[dependabot]

Bumps the runtime-deps group with 27 updates in the / directory:

Package	From	To
arktype	2.2.7	2.2.9
wrap-ansi	10.0.0	10.0.2
@vercel/detect-agent	1.2.4	1.2.7
prettier	3.9.6	3.9.10
jose	6.2.8	6.2.13
temporal-polyfill	1.0.4	1.0.6
pg-connection-string	2.14.0	2.14.1
vitest	4.1.10	4.1.12
next	16.3.0	16.3.8
@prisma/adapter-pg	7.10.0	7.10.1
@prisma/client	7.10.0	7.10.1
@react-router/node	8.3.0	8.3.1
@react-router/serve	8.3.0	8.3.1
isbot	5.2.1	5.2.2
react-router	8.3.0	8.3.1
@radix-ui/react-dropdown-menu	2.1.24	2.1.25
@radix-ui/react-label	2.1.15	2.1.17
@radix-ui/react-radio-group	1.4.7	1.4.8
@radix-ui/react-select	2.3.7	2.3.8
@radix-ui/react-separator	1.1.15	1.1.16
postcss	8.5.26	8.5.31
vite	6.4.3	6.4.5
bson	7.3.1	7.3.3
mongodb-connection-string-url	7.0.1	7.0.2
tsx	4.23.12	4.23.15
vscode-languageserver-textdocument	1.0.12	1.0.16
vscode-languageserver	10.1.0	10.1.2

Updates arktype from 2.2.7 to 2.2.9

Changelog

Sourced from arktype's changelog.

2.2.9

Keep tuple elements around defaults in .in and .out

Combining a tuple's defaultable elements with its other elements dropped some of them, depending on key order:

const T = type(["string", "number = 5", "boolean?"])
// was: [string, boolean?]
// now: [string, number?, boolean?]
T.in.expression
// was: number[]
// now: [number, string, ...number[]]
type(["number", "string = 'foo'", "...", "number[]"]).out.expression

A bound that narrows two existing length constraints at once also no longer throws "multiple distinct intersection results":

// was: throws
// now: string == 2
type("1 <= string <= 2").and("string >= 2")

Thanks to @​ybai08 (#1696).

Reject NaN in unions discriminated by typeof

number rejects NaN, but compiled unions like number | null dropped that check when they discriminated by typeof, so NaN was only rejected with jitless (#1702).

const T = type("number | null")
// was: NaN
// now: ArkErrors: must be a number (was NaN)
T(NaN)

Thanks to @​thecotne.

Don't treat Object.prototype keys as declared

Inherited names like toString or constructor, and an own __proto__ key like the one JSON.parse creates, were treated as declared keys, so "+": "delete" kept them and "+": "reject" accepted them (#1701).

const T = type({ a: "string", "+": "reject" })
// was: { a: "x", constructor: 1 }
</tr></table>

... (truncated)

Commits

• cfded1a release: arktype 2.2.9 + dependents (#1704)
• 092075a fix(schema): keep tuple elements around defaults in .in and .out (#1696)
• fc06904 fix(schema): only emit referenced $defs in toJsonSchema (#1689)
• cd11e1f fix(schema): don't treat Object.prototype keys as declared for undeclared key...
• c82c596 fix(schema): keep the NaN check when a union discriminates on typeof (#1702)
• 5aad144 fix(schema): convert what JSON Schema can't represent in ~standard.jsonSchema...
• 9d60ec7 docs: simpler landing examples, Markdown docs for agents, and an ArkType skil...
• fe481db attest ts7 support, arktype fixes (#1680)
• 9303229 feat(type): add string.base58 built-in validator (#1604)
• 97ed4f9 Return empty props for base object instead of throwing (#1682)
• See full diff in compare view

Updates wrap-ansi from 10.0.0 to 10.0.2

Release notes

Sourced from wrap-ansi's releases.

