deps(deps): Bump the minor-and-patch group with 18 updates by dependabot[bot] · Pull Request #333 · profullstack/media-streamer

dependabot · 2026-11-09T17:13:13Z

Bumps the minor-and-patch group with 18 updates:

Package	From	To
@supabase/supabase-js	`2.118.0`	`2.119.0`
framer-motion	`14.9.0`	`14.10.1`
imapflow	`2.10.0`	`2.11.0`
linkedom	`0.18.14`	`0.18.15`
lucide-react	`1.65.0`	`1.70.0`
mailparser	`3.14.1`	`3.14.2`
next	`16.4.3`	`16.4.5`
openai	`7.45.1`	`7.53.0`
posthog-js	`1.444.0`	`1.447.3`
resend	`6.36.0`	`6.37.0`
undici	`8.12.3`	`8.12.4`
@playwright/test	`1.64.1`	`1.65.0`
@tailwindcss/postcss	`4.3.3`	`4.3.5`
@vitest/coverage-v8	`5.0.5`	`5.1.0`
eslint-config-next	`16.4.3`	`16.4.5`
tailwindcss	`4.3.3`	`4.3.5`
vite	`8.3.5`	`8.3.6`
vitest	`5.0.5`	`5.1.0`

Updates @supabase/supabase-js from 2.118.0 to 2.119.0

Release notes

Sourced from @supabase/supabase-js's releases.

v2.119.0

2.119.0 (2026-11-04)

🚀 Features

postgrest: expose query builder options to .from method - custom fetch per request (#1570)

realtime: broadcast persistence (#2690)

🩹 Fixes

auth: deleteUser miscast empty object to User (#2773)

auth: global sign out cleared the local session when the server failed to log out (#2786)

realtime: include vsn in the unsupported serializer error (#2812)

storage: exists reports invalid JWT or missing bucket as missing file (#2783)

storage: ignore undefined FileOptions during upload (#2789)

❤️ Thank You

7vignesh

7vignesh vigneshgopikrishnan7@gmail.com and stenlan @stenlan

Christian Melchior

Claude Opus 5.5

Guilherme Souza

Katerina Skroumpelou

Leandro Pereira @leandrocp

Pintu Kumar @pintu544

Rami Hersonsky @ramiscaleai

stenlan @stenlan

Vignesh

v2.119.0-canary.6

2.119.0-canary.6 (2026-11-04)

This was a version bump only, there were no code changes.

v2.119.0-canary.5

2.119.0-canary.5 (2026-11-03)

🚀 Features

realtime: broadcast persistence (#2690)

🩹 Fixes

realtime: include vsn in the unsupported serializer error (#2812)

❤️ Thank You

Claude Opus 5.5

Guilherme Souza

... (truncated)

Changelog

Sourced from @supabase/supabase-js's changelog.

2.119.0 (2026-11-04)

🚀 Features

postgrest: expose query builder options to .from method - custom fetch per request (#1570)

❤️ Thank You

7vignesh

7vignesh vigneshgopikrishnan7@gmail.com and stenlan @stenlan

Katerina Skroumpelou

stenlan @stenlan

Vignesh

Commits

d2090f3 ci(repo): migrate test configs to supabase cli v3 (#2811)
ecab7fb docs(misc): document SDK compatibility with Platform Services (#2798)
8181a4d chore(deps): bump playwright to 1.64.0 (#2777)
bb56484 feat(postgrest): expose query builder options to .from method - custom fetch ...
e428dfe chore(release): version 2.118.0 changelogs (#2766)
See full diff in compare view

Updates framer-motion from 14.9.0 to 14.10.1

Changelog

Sourced from framer-motion's changelog.

[14.10.1] 2026-11-05

Fixed

animate: Fix not recognising timeline of only nested sequences as timeline.

Various performance-related improvements.

[14.10.0] 2026-11-05

Added

press: count, hold and repeat, for double/triple press, long press and multipress gestures.

drag: Expose getProps on the dragConstraints function context.

drag: x/y props for headless gesture tracking.

Reorder: Home and End buttons move selected item to beginning and end of list, respectively.

motion: New tap prop for configuring press gesture.

Fixed

animate: Minor fixes.

[14.9.1] 2026-11-04

Added

Ensure accelerated transform animations finish correctly.

AnimatePresence: Fix exit never starting when a child mounts already exiting.

AnimatePresence: Fix exit stuck after an open layoutId card switches to another item.

Ensure accelerated animations are cleaned up in WebKit.

