx prisma7 db push
Prisma 7 now prefers version-specific configuration files, allowing its configuration to coexist with Prisma 8's prisma.config.* files:
// prisma7.config.ts
import { defineConfig } from '@prisma/prisma7/config'
export default defineConfig({
schema: 'prisma/schema.prisma',
migrations: {
path: 'prisma/migrations',
},
})
Without an explicit --config option, Prisma 7 searches for:

Root-level prisma7.config.* files.

.config/prisma7.* files.

Existing prisma.config.* files as a backwards-compatible fallback.

The supported extensions are .js, .ts, .mjs, .cjs, .mts, and .cts. An explicit config path always takes precedence:

... (truncated)

Commits

3fa65ac fix(p2002): correct modelName in nested create unique constraint errors #2959...
a180209 fix(adapter-pg): map PostgreSQL deadlocks to P2034 (#29717)
800f1d1 fix(adapter-pg): preserve constraint name for unique violations (23505) (#29587)
7ef2104 fix(postgres): handle SQLSTATE 23001 for RESTRICT violations (#29554)
See full diff in compare view

Updates @prisma/client from 7.9.1 to 7.10.0

Release notes

Sourced from @prisma/client's releases.

7.10.0

Prisma ORM 7.10.0

Prisma ORM 7.10.0 introduces a compatibility package for running Prisma 7 alongside newer Prisma versions, secures Prisma Studio's local server, and includes fixes across Prisma Client and the PostgreSQL, MariaDB, Neon, SQLite, and Prisma Postgres Serverless adapters.

Highlights

Run Prisma 7 alongside Prisma 8

This release introduces @prisma/prisma7, a compatibility package that lets you retain a matching Prisma 7 CLI and configuration while installing Prisma 8 in the same project.

Once 7.10.0 is released, a side-by-side installation can use:
npm install --save-dev prisma@8 @prisma/prisma7@7.10.0
npm install @prisma/client@7.10.0
Use prisma for the directly installed Prisma 8 CLI and prisma7 for Prisma 7:
npx prisma --version
npx prisma7 --version
npx prisma7 generate
npx prisma7 migrate dev
npx prisma7 db push
Prisma 7 now prefers version-specific configuration files, allowing its configuration to coexist with Prisma 8's prisma.config.* files:
// prisma7.config.ts
import { defineConfig } from '@prisma/prisma7/config'
export default defineConfig({
schema: 'prisma/schema.prisma',
migrations: {
path: 'prisma/migrations',
},
})
Without an explicit --config option, Prisma 7 searches for:

Root-level prisma7.config.* files.

.config/prisma7.* files.

Existing prisma.config.* files as a backwards-compatible fallback.

The supported extensions are .js, .ts, .mjs, .cjs, .mts, and .cts. An explicit config path always takes precedence:

... (truncated)

Commits

05c1b88 Teach Prisma 7 to prefer versioned config files (#30020)
cf2bc1f Rename prisma7 package to @prisma/prisma7 (#30002)
ce5a34c Complete downstream actionable Prisma 7 guidance propagation (#29994)
3f13ec6 Complete CLI-owned prisma7 distribution identity (#29969)
179ba0c feat(prisma7): add side-by-side CLI wrapper (#29949)
3fa65ac fix(p2002): correct modelName in nested create unique constraint errors #2959...
6b6d9e9 chore(deps): update engines to 7.10.0-4.0edf323efd1d98336f3f0a68684b56f689b90...
b64e33c chore(deps): update engines to 7.10.0-3.9d90ce2c89d5c95a1148aef15e5561ab6c490...
2046f9b feat(client): expose ModelName to compute function in Result extensions (#29782)
f2b3abd chore(deps): update engines to 7.10.0-1.6d040c802892de6d56c7e0061b7a10b3e6a0c...
Additional commits viewable in compare view

Updates nestjs-cls from 6.2.1 to 6.3.0

Release notes

Sourced from nestjs-cls's releases.

nestjs-cls@6.3.0

6.3.0 "nestjs-cls" (2026-09-04)

Features

support NestJS 12 (7c92d8e) (#629)

nestjs-cls@6.2.2

6.2.2 "nestjs-cls" (2026-08-25)

Bug fixes

core: proxy provider improvements - optional deps, better error messages, docs caveats (#579)

Support OptionalFactoryDependency in inject arrays (closes #381)

Factory proxy providers now accept { token: T, optional: true } in inject:
ClsModule.forFeatureAsync({
  provide: MY_PROXY,
  inject: [{ token: SomeService, optional: true }],
  useFactory: (svc?: SomeService) => ({ value: svc?.getValue() ?? 'default' }),
});
@Optional() on class proxy constructor params already worked.