v10.0.2

• Keep a sequence whole when a combining mark follows it bb6b370

---

chalk/wrap-ansi@v10.0.1...v10.0.2

v10.0.1

• Fix handling of hyperlinks 1f23be6

---

chalk/wrap-ansi@v10.0.0...v10.0.1

Commits

• 4e44ec2 10.0.2
• bb6b370 Keep a sequence whole when a combining mark follows it
• 0309544 Meta tweaks
• c6b6259 10.0.1
• f3287cf Rewrite tests
• 1f23be6 Fix handling of hyperlinks
• See full diff in compare view

Updates @vercel/detect-agent from 1.2.4 to 1.2.7

Release notes

Sourced from @​vercel/detect-agent's releases.

@​vercel/h3@​0.1.116

Patch Changes

• @​vercel/node@​5.9.3

@​vercel/h3@​0.1.115

Patch Changes

• @​vercel/node@​5.9.2

@​vercel/h3@​0.1.114

Patch Changes

• @​vercel/node@​5.9.1

@​vercel/h3@​0.1.113

Patch Changes

• Updated dependencies [4502520]
  • @​vercel/node@​5.9.0

@​vercel/h3@​0.1.112

Patch Changes

• @​vercel/node@​5.8.27

Changelog

Sourced from @​vercel/detect-agent's changelog.

1.2.7

Patch Changes

• f7da501: Add fx and eve to detect-agent supported agents

1.2.6

Patch Changes

• e35da01: Detect OpenCode CLI subprocesses using the OPENCODE=1 environment marker, in addition to OPENCODE_CLIENT.

1.2.5

Patch Changes

• 2da7809: Remove redundant and ineffective package tests.

Commits

• See full diff in compare view

Updates prettier from 3.9.6 to 3.9.10

Release notes

Sourced from prettier's releases.

3.9.10

• Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

🔗 Changelog

3.9.9

• Markdown: Fix text with $ been incorrectly parsed as math syntax (#20140 by @​fisker)

🔗 Changelog

3.9.8

• Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by @​seiyab)

🔗 Changelog

3.9.7

• Support Angular 22.2
• Fix regressions in v3.9

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.10

diff

Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

See micromark/micromark-extension-gfm-table@4f43ead for details.

3.9.9

diff

Markdown: Fix text with $ been incorrectly parsed as math syntax (#20140 by @​fisker)

<!-- Input -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR` from `c.sh`, before anything else runs here.
<!-- Prettier 3.9.8 -->
Uses $FOO from a.sh and b.sh, plus $BARfromc.sh, before anything else runs here.
<!-- Prettier 3.9.9 -->
Uses $FOO from a.sh and b.sh, plus $BAR from c.sh, before anything else runs here.

3.9.8

diff

Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by @​seiyab)

<!-- Input -->
If `module` is not a [`WebAssembly.Module`](https://github.com/prettier/prettier/blob/main/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module) object instance, a
{{jsxref("TypeError")}} is thrown.
<!-- Prettier 3.9.7 -->
If module is not a WebAssembly.Module object instance, a
{{jsxref("TypeError")}} is thrown.
<!-- Prettier 3.9.8 -->
If module is not a WebAssembly.Module object instance, a
{{jsxref("TypeError")}} is thrown.

3.9.7

... (truncated)

Commits

• 1172b82 Release 3.9.10
• d014227 Update micromark-extension-gfm-table to fix the table parse issue on perfor...
• 953b908 Bump Prettier dependency to 3.9.9
• ad8a6bf Clean changelog_unreleased
• cdd17f2 Release 3.9.9
• dc7b896 Disable singleDollarTextMath in mdast-util-math (#20140)
• f9be58f Git blame ignore 3.9.8
• 88470cb Bump Prettier dependency to 3.9.8
• 9559cab Clean changelog_unreleased
• 4fc8ee8 Update dependents count
• Additional commits viewable in compare view

Updates jose from 6.2.8 to 6.2.13

Release notes

Sourced from jose's releases.