Commits

78f3ff5 v14.10.1
5243b32 Updating changelog
a404e1a Merge pull request #4070 from motiondivision/claude/project-thread-e45kg1
cfdf2ef Merge branch 'main' into claude/project-thread-e45kg1
94097e4 Merge pull request #4067 from motiondivision/lean/5-binding
d95cc90 Merge pull request #4066 from motiondivision/lean/4-spans
5797936 Fix timing flake in "built when played after a pause" test
7a0a081 Merge remote-tracking branch 'origin/main' into claude/project-thread-kgyuj9
16320ad Merge pull request #4065 from motiondivision/lean/2-value
1c9194b Raise framer-motion size budgets to current sizes
Additional commits viewable in compare view

Updates imapflow from 2.10.0 to 2.11.0

Release notes

Sourced from imapflow's releases.

v2.11.0

2.11.0 (2026-11-06)

Summary

Adds the sessionExpires option for servers that end a session at a known time, such as Exchange Online, which ends an IMAP session when the OAuth2 access token it authenticated with expires.

Who should upgrade

Anyone connecting to Microsoft 365 or Outlook.com over IMAP with OAuth2 who sees commands fail with BYE Session invalidated - AccessTokenExpired roughly once per token lifetime. Nothing changes unless the new option is set.

Highlights

sessionExpires (a Date or milliseconds since the epoch) and sessionExpiryLead (default 5 minutes): from the lead before the expiry the client closes the connection the first time nothing runs on it, with an idling connection counting as free, and shortly before the expiry it closes it regardless. The close is reported like close(), so the application reconnects with a fresh token instead of losing a command to the server's BYE.

Features

sessionExpires option closes a session before the server ends it (51a64ac)

v2.10.2

2.10.2 (2026-11-04)

Bug Fixes

update dependencies (eb1e6d9)

v2.10.1

2.10.1 (2026-11-04)

Bug Fixes

update dependencies (73e298e)

update dependencies (ad607d2)

Changelog

Sourced from imapflow's changelog.

2.11.0 (2026-11-06)

Features

sessionExpires option closes a session before the server ends it (51a64ac)

2.10.2 (2026-11-04)

Bug Fixes

update dependencies (eb1e6d9)

2.10.1 (2026-11-04)

Bug Fixes

update dependencies (73e298e)

update dependencies (ad607d2)

Commits

baf7ad6 chore(master): release 2.11.0 [skip-ci] (#461)
c1e2d09 test: arm the session expiry timers once the tested state is reached
51a64ac feat: sessionExpires option closes a session before the server ends it
f0bc48c Merge pull request #460 from postalsys/release-please--branches--master--comp...
199e1e3 chore(master): release 2.10.2 [skip-ci]
eb1e6d9 fix: update dependencies
4f35792 Merge pull request #459 from postalsys/release-please--branches--master--comp...
ca495c5 chore(master): release 2.10.1 [skip-ci]
73e298e fix: update dependencies
ad607d2 fix: update dependencies
See full diff in compare view

Updates linkedom from 0.18.14 to 0.18.15

Commits

6e2ae0c 0.18.15
fabb4a2 updated devDependencies
4b80ce6 Replace @acemir/cssom with cssomnom/parse (#356)
See full diff in compare view

Updates lucide-react from 1.65.0 to 1.70.0
Updates mailparser from 3.14.1 to 3.14.2

Changelog

Sourced from mailparser's changelog.

3.14.2 (2026-11-04)

Bug Fixes

update dependencies (7f3bad5)

Commits

f812318 chore(master): release 3.14.2 [skip-ci] (#476)
7f3bad5 fix: update dependencies
7f7c18e ci: rerun the workflows for the npm 12 test fix
f42aae4 test: run the suite under npm 12
c0e9653 chore(deps): update development dependencies
ce35550 chore(deps): update development dependencies
See full diff in compare view

Updates next from 16.4.3 to 16.4.5

Release notes

Sourced from next's releases.

v16.4.5

This release contains security fixes for the following advisories:

Moderate

Cross-tenant sensitive information disclosure in Next.js 'use cache' when called through unstable_cache

Cache leak across root param values in nested 'use cache' functions (follow-up)

Cache poisoning of shared fallback shells in Cache Components via request-supplied placeholder route params

Cross-user cache disclosure and poisoning in Next.js use cache with binary arguments

Cross-client response injection and disclosure in self-hosted Next.js applications forwarding fetched responses

SVG rejection bypass in Next.js image optimization

HttpOnly cookie exposure through internal response header on Next.js Edge runtime routes

v16.4.4

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. The announced security released for November will be published tomorrow.

Core Changes

[lts-active] test: disable the reads fallback params after a client navigation deployment test (#100668)

[lts-active] Reload on missed Turbopack startup CSS updates (#100619)

[lts-active] Revert "Optimize strict module factory chunks (#98421)" (#100866)

[lts-active] Emit the Turbopack shared-runtime bootstrap in the PPR resume so it gets the CSP nonce (#100907)

[lts-active] [ci] Pin deploy test deployments to Node.js 22.x (#100886)

[lts-active] fix(analyze): use route summaries as the analyzer route index (#100974)

[lts-active] Use fast-jwt instead of jsonwebtoken (#100885)

Credits

Huge thanks to @icyJoseph, @mischnic, @wbinnssmith, @lukesandberg, and @eps1lon for helping!