Throw on invalid factory return values (closes #375)

Factories returning null, undefined, or a primitive now throw ProxyProviderInvalidReturnTypeException instead of silently producing a broken proxy.

Commits

382e864 chore: release packages [skip ci]
999e48d ci: run tests on Node 24
16d6050 docs: document NestJS 12 compatibility and ESM test setup
7c92d8e feat: support NestJS 12
2b9257b test: run the test suites on Jest's ESM runtime
d4ab18a chore(build): split dev and build TypeScript projects
e3110b8 chore: release packages [skip ci]
70b172a fix(core): proxy provider improvements - optional deps, better error messages...
d1cec03 chore: release packages [skip ci]
5417f21 feat(transactional-adapter-drizzle-orm): accept drizzle-orm v1 in the peer ra...
Additional commits viewable in compare view

Updates pdfkit from 0.19.1 to 0.20.2

Release notes

Sourced from pdfkit's releases.

v0.20.2

Fix bundlers and file tracers packing the ESM copies of the standard font metrics instead of the CommonJS ones the Node build actually loads, which left Cannot find module errors for every standard font at runtime, by resolving the internal #standard-fonts/* mapping to a single file under all conditions

Fix doc.file() throwing when the same in-memory attachment is embedded twice under one name, because the creation and modified dates the deduplication check compares are absent for sources that are not read from disk

Fix doc.text() throwing unsupported number: NaN when lineBreak: false is combined with underline, strike, link or goTo, because the rendered width was computed from the line wrapper's measurements, which are never produced when wrapping is disabled

v0.20.1

Add a Node ESM build so import 'pdfkit' in Node resolves to the Node build (real file system, native zlib, Node streams, self-registering standard fonts) instead of the browser bundle

v0.20.0

Highlights

TLDR: "A PDF generation library for Node.js" -> "A JavaScript PDF generation library"

Standard Font Support rewritten

Standard font support has been rewritten to use pre-parsed font metrics instead of parsing raw AFM definitions at runtime. The new approach is more efficient (less runtime overhead and memory usage) and reduces the size of the browser bundle significantly. Standalone build which bundles all standard fonts is down to 1.3MB from 2.3MB.

In Node, font metrics are loaded lazily as before, while in browser builds, except the standalone one, each font must be imported from pdfkit/standard-fonts/* and registered with registerStdFonts(). Previously, to use a standard font in browser was necessary to use a bundler.

See usage example in output helpers section below.

Removal of Node specific dependencies

Buffer is no longer used internally. Uint8Array is now the minimum denominator for binary data in both Node and browsers. Since Buffer is a Uint8Array subclass, this change is fully backward compatible.

Native fs, zlib and ReadableStream are conditionally imported only in Node. Browser builds use minimal implementations. This approach gives us the best of both worlds: Node builds still use the native modules, while browser ones are portable.

Many thanks to @diegomura for his help in removing the Node specific dependencies.

registerFile API

The new registerFile(path, data) API allows registering in-memory files globally. The data argument must be a Uint8Array. Passing undefined as data unregisters the path.

In browsers, it can be used as a simplified virtual file system. In Node, this is useful for registering fonts, images and other resources that are not available on disk. The native file system is still used when the path is not registered.
import { PDFDocument, registerFile } from 'pdfkit';
const response = await fetch('/fonts/Roboto-Regular.ttf');
const fontData = new Uint8Array(await response.arrayBuffer());
registerFile('fonts/Roboto-Regular.ttf', fontData);
const doc = new PDFDocument();
// register an alias for the font path
doc.registerFont('Roboto', 'fonts/Roboto-Regular.ttf');
// or use the path directly
doc.font('fonts/Roboto-Regular.ttf');
</tr></table>

... (truncated)

Changelog

Sourced from pdfkit's changelog.

