Skip to content

Bump the production group across 1 directory with 7 updates - #15

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-10629dc1eb
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-10629dc1eb

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 8, 2026

Copy link
Copy Markdown

Bumps the production group with 7 updates in the / directory:

Package From To
drizzle-orm 0.45.2 0.45.3
next 16.3.1 16.3.8
nodemailer 9.0.5 10.0.15
pg 8.23.0 8.23.1
react 19.2.8 19.3.0
react-dom 19.2.8 19.3.0
zod 4.4.3 4.6.5

Updates drizzle-orm from 0.45.2 to 0.45.3

Release notes

Sourced from drizzle-orm's releases.

0.45.3

New Netlify DB Driver

Note: The Netlify DB driver is developed and maintained by the Netlify team.

Installation:

npm i @netlify/db

Usage example:

import { drizzle } from 'drizzle-orm/netlify-db';
// reads NETLIFY_DB_URL and NETLIFY_DB_DRIVER env vars
const db = drizzle();
const result = await db.execute('select 1');

import { drizzle } from 'drizzle-orm/netlify-db';
const db = drizzle(process.env.DATABASE_URL);
const result = await db.execute('select 1');

import { drizzle } from 'drizzle-orm/netlify-db';

// Explicit client — consumer controls the driver
const db = drizzle({ client: netlifyDbClient });

const result = await db.execute('select 1');
Commits
  • 15454db +
  • 54e436f exclude gel from pull
  • 0fd1cc6 remove gel
  • d028db7 skip gel
  • 93dc01e [All-kit]: Warn when journal timestamps can cause migrations to be skipped (#...
  • b786252 Merge pull request #6049 from drizzle-team/drizzle-kit-announcements
  • f9fc5bf Add drizzle-kit announcement manifest and schema doc
  • 9d64532 Merge pull request #6004 from drizzle-team/pin-npm-11-main
  • 0af2f2e Pin the release npm self-update to major 11: the npm 12.0.0 tarball is missin...
  • 6968638 Merge pull request #6001 from drizzle-team/release-router-dispatch-inputs
  • Additional commits viewable in compare view

Updates next from 16.3.1 to 16.3.8

Release notes

Sourced from next's releases.

v16.3.8

This release contains security fixes for the following advisories:

High:

Medium:

Low:

v16.3.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • turbo-tasks-backend: fix strongly consistent read hanging on a canceled task (#98931)

Credits

Huge thanks to @​lukesandberg for helping!

v16.3.6

This release contains a security fix for GHSA-vcvr-r3jv-pc5j: Remote Code Execution in next/og ImageResponse

v16.3.5

The following bug fixes have been backported. It does not include all pending features/changes on canary.

  • next/image: Skip 0-byte entries when initializing disk LRU cache (#98185)
  • next/image: Reject empty images when reading/writing to the disk cache (#98186)
  • Emit whole-app server NFTs when output: 'standalone' is used with an adapter (#98167)
  • Add CSP nonce to script tags of loading and template files (#98403)
  • Fix use cache prerender signal retention (#98448)

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

  • testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
  • Fix build error when aliasing typescript to @​typescript/typescript6 (#97997)
  • Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

... (truncated)

Commits
  • b0fad0d v16.3.8
  • 719e4c6 [lts-active] Scope response cache keys to their source route (#218)
  • e92db45 [lts-active] Fix metadata propagation for deduplicated nested caches (#223)
  • 40c2ba9 [lts-active] Match Next data paths case-sensitively (#196)
  • 2d9f50a [lts-active] Fix MCP middleware DNS rebinding (#213)
  • bd9214f [lts-active] Fix draft mode leaks through cross-request 'use cache' dedupli...
  • 8db4a62 [lts-active][webpack] Ensure dynamicParams is respected in `opengraph-image...
  • e002ad6 [lts-active] fix(next/image): Pin DNS resolution when fetching external image...
  • 4c20699 v16.3.7
  • 2521aec [backport] turbo-tasks-backend: fix strongly consistent read hanging on a can...
  • Additional commits viewable in compare view

Updates nodemailer from 9.0.5 to 10.0.15

Release notes

Sourced from nodemailer's releases.

v10.0.15

10.0.15 (2026-10-05)

Bug Fixes

  • errors: inherit NodemailerError code from ErrnoException (e99db61), closes #1884
  • errors: keep NodemailerError compatible with @​types/node 26 ErrnoException (#1885) (b660328)

v10.0.14

10.0.14 (2026-10-03)

Bug Fixes

  • addressparser: keep a quoted display name that holds no "@" out of the address (3570d26)
  • addressparser: keep the group recursion depth out of the options object (a680254)
  • addressparser: stop a "[" from hiding the operators after it (5619784)
  • dkim: trim a header field name in linear time (c6f7a55)
  • mime-funcs: read and write header parameters per rfc2045 and rfc2231 (b8ccad7)
  • search only the new bytes for the end of the proxy CONNECT response (81efd7b)

v10.0.13

10.0.13 (2026-09-30)

Bug Fixes

  • read the advertised SASL methods without backtracking regexes (b5a896f)
  • strip comments inside an angle-addr before it becomes the address (a502247)

v10.0.12

10.0.12 (2026-09-28)

Bug Fixes

  • settle every send on a connection error, back off pool requeues, turn a bare CR into CRLF, bound fetch, honour requireTLS (63ccd66)

v10.0.11

10.0.11 (2026-09-27)

Bug Fixes

  • fetch: report a form body that can not be encoded through the returned stream (74d40bf)
  • keep the CommonJS entry point and the services subpath compatible with the pre-TypeScript build (52901ef)
  • qp: keep wrap() terminating for short line lengths and a trailing incomplete escape (8fa140b)
  • smtp-connection: fail a password login cleanly when the server offers only XOAUTH2 (90abf7d)
  • types: restore the layout of @​types/nodemailer in the bundled declarations (ac2e40f)

... (truncated)

Changelog

Sourced from nodemailer's changelog.