Commits

4e5335a v16.4.5
809be72 [lts-active] Strip internal middleware cookie headers from edge responses (#282)
2842833 [lts-active] Fix stale compressed framing for forwarded fetch responses (#281)
6596840 [lts-active] [use cache] Fix cache key when binary args are used (#280)
18eeffb [lts-active] Fix shared shell poisoning from request-supplied placeholder par...
e66e656 [lts-active] [next/image] Fix false-positive AVIF/HEIC detection (#278)
d605874 [lts-active] Fix unstable_cache leaking cold 'use cache' fills across roo...
80c96ed [lts-active] Fix outer 'use cache' entries reused across root param values ...
b175f52 v16.4.4
ba4a4c1 [lts-active] Use fast-jwt instead of jsonwebtoken (#100885)
Additional commits viewable in compare view

Updates openai from 7.45.1 to 7.53.0

Release notes

Sourced from openai's releases.

v7.53.0

7.53.0 (2026-11-06)

Features

agents: deliver session errors as stream events (#3120) (c48e5aa)

Bug Fixes

deps-dev: bump @aws-sdk/credential-provider-node from 3.972.84 to 3.972.88 (#3099) (101175b)

deps-dev: bump oxfmt from 0.72.0 to 0.75.0 (#3091) (77012af)

deps-dev: bump oxlint from 1.87.0 to 1.90.0 (#3096) (75903b2)

deps-dev: bump ultracite from 7.11.1 to 8.1.0 (#3098) (a523d74)

deps: bump @azure/identity from 4.13.3 to 4.14.0 (#3094) (6a3d573)

deps: bump @azure/identity from 4.13.3 to 4.14.0 (#3094) (3f56f57)

v7.52.0

7.52.0 (2026-11-05)

Features

api: add a model option for Responses (#3116) (c05ed3e)

Bug Fixes

deps-dev: bump follow-redirects from 1.16.0 to 1.16.2 in /ecosystem-tests/cloudflare-worker (#3113) (2d5b81c)

v7.51.0

7.51.0 (2026-11-05)

Features

api: add Australia, India, and Japan residency options (#3112) (42c31dc)

api: add GPT-6 Rosalind to the model catalog (#3109) (9854bd6)

api: add image complexity and GIF and SVG output controls (#3114) (39b724a)

api: expand agent turn errors and image and audio options (#3110) (c3f42fa)

Bug Fixes

deps-dev: bump follow-redirects from 1.16.0 to 1.16.2 in /ecosystem-tests/ts-browser-webpack (#3102) (934421d)

v7.50.0

7.50.0 (2026-11-03)

... (truncated)

Changelog

Sourced from openai's changelog.

7.53.0 (2026-11-06)

Features

agents: deliver session errors as stream events (#3120) (c48e5aa)

Bug Fixes

deps-dev: bump @aws-sdk/credential-provider-node from 3.972.84 to 3.972.88 (#3099) (101175b)

deps-dev: bump oxfmt from 0.72.0 to 0.75.0 (#3091) (77012af)

deps-dev: bump oxlint from 1.87.0 to 1.90.0 (#3096) (75903b2)

deps-dev: bump ultracite from 7.11.1 to 8.1.0 (#3098) (a523d74)

deps: bump @azure/identity from 4.13.3 to 4.14.0 (#3094) (6a3d573)

deps: bump @azure/identity from 4.13.3 to 4.14.0 (#3094) (3f56f57)

7.52.0 (2026-11-05)

Features

api: add a model option for Responses (#3116) (c05ed3e)

Bug Fixes

deps-dev: bump follow-redirects from 1.16.0 to 1.16.2 in /ecosystem-tests/cloudflare-worker (#3113) (2d5b81c)

7.51.0 (2026-11-05)

Features

api: add Australia, India, and Japan residency options (#3112) (42c31dc)

api: add GPT-6 Rosalind to the model catalog (#3109) (9854bd6)

api: add image complexity and GIF and SVG output controls (#3114) (39b724a)

api: expand agent turn errors and image and audio options (#3110) (c3f42fa)

Bug Fixes

deps-dev: bump follow-redirects from 1.16.0 to 1.16.2 in /ecosystem-tests/ts-browser-webpack (#3102) (934421d)

7.50.0 (2026-11-03)

Features

api: add 12-hour Responses caching and cache-write usage (#3106) (a286400)

... (truncated)

Commits

065e996 release: 7.53.0 (#3117)
c48e5aa feat(agents): deliver session errors as stream events (#3120)
a523d74 fix(deps-dev): bump ultracite from 7.11.1 to 8.1.0 (#3098)
75903b2 fix(deps-dev): bump oxlint from 1.87.0 to 1.90.0 (#3096)
6a3d573 fix(deps): bump @azure/identity from 4.13.3 to 4.14.0 (#3094)
3f56f57 fix(deps): bump @azure/identity from 4.13.3 to 4.14.0 (#3094)
77012af fix(deps-dev): bump oxfmt from 0.72.0 to 0.75.0 (#3091)
101175b fix(deps-dev): bump @aws-sdk/credential-provider-node from 3.972.84 to 3.972....
5b12ca8 release: 7.52.0 (#3115)
c05ed3e feat(api): add a model option for Responses (#3116)
Additional commits viewable in compare view

Updates posthog-js from 1.444.0 to 1.447.3

Release notes

Sourced from posthog-js's releases.

posthog-js@1.447.3

1.447.3

Patch Changes

#5562 8e042cb Thanks @adityareddy-dev! - Preserve non-empty CDATA content with text masking and rebuild it as text in HTML documents. (2026-11-06)

posthog-js@1.447.2

1.447.2

Patch Changes

#5561 ab49034 Thanks @adityareddy-dev! - Mask hidden input values in session replay when maskAllInputs is enabled, and accept hidden in maskInputOptions. (2026-11-06)

Updated dependencies [ab49034]:

@posthog/types@1.421.1

posthog-js@1.447.1

1.447.1

Patch Changes

#5576 9ee327d Thanks @lucasheriques! - Reworded the description of the llm_model argument that capture_webmcp adds to WebMCP tools, so it no longer points the model at its system prompt. (2026-11-05)

posthog-js@1.447.0

1.447.0

Minor Changes

#5580 aa66d4c Thanks @haacked! - metrics.histogram() accepts a bounds option that sets the histogram's bucket boundaries, and beforeSend sees and can change them. The first sample of a histogram (name and unit) fixes its bounds until the client resets. A later sample with different bounds is recorded in the fixed buckets and logs a warning, and a sample with invalid bounds is dropped. The experimental posthog.flags.request.duration histogram now uses the bounds [50, 75, 100, 150, 200, 300, 400, 500, 750, 1000, 1500, 2000, 3000, 5000, 10000] ms, so its p50 and p95 resolve between 50ms and 5s. This changes the metric's buckets, which its experimental status allows. (2026-11-05)

Patch Changes

Updated dependencies [aa66d4c]:

@posthog/core@1.64.0

@posthog/types@1.421.0

posthog-js@1.446.3

1.446.3

Patch Changes

#5560 e22dedb Thanks @adityareddy-dev! - Use native sibling accessors when recording insertion positions so patched DOM getters do not reorder replayed nodes. (2026-11-05)

posthog-js@1.446.2

1.446.2

... (truncated)

Commits

a0e6485 chore: update versions and lockfile [version bump]
8e042cb fix(replay): preserve nonempty CDATA content (#5562)
5d98ba7 chore: update versions and lockfile [version bump]
2eccf01 fix(rollup): keep chunk IDs stable when unrelated lazy chunks are added (#5571)
c102098 chore: update versions and lockfile [version bump]
ab49034 fix(replay): include hidden inputs in maskAllInputs (#5561)
d2d8a26 chore: update versions and lockfile [version bump]
28fe8c0 fix(node): parse stack frames for functions named async (#5545)
aecc093 chore: update versions and lockfile [version bump]
9ee327d fix(webmcp): stop pointing the model at its system prompt in llm_model (#5576)
Additional commits viewable in compare view

Updates resend from 6.36.0 to 6.37.0

Release notes

Sourced from resend's releases.

v6.37.0

What's Changed

chore(inboxes): use a placeholder URL in draft path attachment tests by @dielduarte in resend/resend-node#1173

fix: catch dot segments hidden behind backslashes and whitespace by @dielduarte in resend/resend-node#1174

fix(emails): send binary attachment content as base64 by @yassinemontassar in resend/resend-node#1167

New Contributors

@yassinemontassar made their first contribution in resend/resend-node#1167

Full Changelog: resend/resend-node@v6.36.0...v6.37.0

v6.36.1

What's Changed

fix: catch dot segments hidden behind backslashes and whitespace by @Abhishek-B-R in resend/resend-node#1168

New Contributors

@Abhishek-B-R made their first contribution in resend/resend-node#1168

Full Changelog: resend/resend-node@v6.36.0...v6.36.1

Commits

5265fee fix(emails): send binary attachment content as base64 (#1167)
5c4035f fix: catch dot segments hidden behind backslashes and whitespace (#1174)
d9bb9b6 chore(inboxes): use a placeholder URL in draft path attachment tests (#1173)
See full diff in compare view

Updates undici from 8.12.3 to 8.12.4

Release notes

Sourced from undici's releases.

v8.12.4

⚠️ Security Fixes

This release fixes six vulnerabilities.

CVE-2026-116592 / GHSA-mqg3-3v4r-cm32 (high)

Undici 8.12.2 and 8.12.3 could cache the final response from a redirect chain under the original request key without applying the origin, cache policy, freshness, or Vary requirements of every intermediate hop. This could poison a cache or expose one user's response to another user. The fix validates every redirect hop, combines their Vary fields, limits freshness and stale serving to the most restrictive hop, and invalidates persistent SQLite entries written by vulnerable releases.

CVE-2026-120474 / GHSA-7xg3-fphp-28hg (medium)

A shared cache used with compose(redirect(), cache()) could store a credential-dependent response from a same-origin redirect under the original URL. A later authenticated or unauthenticated request could then receive another user's response. Redirected requests carrying Authorization, Cookie, or Proxy-Authorization are no longer stored under the original alias key.

CVE-2026-116630 / GHSA-5rm8-gv32-r954 (medium)

A cross-origin redirect during cache revalidation could let a 304 Not Modified response from the redirect target validate a cached response from the original origin. Undici now checks that the revalidation target matches the cached URL and that any returned validator matches the stored representation before replaying the cached body.

CVE-2026-120415 / GHSA-9v6h-8rgp-m69f (medium)

The redirect interceptor did not strip credentials correctly when request headers were supplied as an array of [name, value] pairs. With a header-normalizing interceptor outside redirect(), credentials could be sent to a cross-origin redirect target. Undici now handles both tuple arrays and flat header arrays when removing sensitive headers.

CVE-2026-120222 / GHSA-3g9m-rv3r-w5w2 (medium)

A downstream handler exception during cache replay could escape as an uncaught exception or unhandled promise rejection and terminate the process. This included dump size-limit failures, excessive Content-Encoding values in decompress, asynchronous cache-store failures, and cached-body replay after a 304. These failures are now reported as request errors.

CVE-2026-120423 / GHSA-r4pc-4jcp-7pqc (medium)

fetch() could skip Subresource Integrity verification when valid integrity metadata was separated or surrounded by ASCII whitespace other than a space, including a horizontal tab. Integrity metadata is now split on all ASCII whitespace before SHA-256, SHA-384, or SHA-512 verification.

What's Changed

docs: clarify that origin is optional only for origin-bound dispatchers by @attilayener in nodejs/undici#5994

fix(mock): ignore the trailing slash before a query string by @lprnmns in nodejs/undici#6031

build(deps-dev): bump eslint from 10.12.0 to 10.13.0 by @dependabot[bot] in nodejs/undici#6059

build(deps-dev): bump neostandard from 0.14.0 to 0.14.1 by @dependabot[bot] in nodejs/undici#6058

docs: add QUERY to the documented retry default methods by @qodelicious in nodejs/undici#6062

docs: fix a couple of typos by @qodelicious in nodejs/undici#6057

build(deps): bump cronometro from 6.0.3 to 7.0.1 in /benchmarks by @dependabot[bot] in nodejs/undici#5969

fix: let interim 1xx responses through DecoratorHandler by @mrityunjay-pandey in nodejs/undici#6028

fix(types): declare FormData prototype methods by @RlxChap2 in nodejs/undici#6056

fix(cache): ignore SQLITE_BUSY in the sqlite cache store by @isHeSatoshi in nodejs/undici#6049

fix(http2): keep persistent error sink on released streams by @mcollina in nodejs/undici#5983

fix(h2): replay requests whose HEADERS raced a GOAWAY by @mohamed-rdr in nodejs/undici#6065

build(deps-dev): bump @fastify/busboy from 3.2.3 to 3.2.4 by @dependabot[bot] in nodejs/undici#6102

build(deps-dev): bump undici from 6.29.0 to 6.29.1 by @dependabot[bot] in nodejs/undici#6103

disable wasm SIMD on the RISC-V by @hrw in nodejs/undici#6041

fix(mock): expose aborted on the mock dispatch controller by @santiago-su in nodejs/undici#5964

fix(fetch): avoid eager reads from async iterable bodies by @Kesavamoorthig06 in nodejs/undici#5990

fix(h2): preserve accepted streams with deferred ids by @EpicHigh in nodejs/undici#6090

fix(fetch): preserve abort propagation after garbage collection by @BridgeAR in nodejs/undici#6070

... (truncated)

Commits

779ee3e Bumped v8.12.4 (#6162)
10fa822 docs: remove security release notes
6228fc5 docs: add security release notes
1dd2657 test(cache): align redirect caching with hop policy
8ea1d61 fix(cache): detect an actual redirect, not a plain revalidation
4257261 test(cache): cover credentialed revalidation refresh
aa7ccff fix(cache): treat proxy-authorization as a credential when caching redirects
8cf5ce1 test(cache): cover proxy-authorization credential on same-origin redirect
26c42c2 fix(cache): do not cache credential-bearing same-origin redirects under the a...
e958661 test: cover decompress too-many-content-encodings throw on async cache replay
Additional commits viewable in compare view

Updates @playwright/test from 1.64.1 to 1.65.0

Release notes

Sourced from @playwright/test's releases.

v1.65.0

🥟 Run tests with Bun

The test runner now runs under Bun. Bun transpiles your TypeScript test files itself, so Playwright does not use Babel or its compilation cache. Pass the --bun flag, because without it bunx playwright test runs on Node.js:
bunx --bun playwright test
Our CI runs the test runner tests under Bun 1.4.3 on Linux. Some features work differently under Bun:

There is no watch mode. UI mode does not run tests again when files change, and --only-changed does not follow imports.

