chore(deps): Update npm dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@supabase/supabase-js (source)	^2.110.8 → ^2.112.2
concurrently	^10.0.3 → ^10.0.4
framer-motion	^12.42.2 → ^12.43.0
lucide-react (source)	^1.26.0 → ^1.29.0
mapbox-gl	^3.27.0 → ^3.28.0
motion	^12.42.2 → ^12.43.0
tsx (source)	^4.23.1 → ^4.23.9
turbo (source)	^2.10.6 → ^2.10.8
vite (source)	^8.1.5 → ^8.2.1
wrangler (source)	^4.114.0 → ^4.119.0

---

Release Notes

supabase/supabase-js (@​supabase/supabase-js)

v2.112.2

Compare Source

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

v2.112.1

Compare Source

🩹 Fixes

• realtime: ensure setAuth doesn't disable token refresh (#​2592)

❤️ Thank You

• Eduardo Gurgel

v2.112.0

Compare Source

🚀 Features

• supabase: move OpenTelemetry tracing to opt-in /tracing subpath (#​2583)

🩹 Fixes

• supabase: forward db retry option (#​2571)

❤️ Thank You

• Katerina Skroumpelou @​mandarini
• Vaibhav @​7ttp

v2.111.0

Compare Source

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

v2.110.9

Compare Source

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

open-cli-tools/concurrently (concurrently)

v10.0.4

Compare Source

What's Changed

• deps: upgrade shell-quote to 1.9.0 by @​Mayvis in #​599
• fix: avoid kill timeout exit delays by @​rajanpanth in #​601

New Contributors

• @​Mayvis made their first contribution in #​599
• @​rajanpanth made their first contribution in #​601

Full Changelog: open-cli-tools/concurrently@v10.0.3...v10.0.4

motiondivision/motion (framer-motion)

v12.43.0

Compare Source

Added

• Hardware acceleration for backgroundColor in supported browsers.
• Hardware acceleration for SVG elements.

Fixed

• AnimatePresence: Exiting children no longer interleave with entering children, which could reorder and remount children present in both renders.
• motion: Throw error when passing a custom motion component an incorrect ref type.

lucide-icons/lucide (lucide-react)

v1.29.0: Version 1.29.0

Compare Source

What's Changed

• fix(@​lucide/lab): Fix lab build by @​ericfennis in #​4618
• feat(copilot): remove incorrect spaces clause from copilot instructions by @​karsa-mistmere in #​4623
• feat(docs): remove Super and Noodle from showcase by @​karsa-mistmere in #​4626
• chore(deps-dev): bump @​angular/platform-server from 21.2.18 to 21.2.19 by @​dependabot[bot] in #​4629
• ci(security): improve security with adding permissions by @​ericfennis in #​4619
• feat(dependabot): added dependabot config, grouping PRs for each package by @​karsa-mistmere in #​4633
• fix(ci): limit certain github workflows to main repository by @​karsa-mistmere in #​4628
• fix(dependabot): Revert dependabot groups by @​ericfennis in #​4665
• chore(dependabot): Group by dependency group by @​ericfennis in #​4666
• chore(deps-dev): bump the svelte-deps group with 3 updates by @​dependabot[bot] in #​4671
• chore(deps): bump the vue-deps group with 3 updates by @​dependabot[bot] in #​4670
• chore(deps): bump the github-actions group with 13 updates by @​dependabot[bot] in #​4668
• feat(icons): added layer reordering icons by @​karsa-mistmere in #​4617

Full Changelog: lucide-icons/lucide@1.28.0...1.29.0

v1.28.0

Compare Source

v1.27.0: Version 1.27.0

Compare Source

What's Changed

• feat(icons): removed brand names from tags & revised brand stopwords by @​karsa-mistmere in #​4575
• fix(docs): Fix site build by @​ericfennis in #​4582
• fix(icons): optimised square-scissors icons by @​karsa-mistmere in #​4581
• fix(packages/angular): add more supported attributes for SVG nodes by @​karsa-mistmere in #​4570
• feat(icons): added pending-cw icon by @​NielsLazaroms in #​4439
• fix(icons): changed zap and zap-off icons by @​kapowaz in #​4536
• feat(icons): add square-off icon by @​october-learns in #​4496
• chore(deps-dev): bump astro from 6.4.8 to 7.1.0 by @​dependabot[bot] in #​4572
• fix(icons): changed toolbox icon by @​karsa-mistmere in #​4571
• feat(icons): add scan-square by @​samuelalake in #​4550
• feat(icons): added user-shield icon by @​MArtytraM99 in #​3099
• feat(icons): added mosque icon by @​iskepr in #​4494
• fix(request-review): Remove pull_request_target by @​ericfennis in #​4593
• fix(icons): changed feather icon by @​karsa-mistmere in #​4584
• feat(ci): added custom prettier plugin for icon SVG files by @​karsa-mistmere in #​4576
• ci(ci.yml): Remove concurrency in ci.yml by @​ericfennis in #​4595
• fix(icons): changed barrel icon by @​karsa-mistmere in #​4592
• feat(lab): Migrate lab to main repo. by @​ericfennis in #​4521
• feat(icons): added police-cap icon to lab by @​uibalint in #​3019
• fix(icons): changed trophy icon by @​karsa-mistmere in #​4591
• feat(analytics): add utm source and medium by @​jguddas in #​4596
• feat(docs): Add lab requirement in pull_request_template.md by @​danielbayley in #​3651
• feat(icons): added pilot icon by @​jguddas in #​2409
• feat(icons): replaces podcast icon with new mic-* icons by @​karsa-mistmere in #​4583
• feat(icons): add layout-freeform by @​samuelalake in #​4543

New Contributors

• @​NielsLazaroms made their first contribution in #​4439
• @​kapowaz made their first contribution in #​4536
• @​october-learns made their first contribution in #​4496
• @​samuelalake made their first contribution in #​4550
• @​iskepr made their first contribution in #​4494

Full Changelog: lucide-icons/lucide@1.26.0...1.27.0

mapbox/mapbox-gl-js (mapbox-gl)

v3.28.0

Compare Source

Breaking changes ⚠️

• Disable text-variable-anchor when appearances are present.

Features and improvements ✨

• Introduce experimental map.getVerticalFieldOfView(), map.setVerticalFieldOfView(), and read-only map.getHorizontalFieldOfView() and an animatable fov camera option.
• Expose line-border-width and line-border-color as public paint properties.
• Introduce experimental line-border-gradient property for rendering gradient borders on lines.
• Add support for Meshopt v1 compressed models.
• Support string color values for the model-color in a model source.
• Add map.resetFeatureStates() to clear all feature states for a featureset or layer.
• Expose map.getSchema()/map.setSchema() for managing the imported style's schema.
• Extract development and debug code from the ESM bundle into a separate module.
• Extract more model code from the ESM core bundle.
• Extract raster-array layer as a separate ESM module.
• Reduce the bundle size by restructuring style, program, symbol, and expression code.
• Remove experimental flag from layer appearances.
• Improve symbol layer performance.
• Reduce redundant repaints and checks during initial load.

Bug fixes 🐞

• Fix double rotation of the FF5C character in vertical text rendering.
• Preserve live gesture when camera setter is called from inside a drag/move handler.
• Stop overwriting the pointerEvents of markers set by the user.
• Fix models with vertex alpha 0 appearing black.
• Fix incorrect rendering of fill extrusions with fill-extrusion-edge-radius at low zoom levels in some cases.

privatenumber/tsx (tsx)

v4.23.9

Compare Source

Bug Fixes

• map Node test locations (2f55884)
• support data URLs in tsImport (b94f46f)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.8

Compare Source

Bug Fixes

• preserve package subpath resolution (be1315e)
• preserve typeless ESM dependency exports (70dfc5e)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.7

Compare Source

Bug Fixes

• prevent tsImport cache collisions (4e5a138)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.6

Compare Source

v4.23.5

Compare Source

v4.23.4

Compare Source

Bug Fixes

• cli: allow async process.once() signal handlers to finish (#​827) (2afc7bb)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.3

Compare Source

Bug Fixes

• preserve listenerCount overload semantics (#​823) (b6574d4)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.2

Compare Source

vercel/turborepo (turbo)

v2.10.8: Turborepo v2.10.8

Compare Source

What's Changed

Changelog

• fix: Scroll TUI task list with mouse wheel by @​anthonyshew in #​13479
• fix: Make releases resumable by @​anthonyshew in #​13486
• refactor: Expose knowledge-backed package scope views by @​anthonyshew in #​13456
• chore: Release Turborepo 2.10.7 by @​anthonyshew in #​13489
• refactor: Use package knowledge for configuration scopes by @​anthonyshew in #​13457
• refactor: Use package knowledge for run scope enumeration by @​anthonyshew in #​13458
• release(turborepo): 2.10.8-canary.1 by @​github-actions[bot] in #​13490
• refactor: Use package knowledge in repository views by @​anthonyshew in #​13459
• refactor: Use package knowledge in package integrations by @​anthonyshew in #​13460
• ci: Parallelize environment setup steps by @​anthonyshew in #​13491
• release(turborepo): 2.10.8-canary.2 by @​github-actions[bot] in #​13492
• refactor: Use package knowledge for task hashing paths by @​anthonyshew in #​13461
• refactor: Use package knowledge for run-cache paths by @​anthonyshew in #​13462
• refactor: Bind toolchain callbacks to package knowledge by @​anthonyshew in #​13463
• refactor: Use package knowledge for microfrontend commands by @​anthonyshew in #​13464
• refactor: Use package knowledge for run summaries by @​anthonyshew in #​13465
• refactor: Use package knowledge for watcher paths by @​anthonyshew in #​13466
• ci: Enable remote cache for types codegen by @​anthonyshew in #​13495
• docs: Fix llms.txt links to page markdown routes by @​molebox in #​13497
• refactor: Use package knowledge for prune paths by @​anthonyshew in #​13467
• refactor: Use package knowledge in the LSP by @​anthonyshew in #​13468
• refactor: Use consistent repository construction by @​anthonyshew in #​13469
• refactor: Delete legacy package and scope authority by @​anthonyshew in #​13470
• perf: Cache telemetry salt instead of re-reading config on every hash by @​charpeni in #​13498
• feat: Support Android (Termux) by @​gtbuchanan in #​12735
• ci: Restore Cargo targets on all test platforms by @​anthonyshew in #​13505
• fix: Resolve gitdir for linked worktrees in repo index by @​charpeni in #​13503
• test: Characterize relationship projections by @​anthonyshew in #​13499
• refactor: Produce native relationship observations by @​anthonyshew in #​13500
• feat: Resolve GitHub Actions remote base refs behind future flag by @​louis-bompart in #​10732
• refactor: Add core relationship projections by @​anthonyshew in #​13502
• refactor: Define external resolution contracts by @​anthonyshew in #​13507
• refactor: Move repository tasks into Turbo configuration by @​anthonyshew in #​13504
• refactor: Build JavaScript external resolution generations by @​anthonyshew in #​13508
• refactor: Contribute Cargo external resolutions by @​anthonyshew in #​13509
• refactor: Migrate external declaration consumers by @​anthonyshew in #​13511
• ci: Auto-merge release PRs by @​anthonyshew in #​13510
• chore: Release Turborepo 2.10.8-canary.3 by @​anthonyshew in #​13512
• fix: Use tokenless release review gate by @​anthonyshew in #​13513
• refactor: Use resolution fingerprints for task hashes by @​anthonyshew in #​13514
• fix: Support fork PRs in review gate by @​anthonyshew in #​13516
• refactor: Migrate lockfile affectedness by @​anthonyshew in #​13519
• refactor: Migrate external resolution summaries by @​anthonyshew in #​13520
• refactor: Migrate external package queries to resolution knowledge by @​anthonyshew in #​13523
• fix: Serialize macOS Homebrew setup by @​anthonyshew in #​13549
• refactor: Migrate prune lockfile keys to resolution identities by @​anthonyshew in #​13524
• refactor: Migrate global hash inputs to resolution knowledge by @​anthonyshew in #​13525
• refactor: Delete legacy external-resolution PackageInfo state by @​anthonyshew in #​13526
• chore: Release Turborepo 2.10.8-canary.4 by @​github-actions[bot] in #​13557
• refactor: Remove external declaration compatibility paths by @​anthonyshew in #​13527
• refactor: Produce immutable native task and command knowledge by @​anthonyshew in #​13528
• refactor: Migrate native task registration and suggestions by @​anthonyshew in #​13529
• refactor: Migrate turbo-json native task synthesis by @​anthonyshew in #​13530
• refactor: Migrate persistent and recursive task validation by @​anthonyshew in #​13531
• refactor: Migrate native task definition precedence by @​anthonyshew in #​13532
• refactor: Migrate engine native command planning by @​anthonyshew in #​13533
• refactor: Migrate executor native command resolution by @​anthonyshew in #​13534
• refactor: Migrate native task query, devtools, and LSP views by @​anthonyshew in #​13535
• refactor: Migrate command summaries and delete legacy task paths by @​anthonyshew in #​13536
• refactor: Produce immutable task-contract knowledge by @​anthonyshew in #​13537
• refactor: Migrate engine task-contract composition by @​anthonyshew in #​13538
• refactor: Migrate hashing engines to task contracts by @​anthonyshew in #​13539
• refactor: Exclude JavaScript from toolchain task-I/O dispatch by @​anthonyshew in #​13540
• refactor: Migrate change classification to immutable knowledge by @​anthonyshew in #​13543
• refactor: Separate prune rendering with golden coverage by @​anthonyshew in #​13546
• refactor: Delete JS format interpretation from prune orchestration by @​anthonyshew in #​13554
• refactor: Audit remaining JS knowledge consumer reads by @​anthonyshew in #​13556
• refactor: Migrate MFE dependency detection off PackageInfo by @​anthonyshew in #​13558
• refactor: Remove prune PackageInfo dependencies by @​anthonyshew in #​13562
• refactor: Remove residual runtime PackageInfo gates by @​anthonyshew in #​13564
• refactor: Migrate boundary diagnostics off PackageInfo by @​anthonyshew in #​13571
• docs: Audit Cargo package knowledge by @​anthonyshew in #​13572
• refactor: Complete Cargo relationship and resolution knowledge by @​anthonyshew in #​13576
• refactor: Port Cargo task and contract knowledge by @​anthonyshew in #​13581
• refactor: Port Cargo watch and prune knowledge by @​anthonyshew in #​13582
• refactor: Remove runtime toolchain dispatch by @​anthonyshew in #​13584
• ci: Restore Cargo target for lockfile tests by @​anthonyshew in #​13588
• refactor: Replace toolchains with repository contributors by @​anthonyshew in #​13585
• refactor: Remove Cargo contributor plumbing by @​anthonyshew in #​13586
• refactor: Remove ToolchainId runtime dispatch by @​anthonyshew in #​13587
• refactor: Route task behavior through contract domains by @​anthonyshew in #​13589
• refactor: Route package consumers by manifest by @​anthonyshew in #​13591
• refactor: Route MFE eligibility by manifest by @​anthonyshew in #​13592
• refactor: Project manifest-derived repository facts by @​anthonyshew in #​13593
• refactor: Route residual task behavior by capability by @​anthonyshew in #​13595
• refactor: Route resolution through explicit domains by @​anthonyshew in #​13596
• refactor: Route N-API package listing by manifest by @​anthonyshew in #​13597
• docs: Vercel Remote Cache authentication with OIDC policies by @​markandrus in #​13140
• refactor: Own resolution fingerprints in repository by @​anthonyshew in #​13598
• refactor: Fail closed on invalid relationships by @​anthonyshew in #​13599
• perf: Reuse Cargo metadata discovery snapshot by @​anthonyshew in #​13600
• refactor: Resolve MFE package ownership from graph by @​anthonyshew in #​13601
• refactor: Remove retained package payloads by @​anthonyshew in #​13603
• feat: Add native Cargo format task by @​anthonyshew in #​13606
• refactor: Compose repository graphs for optional toolchains by @​anthonyshew in #​13608
• ci: Invalidate Cap'n Proto caches by @​anthonyshew in #​13616
• feat: Discover uv workspaces by @​anthonyshew in #​13609
• feat: Run native uv tasks by @​anthonyshew in #​13610
• feat: Hash uv lockfile closures by @​anthonyshew in #​13611
• fix: Make Windows Cap'n Proto cache relocatable by @​anthonyshew in #​13621
• feat: Watch uv workspace changes by @​anthonyshew in #​13612
• feat: Prune uv workspaces by @​anthonyshew in #​13613
• fix: Fall back to polling on macOS by @​anthonyshew in #​13622
• test: Add uv workspace integration coverage by @​anthonyshew in #​13602

New Contributors

• @​gtbuchanan made their first contribution in #​12735

Full Changelog: vercel/turborepo@v2.10.7...v2.10.8

v2.10.7: Turborepo v2.10.7

Compare Source

What's Changed

Changelog

• release(turborepo): 2.10.6 by @​github-actions[bot] in #​13431
• chore: Refine bug report template help section by @​anthonyshew in #​13433
• fix: Verify version after attempting codemod upgrade by @​anthonyshew in #​13446
• test: Characterize JavaScript package discovery by @​anthonyshew in #​13440
• refactor: Separate package graph node assembly by @​anthonyshew in #​13441
• fix: Upgrade @​vercel/connect by @​anthonyshew in #​13450
• refactor: Add authoritative package knowledge by @​anthonyshew in #​13442
• feat: Select runnable task entrypoints by @​anthonyshew in #​13452
• refactor: Add workspace root contribution contract by @​anthonyshew in #​13447
• refactor: Use package knowledge for scope selection by @​anthonyshew in #​13443
• fix: Prevent mobile homepage overflow by @​anthonyshew in #​13453
• docs: Document service readiness probes by @​anthonyshew in #​13472
• fix: Preserve pnpm root dependencies during prune by @​anthonyshew in #​13476
• fix: Preserve pnpm aliased dependencies during prune by @​anthonyshew in #​13477
• release(turborepo): 2.10.7-canary.1 by @​github-actions[bot] in #​13478
• test: Add Terminal UI sanity tests by @​anthonyshew in #​13475
• chore: Upgrade Next.js by @​anthonyshew in #​13482
• chore: Upgrade brace-expansion by @​anthonyshew in #​13483
• fix: Support multiple macOS file watch roots by @​anthonyshew in #​13484

Full Changelog: vercel/turborepo@v2.10.6...v2.10.7

vitejs/vite (vite)

v8.2.1

Bug Fixes

• build: make client chunkImportMap work with sharedPlugins: true (#​23184) (15f0307)
• bundled-dev: inject client script tag before chunk scripts (#​23161) (eac0cc8)
• css: don't re-run lightningcss visitor during minify (fix #​23146) (#​23147) (de041a7)
• deps: update all non-major dependencies (#​23136) (14454fd)
• deps: update rolldown-related dependencies (#​23070) (7ac6f7f)
• don't mutate the user config when resolving the lib entry from the top-level input (#​23135) (b4bf596)
• handle shebang ending with uncommon line terminators (#​23038) (17f7b2f)
• server: use a random port when port is 0 (#​23158) (fddf4ea)

Performance Improvements

• css: look up pure CSS chunks through a Set (#​23114) (1331b0b)

Documentation

• build: fix incomplete @default for build.minify (#​23177) (ef02435)

Miscellaneous Chores

• deps: update dependency rolldown-plugin-dts to ^0.28.0 (#​23137) (4adc1e7)
• deps: update dependency strip-literal to v4 (#​23140) (9db65ce)

Code Refactoring

• bundled-dev: avoid injecting server values in the bundle (#​22967) (23b8a08)
• bundled-dev: remove rolldown lazy stub module workaround (#​23129) (e72036e)

Tests

• bundled-dev: enable sourcemap playgrounds (#​23080) (c2155fe)
• reduce logs (#​23138) (7673c02)

v8.2.0

Compare Source

Features

• add input to server.fs.allow (#​23035) (95a3cda)
• bundled-dev: reload once after rebuild instead of via the fallback page (#​23106) (b24381d)
• bundled-dev: support worker file update accepted by HMR (#​23068) (0d04351)
• config: include column in config incompatibility location (#​23064) (8a24572)
• dev: resolve interface name for explicit host in network URLs (#​22965) (3ac77d9)

Bug Fixes

• bundledDev: print build errors to the terminal when an HMR update fails (#​23024) (41c4658)
• deps: update all non-major dependencies (#​23069) (4c07b74)
• hmr: preserve environment snapshot during server restart (#​22992) (b1186c3)
• importAnalysis: interop imports injected into optimized dep files by plugins (#​23029) (8c2a87d)
• module-runner: keep stack trace interception working when Object.prototype is frozen (#​23073) (599c5b0)
• server: strip base in indexHtml module graph lookup (#​22932) (fa005d1)
• support resolving top-level input option with plugins (#​23101) (41df81a)

Documentation

• config: correct cacheDir default fallback description (#​23060) (aafa103)

Tests

• config CJS module vars in ESM case (#​23010) (d8cd388)

cloudflare/workers-sdk (wrangler)

v4.119.0

Compare Source

Minor Changes

• #​14952 20470fa Thanks @​nelsonjsduarte! - Add --parse-type flag to wrangler ai-search create

  wrangler ai-search create now accepts --parse-type to control how a website data source discovers URLs. sitemap (the default) reads XML sitemaps; discover follows links recursively.

  Previously the parse type could only be chosen through the interactive wizard, which was skipped whenever --source was supplied — so it was impossible to create a discover instance from a script.

  wrangler ai-search create my-instance \
    --type web-crawler \
    --source https://example.com \
    --parse-type discover

  The interactive wizard now offers Discover alongside Sitemap. --parse-type is only valid with --type web-crawler; passing it with --type builtin or --type r2 is rejected, since the API stores the value for those source types but never reads it. When the flag is omitted in non-interactive mode the field is left unset and the API default (sitemap) applies.

• #​14941 [

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.