[dependabot]

Bumps the npm-minor-and-patch group with 12 updates in the / directory:

Package	From	To
@types/node	22.20.1	22.20.5
tsx	4.23.12	4.23.15
drizzle-orm	0.45.2	0.45.4
drizzle-kit	0.31.10	0.31.11
jose	6.2.8	6.2.13
@swc/core	1.16.0	1.16.20
next	15.5.23	15.5.28
react	19.2.8	19.3.1
@types/react	19.2.18	19.3.0
react-dom	19.2.8	19.3.1
@types/react-dom	19.2.4	19.3.0
@types/react	19.2.18	19.3.0
@types/react-dom	19.2.4	19.3.0
jsdom	30.0.1	30.1.3

Updates @types/node from 22.20.1 to 22.20.5

Commits

• See full diff in compare view

Updates tsx from 4.23.12 to 4.23.15

Release notes

Sourced from tsx's releases.

v4.23.15

4.23.15 (2026-09-20)

Bug Fixes

• exclude bare builtins from namespace inheritance (38e1588)
• expose require.cache and require.extensions to tsImport CommonJS modules (2da3407)
• make namespaced register() overloads portable for declaration emit (562c434)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.14

4.23.14 (2026-09-20)

Bug Fixes

• restore the CJS bridge namespace for Node 24 require(esm) under tsImport() (#802) (6e5236b)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.13

4.23.13 (2026-08-30)

Bug Fixes

• cache: bound shared transform cache memory (#835) (28e1f12)

---

This release is also available on:

• npm package (@​latest dist-tag)

Commits

• ca66105 test: fix drive-less file URLs in ESM resolver fixtures
• 2da3407 fix: expose require.cache and require.extensions to tsImport CommonJS modules
• 38e1588 fix: exclude bare builtins from namespace inheritance
• 562c434 fix: make namespaced register() overloads portable for declaration emit
• edfb1f0 build: upgrade pkgroll and externalize CJS loader reference
• 70e7828 test: upgrade tinyspy for disposable API
• 9ed2022 ci: avoid duplicate release notifications
• 872e77f refactor: use disposables for cleanup
• 6e5236b fix: restore the CJS bridge namespace for Node 24 require(esm) under tsImport...
• 28e1f12 fix(cache): bound shared transform cache memory (#835)
• See full diff in compare view

Updates drizzle-orm from 0.45.2 to 0.45.4

Release notes

Sourced from drizzle-orm's releases.

0.45.4

• Fixed postgres-js not using prepared queries on explicit .prepare(name)

0.45.3

New Netlify DB Driver

Note: The Netlify DB driver is developed and maintained by the Netlify team.

Installation:

npm i @netlify/db

Usage example:

import { drizzle } from 'drizzle-orm/netlify-db';
// reads NETLIFY_DB_URL and NETLIFY_DB_DRIVER env vars
const db = drizzle();
const result = await db.execute('select 1');

import { drizzle } from 'drizzle-orm/netlify-db';
const db = drizzle(process.env.DATABASE_URL);
const result = await db.execute('select 1');

import { drizzle } from 'drizzle-orm/netlify-db';

// Explicit client — consumer controls the driver
const db = drizzle({ client: netlifyDbClient });

const result = await db.execute('select 1');

Commits

• eab8bed Fixed postgres-js not using prepared queries on explicit .prepare(name) (...
• 15454db +
• 54e436f exclude gel from pull
• 0fd1cc6 remove gel
• d028db7 skip gel
• 93dc01e [All-kit]: Warn when journal timestamps can cause migrations to be skipped (#...
• b786252 Merge pull request #6049 from drizzle-team/drizzle-kit-announcements
• f9fc5bf Add drizzle-kit announcement manifest and schema doc
• 9d64532 Merge pull request #6004 from drizzle-team/pin-npm-11-main
• 0af2f2e Pin the release npm self-update to major 11: the npm 12.0.0 tarball is missin...
• Additional commits viewable in compare view

Updates drizzle-kit from 0.31.10 to 0.31.11

Release notes

Sourced from drizzle-kit's releases.