Bun loads modules itself, so --tsconfig and the JSX options in tsconfig.json have no effect, and custom ESM loaders are not supported.

Stack traces do not include async frames, and API names do not include the class name: click instead of locator.click. This changes some step locations, step titles and error messages.

Console output of a test does not get into the trace and UI mode.

🚨 Reports with only failures

New failures reporter prints failures and successful retries as they occur, followed by a summary, without progress output.

New onlyFailures option of the HTML, JSON and JUnit reporters keeps only tests with unexpected outcomes, flaky tests and interrupted tests:
// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
reporter: [
['failures'],
['html', { onlyFailures: true }],
],
});
🎯 Test runner
New built-in -exclusive- test lock runs a test only when no other tests are running. All other tests continue to run in parallel with each other:
test('restart the server', { lock: '-exclusive-' }, async () => {
  // No other test runs while this one is running.
});
test.skip(), test.fixme(), test.fail() and test.slow() now accept only a description. It is recorded in the test annotation:
test('upload a file', async ({ page }) => {
  test.skip('Not implemented yet');
});

... (truncated)

Commits

a1f35e1 chore: mark v1.65.0 (#43925)
a99c1ab cherry-pick(#43918): Revert "fix(docker): use latest stable Chrome for Testin...
6f9a7f5 cherry-pick(#43914): docs(release-notes): update Chromium version for 1.65
daf93bb cherry-pick(#43912): feat(chromium): roll to r1254
6545e89 cherry-pick(#43902): chore(deps): bump runtime deps
0347448 fix(test runner): track shared ESM dependencies for only-changed (#43837)
86e6924 fix(clock): cancel real-time timer when replay ends paused (#43873)
d745ae0 fix(route): wait for all active handlers before disabling interception (#43889)
6e3f5ff docs: release notes for v1.65 (#43874)
aa33d27 fix(chromium): honor Linux config directories for channel connections (#43884)
Additional commits viewable in compare view

Updates @tailwindcss/postcss from 4.3.3 to 4.3.5

Release notes

Sourced from @tailwindcss/postcss's releases.

v4.3.5

Fixed

Canonicalization: improve performance in projects with many functional variant values (e.g. a matchVariant plugin with thousands of values) (#20663)

Don't crash or create a fallback with the wrong color for a color-mix(…) without a color interpolation method (e.g. color-mix(var(--color-red-500)) or color-mix(currentcolor 50%, transparent)) (#20658, #20666)

Ensure @tailwindcss/oxide-wasm32-wasi loads instead of hanging forever (e.g. with NAPI_RS_FORCE_WASI=error or in WebContainers) (#20667)

Remove as: '*.css' from the @tailwindcss/turbopack setup in its README, because it breaks CSS modules (#20660)

Ignore  between top-level rules in CSS instead of throwing or swallowing the next rule (e.g. a { color: red } --> b { color: blue }) (#20665)

Ensure @tailwindcss/oxide-wasm32-wasi detects changed and new source files after the first scan...
Description has been truncated

Bumps the minor-and-patch group with 18 updates: | Package | From | To | | --- | --- | --- | | [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.118.0` | `2.119.0` | | [framer-motion](https://github.com/motiondivision/motion) | `14.9.0` | `14.10.1` | | [imapflow](https://github.com/postalsys/imapflow) | `2.10.0` | `2.11.0` | | [linkedom](https://github.com/WebReflection/linkedom) | `0.18.14` | `0.18.15` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.65.0` | `1.70.0` | | [mailparser](https://github.com/nodemailer/mailparser) | `3.14.1` | `3.14.2` | | [next](https://github.com/vercel/next.js) | `16.4.3` | `16.4.5` | | [openai](https://github.com/openai/openai-node) | `7.45.1` | `7.53.0` | | [posthog-js](https://github.com/PostHog/posthog-js) | `1.444.0` | `1.447.3` | | [resend](https://github.com/resend/resend-node) | `6.36.0` | `6.37.0` | | [undici](https://github.com/nodejs/undici) | `8.12.3` | `8.12.4` | | [@playwright/test](https://github.com/microsoft/playwright) | `1.64.1` | `1.65.0` | | [@tailwindcss/postcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss) | `4.3.3` | `4.3.5` | | [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `5.0.5` | `5.1.0` | | [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.4.3` | `16.4.5` | | [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.3.3` | `4.3.5` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.3.5` | `8.3.6` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.5` | `5.1.0` | Updates `@supabase/supabase-js` from 2.118.0 to 2.119.0 - [Release notes](https://github.com/supabase/supabase-js/releases) - [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md) - [Commits](https://github.com/supabase/supabase-js/commits/v2.119.0/packages/core/supabase-js) Updates `framer-motion` from 14.9.0 to 14.10.1 - [Changelog](https://github.com/motiondivision/motion/blob/main/CHANGELOG.md) - [Commits](motiondivision/motion@v14.9.0...v14.10.1) Updates `imapflow` from 2.10.0 to 2.11.0 - [Release notes](https://github.com/postalsys/imapflow/releases) - [Changelog](https://github.com/postalsys/imapflow/blob/master/CHANGELOG.md) - [Commits](postalsys/imapflow@v2.10.0...v2.11.0) Updates `linkedom` from 0.18.14 to 0.18.15 - [Commits](WebReflection/linkedom@v0.18.14...v0.18.15) Updates `lucide-react` from 1.65.0 to 1.70.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.70.0/packages/lucide-react) Updates `mailparser` from 3.14.1 to 3.14.2 - [Release notes](https://github.com/nodemailer/mailparser/releases) - [Changelog](https://github.com/nodemailer/mailparser/blob/master/CHANGELOG.md) - [Commits](nodemailer/mailparser@v3.14.1...v3.14.2) Updates `next` from 16.4.3 to 16.4.5 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.4.3...v16.4.5) Updates `openai` from 7.45.1 to 7.53.0 - [Release notes](https://github.com/openai/openai-node/releases) - [Changelog](https://github.com/openai/openai-node/blob/main/CHANGELOG.md) - [Commits](openai/openai-node@v7.45.1...v7.53.0) Updates `posthog-js` from 1.444.0 to 1.447.3 - [Release notes](https://github.com/PostHog/posthog-js/releases) - [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md) - [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.444.0...posthog-js@1.447.3) Updates `resend` from 6.36.0 to 6.37.0 - [Release notes](https://github.com/resend/resend-node/releases) - [Changelog](https://github.com/resend/resend-node/blob/canary/CHANGELOG.md) - [Commits](resend/resend-node@v6.36.0...v6.37.0) Updates `undici` from 8.12.3 to 8.12.4 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v8.12.3...v8.12.4) Updates `@playwright/test` from 1.64.1 to 1.65.0 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.64.1...v1.65.0) Updates `@tailwindcss/postcss` from 4.3.3 to 4.3.5 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.5/packages/@tailwindcss-postcss) Updates `@vitest/coverage-v8` from 5.0.5 to 5.1.0 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.1.0/packages/coverage-v8) Updates `eslint-config-next` from 16.4.3 to 16.4.5 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.4.5/packages/eslint-config-next) Updates `tailwindcss` from 4.3.3 to 4.3.5 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.5/packages/tailwindcss) Updates `vite` from 8.3.5 to 8.3.6 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.3.6/packages/vite) Updates `vitest` from 5.0.5 to 5.1.0 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.1.0/packages/vitest) --- updated-dependencies: - dependency-name: "@supabase/supabase-js" dependency-version: 2.119.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: framer-motion dependency-version: 14.10.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: imapflow dependency-version: 2.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: linkedom dependency-version: 0.18.15 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: lucide-react dependency-version: 1.70.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: mailparser dependency-version: 3.14.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: next dependency-version: 16.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: openai dependency-version: 7.53.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: posthog-js dependency-version: 1.447.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: resend dependency-version: 6.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: undici dependency-version: 8.12.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@playwright/test" dependency-version: 1.65.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@tailwindcss/postcss" dependency-version: 4.3.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@vitest/coverage-v8" dependency-version: 5.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: eslint-config-next dependency-version: 16.4.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: tailwindcss dependency-version: 4.3.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: vite dependency-version: 8.3.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: vitest dependency-version: 5.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-11-09T17:13:17Z

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

socket-security · 2026-11-09T17:13:36Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
next@16.4.3 ⏵ 16.4.5		⁺¹
eslint-config-next@16.4.3 ⏵ 16.4.5	⁺¹
openai@7.45.1 ⏵ 7.53.0	⁺¹	⁺¹	⁺¹
@vitest/coverage-v8@5.0.5 ⏵ 5.1.0	⁺¹	⁺¹
vitest@5.0.5 ⏵ 5.1.0	⁺¹	⁺¹
lucide-react@1.65.0 ⏵ 1.70.0	⁺¹	^-2	⁺¹
posthog-js@1.444.0 ⏵ 1.447.3	⁺¹	⁺¹
vite@8.3.5 ⏵ 8.3.6
tailwindcss@4.3.3 ⏵ 4.3.5	⁺¹	⁺¹
linkedom@0.18.14 ⏵ 0.18.15	^-5	⁺¹	^-3
@supabase/supabase-js@2.118.0 ⏵ 2.119.0	^-3		⁺¹
undici@8.12.3 ⏵ 8.12.4		⁺¹
mailparser@3.14.1 ⏵ 3.14.2			⁺¹
imapflow@2.10.0 ⏵ 2.11.0			⁺¹
framer-motion@14.9.0 ⏵ 14.10.1	⁺¹	⁺¹	⁺¹
resend@6.36.0 ⏵ 6.37.0	⁺¹		⁺¹
@tailwindcss/postcss@4.3.3 ⏵ 4.3.5	⁺¹	⁺¹
@playwright/test@1.64.1 ⏵ 1.65.0