v6.2.13

Refactor

• align terminology with JOSE specifications (bafcb74)
• preserve underlying error causes (724ba24), closes #908

v6.2.12

Documentation

• clarify and shorten public API guidance (be62530)

Refactor

• simplify JWS and JWE operation cores (92e9640)

Performance

• avoid copying AES-GCM output (6925d43)
• deduplicate pending jwks key imports (bf5138b)
• encode single-signature JWS input once (7bc9a33)
• normalize General JWE shared headers once (78637bd)
• normalize jwks selection metadata once (fd3ae3f)
• use native encoding for larger ASCII strings (b23a6f3)

v6.2.11

Documentation

• render subpath indexes as tables (94589ee)
• shorten API index descriptions (681482f)

Refactor

• model JWE key management modes (e01dda6)
• types: reduce declaration repetition (55b970f)

v6.2.10

Fixes

• jose: consume serialization members once (9bee285)
• jose: reject empty protected and JWE AAD members (8da4145)
• jose: validate serialized header values (b711d8f)
• jwe: conceal invalid decrypted CEK lengths (41fafe0)
• jwe: enforce AES-GCM tag boundaries (9a5b744)
• jwe: validate explicit encryption parameters (7a02697)
• jwk: accept empty octet-sequence keys (3f871e7)
• jwk: normalize key resolution inputs (f54ee7b)
• jwks: enforce verification key metadata (f9ba510)
• jwks: order overlapping remote reloads (9a1a913)
• jwks: reject invalid remote duration values (7bdb9e5)
• jwk: validate ext and key_ops parameters (4d91c37)

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.13 (2026-10-20)

Refactor

• align terminology with JOSE specifications (bafcb74)
• preserve underlying error causes (724ba24), closes #908

6.2.12 (2026-09-05)

Documentation

• clarify and shorten public API guidance (be62530)

Refactor

• simplify JWS and JWE operation cores (92e9640)

Performance

• avoid copying AES-GCM output (6925d43)
• deduplicate pending jwks key imports (bf5138b)
• encode single-signature JWS input once (7bc9a33)
• normalize General JWE shared headers once (78637bd)
• normalize jwks selection metadata once (fd3ae3f)
• use native encoding for larger ASCII strings (b23a6f3)

6.2.11 (2026-09-04)

Documentation

• render subpath indexes as tables (94589ee)
• shorten API index descriptions (681482f)

Refactor

• model JWE key management modes (e01dda6)
• types: reduce declaration repetition (55b970f)

6.2.10 (2026-08-21)

Fixes

• jose: consume serialization members once (9bee285)
• jose: reject empty protected and JWE AAD members (8da4145)
• jose: validate serialized header values (b711d8f)
• jwe: conceal invalid decrypted CEK lengths (41fafe0)
• jwe: enforce AES-GCM tag boundaries (9a5b744)
• jwe: validate explicit encryption parameters (7a02697)
• jwk: accept empty octet-sequence keys (3f871e7)
• jwk: normalize key resolution inputs (f54ee7b)

... (truncated)

Commits

• 316b7f2 chore(release): 6.2.13
• 8106395 chore: bump packages
• 724ba24 refactor: preserve underlying error causes
• b112a5e chore: bump packages
• 2a3a525 chore(deps-dev): bump workerd in /tap/workerd
• 8f540d8 chore(deps): bump the actions group with 3 updates
• 8d6c02b chore(deps-dev): bump electron from 44.0.0 to 44.4.5 in /tap/electron
• 55c959f ci: use gh run rerun for retries
• 5b00c64 ci: address zizmor findings and bump shared workflows
• 1761d7f chore: bump packages
• Additional commits viewable in compare view

Updates temporal-polyfill from 1.0.4 to 1.0.6

Release notes

Sourced from temporal-polyfill's releases.