[v0.20.2] - 2026-08-29

Fix bundlers and file tracers packing the ESM copies of the standard font metrics instead of the CommonJS ones the Node build actually loads, which left Cannot find module errors for every standard font at runtime, by resolving the internal #standard-fonts/* mapping to a single file under all conditions

Fix doc.file() throwing when the same in-memory attachment is embedded twice under one name, because the creation and modified dates the deduplication check compares are absent for sources that are not read from disk

Fix doc.text() throwing unsupported number: NaN when lineBreak: false is combined with underline, strike, link or goTo, because the rendered width was computed from the line wrapper's measurements, which are never produced when wrapping is disabled

[v0.20.1] - 2026-08-23

Add a Node ESM build so import 'pdfkit' in Node resolves to the Node build (real file system, native zlib, Node streams, self-registering standard fonts) instead of the browser bundle

[v0.20.0] - 2026-08-23

[BREAKING CHANGE] Remove the virtual file system (pdfkit/virtual-fs). Browser builds no longer depend on fs: use registerFile to register Uint8Array data under a path, pass a Uint8Array or ArrayBuffer directly to registerFont, image and file, or pass a data URL directly to image and file

Add registerFile(path, data, options) to globally register in-memory files in Node and browsers, with optional birthtime and ctime metadata. Passing undefined as data unregisters the path

[BREAKING CHANGE] Export PDFDocument, LineWrapper and registerFile as named exports from the main Node and browser entry points while preserving the default PDFDocument export

Add experimental toBlob(document) and toBytes(document) output helpers under pdfkit/output

Accept already-parsed fontkit Font instances in doc.font() and registerFont

Load the PDF/A ICC profile from disk only when needed in Node, while continuing to bundle it in browser builds

Add tools to convert raw AFM standard-font definitions into parsed or compact runtime JavaScript modules

[BREAKING CHANGE] Use generated standard-font data instead of parsing raw AFM definitions at runtime. Node loads font metrics lazily; browser applications must import each font they use from pdfkit/standard-fonts/* and register it with registerStdFonts()

[BREAKING CHANGE] Restrict AcroForm options to documented mappings and explicit escape hatches.

[BREAKING CHANGE] Stop automatically uppercasing annotation option keys.

[BREAKING CHANGE] Throw from addNamedEmbeddedFile when no ref is given, instead of writing an unparseable undefined token into the /EmbeddedFiles name tree

Do not mutate options passed to doc.annotate() and its convenience methods (link, note, strike, lineAnnotation, rectAnnotation, ellipseAnnotation, textAnnotation, fileAnnotation)

Persist font options when adding a new page. Fixes #1739

Use Uint8Array instead of Node's Buffer internally

Fix date text field formatting emitting invalid JavaScript, so the format was never applied. Fixes #1546

Fix indentAllLines applying the indent again on every paragraph and every page break, and keep it applied across continued text. Fixes #1606

Fix a hole in a sparse array being skipped entirely, which shifted every later entry down one

Encrypt strings inside name trees. Fixes #1513

Commits

8d72a71 v0.20.2
70c9ad5 Document the parameter list each destination type takes (#1785)
e04b677 Fix doc.text() throwing NaN with lineBreak false and underline/strike/link/go...
c6f57c6 fix: resolve #standard-fonts/* to one file under every condition (#1782)
b87b5ac Fix case-insensitive lookup for named CSS colors (#1780)
69671d9 Fix doc.file() throwing when the same in-memory attachment is added twice (#1...
1f1abb8 Bump ip-address from 10.2.0 to 10.4.0 (#1761)
f58c4c7 Bump postcss from 8.5.15 to 8.5.25 (#1762)
f048bdd v0.20.1
910c86a Add Node ESM build: route the node import condition to a real Node bundle (#1...
Additional commits viewable in compare view

Updates pg from 8.22.0 to 8.23.0

Changelog

Sourced from pg's changelog.

pg@8.23.0

Add support for query pipelineing.

Commits

df274d1 Publish
eb19d0f Add opt-in query pipelining (#3652)
See full diff in compare view

Updates prisma from 7.9.1 to 7.10.0

Commits

See full diff in compare view

Attestation changes

This version has no provenance attestation, while the previous version (7.9.1) was attested. Review the package versions before updating.

Updates lucide-react from 1.31.0 to 1.41.0

Release notes

Sourced from lucide-react's releases.