View full report

socket-security · 2026-11-09T17:13:39Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert (click "▶" to expand/collapse)	Action
	License policy violation: npm `@zone-eu/mailsplit` under EUPL-1.2 License: EUPL-1.2 - The applicable license policy does not permit this license (5) (package/LICENSE.EUPL-1.2) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/LICENSE.EUPL-1.2) License: EUPL-1.1+ - This license classifier is not allowed by the applicable policy (package/package.json) From: pnpm-lock.yaml → `npm/mailparser@3.14.2` → `npm/imapflow@2.11.0` → `npm/@zone-eu/mailsplit@5.4.30` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@zone-eu/mailsplit@5.4.30`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm `playwright-core` under ms-azure-data-studio License: ms-azure-data-studio - The applicable license policy does not permit this license (5) (package/ThirdPartyNotices.txt) License: MIT WITH Google-Patent-WebM - The applicable license policy does not permit this license (5) (package/lib/webp_codec.LICENSE) From: pnpm-lock.yaml → `npm/@playwright/test@1.65.0` → `npm/playwright-core@1.65.0` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/playwright-core@1.65.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm `playwright` under ms-azure-data-studio License: ms-azure-data-studio - The applicable license policy does not permit this license (5) (package/ThirdPartyNotices.txt) From: pnpm-lock.yaml → `npm/@playwright/test@1.65.0` → `npm/playwright@1.65.0` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/playwright@1.65.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Low adoption: npm `cssomnom` Location: Package overview From: pnpm-lock.yaml → `npm/linkedom@0.18.15` → `npm/cssomnom@0.1.11` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/cssomnom@0.1.11`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm `@vitest/istanbul-lib-report` under OFL-1.1 License: OFL-1.1 - The applicable license policy does not permit this license (5) (package/dist/reports/html/assets/readex-pro-license.txt) From: pnpm-lock.yaml → `npm/@vitest/coverage-v8@5.1.0` → `npm/@vitest/istanbul-lib-report@2.1.0` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@vitest/istanbul-lib-report@2.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

ralyodio merged commit e65a478 into master Nov 9, 2026
9 checks passed

dependabot Bot deleted the dependabot/npm_and_yarn/minor-and-patch-2d4087824b branch November 9, 2026 17:16

Navigation Menu

Repository navigation

deps(deps): Bump the minor-and-patch group with 18 updates - #333

deps(deps): Bump the minor-and-patch group with 18 updates#333
ralyodio merged 1 commit into
masterfrom
dependabot/npm_and_yarn/minor-and-patch-2d4087824b

dependabot Bot commented on behalf of github Nov 9, 2026

Uh oh!

dependabot Bot commented on behalf of github Nov 9, 2026

Uh oh!

socket-security Bot commented Nov 9, 2026

Uh oh!

socket-security Bot commented Nov 9, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Nov 9, 2026

v2.119.0

2.119.0 (2026-11-04)

🚀 Features

🩹 Fixes

❤️ Thank You

v2.119.0-canary.6

2.119.0-canary.6 (2026-11-04)

v2.119.0-canary.5

2.119.0-canary.5 (2026-11-03)

🚀 Features

🩹 Fixes

❤️ Thank You

2.119.0 (2026-11-04)

🚀 Features

❤️ Thank You

[14.10.1] 2026-11-05

Fixed

[14.10.0] 2026-11-05

Added

Fixed

[14.9.1] 2026-11-04

Added

v2.11.0

2.11.0 (2026-11-06)

Summary

Who should upgrade

Highlights

Features

v2.10.2

2.10.2 (2026-11-04)

Bug Fixes

v2.10.1

2.10.1 (2026-11-04)

Bug Fixes

2.11.0 (2026-11-06)

Features

2.10.2 (2026-11-04)

Bug Fixes

2.10.1 (2026-11-04)

Bug Fixes

3.14.2 (2026-11-04)

Bug Fixes

v16.4.5

Moderate

v16.4.4

Core Changes

Credits

v7.53.0

7.53.0 (2026-11-06)

Features

Bug Fixes

v7.52.0

7.52.0 (2026-11-05)

Features

Bug Fixes

v7.51.0

7.51.0 (2026-11-05)

Features

Bug Fixes

v7.50.0

7.50.0 (2026-11-03)

7.53.0 (2026-11-06)

Features

Bug Fixes

7.52.0 (2026-11-05)

Features

Bug Fixes

7.51.0 (2026-11-05)

Features

Bug Fixes

7.50.0 (2026-11-03)

Features

posthog-js@1.447.3

1.447.3

Patch Changes

posthog-js@1.447.2

1.447.2

Patch Changes