temporal-polyfill@1.0.6

• FIX: Load-time ReferenceError: Cannot access '...' before initialization under ESM loaders that wrap modules, such as OpenTelemetry's import-in-the-middle (#107, #108). Thx @​noahsilas
• FIX: Clearer error for disallowed duration units, e.g. instant.add({ days: 1 }) throws Invalid unit: days; must be between nanoseconds-hours instead of Cannot use large units (#85, #109). Thx @​cpruijsen

temporal-polyfill@1.0.5

📉 Size Wins

• Smaller global IIFE bundles after min+gzip:
  • Basic (global.js): 19,532 → 19,433 bytes (−0.5%)
  • Full (full/global.js): 23,378 → 23,276 bytes (−0.4%)
• Tree-shakeable API imports are 27.30% smaller on average after min+gzip. Highlights:
  • DurationFns.sign: 880 → 186 bytes (−79%)
  • ZonedDateTimeFns.compare: 950 → 268 bytes (−72%)
  • PlainDateFns.toPlainYearMonth: 2,808 → 1,194 bytes (−57%)

🐛 Tree-Shakeable API Correctness Fixes

• FIX: Tree-shakeable API year/month rounding and alignment helpers use correct non-ISO calendar boundaries instead of mixing calendar year/month values with ISO fields
• FIX: ZonedDateTimeFns.getTimeZoneTransition preserves transitions at epoch nanoseconds 0n instead of returning null, in both class-based and tree-shakeable APIs
• FIX: Improve behavioral parity between the tree-shakeable and class-based APIs:
  • diffYears/Months/Weeks/Days:
    • ZonedDateTime handles equal instants, fractional units, DST transitions, skipped dates, rounding, and calendar validation (#103, #104), thx @​Pawel-IT
    • PlainDateTime includes time remainders and uses correct relative calendar-unit rounding, floating-point precision, calendar validation, and range validation
    • PlainDate uses correct relative calendar-unit rounding, floating-point precision, calendar validation, and range validation
    • PlainYearMonth ignores the internal reference ISO day, uses month precision, and handles rounding and range boundaries correctly
  • diffHours/Minutes/Seconds/Milliseconds/Microseconds/Nanoseconds
    • PlainTime preserves fractional precision and return positive zero for results that round to zero

Changelog

Sourced from temporal-polyfill's changelog.

v1.0.6

🐛 Bugfixes

• FIX: Load-time ReferenceError: Cannot access '...' before initialization under ESM loaders that wrap modules, such as OpenTelemetry's import-in-the-middle (#107, #108). Thx @​noahsilas
• FIX: Clearer error for disallowed duration units, e.g. instant.add({ days: 1 }) throws Invalid unit: days; must be between nanoseconds-hours instead of Cannot use large units (#85, #109). Thx @​cpruijsen

v1.0.5

📉 Size Wins

• Smaller global IIFE bundles after min+gzip:
  • Basic (global.js): 19,532 → 19,433 bytes (−0.5%)
  • Full (full/global.js): 23,378 → 23,276 bytes (−0.4%)
• Tree-shakeable API imports are 27.30% smaller on average after min+gzip. Highlights:
  • DurationFns.sign: 880 → 186 bytes (−79%)
  • ZonedDateTimeFns.compare: 950 → 268 bytes (−72%)
  • PlainDateFns.toPlainYearMonth: 2,808 → 1,194 bytes (−57%)

🐛 Tree-Shakeable API Correctness Fixes

• FIX: Tree-shakeable API year/month rounding and alignment helpers use correct non-ISO calendar boundaries instead of mixing calendar year/month values with ISO fields
• FIX: ZonedDateTimeFns.getTimeZoneTransition preserves transitions at epoch nanoseconds 0n instead of returning null, in both class-based and tree-shakeable APIs
• FIX: Improve behavioral parity between the tree-shakeable and class-based APIs:
  • diffYears/Months/Weeks/Days:
    • ZonedDateTime handles equal instants, fractional units, DST transitions, skipped dates, rounding, and calendar validation (#103, #104), thx @​Pawel-IT
    • PlainDateTime includes time remainders and uses correct relative calendar-unit rounding, floating-point precision, calendar validation, and range validation
    • PlainDate uses correct relative calendar-unit rounding, floating-point precision, calendar validation, and range validation
    • PlainYearMonth ignores the internal reference ISO day, uses month precision, and handles rounding and range boundaries correctly
  • diffHours/Minutes/Seconds/Milliseconds/Microseconds/Nanoseconds
    • PlainTime preserves fractional precision and return positive zero for results that round to zero