drizzle-kit@0.31.11

• Warn about silent migration skips on drizzle-kit checks - thanks @​shaneikennedy

Commits

• 15454db +
• 54e436f exclude gel from pull
• 0fd1cc6 remove gel
• d028db7 skip gel
• 93dc01e [All-kit]: Warn when journal timestamps can cause migrations to be skipped (#...
• b786252 Merge pull request #6049 from drizzle-team/drizzle-kit-announcements
• f9fc5bf Add drizzle-kit announcement manifest and schema doc
• 9d64532 Merge pull request #6004 from drizzle-team/pin-npm-11-main
• 0af2f2e Pin the release npm self-update to major 11: the npm 12.0.0 tarball is missin...
• 6968638 Merge pull request #6001 from drizzle-team/release-router-dispatch-inputs
• Additional commits viewable in compare view

Updates jose from 6.2.8 to 6.2.13

Release notes

Sourced from jose's releases.

v6.2.13

Refactor

• align terminology with JOSE specifications (bafcb74)
• preserve underlying error causes (724ba24), closes #908

v6.2.12

Documentation

• clarify and shorten public API guidance (be62530)

Refactor

• simplify JWS and JWE operation cores (92e9640)

Performance

• avoid copying AES-GCM output (6925d43)
• deduplicate pending jwks key imports (bf5138b)
• encode single-signature JWS input once (7bc9a33)
• normalize General JWE shared headers once (78637bd)
• normalize jwks selection metadata once (fd3ae3f)
• use native encoding for larger ASCII strings (b23a6f3)

v6.2.11

Documentation

• render subpath indexes as tables (94589ee)
• shorten API index descriptions (681482f)

Refactor

• model JWE key management modes (e01dda6)
• types: reduce declaration repetition (55b970f)

v6.2.10

Fixes

• jose: consume serialization members once (9bee285)
• jose: reject empty protected and JWE AAD members (8da4145)
• jose: validate serialized header values (b711d8f)
• jwe: conceal invalid decrypted CEK lengths (41fafe0)
• jwe: enforce AES-GCM tag boundaries (9a5b744)
• jwe: validate explicit encryption parameters (7a02697)
• jwk: accept empty octet-sequence keys (3f871e7)
• jwk: normalize key resolution inputs (f54ee7b)
• jwks: enforce verification key metadata (f9ba510)
• jwks: order overlapping remote reloads (9a1a913)
• jwks: reject invalid remote duration values (7bdb9e5)
• jwk: validate ext and key_ops parameters (4d91c37)

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.13 (2026-10-20)

Refactor

• align terminology with JOSE specifications (bafcb74)
• preserve underlying error causes (724ba24), closes #908

6.2.12 (2026-09-05)

Documentation

• clarify and shorten public API guidance (be62530)

Refactor

• simplify JWS and JWE operation cores (92e9640)

Performance

• avoid copying AES-GCM output (6925d43)
• deduplicate pending jwks key imports (bf5138b)
• encode single-signature JWS input once (7bc9a33)
• normalize General JWE shared headers once (78637bd)
• normalize jwks selection metadata once (fd3ae3f)
• use native encoding for larger ASCII strings (b23a6f3)

6.2.11 (2026-09-04)

Documentation

• render subpath indexes as tables (94589ee)
• shorten API index descriptions (681482f)

Refactor

• model JWE key management modes (e01dda6)
• types: reduce declaration repetition (55b970f)

6.2.10 (2026-08-21)

Fixes

• jose: consume serialization members once (9bee285)
• jose: reject empty protected and JWE AAD members (8da4145)
• jose: validate serialized header values (b711d8f)
• jwe: conceal invalid decrypted CEK lengths (41fafe0)
• jwe: enforce AES-GCM tag boundaries (9a5b744)
• jwe: validate explicit encryption parameters (7a02697)
• jwk: accept empty octet-sequence keys (3f871e7)
• jwk: normalize key resolution inputs (f54ee7b)

... (truncated)

Commits

• 316b7f2 chore(release): 6.2.13
• 8106395 chore: bump packages
• 724ba24 refactor: preserve underlying error causes
• b112a5e chore: bump packages
• 2a3a525 chore(deps-dev): bump workerd in /tap/workerd
• 8f540d8 chore(deps): bump the actions group with 3 updates
• 8d6c02b chore(deps-dev): bump electron from 44.0.0 to 44.4.5 in /tap/electron
• 55c959f ci: use gh run rerun for retries
• 5b00c64 ci: address zizmor findings and bump shared workflows
• 1761d7f chore: bump packages
• Additional commits viewable in compare view

Updates @swc/core from 1.16.0 to 1.16.20

Changelog

Sourced from @​swc/core's changelog.

[1.16.20] - 2026-10-22

Bug Fixes

• (es/codegen) Disambiguate TSX generic arrows (#12505) (2c9d198)

• (es/codegen) Preserve non-null token boundaries (#12504) (410ae3a)

• (es/codegen) Parenthesize typed arrow parameters (#12503) (aa1ffd6)

• (es/codegen) Preserve TypeScript token boundaries (#12523) (9f36ae0)

• (es/codegen) Emit space after div if rhs starts with a regex (#12544) (dddf716)

• (es/codegen) Preserve optional call type arguments (#12549) (f7bef4d)

• (es/compat) Scope private access modes to each member (#12526) (c0e3fa1)

• (es/fixer) Preserve TypeScript expression grouping (#12518) (b9d3f8f)

• (es/fixer) Preserve TypeScript operand grouping (#12539) (7c4a214)

• (es/fixer) Avoid panicking on recovered parenthesized assignment targets (#12551) (ec34371)

• (es/fixer) Preserve optional chain boundaries (#12550) (01d5630)

• (es/fixer) Wrap function declarations in sloppy-mode loop bodies (#12567) (76ff943)

• (es/minifier) Bound literal expressions copied by the sequential inliner (#12521) (60c700f)

• (es/minifier) Preserve rest array identity when its reference runs more than once (#12546) (4768dbe)

• (es/minifier) Keep trimLeft and trimRight on string literals (#12574) (663ffb0)

... (truncated)

Commits

• 566c595 chore: Publish 1.16.20 with swc_core v82.2.0
• 196ac57 chore: Publish 1.16.20-nightly-20261022.1 with swc_core v82.2.0
• 6d71046 chore: Publish 1.16.19-nightly-20261015.1 with swc_core v82.1.1
• 63ced3b chore: Publish 1.16.18 with swc_core v82.0.2
• ff4257e chore: Publish 1.16.18-nightly-20261011.1 with swc_core v82.0.2
• d2bfb94 chore: Publish 1.16.17 with swc_core v82.0.1
• 5274627 chore: Publish 1.16.17-nightly-20261011.1 with swc_core v82.0.1
• f8269e6 chore: Publish 1.16.16-nightly-20261007.1 with swc_core v82.0.0
• 3e034f2 chore: Publish 1.16.15-nightly-20261007.1 with swc_core v82.0.0
• d6b897c chore: Publish 1.16.14-nightly-20261006.1 with swc_core v82.0.0
• Additional commits viewable in compare view

Updates next from 15.5.23 to 15.5.28

Release notes

Sourced from next's releases.

v15.5.28

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

• Denial of Service in App Router using Server Actions

v15.5.27

This release contains security fixes for the following advisories:

Medium:

• Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass
• Cache poisoning of SSG and ISR pages in self-hosted Next.js applications
• Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service

v15.5.26

This release contains additional security hardening for next/og. For more information, check out https://nextjs.org/blog/nextjs-security-update-september-22-2026

v15.5.25

Follow-up release to v15.5.24 re-enabling AVIF Image Optimization when newer versions of sharp are installed (#97954).

v15.5.24

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution on windows-hosted servers
• Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

Commits

• 195cd6a v15.5.28
• 1b53604 [cd] Allow branch to get published
• 5e3b687 [lts-maintenance][next/image] Bump sharp (#232)
• a2021b3 [lts-maintenance][react] Improve Server Component transport protocol (#194)
• a836b53 [lts-maintenance] Fix google tag manager e2e test, assume GTM 200s instead of...
• 9c1c1b1 [lts-maintenance][ci] Wire preview builds variables consistently (#99325)
• def7eff v15.5.27
• 52c94ab [lts-maintenance] Scope response cache keys to their source route (#219)
• 785f4c2 [lts-maintenance] Match Next data paths case-sensitively (#197)
• 7217d63 [lts-maintenance][webpack] Ensure dynamicParams is respected in `opengraph-...
• Additional commits viewable in compare view

Updates react from 19.2.8 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

• Improve transport protocol (#37845 by @​unstubbable and @​eps1lon)

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)
• Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@​jackpope, @​sebmarkbage, @​eps1lon, @​Dhakshin2007, @​chirokas, @​teamleaderleo, @​fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

• browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
  • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

• Enable Trusted Types API integration (@​rickhanlonii #35816)
• Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@​acdlite #37290)
• Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@​hoxyq, @​eps1lon: #37104, #37203, #37491)

All Changes

React

• Fast Refresh Fixes
  • Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@​sophiebits #36965)
  • Fix Fast Refresh so edits to a memo() comparison function take effect (@​sophiebits #36964)
  • Fix Fast Refresh crash when an edit changes the kind of a component's type (@​sophiebits #36963)
  • Unify hot reload type resolution for Fast Refresh (@​sophiebits #36962)
  • Fix Fast Refresh to remount correctly when an edit changes the component kind (@​sophiebits #36950)
  • Double invoke effects in StrictMode after Fast Refresh (@​eps1lon #35962)
• Performance Track Fixes
  • Prevent crash when accessing $$typeof in Performance Tracks (@​eps1lon #35679)
  • Handle non-string function names in Performance Tracks (@​eps1lon #35659)
  • Use minus (-) instead of en dash for removed props in Performance Tracks (@​eps1lon #35649)
  • Handle arrays with bigints in deep objects in Performance Tracks (@​eps1lon #35648)
  • Don't enumerate typed array props in Performance Tracks in DEV (@​UditDewan #36913)
  • Bail out of diffing wide objects and arrays in Performance Tracks (@​eps1lon #34742)
  • Clear potentially large performance measures in DEV (@​hoxyq #34803)
  • Fix missing else branch for renders with no props change in Performance Tracks (@​hoxyq #34837)
• Activity Fixes
  • Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@​sophiebits #36947)
  • Hide portal contents when an Activity is hidden (@​acdlite #35091)
  • Prevent metadata hoisting in hidden <Activity> trees (@​ronnakamoto #34983)

... (truncated)

Changelog

Sourced from react's changelog.

19.3.0 (September 9, 2026)

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)
• Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@​jackpope, @​sebmarkbage, @​eps1lon, @​Dhakshin2007, @​chirokas, @​teamleaderleo, @​fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

• browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
  • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

• Enable Trusted Types API integration (@​rickhanlonii #35816)
• Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@​acdlite #37290)
• Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@​hoxyq, @​eps1lon: #37104, #37203, #37491)

All Changes

React

• Fast Refresh Fixes
  • Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@​sophiebits #36965)
  • Fix Fast Refresh so edits to a memo() comparison function take effect (@​sophiebits #36964)
  • Fix Fast Refresh crash when an edit changes the kind of a component's type (@​sophiebits #36963)
  • Unify hot reload type resolution for Fast Refresh (@​sophiebits #36962)
  • Fix Fast Refresh to remount correctly when an edit changes the component kind (@​sophiebits #36950)
  • Double invoke effects in StrictMode after Fast Refresh (@​eps1lon #35962)
• Performance Track Fixes
  • Prevent crash when accessing $$typeof in Performance Tracks (@​eps1lon #35679)
  • Handle non-string function names in Performance Tracks (@​eps1lon #35659)
  • Use minus (-) instead of en dash for removed props in Performance Tracks (@​eps1lon #35649)
  ...

  Description has been truncated