10.0.15 (2026-10-05)

Bug Fixes

  • errors: inherit NodemailerError code from ErrnoException (e99db61), closes #1884
  • errors: keep NodemailerError compatible with @​types/node 26 ErrnoException (#1885) (b660328)

10.0.14 (2026-10-03)

Bug Fixes

  • addressparser: keep a quoted display name that holds no "@" out of the address (3570d26)
  • addressparser: keep the group recursion depth out of the options object (a680254)
  • addressparser: stop a "[" from hiding the operators after it (5619784)
  • dkim: trim a header field name in linear time (c6f7a55)
  • mime-funcs: read and write header parameters per rfc2045 and rfc2231 (b8ccad7)
  • search only the new bytes for the end of the proxy CONNECT response (81efd7b)

10.0.13 (2026-09-30)

Bug Fixes

  • read the advertised SASL methods without backtracking regexes (b5a896f)
  • strip comments inside an angle-addr before it becomes the address (a502247)

10.0.12 (2026-09-28)

Bug Fixes

  • settle every send on a connection error, back off pool requeues, turn a bare CR into CRLF, bound fetch, honour requireTLS (63ccd66)

10.0.11 (2026-09-27)

Bug Fixes

  • fetch: report a form body that can not be encoded through the returned stream (74d40bf)
  • keep the CommonJS entry point and the services subpath compatible with the pre-TypeScript build (52901ef)
  • qp: keep wrap() terminating for short line lengths and a trailing incomplete escape (8fa140b)
  • smtp-connection: fail a password login cleanly when the server offers only XOAUTH2 (90abf7d)
  • types: restore the layout of @​types/nodemailer in the bundled declarations (ac2e40f)

10.0.10 (2026-09-14)

Bug Fixes

... (truncated)

Commits
  • c17efc0 chore(master): release 10.0.15 (#1886)
  • 8d423d0 chore(deps): update dependencies
  • e99db61 fix(errors): inherit NodemailerError code from ErrnoException
  • b660328 fix(errors): keep NodemailerError compatible with @​types/node 26 ErrnoExcepti...
  • aefd1da chore(master): release 10.0.14 (#1880)
  • 520c4ef chore(deps): update dependencies
  • a680254 fix(addressparser): keep the group recursion depth out of the options object
  • 3570d26 fix(addressparser): keep a quoted display name that holds no "@" out of the a...
  • b8ccad7 fix(mime-funcs): read and write header parameters per rfc2045 and rfc2231
  • c6f7a55 fix(dkim): trim a header field name in linear time
  • Additional commits viewable in compare view
Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates pg from 8.23.0 to 8.23.1

Changelog

Sourced from pg's changelog.

All major and minor releases are briefly explained below.

For richer information consult the commit log on github with referenced pull requests.

We do not include break-fix version release in this file.

Commits
  • 0980cef Publish
  • 2759b2c fix(pg): run a named statement with an empty text more than once (#3781)
  • 7feb7df fix(pg): expose detail and hint on errors from the native client (#3780)
  • 9683053 fix(pg): do not treat Sync as connection ending (#3772)
  • 4589038 fix: validate server certificate against host when connecting to an IP addres...
  • 9808955 cleanup: Fix typo in comment
  • 2b02f64 fix: avoid mutating query config (#3720)
  • 0cef6af Reject portal based queries in pipeline mode instead of misrouting rows (#3737)
  • 2991480 Deprecate serializing invalid Dates (#3731)
  • c940d7c Fail pipelined queries when the connection dies instead of hanging (#3736)
  • Additional commits viewable in compare view

Updates react from 19.2.8 to 19.3.0

Release notes

Sourced from react's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

New React DOM Features

  • browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
    • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

All Changes

React

... (truncated)

Changelog

Sourced from react's changelog.

19.3.0 (September 9, 2026)

New React Features

New React DOM Features

  • browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
    • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

All Changes

React

... (truncated)

Commits

Updates react-dom from 19.2.8 to 19.3.0

Release notes

Sourced from react-dom's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

Bumps the production group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [drizzle-orm](https://github.com/drizzle-team/drizzle-orm) | `0.45.2` | `0.45.3` |
| [next](https://github.com/vercel/next.js) | `16.3.1` | `16.3.8` |
| [nodemailer](https://github.com/nodemailer/nodemailer) | `9.0.5` | `10.0.15` |
| [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.23.0` | `8.23.1` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.8` | `19.3.0` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.8` | `19.3.0` |
| [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.6.5` |



Updates `drizzle-orm` from 0.45.2 to 0.45.3
- [Release notes](https://github.com/drizzle-team/drizzle-orm/releases)
- [Commits](drizzle-team/drizzle-orm@0.45.2...0.45.3)

Updates `next` from 16.3.1 to 16.3.8
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.3.1...v16.3.8)

Updates `nodemailer` from 9.0.5 to 10.0.15
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v9.0.5...v10.0.15)

Updates `pg` from 8.23.0 to 8.23.1
- [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md)
- [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.1/packages/pg)

Updates `react` from 19.2.8 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react)

Updates `react-dom` from 19.2.8 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react-dom)

Updates `zod` from 4.4.3 to 4.6.5
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.4.3...v4.6.5)

---
updated-dependencies:
- dependency-name: drizzle-orm
  dependency-version: 0.45.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: next
  dependency-version: 16.3.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: nodemailer
  dependency-version: 10.0.15
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production
- dependency-name: pg
  dependency-version: 8.23.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: react
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: react-dom
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: zod
  dependency-version: 4.6.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants