fix(deps): bump the npm-major group across 1 directory with 16 updates

[dependabot]

Bumps the npm-major group with 16 updates in the / directory:

Package	From	To
verdaccio	6.9.3	6.10.0
@supabase/supabase-js	2.112.3	2.112.4
jose	6.2.9	6.2.10
@anthropic-ai/sdk	0.117.1	0.120.0
posthog-node	5.49.1	5.51.1
fumadocs-core	16.14.4	16.15.1
fumadocs-mdx	15.2.3	15.3.1
fumadocs-ui	16.14.4	16.15.1
next	16.3.1	16.3.2
@types/node	26.2.0	26.3.0
@types/react-dom	19.2.4	19.2.5
@vitest/coverage-istanbul	4.1.10	4.1.11
oxfmt	0.63.0	0.65.0
oxlint	1.78.0	1.80.0
tldts	6.1.86	7.4.11
vitest	4.1.10	4.1.11

Updates verdaccio from 6.9.3 to 6.10.0

Release notes

Sourced from verdaccio's releases.

v6.10.0

Minor Changes

• 51c2733: Expose the optional legacy authentication cache for Verdaccio 6.x through server.legacyAuthCache.

  This feature is intended for performance-sensitive installations that still use legacy bearer tokens. When enabled, Verdaccio caches successful legacy token authentication results for a short period of time, so repeated requests using the same token do not need to run password verification through the authentication plugin every time. Concurrent requests for the same legacy token can also share the same in-flight authentication result.

  The cache is disabled by default, so existing installations keep their current authentication behavior unless they explicitly opt in. Basic authentication is not cached. If the cache is enabled, changed or revoked credentials may remain valid until the cached entry expires.

  Enable it in config.yaml:

  server:
    legacyAuthCache:
      enabled: true
      ttlMs: 15000
      maxEntries: 1000

  Options:

  • enabled: enables the legacy token authentication cache. Default: false.
  • ttlMs: time in milliseconds before a cached validation expires. Default: 15000.
  • maxEntries: maximum number of cached legacy tokens. Default: 1000.

  See #6147 and the original 8.x backport in #6143.

Changelog

Sourced from verdaccio's changelog.

6.10.0

Minor Changes

• 51c2733: Update internal Verdaccio types to include the optional server.legacyAuthCache configuration used by the 8.x auth and config packages.

Commits

• dfe2439 chore: release 6.x (#6148)
• 51c2733 feat: expose legacy auth cache config (#6147)
• See full diff in compare view

Updates @supabase/supabase-js from 2.112.3 to 2.112.4

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.112.4

2.112.4 (2026-08-24)

🩹 Fixes

• auth: convert stolen-lock AbortError when acquireTimeout is 0 (#2616)
• auth: warn on deprecated lock option and prevent unhandled refresh rejection (#2627)
• postgrest: move override fixtures out of generated types, repair codegen (#2605)
• realtime: respect custom logger for send() REST fallback warning (#2612)

❤️ Thank You

• Katerina Skroumpelou @​mandarini
• mmustafasenoglu @​mmustafasenoglu

v2.112.4-canary.3

2.112.4-canary.3 (2026-08-24)

🩹 Fixes

• auth: warn on deprecated lock option and prevent unhandled refresh rejection (#2627)

❤️ Thank You

• Katerina Skroumpelou @​mandarini

v2.112.4-canary.2

2.112.4-canary.2 (2026-08-24)

🩹 Fixes

• auth: convert stolen-lock AbortError when acquireTimeout is 0 (#2616)
• realtime: respect custom logger for send() REST fallback warning (#2612)

❤️ Thank You

• Katerina Skroumpelou @​mandarini
• mmustafasenoglu @​mmustafasenoglu

v2.112.4-canary.1

2.112.4-canary.1 (2026-08-12)

This was a version bump only, there were no code changes.

v2.112.4-canary.0

2.112.4-canary.0 (2026-08-11)

🩹 Fixes

• postgrest: move override fixtures out of generated types, repair codegen (#2605)

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.112.4 (2026-08-24)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

Commits

• c7397c1 chore(supabase): bump supabase cli to 2.113.0 (#2606)
• bbc167c chore(release): version 2.112.3 changelogs (#2608)
• See full diff in compare view

Updates jose from 6.2.9 to 6.2.10

Release notes

Sourced from jose's releases.

v6.2.10

Fixes

• jose: consume serialization members once (9bee285)
• jose: reject empty protected and JWE AAD members (8da4145)
• jose: validate serialized header values (b711d8f)
• jwe: conceal invalid decrypted CEK lengths (41fafe0)
• jwe: enforce AES-GCM tag boundaries (9a5b744)
• jwe: validate explicit encryption parameters (7a02697)
• jwk: accept empty octet-sequence keys (3f871e7)
• jwk: normalize key resolution inputs (f54ee7b)
• jwks: enforce verification key metadata (f9ba510)
• jwks: order overlapping remote reloads (9a1a913)
• jwks: reject invalid remote duration values (7bdb9e5)
• jwk: validate ext and key_ops parameters (4d91c37)
• jws: reject mixed payload encoding modes (dc69713)
• jws: validate unencoded payload strings (541f282)
• jwt: enforce explicit verification policies (b347182)
• jwt: prevent replacing protected headers (ae07d09)
• jwt: reject invalid duration inputs (282f9aa)
• jwt: validate builder claim values (ea03f83)
• jwt: validate unsecured protected headers (230c14e)
• key: validate generation and import options (15d880e)
• reject mixed b64 modes for empty General JWS payloads (61a2ef7)
• x509: reject DER truncated past its outer length (d8db9f6)