Version 1.41.0

What's Changed

feat(icons): Add new icons germ and germ-off by @rrod497 in lucide-icons/lucide#4056

feat(icons): added door-stairwell icon & updated door-* icons by @jguddas in lucide-icons/lucide#3554

feat(icons): added credit-card-reader icon by @jguddas in lucide-icons/lucide#4616

feat(icons): added 'engine' icon by @benhaube in lucide-icons/lucide#4598

feat(icons): fixed germ & germ-off by @karsa-mistmere in lucide-icons/lucide#4789

chore(deps): bump the vue-deps group with 2 updates by @dependabot[bot] in lucide-icons/lucide#4771

feat(icons): added virus/virus-off icon by @karsa-mistmere in lucide-icons/lucide#4765

chore(copilot-reviews): Improve use-cases description. by @ericfennis in lucide-icons/lucide#4558

feat(icons): add can-soda icon by @jaynewey in lucide-icons/lucide#4718

feat(icons): added square-alert Icon by @viralcodex in lucide-icons/lucide#3687

chore(lab): Add label for lab icons by @ericfennis in lucide-icons/lucide#4793

feat(icons): changed lab/bottle-toothbrush-comb icon by @karsa-mistmere in lucide-icons/lucide#4756

ci(@lucide/lab): Create automatic release flow for @lucide/lab by @ericfennis in lucide-icons/lucide#4792

fix(icons): removed trash icon in favour of trash-2 by @jguddas in lucide-icons/lucide#3141

feat(icons): changed leaf icon by @karsa-mistmere in lucide-icons/lucide#4801

New Contributors

@jaynewey made their first contribution in lucide-icons/lucide#4718

@viralcodex made their first contribution in lucide-icons/lucide#3687

Full Changelog: lucide-icons/lucide@1.40.0...1.41.0

Version 1.40.0

What's Changed

feat(icons): added can icon by @l0uisgrange in lucide-icons/lucide#4767

feat(icons): added bridge icon by @Nykoula in lucide-icons/lucide#3949

feat(icons): added shrimp-off icon by @jguddas in lucide-icons/lucide#3613

feat(icons): added shopping-cart-plus & shopping-cart-minus icons by @Ajay199210 in lucide-icons/lucide#4248

fix(docs): updated artboard name on illustrator template by @EthanHazel in lucide-icons/lucide#4724

chore(deps): bump softprops/action-gh-release from 3.0.2 to 3.0.3 in the github-actions group by @dependabot[bot] in lucide-icons/lucide#4781

feat(icons): added lighthouse icon by @Xougui in lucide-icons/lucide#4507

New Contributors

@Nykoula made their first contribution in lucide-icons/lucide#3949

@Ajay199210 made their first contribution in lucide-icons/lucide#4248

@Xougui made their first contribution in lucide-icons/lucide#4507

Full Changelog: lucide-icons/lucide@1.39.0...1.40.0

Version 1.39.0

What's Changed

fix(icons): added RWD metadata to monitor, tablet & smartphone icons by @karsa-mistmere in lucide-icons/lucide#4775

feat(icons): add whistle icon by @timmy471 in lucide-icons/lucide#3006

feat(icons): Add mail-pen icon by @jennieboops in lucide-icons/lucide#4399

Full Changelog: lucide-icons/lucide@1.38.0...1.39.0

... (truncated)

Commits

75b5516 chore(dev): upgrade ESLint to latest compatible stack (v10) (#4378)
See full diff in compare view

Updates next from 16.3.0 to 16.3.4

Release notes

Sourced from next's releases.

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

testmode: Fix infinite recursion in testmode passthrough fetch (#97691)

Fix build error when aliasing typescript to @typescript/typescript6 (#97997)

Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

Huge thanks to @eps1lon, @mischnic, and @timneutkens for helping!

v16.3.3

This release contains security fixes for the following advisories:

Critical:

Unauthenticated Remote Code Execution on windows-hosted servers

Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

[backport] Scope app-entry export validation to files inside the app directory (#97357)

[backport] Fix catch-all index page being served for every other slug (#97416)

[16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)

[16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)

[16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)

[16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @lubieowoce, @unstubbable, @timneutkens, @mischnic, and @eps1lon for helping!

v16.3.1

What's Changed

[16.x] Turbopack: don't strip async-module runtime from shared runtime chunks by @lukesandberg in vercel/next.js#96653

[16.x] [turbopack] Add turbopack_ecmascript and turbopack_wasm's embeded FS to internal_assets_conditions by @lukesandberg in vercel/next.js#96655

[16.x] [turbopack] Collapse nested promises in the analyzer by @sampoder in vercel/next.js#96675

[16.x] fix(next/image): preserve image response after optimization by @styfle in vercel/next.js#96733

[16.3.x] Default deploy e2e tests to the repo next version by @eps1lon in vercel/next.js#96900

[backport] Bump @swc/helpers by @mischnic in vercel/next.js#96885

[backport] [turbopack] Raise registration calls in hoisted modules to the top by @lukesandberg in vercel/next.js#97308

[backport] Fix missing styled-jsx styles in Pages Router SSR on adapter builds by @lukesandberg in vercel/next.js#97302

[backport] [turbopack] Fix HMR for dynamic imports evaluated from layouts by @lukesandberg in vercel/next.js#97317

[backport] Restore the live headers() view of the incoming request by @unstubbable in vercel/next.js#97311

... (truncated)

Commits

299180d v16.3.4
12e173d [16.3.x] Re-enable AVIF image optimization and require sharp 0.35.4 (#97949)
5d9022e [backport] Fix unset crossOrigin in Turbopack manifests (#97930)
d8f4560 [16.3.x] Fix build error when aliasing typescript to @typescript/typescript6 ...
656aebf [16.3] testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
f37c1d6 [16.3.x] ci: remove pull_request_stats workflow (#97975)
a9a1cb7 v16.3.3
968b9fc [16.3.x] Fix ISR misses with backslashes in segments when deployed on Windows
3a15b4a [16.3.x] [next/image]: disable avif image optimization
7378b51 Backport/docs fixes 16.3 (#97649)
Additional commits viewable in compare view

Updates react-hook-form from 7.85.0 to 7.87.0

Release notes

Sourced from react-hook-form's releases.

Version 7.87.0

✨ Features
Add shouldTouch option to trigger() ([#13671](react-hook-form/react-hook-form#13671))

setValue already supported shouldTouch; trigger() now does too. This allows you to mark field(s) as touched after manual or programmatic validation, such as validate-on-mount or multi-step form navigation, without needing a setValue workaround:
// Mark a single field as touched after validating it
await trigger('firstName', { shouldTouch: true });
// Mark every mounted field as touched after validating the whole form
await trigger(undefined, { shouldTouch: true });
Add OpaqueTypes registry for opaque leaf types ([#13676](react-hook-form/react-hook-form#13676))

Recursive type helpers (Path, DeepPartial, DeepRequired, FieldErrorsImpl, etc.) previously stopped only at Primitive | BrowserNativeObject. As a result, rich third-party value types such as Dayjs and Decimal could be recursively traversed member-by-member, potentially causing TypeScript to report "Excessive complexity" diagnostics on large form types.

You can now register a type as an opaque leaf via declaration merging:
import type { Dayjs } from 'dayjs';
declare module 'react-hook-form' {
interface OpaqueTypes {
dayjs: Dayjs;
}
}
While the registry is empty, types remain identical to the existing behavior. This is purely opt-in.
🐞 Fixes

Fix inconsistent behavior among useController().field.onChange()-like APIs. ([#13673](react-hook-form/react-hook-form#13673))

Fix Controller under a null parent submitting undefined instead of a value. ([#13675](react-hook-form/react-hook-form#13675))

Fix ERR_MODULE_NOT_FOUND when resolving react-hook-form due to a react-server declaration in Next.js builds. ([#13682](react-hook-form/react-hook-form#13682))

Fix useWatch never reconciling when an Activity subtree is hidden on its first render. ([#13683](react-hook-form/react-hook-form#13683))

Fix resetField not recomputing isValid for subscribe-only consumers. ([#13684](react-hook-form/react-hook-form#13684))

Fix generateWatchOutput ignoring defaultValue for an array of names. ([#13686](react-hook-form/react-hook-form#13686))

Fix useFormState never reconciling when an Activity subtree is hidden on its first render. ([#13687](react-hook-form/react-hook-form#13687))

❤️ Thank You

Thanks to @giaBaoJS, @dfedoryshchev, @Alioth-91, @Masatoshi0227, @modosc, and @bluebill1049 for their contributions! 🎉

Version 7.86.0

✨ Features

... (truncated)

Changelog

Sourced from react-hook-form's changelog.

[7.87.0] - 2026-08-30

Added

shouldTouch option for trigger()

OpaqueTypes registry for opaque leaf types

Fixed

Inconsistent behavior among useController().field.onChange()-like APIs

Controller under a null parent submitting undefined instead of a value

ERR_MODULE_NOT_FOUND resolving react-hook-form due to a react-server declaration (Next.js builds)

useWatch never reconciling when an Activity subtree is hidden on its first render

resetField not recomputing isValid for subscribe-only consumers

generateWatchOutput ignoring defaultValue for an array of names

useFormState never reconciling when an Activity subtree is hidden on its first render

[7.86.0] - 2026-08-22

Added

Type-safe getErrors method

Performance

Improve createFormControl

Improve clone object check

Avoid cloning values in unregister without subscribers

Fixed

Field array update leaving stale errors and touched state at the updated index

flatten discarding File and Blob values instead of treating them as leaf nodes

validateField not passing the field error to setCustomValidity when criteriaMode is all

hasValidation treating falsy but valid values (min: 0, max: 0, minLength: 0, maxLength: 0, required: '') as no validation

setValue targeting a nested leaf not notifying a Controller registered on a field array item root

setValues not updating fields registered under an object or array value

useWatch returning a stale value on name change when the new value is null

unregister inverting keepDirty when broadcasting isDirty

Commits

29af888 7.87.0
1eeab63 🐞 fix(useFormState): never reconciles when an Activity subtree is hidden on i...
145441c 🐞 fix(generateWatchOutput): defaultValue is ignored for an array of names (#1...
1fb065c 🐞 fix(resetField): isValid not recomputed for subscribe-only consumers (#13684)
2f7380e 🧹refactor: use continue instead of return in setFieldValues' hasOwnProper...
1b0a314 📖 remove comment
a457ca7 🐞 fix #13680: useWatch never reconciles when an Activity subtree is hidden on...
bb3360f 🐞 fix #13681 issue: ERR_MODULE_NOT_FOUND, Can't resolve react-hook-form due t...
f646948 🪅 feat: add OpaqueTypes registry for opaque leaf types (#13676)
e17a95c 🧇 chore: scope the lock workflow to issues so its scheduled run can finish (#...
Additional commits viewable in compare view

Updates sonner from 2.0.7 to 2.0.8

Release notes

Sourced from sonner's releases.

v2.0.8

What's Changed

Added support for custom aria labels by @hirotomoyamada in emilkowalski/sonner#704

Fixed handling when hotkey is an empty array by

…updates Bumps the production-deps group with 11 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1109.0` | `3.1127.0` | | [@prisma/adapter-pg](https://github.com/prisma/prisma/tree/HEAD/packages/adapter-pg) | `7.9.1` | `7.10.0` | | [@prisma/client](https://github.com/prisma/prisma/tree/HEAD/packages/client) | `7.9.1` | `7.10.0` | | [nestjs-cls](https://github.com/Papooch/nestjs-cls) | `6.2.1` | `6.3.0` | | [pdfkit](https://github.com/foliojs/pdfkit) | `0.19.1` | `0.20.2` | | [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.22.0` | `8.23.0` | | [prisma](https://github.com/prisma/prisma-cli/tree/HEAD/packages/prisma) | `7.9.1` | `7.10.0` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.31.0` | `1.41.0` | | [next](https://github.com/vercel/next.js) | `16.3.0` | `16.3.4` | | [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.85.0` | `7.87.0` | | [sonner](https://github.com/emilkowalski/sonner) | `2.0.7` | `2.0.8` | Updates `@aws-sdk/client-s3` from 3.1109.0 to 3.1127.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1127.0/clients/client-s3) Updates `@prisma/adapter-pg` from 7.9.1 to 7.10.0 - [Release notes](https://github.com/prisma/prisma/releases) - [Commits](https://github.com/prisma/prisma/commits/7.10.0/packages/adapter-pg) Updates `@prisma/client` from 7.9.1 to 7.10.0 - [Release notes](https://github.com/prisma/prisma/releases) - [Commits](https://github.com/prisma/prisma/commits/7.10.0/packages/client) Updates `nestjs-cls` from 6.2.1 to 6.3.0 - [Release notes](https://github.com/Papooch/nestjs-cls/releases) - [Commits](https://github.com/Papooch/nestjs-cls/compare/nestjs-cls@6.2.1...nestjs-cls@6.3.0) Updates `pdfkit` from 0.19.1 to 0.20.2 - [Release notes](https://github.com/foliojs/pdfkit/releases) - [Changelog](https://github.com/foliojs/pdfkit/blob/master/CHANGELOG.md) - [Commits](foliojs/pdfkit@v0.19.1...v0.20.2) Updates `pg` from 8.22.0 to 8.23.0 - [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md) - [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.0/packages/pg) Updates `prisma` from 7.9.1 to 7.10.0 - [Release notes](https://github.com/prisma/prisma-cli/releases) - [Commits](https://github.com/prisma/prisma-cli/commits/HEAD/packages/prisma) Updates `lucide-react` from 1.31.0 to 1.41.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.41.0/packages/lucide-react) Updates `next` from 16.3.0 to 16.3.4 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.3.0...v16.3.4) Updates `react-hook-form` from 7.85.0 to 7.87.0 - [Release notes](https://github.com/react-hook-form/react-hook-form/releases) - [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md) - [Commits](react-hook-form/react-hook-form@v7.85.0...v7.87.0) Updates `sonner` from 2.0.7 to 2.0.8 - [Release notes](https://github.com/emilkowalski/sonner/releases) - [Commits](emilkowalski/sonner@v2.0.7...v2.0.8) --- updated-dependencies: - dependency-name: "@aws-sdk/client-s3" dependency-version: 3.1127.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: "@prisma/adapter-pg" dependency-version: 7.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: "@prisma/client" dependency-version: 7.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: nestjs-cls dependency-version: 6.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: pdfkit dependency-version: 0.20.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: pg dependency-version: 8.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: prisma dependency-version: 7.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: lucide-react dependency-version: 1.41.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: next dependency-version: 16.3.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-deps - dependency-name: react-hook-form dependency-version: 7.87.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-deps - dependency-name: sonner dependency-version: 2.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-deps ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency npm npm dependency updates labels Sep 7, 2026