Commits

• f75f6ae Update test262 and October 2026 spec compliance
• 81f55b5 Bump and shorter changelog
• 61aa4d2 Update size results
• 608ad7c Name the offending duration field in unit-range errors (#85)
• c93539a Readme about CommonJS & Test Runners
• 1f1ad15 Accept size baseline after options/ move, thank @​noahsilas
• 43273de Move chunk cycle guard to scripts/lib, always use named chunks
• 1812962 Fail the build when emitted chunks form an import cycle
• df37d0a Move options/ into internal/ to fix chunk import cycle (#107)
• b28e5a8 tweak changelog
• Additional commits viewable in compare view

Updates pg-connection-string from 2.14.0 to 2.14.1

Commits

• 0980cef Publish
• e4e4003 chore(pg-connection-string): remove unused istanbul dependency (#3790)
• 6f1e8af fix(pg-connection-string): strip IPv6 URI brackets from the parsed host (#3698)
• See full diff in compare view

Updates vitest from 4.1.10 to 4.1.12

Release notes

Sourced from vitest's releases.

v4.1.12

   🐞 Bug Fixes

• mocker: Harden manual and redirect mocks [backport to v4]  -  by @​sheremet-va in vitest-dev/vitest#11580 (b8253)

    View changes on GitHub

v4.1.11

   🐞 Bug Fixes

• Revive global concurrency limit for test lifecycle [backport to v4]  -  by @​sheremet-va and @​hi-ogawa in vitest-dev/vitest#10992 (5146d)
• browser:
  • Encode iframeId in tester iframe URL [backport to v4]  -  by @​sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)
  • Trigger playwright/chromium gc on lower disk availability [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)
• mocker:
  • Restrict redirect mocks to the fs allowlist [backport to v4]  -  by @​sheremet-va in vitest-dev/vitest#10974 (fe5a1)

    View changes on GitHub

Commits

• 4766ce1 chore: release v4.1.12 (#11610)
• 5bf2197 chore: delete wdio folder from v4 branch to avoid falsy release (#11581)
• 9bd8d46 chore: release v4.1.11 (#10995)
• 9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
• See full diff in compare view

Updates next from 16.3.0 to 16.3.8

Release notes

Sourced from next's releases.

v16.3.8

This release contains security fixes for the following advisories:

High:

• Server-Side Request Forgery in Image Optimization

Medium:

• Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass
• Cache poisoning of SSG and ISR pages in self-hosted Next.js applications
• Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service
• Pending use cache fill can leak Draft Mode content into regular responses and persisted pages
• Cache leak across root param values in nested 'use cache' functions

Low:

• Information disclosure in the Next.js development server's Model Context Protocol endpoint

v16.3.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• turbo-tasks-backend: fix strongly consistent read hanging on a canceled task (#98931)

Credits

Huge thanks to @​lukesandberg for helping!

v16.3.6

This release contains a security fix for GHSA-vcvr-r3jv-pc5j: Remote Code Execution in next/og ImageResponse

v16.3.5

The following bug fixes have been backported. It does not include all pending features/changes on canary.

• next/image: Skip 0-byte entries when initializing disk LRU cache (#98185)
• next/image: Reject empty images when reading/writing to the disk cache (#98186)
• Emit whole-app server NFTs when output: 'standalone' is used with an adapter (#98167)
• Add CSP nonce to script tags of loading and template files (#98403)
• Fix use cache prerender signal retention (#98448)

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

• testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
• Fix build error when aliasing typescript to @​typescript/typescript6 (#97997)
• Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

... (truncated)

Commits

• b0fad0d v16.3.8
• 719e4c6 [lts-active] Scope response cache keys to their source route (#218)
• e92db45 [lts-active] Fix metadata propagation for deduplicated nested caches (#223)
• 40c2ba9 [lts-active] Match Next data paths case-sensitively (#196)
• 2d9f50a [lts-active] Fix MCP middleware DNS rebinding (#213)
• bd9214f [lts-active] Fix draft mode leaks through cross-request 'use cache' dedupli...
• 8db4a62 [lts-active][webpack] Ensure dynamicParams is respected in `opengraph-image...
• e002ad6 [lts-active] fix(next/image): Pin DNS resolution when fetching external image...
• 4c20699 v16.3.7
• 2521aec [backport] turbo-tasks-backend: fix strongly consistent read hanging on a can...
• Additional commits viewable in compare view

Updates @prisma/adapter-pg from 7.10.0 to 7.10.1

Release notes

Sourced from @​prisma/adapter-pg's releases.

7.10.1

Prisma ORM 7.10.1 is a patch release. It fixes a bug where a nested interactive transaction could make later, unrelated transactions run inside the wrong transaction. It also updates dependencies that had security advisories.

Fixes

Prisma Client: nested $transaction no longer changes the options object you pass in

If you passed the same options object to a nested tx.$transaction(...) and later to a top-level prisma.$transaction(...), the nested call wrote the outer transaction's id into that object. Every later top-level transaction that used the object was then treated as nested inside that old transaction:

• if the old transaction had committed, the new one failed with P2028;
• if the old transaction was still open, the new one silently ran as a savepoint inside another request's transaction.

const TX_OPTIONS = { timeout: 30_000, maxWait: 10_000 }
await prisma.$transaction(async (tx) => {
await tx.$transaction(async (inner) => { /* ... */ }, TX_OPTIONS)
})
// Before 7.10.1, this call could fail with P2028 or join another transaction.
await prisma.$transaction(async (tx) => { /* ... */ }, TX_OPTIONS)

Prisma Client no longer modifies the options object. (prisma/orm#30368, thanks @​lazerg)

Prisma Migrate: refuse a shadow database that is the main database

Prisma Migrate now refuses to run with error P3025 when the shadow database URL points at the same database as the main database URL. Before, prisma migrate diff --from-migrations with that setup dropped the real schema, rebuilt it from the migrations, and reported an empty diff. (prisma/prisma-engines#5851)

MariaDB adapter: updated to mariadb 3.5.4

@prisma/adapter-mariadb now depends on mariadb 3.5.4, which fixes several security advisories in 3.5.3. The adapter no longer rewrites IPv6 hosts in connection strings, because mariadb 3.5.4 accepts them as written. IPv6 connection strings keep working without changes. (prisma/orm#30668)

Dependency updates

Dependencies with security advisories were updated: mysql2, fast-uri, deepmerge-ts, mariadb and source-map-js. (prisma/orm#30314, prisma/orm#30189, prisma/orm#30668)

Commits

• 312e543 chore: update npm provenance repository (#30146)
• See full diff in compare view

Updates @prisma/client from 7.10.0 to 7.10.1

Release notes

Sourced from @​prisma/client's releases.

7.10.1

Prisma ORM 7.10.1 is a patch release. It fixes a bug where a nested interactive transaction could make later, unrelated transactions run inside the wrong transaction. It also updates dependencies that had security advisories.

Fixes

Prisma Client: nested $transaction no longer changes the options object you pass in

If you passed the same options object to a nested tx.$transaction(...) and later to a top-level prisma.$transaction(...), the nested call wrote the outer transaction's id into that object. Every later top-level transaction that used the object was then treated as nested inside that old transaction:

• if the old transaction had committed, the new one failed with P2028;
• if the old transaction was still open, the new one silently ran as a savepoint inside another request's transaction.

const TX_OPTIONS = { timeout: 30_000, maxWait: 10_000 }
await prisma.$transaction(async (tx) => {
await tx.$transaction(async (inner) => { /* ... */ }, TX_OPTIONS)
})
// Before 7.10.1, this call could fail with P2028 or join another transaction.
await prisma.$transaction(async (tx) => { /* ... */ }, TX_OPTIONS)

Prisma Client no longer modifies the options object. (prisma/orm#30368, thanks @​lazerg)

Prisma Migrate: refuse a shadow database that is the main database

Prisma Migrate now refuses to run with error P3025 when the shadow database URL points at the same database as the main database URL. Before, prisma migrate diff --from-migrations with that setup dropped the real schema, rebuilt it from the migrations, and reported an empty diff. (prisma/prisma-engines#5851)

MariaDB adapter: updated to mariadb 3.5.4

@prisma/adapter-mariadb now depends on mariadb 3.5.4, which fixes several security advisories in 3.5.3. The adapter no longer rewrites IPv6 hosts in connection strings, because mariadb 3.5.4 accepts them as written. IPv6 connection strings keep working without changes. (prisma/orm#30668)

Dependency updates

Dependencies with security advisories were updated: mysql2, fast-uri, deepmerge-ts, mariadb and source-map-js. (prisma/orm#30314, prisma/orm#30189, prisma/orm#30668)

Commits

• 97ea359 fix(client): stop nested $transaction from mutating the caller's options obje...
• 3dcc5b3 chore(deps): update engines to 8.1.0-1.d1b3f377ca835d73fd50954a5e22128b9ebdd6...
• 9cb9c08 test(e2e): run prisma init from the local tarball in the corepack test (#30183)
• 312e543 chore: update npm provenance repository (#30146)
• See full diff in compare view

Updates @react-router/node from 8.3.0 to 8.3.1

Release notes

Sourced from @​react-router/node's releases.

v8.3.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v831

Changelog

Sourced from @​react-router/node's changelog.

v8.3.1

Patch Changes

• Bump @remix-run/node-fetch-server dependency (#15447)
• fix: Prevent client disconnects during streaming from crashing the Node process (#15324)
• Updated dependencies:
  • react-router@8.3.1

Commits

• da2a0f0 Release v8.3.1 (#15368)
• 818fb10 Bump node fetch server dependency (#15447)
• 1401852 Prevent streaming disconnects from crashing Node (#15324)
• fc873b0 Use optional catch bindings (#15372)
• See full diff in compare view

Updates @react-router/serve from 8.3.0 to 8.3.1

Release notes

Sourced from @​react-router/serve's releases.

v8.3.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v831

Changelog

Sourced from @​react-router/serve's changelog.

v8.3.1

Patch Changes

• Bump @remix-run/node-fetch-server dependency (#15447)
• Serve /.well-known/* files from the client build directory. Express 5's static middleware ignores every dot-segment path by default, so RFC 8615 well-known URIs — ACME challenges, Android's assetlinks.json, Apple's apple-app-site-association — fell through to the request handler and came back as app-rendered HTML instead of the static file. Other dotfiles remain hidden. (#15340)
• Updated dependencies:
  • react-router@8.3.1
  • @react-router/express@8.3.1
  • @react-router/node@8.3.1

Commits

• da2a0f0 Release v8.3.1 (#15368)
• 818fb10 Bump node fetch server dependency (#15447)
• 6beaca3 fix(react-router-serve): serve /.well-known files (#15340)
• See full diff in compare view

Updates isbot from 5.2.1 to 5.2.2

Changelog

Sourced from isbot's changelog.

5.2.2

• Pattern update: reduce size

Commits

• eff2b5a Pattern update: reduce size
• 09506ca adjust procedure for zsh, too
• 06e1827 Does anyone read this? I'll be at the coffee shop accross the street.
• 344052d nothing really
• See full diff in compare view

Updates react-router from 8.3.0 to 8.3.1
...

Description has been truncated

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: prisma/orm
• Branch: main
• File: .coderabbit.yml
• Commit: 4f70a33
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 37cf0a65-ed9c-4749-ad88-bf0d56daa48b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}