chore(deps): bump the npm-minor-patch group with 27 updates

[dependabot]

Bumps the npm-minor-patch group with 27 updates:

Package	From	To
concurrently	10.0.4	10.0.5
@prisma/adapter-pg	7.9.1	7.10.0
@prisma/client	7.9.1	7.10.0
express-rate-limit	8.6.2	8.7.0
uuid	14.0.1	14.0.2
zod	4.4.3	4.6.2
prisma	7.9.1	7.10.0
tsx	4.23.11	4.23.13
@playwright/test	1.62.1	1.63.0
lucide-react	1.30.0	1.45.0
react	19.2.8	19.3.0
@types/react	19.2.18	19.3.0
react-dom	19.2.8	19.3.0
@types/react-dom	19.2.4	19.3.0
react-router	8.3.0	8.3.1
@testing-library/jest-dom	7.0.0	7.0.1
@testing-library/react	16.3.2	16.3.3
@testing-library/user-event	14.6.3	14.6.7
@vitejs/plugin-react	6.0.5	6.1.1
eslint-plugin-react-refresh	0.5.3	0.5.6
postcss	8.5.26	8.5.28
stylelint	17.14.1	17.15.0
vite	8.2.1	8.3.0
eslint	10.8.0	10.10.0
globals	17.9.0	17.12.0
pg	8.22.0	8.23.0
typescript-eslint	8.66.0	8.70.0

Updates concurrently from 10.0.4 to 10.0.5

Release notes

Sourced from concurrently's releases.

v10.0.5

What's Changed

• fix: correctly output non-ASCII text on Windows by @​DanielC000 in open-cli-tools/concurrently#604
• fix: expand wildcards from package.json5 when package.json is missing by @​DSeaStar in open-cli-tools/concurrently#608

New Contributors

• @​DanielC000 made their first contribution in open-cli-tools/concurrently#604
• @​DSeaStar made their first contribution in open-cli-tools/concurrently#608

Full Changelog: open-cli-tools/concurrently@v10.0.4...v10.0.5

Commits

• 1b8cbeb 10.0.5
• 544dba0 docs: make linter happy
• 667b701 deps: update several dev deps
• f67c57c vscode: use installed TS version
• dbb5617 fix: expand wildcards from package.json5 when package.json is missing (#608)
• 9f90a1a fix: correctly output non-ASCII text on Windows (#604)
• 94415cc ci: fix publishing to latest/backport
• See full diff in compare view

Updates @prisma/adapter-pg from 7.9.1 to 7.10.0

Release notes

Sourced from @​prisma/adapter-pg's releases.

7.10.0

Prisma ORM 7.10.0

Prisma ORM 7.10.0 introduces a compatibility package for running Prisma 7 alongside newer Prisma versions, secures Prisma Studio's local server, and includes fixes across Prisma Client and the PostgreSQL, MariaDB, Neon, SQLite, and Prisma Postgres Serverless adapters.

Highlights

Run Prisma 7 alongside Prisma 8

This release introduces @prisma/prisma7, a compatibility package that lets you retain a matching Prisma 7 CLI and configuration while installing Prisma 8 in the same project.

Once 7.10.0 is released, a side-by-side installation can use:

npm install --save-dev prisma@8 @prisma/prisma7@7.10.0
npm install @prisma/client@7.10.0

Use prisma for the directly installed Prisma 8 CLI and prisma7 for Prisma 7:

npx prisma --version
npx prisma7 --version
npx prisma7 generate
npx prisma7 migrate dev
npx prisma7 db push

Prisma 7 now prefers version-specific configuration files, allowing its configuration to coexist with Prisma 8's prisma.config.* files:

// prisma7.config.ts
import { defineConfig } from '@prisma/prisma7/config'
export default defineConfig({
schema: 'prisma/schema.prisma',
migrations: {
path: 'prisma/migrations',
},
})

Without an explicit --config option, Prisma 7 searches for:

1. Root-level prisma7.config.* files.
2. .config/prisma7.* files.
3. Existing prisma.config.* files as a backwards-compatible fallback.

The supported extensions are .js, .ts, .mjs, .cjs, .mts, and .cts. An explicit config path always takes precedence:

... (truncated)

Commits

• 3fa65ac fix(p2002): correct modelName in nested create unique constraint errors #2959...
• a180209 fix(adapter-pg): map PostgreSQL deadlocks to P2034 (#29717)
• 800f1d1 fix(adapter-pg): preserve constraint name for unique violations (23505) (#29587)
• 7ef2104 fix(postgres): handle SQLSTATE 23001 for RESTRICT violations (#29554)
• See full diff in compare view

Updates @prisma/client from 7.9.1 to 7.10.0

Release notes

Sourced from @​prisma/client's releases.

7.10.0

Prisma ORM 7.10.0

Prisma ORM 7.10.0 introduces a compatibility package for running Prisma 7 alongside newer Prisma versions, secures Prisma Studio's local server, and includes fixes across Prisma Client and the PostgreSQL, MariaDB, Neon, SQLite, and Prisma Postgres Serverless adapters.

Highlights

Run Prisma 7 alongside Prisma 8

This release introduces @prisma/prisma7, a compatibility package that lets you retain a matching Prisma 7 CLI and configuration while installing Prisma 8 in the same project.

Once 7.10.0 is released, a side-by-side installation can use:

npm install --save-dev prisma@8 @prisma/prisma7@7.10.0
npm install @prisma/client@7.10.0

Use prisma for the directly installed Prisma 8 CLI and prisma7 for Prisma 7:

npx prisma --version
npx prisma7 --version
npx prisma7 generate
npx prisma7 migrate dev
npx prisma7 db push

Prisma 7 now prefers version-specific configuration files, allowing its configuration to coexist with Prisma 8's prisma.config.* files:

// prisma7.config.ts
import { defineConfig } from '@prisma/prisma7/config'
export default defineConfig({
schema: 'prisma/schema.prisma',
migrations: {
path: 'prisma/migrations',
},
})

Without an explicit --config option, Prisma 7 searches for:

1. Root-level prisma7.config.* files.
2. .config/prisma7.* files.
3. Existing prisma.config.* files as a backwards-compatible fallback.

The supported extensions are .js, .ts, .mjs, .cjs, .mts, and .cts. An explicit config path always takes precedence:

... (truncated)

Commits

• 05c1b88 Teach Prisma 7 to prefer versioned config files (#30020)
• cf2bc1f Rename prisma7 package to @​prisma/prisma7 (#30002)
• ce5a34c Complete downstream actionable Prisma 7 guidance propagation (#29994)
• 3f13ec6 Complete CLI-owned prisma7 distribution identity (#29969)
• 179ba0c feat(prisma7): add side-by-side CLI wrapper (#29949)
• 3fa65ac fix(p2002): correct modelName in nested create unique constraint errors #2959...
• 6b6d9e9 chore(deps): update engines to 7.10.0-4.0edf323efd1d98336f3f0a68684b56f689b90...
• b64e33c chore(deps): update engines to 7.10.0-3.9d90ce2c89d5c95a1148aef15e5561ab6c490...
• 2046f9b feat(client): expose ModelName to compute function in Result extensions (#29782)
• f2b3abd chore(deps): update engines to 7.10.0-1.6d040c802892de6d56c7e0061b7a10b3e6a0c...
• Additional commits viewable in compare view

Updates express-rate-limit from 8.6.2 to 8.7.0

Release notes

Sourced from express-rate-limit's releases.

v8.7.0

You can view the changelog here.

Commits

• 48db09e 8.7.0
• dce5871 v8.7.0 changelog
• 2f08044 Add inspect.software health badge (#673)
• a29757c feat: add retryAfter option (#661)
• 146e88b chore: rename license
• 5cfb8e8 ci: drop top-level id-token: write from the workflow token (#676)
• 062bbdd fix: re-wrap license.md so GitHub recognizes it as MIT (#675)
• 514772d chore(deps-dev): bump mintlify in the development-dependencies group (#674)
• 4f06c8a chore(deps-dev): bump the development-dependencies group with 2 updates (#671)
• 83356a5 chore(deps): bump ip-address from 10.4.0 to 10.5.0 (#672)
• Additional commits viewable in compare view

Updates uuid from 14.0.1 to 14.0.2

Release notes

Sourced from uuid's releases.

v14.0.2

14.0.2 (2026-08-18)

Bug Fixes

• v1: carry nsecs overflow into the timestamp's high bits (#972) (6adcc1d)
• v1: set the multicast bit on v1Bytes's own randomly-generated node (#973) (b1da338)
• v7: align default seq formula in v7Bytes with updateV7State (#965) (a67db57)

Changelog

Sourced from uuid's changelog.

14.0.2 (2026-08-18)

Bug Fixes

• v1: carry nsecs overflow into the timestamp's high bits (#972) (6adcc1d)
• v1: set the multicast bit on v1Bytes's own randomly-generated node (#973) (b1da338)
• v7: align default seq formula in v7Bytes with updateV7State (#965) (a67db57)

Commits

• fd59f02 chore(main): release 14.0.2 (#967)
• f3c564e docs: point the Node support permalink at the CI version matrix (#974)
• b1da338 fix(v1): set the multicast bit on v1Bytes's own randomly-generated node (#973)
• 6adcc1d fix(v1): carry nsecs overflow into the timestamp's high bits (#972)
• ea83515 docs: cleanup API summary (#968)
• ac36860 chore: pin publint version in CI (#966)
• a67db57 fix(v7): align default seq formula in v7Bytes with updateV7State (#965)
• See full diff in compare view

Updates zod from 4.4.3 to 4.6.2

Release notes

Sourced from zod's releases.

v4.6.2

A patch on top of 4.6.1.

• 9446b5cc fix: preserve undefined prefault outputs and object keys (#6587) — closes #6585
• 0c483c58 docs: the Zod 4.6 announcement post (#6546)
• a00c3f34 docs: use Trigger.dev's brand-kit lockups for the platinum card

v4.6.1

A patch on top of 4.6.0.

• b12aa523 fix: preserve unique tags with defaulted discriminators (#6582) — closes #6577
• dd9c36fa fix(v4): defer recursive object index inference (#6580)
• 3b154992 feat(lang): add Tajik (tg) locale (#6581) by @​ismoil77
• 2efa8b80 ci: give the npm wait a real budget and drop the back-publish path (#6583)

v4.6.0

Zod 4.6 is now available.

npm install zod@latest

At a glance:

• .validate() — checks input validity without building a result (up to 35x faster than .safeParse().success on a compiled schema)
• z.instanceof().properties() — validates properties of an instance
• fromJSONSchema() — enforces six validation keywords it used to ignore
• z.iban() — electronic-format IBAN plus mod-97 checksum
• z.withParser() — installs a parser generated elsewhere, for environments without new Function
• Faster CommonJS — drops the getter on every export (~3x faster z.validate() under require)
• Memory retention in recursive schemas — releases the parsed input, fixing a 4.5 out-of-memory regression
• @zod/mini — Zod Mini as a standalone package, versioned in lockstep with zod since 4.5

.validate()

Standalone boolean validation, in Zod, Zod Mini, and Zod Core. It answers "is this input valid?" without constructing a ZodError, which makes rejection cheap. The return type is a guard on the schema's input type.

z.validate(z.string(), "hi"); // true
z.validate(z.string(), 42);   // false

It is a method on Zod Classic schemas too. (#6547)

const Player = z.object({
  username: z.string(),
  xp: z.number(),
});
</tr></table>

... (truncated)

Commits

• e359f73 4.6.2
• 9446b5c fix: preserve undefined prefault outputs and object keys (#6587)
• 0c483c5 docs: Zod 4.6 announcement post (#6546)
• a00c3f3 docs: use Trigger.dev's brand-kit lockups for the platinum card
• 62311eb 4.6.1
• 2efa8b8 ci: give the npm wait a real budget and drop the back-publish path (#6583)
• b12aa52 fix: preserve unique tags with defaulted discriminators (#6582)
• dd9c36f fix(v4): defer recursive object index inference (#6580)
• 574d480 fix(locales): clarify Tajik discriminator value message
• c532d76 test(locales): cover Tajik error branches
• Additional commits viewable in compare view

Updates prisma from 7.9.1 to 7.10.0

Commits

• See full diff in compare view

Attestation changes

This version has no provenance attestation, while the previous version (7.9.1) was attested. Review the package versions before updating.

Updates tsx from 4.23.11 to 4.23.13

Release notes

Sourced from tsx's releases.

v4.23.13

4.23.13 (2026-08-30)

Bug Fixes

• cache: bound shared transform cache memory (#835) (28e1f12)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

• shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

---

This release is also available on:

• npm package (@​latest dist-tag)

Commits

• 28e1f12 fix(cache): bound shared transform cache memory (#835)
• ed9d330 fix: shim import.meta when tokens are split by comments or newlines (#829)
• 651f5be test: cover CommonJS TypeScript import.meta paths
• See full diff in compare view

Updates @playwright/test from 1.62.1 to 1.63.0

Release notes

Sourced from @​playwright/test's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits

• 1b025d7 chore: mark v1.63.0 (#42569)
• 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
• 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
• e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
• 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
• 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
• 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
• 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
• 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
• bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
• Additional commits viewable in compare view

Updates lucide-react from 1.30.0 to 1.45.0

Release notes

Sourced from lucide-react's releases.

Version 1.45.0

What's Changed

• feat(icons): added calendar-chevrons-right icon by @​AlexandrePhilibert in lucide-icons/lucide#3565
• feat(icons): added building-complex-plus icon by @​tylerkade in lucide-icons/lucide#4758
• feat(icons): add hourglass-cog icon by @​lazerg in lucide-icons/lucide#4635
• feat(icons): added mouth & mouth-off by @​karsa-mistmere in lucide-icons/lucide#4787
• feat(icons): added iv-bag icon by @​karsa-mistmere in lucide-icons/lucide#4821
• fix(icons): changed lectern icon by @​UsamaKhan in lucide-icons/lucide#2925
• feat(icons): add layout-arrow-right and layout-arrow-down by @​samuelalake in lucide-icons/lucide#4541
• feat(icons): added park icon by @​skajosborn in lucide-icons/lucide#3177
• fix(icons): changed album, book-marked, folder-bookmark icons by @​karsa-mistmere in lucide-icons/lucide#3043
• fix(icons): correct misspelled tags by @​decknamec in lucide-icons/lucide#4836
• feat(icons): added houses icon by @​danielbayley in lucide-icons/lucide#3241
• feat(icons): added notebook-dot icon by @​elenakovelskikh in lucide-icons/lucide#3228
• feat(icons): add messages-circle icon by @​Mirazstudio-offical in lucide-icons/lucide#4754
• feat(icons): added plant-pot icon by @​vqh2602 in lucide-icons/lucide#3122
• fix(icons): changed cookie icon by @​karsa-mistmere in lucide-icons/lucide#4815
• fix(icons): remove duplicate use-cases prop from cookie.json by @​karsa-mistmere in lucide-icons/lucide#4838
• fix(site): fix home card icons by @​karsa-mistmere in lucide-icons/lucide#4839
• feat(docs): added "How to use Lucide icons" section to resources by @​karsa-mistmere in lucide-icons/lucide#4829
• fix(packages/vue): fix generated icon declaration types for @​lucide/vue by @​karsa-mistmere in lucide-icons/lucide#4841
• chore(deps-dev): bump vitest from 4.1.10 to 4.1.11 by @​dependabot[bot] in lucide-icons/lucide#4845
• chore(deps-dev): bump vitest from 4.1.10 to 4.1.11 in /integrations/lucide-react/vite by @​dependabot[bot] in lucide-icons/lucide#4844
• ci(ci.yml): Add dispatch post release by @​ericfennis in lucide-icons/lucide#4847
• feat(icons): added globe-code icon by @​AleksejDix in lucide-icons/lucide#3722

New Contributors

• @​tylerkade made their first contribution in lucide-icons/lucide#4758
• @​alx-xo made their first contribution in lucide-icons/lucide#4115
• @​skajosborn made their first contribution in lucide-icons/lucide#3177
• @​elenakovelskikh made their first contribution in lucide-icons/lucide#3228
• @​Mirazstudio-offical made their first contribution in lucide-icons/lucide#4754
• @​AleksejDix made their first contribution in lucide-icons/lucide#3722

Full Changelog: lucide-icons/lucide@1.44.0...1.45.0

Version 1.44.0

What's Changed

• feat(packages/icons): fixed @​lucide/icons rollup config by @​karsa-mistmere in lucide-icons/lucide#4824
• fix(icons): changed door-open by @​karsa-mistmere in lucide-icons/lucide#4826
• fix(docs): replace missing LucideIcon icon names in guides by @​karsa-mistmere in lucide-icons/lucide#4827
• feat(docs): fixed fuse js search by @​karsa-mistmere in lucide-icons/lucide#4825
• fix(icons): changed satellite-dish icon by @​karsa-mistmere in lucide-icons/lucide#4813
• fix(icons): arcified flip icons & renamed them by @​karsa-mistmere in lucide-icons/lucide#4833
• fix(icons): improve legibility of credit card icons by @​karsa-mistmere in lucide-icons/lucide#4831
• feat(lab): add check-x icon by @​ishanbagra18 in lucide-icons/lucide#4737
• fix(icons): correct compromised tags in shield icons by @​decknamec in lucide-icons/lucide#4835
• feat(icons): added toothbrush icon by @​karsa-mistmere in lucide-icons/lucide#4755

New Contributors

... (truncated)

Commits

• 94e4cb9 chore(dependencies): Update dependencies (#4806)
• 99d25bd feat(packages): extract icon build logic into @lucide/shared (#4409)
• 75b5516 chore(dev): upgrade ESLint to latest compatible stack (v10) (#4378)
• See full diff in compare view

Updates react from 19.2.8 to 19.3.0

Release notes

Sourced from react's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)
• Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@​jackpope, @​sebmarkbage, @​eps1lon, @​Dhakshin2007, @​chirokas, @​teamleaderleo, @​fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

• browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
  • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

• Enable Trusted Types API integration (@​rickhanlonii #35816)
• Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@​acdlite #37290)
• Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@​hoxyq, @​eps1lon: #37104, #37203, #37491)

All Changes

React

• Fast Refresh Fixes
  • Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@​sophiebits #36965)
  • Fix Fast Refresh so edits to a memo() comparison function take effect (@​sophiebits #36964)
  • Fix Fast Refresh crash when an edit changes the kind of a component's type (@​sophiebits #36963)
  • Unify hot reload type resolution for Fast Refresh (@​sophiebits #36962)
  • Fix Fast Refresh to remount correctly when an edit changes the component kind (@​sophiebits #36950)
  • Double invoke effects in StrictMode after Fast Refresh (@​eps1lon #35962)
• Performance Track Fixes
  • Prevent crash when accessing $$typeof in Performance Tracks (@​eps1lon #35679)
  • Handle non-string function names in Performance Tracks (@​eps1lon #35659)
  • Use minus (-) instead of en dash for removed props in Performance Tracks (@​eps1lon #35649)
  • Handle arrays with bigints in deep objects in Performance Tracks (@​eps1lon #35648)
  • Don't enumerate typed array props in Performance Tracks in DEV (@​UditDewan #36913)
  • Bail out of diffing wide objects and arrays in Performance Tracks (@​eps1lon #34742)
  • Clear potentially large performance measures in DEV (@​hoxyq #34803)
  • Fix missing else branch for renders with no props change in Performance Tracks (@​hoxyq #34837)
• Activity Fixes
  • Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@​sophiebits #36947)
  • Hide portal contents when an Activity is hidden (@​acdlite #35091)
  • Prevent metadata hoisting in hidden <Activity> trees (@​ronnakamoto #34983)
  • Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@​acdlite #35074)
  • Don't unhide a node if a direct parent Offscreen is still hidden (@​sebmarkbage #34821)
  • Don't show internal <Offscreen> component in error messages (@​rickhanlonii #35763)
• Warn in DEV when a component appears to have been unblocked by a conditional use() (@​hoxyq, @​eps1lon: #37104, #37203, #37491)
• Render transitions independently instead of entang...

  Description has been truncated

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!