Documentation

• jwks: correct cache timestamp units (01a44d9)

Refactor

• jose: share binary input validation (eedb124)
• jose: share compact token processing internals (85e30ed)
• jwe: consolidate CBC decryption failures (1ee6f61)
• jwe: specialize compact processing (a998927)
• jwe: streamline single-recipient encryption (290aaa6)
• jwks: compact JWK Set shape validation (930c7df), references Array#every
• jwks: compact local key selection (4cb5ae5)
• jwks: compact remote resolver state (ef5eaf4)
• jws: specialize compact processing (021abf4)
• jwt: compact claim validation helpers (f390683)
• jwt: consolidate replicated claim checks (7dd5591)
• jwt: share producer claim state (52ba159)
• key: compact JWK algorithm selection (a6b29da)
• key: compact secret length parsing (cc03be8)

Changelog

Sourced from jose's changelog.

6.2.10 (2026-08-21)

Fixes

• jose: consume serialization members once (9bee285)
• jose: reject empty protected and JWE AAD members (8da4145)
• jose: validate serialized header values (b711d8f)
• jwe: conceal invalid decrypted CEK lengths (41fafe0)
• jwe: enforce AES-GCM tag boundaries (9a5b744)
• jwe: validate explicit encryption parameters (7a02697)
• jwk: accept empty octet-sequence keys (3f871e7)
• jwk: normalize key resolution inputs (f54ee7b)
• jwks: enforce verification key metadata (f9ba510)
• jwks: order overlapping remote reloads (9a1a913)
• jwks: reject invalid remote duration values (7bdb9e5)
• jwk: validate ext and key_ops parameters (4d91c37)
• jws: reject mixed payload encoding modes (dc69713)
• jws: validate unencoded payload strings (541f282)
• jwt: enforce explicit verification policies (b347182)
• jwt: prevent replacing protected headers (ae07d09)
• jwt: reject invalid duration inputs (282f9aa)
• jwt: validate builder claim values (ea03f83)
• jwt: validate unsecured protected headers (230c14e)
• key: validate generation and import options (15d880e)
• reject mixed b64 modes for empty General JWS payloads (61a2ef7)
• x509: reject DER truncated past its outer length (d8db9f6)

Documentation

• jwks: correct cache timestamp units (01a44d9)

Refactor

• jose: share binary input validation (eedb124)
• jose: share compact token processing internals (85e30ed)
• jwe: consolidate CBC decryption failures (1ee6f61)
• jwe: specialize compact processing (a998927)
• jwe: streamline single-recipient encryption (290aaa6)
• jwks: compact JWK Set shape validation (930c7df), references Array#every
• jwks: compact local key selection (4cb5ae5)
• jwks: compact remote resolver state (ef5eaf4)
• jws: specialize compact processing (021abf4)
• jwt: compact claim validation helpers (f390683)
• jwt: consolidate replicated claim checks (7dd5591)
• jwt: share producer claim state (52ba159)
• key: compact JWK algorithm selection (a6b29da)
• key: compact secret length parsing (cc03be8)

Commits

• 3eab152 chore(release): 6.2.10
• 021abf4 refactor(jws): specialize compact processing
• a998927 refactor(jwe): specialize compact processing
• eedb124 refactor(jose): share binary input validation
• 52ba159 refactor(jwt): share producer claim state
• 85e30ed refactor(jose): share compact token processing internals
• 0bd81d2 test(jose): cover hidden critical-header options
• 9cf7876 test(jose): reject callable object impostors
• f23cafd test(jose): preserve resolved key data properties
• 1ee6f61 refactor(jwe): consolidate CBC decryption failures
• Additional commits viewable in compare view

Updates @anthropic-ai/sdk from 0.117.1 to 0.120.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk: v0.120.0

0.120.0 (2026-08-19)

Full Changelog: sdk-v0.119.0...sdk-v0.120.0

Features

• api: managed agents web search config and self hosted sandbox memory (ba8ec50)

Chores

• internal: use a single pnpm workspace lockfile (#359) (3c32145)

sdk: v0.119.0

0.119.0 (2026-08-19)

Full Changelog: sdk-v0.118.0...sdk-v0.119.0

Features

• api: Files and Skills APIs are now GA; add computer use and browser use toolsets (ab41aa3)

sdk: v0.118.0

0.118.0 (2026-08-18)