github-actions Bot approved these changes Sep 7, 2026

View reviewed changes

github-actions Bot enabled auto-merge (squash) September 7, 2026 22:51

Navigation Menu

Uh oh!

fix(deps): bump the production-deps group across 1 directory with 11 updates - #142

fix(deps): bump the production-deps group across 1 directory with 11 updates#142
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-deps-72f80fd63d

dependabot Bot commented on behalf of github Sep 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 7, 2026

v3.1127.0

3.1127.0(2026-09-04)

New Features

v3.1126.0

3.1126.0(2026-09-03)

Documentation Changes

New Features

v3.1125.0

3.1125.0(2026-09-02)

New Features

3.1127.0 (2026-09-04)

3.1126.0 (2026-09-03)

3.1125.0 (2026-09-02)

3.1124.0 (2026-09-01)

3.1123.0 (2026-08-31)

3.1122.0 (2026-08-31)

3.1121.0 (2026-08-28)

7.10.0

Prisma ORM 7.10.0

Highlights

Run Prisma 7 alongside Prisma 8

7.10.0

Prisma ORM 7.10.0

Highlights

Run Prisma 7 alongside Prisma 8

nestjs-cls@6.3.0

6.3.0 "nestjs-cls" (2026-09-04)

Features

nestjs-cls@6.2.2

6.2.2 "nestjs-cls" (2026-08-25)

Bug fixes

Support OptionalFactoryDependency in inject arrays (closes #381)

Throw on invalid factory return values (closes #375)

v0.20.2

v0.20.1

v0.20.0

Highlights

Standard Font Support rewritten

Removal of Node specific dependencies

registerFile API

[v0.20.2] - 2026-08-29

[v0.20.1] - 2026-08-23

[v0.20.0] - 2026-08-23

pg@8.23.0

Version 1.41.0

What's Changed

New Contributors

Version 1.40.0

What's Changed

New Contributors

Version 1.39.0

What's Changed

v16.3.4

Credits

v16.3.3

v16.3.2

Core Changes

Credits

v16.3.1

What's Changed

Version 7.87.0

✨ Features

🐞 Fixes

❤️ Thank You

Version 7.86.0

✨ Features

[7.87.0] - 2026-08-30

Added

Fixed

[7.86.0] - 2026-08-22

Added

Performance

Fixed

v2.0.8

What's Changed

Uh oh!

Reviewers

Support `OptionalFactoryDependency` in `inject` arrays (closes #381)

`registerFile` API