Full Changelog: sdk-v0.117.1...sdk-v0.118.0

Features

• api: additions to files and memory stores (fdc0379)
• api: updates to skill, files, and user profiles (671e6b1)
• client: add helpers for accessing the workspace ID in response headers (28aa5af)

Bug Fixes

• api: remove unsupported mid_conv_system content block (ae6ca94)
• session-runner: retry tool-result sends for at least the lease TTL (#339) (7dc6325)

Chores

• internal: bump zod to 4.4.3 (#334) (faa5b7b)
• internal: remove leftover prism references (a163b96)
• stop shipping the v0.50 migration guide and migrate CLI (53992d7)

Documentation

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.120.0 (2026-08-19)

Full Changelog: sdk-v0.119.0...sdk-v0.120.0

Features

• api: managed agents web search config and self hosted sandbox memory (ba8ec50)

Chores

• internal: use a single pnpm workspace lockfile (#359) (3c32145)

0.119.0 (2026-08-19)

Full Changelog: sdk-v0.118.0...sdk-v0.119.0

Features

• api: Files and Skills APIs are now GA; add computer use and browser use toolsets (ab41aa3)

0.118.0 (2026-08-18)

Full Changelog: sdk-v0.117.1...sdk-v0.118.0

Features

• api: additions to files and memory stores (fdc0379)
• api: updates to skill, files, and user profiles (671e6b1)
• client: add helpers for accessing the workspace ID in response headers (28aa5af)

Bug Fixes

• api: remove unsupported mid_conv_system content block (ae6ca94)
• session-runner: retry tool-result sends for at least the lease TTL (#339) (7dc6325)

Chores

• internal: bump zod to 4.4.3 (#334) (faa5b7b)
• internal: remove leftover prism references (a163b96)
• stop shipping the v0.50 migration guide and migrate CLI (53992d7)

Documentation

• tools: warn that blocking tool bodies stall the worker heartbeat (#299) (908fdb5)

Commits

• bfa9197 chore: release main
• bc167f3 feat(api): managed agents web search config and self hosted sandbox memory
• 83fd898 chore(internal): use a single pnpm workspace lockfile (#359)
• 7fe6dd5 remove internal ticket references from changelog- #360
• c67e4e2 chore: release main
• 50fc0db feat(api): Files and Skills APIs are now GA; add computer use and browser use...
• 18ea26d chore: release main
• 6ed9ddd feat(api): updates to skill, files, and user profiles
• 91921f5 fix(session-runner): retry tool-result sends for at least the lease TTL (#339)
• 142adcc docs(tools): warn that blocking tool bodies stall the worker heartbeat (#299)
• Additional commits viewable in compare view

Updates posthog-node from 5.49.1 to 5.51.1

Release notes

Sourced from posthog-node's releases.

posthog-node@5.51.1

5.51.1

Patch Changes

• #4614 3593c43 Thanks @​iamomiid! - The Node SDK now sends the raw gzip bytes as the request body instead of wrapping them in a Blob. On Node 24.16 and later, reading a Blob request body leaks a native BlobReader that is never released, so a service calling capture() and flush() once per request grew by roughly 2.3 KB of heap per event and never gave it back. This completes the work in #4423: switching to node:zlib removed the compression-time Blob reads, but the body itself was still a Blob and still got read once per request. Compression behaviour, headers and the wire format are unchanged, and the edge build keeps using CompressionStream. (2026-08-24)
• Updated dependencies [3593c43]:
  • @​posthog/core@​1.48.9

posthog-node@5.51.0

5.51.0

Minor Changes

• #4564 233ac88 Thanks @​marandaneto! - Fall back to remote evaluation when a requested flag is missing from loaded local definitions. This changes scoped calls that previously omitted the flag without making a request. (2026-08-24)

posthog-node@5.50.0

5.50.0

Minor Changes

• #4484 557140e Thanks @​posthog! - FeatureFlagEvaluations.isEnabled() now accepts an optional defaultValue option, returned whenever the flag has no value (missing key, not loaded, or a failed request). A flag with a present value — including false and variant strings — always wins over defaultValue. Purely additive; omitting the option preserves the existing false-on-miss behavior. (2026-08-21)

posthog-node@5.49.4

5.49.4

Patch Changes

• #4569 00d22ea Thanks @​v11t! - fix getFeatureFlagResult returning null variant instead of undefined when remotely evaluated (2026-08-21)

posthog-node@5.49.3

5.49.3

Patch Changes

• #4583 6322f09 Thanks @​turnipdabeets! - Fix logs and metrics being silently dropped when an attribute holds a very large integer, a function, a symbol, a sparse array, or a truncated emoji. Cap log and metric attributes at 20 levels of nesting, 1,000 entries per object and 10,000 values in total, marking anything beyond as [Truncated]. Type OtlpAnyValue.intValue as string | number — code reading that field must handle both. (2026-08-21)
• Updated dependencies [6322f09]:
  • @​posthog/core@​1.48.7

posthog-node@5.49.2

5.49.2

Patch Changes

... (truncated)

Changelog

Sourced from posthog-node's changelog.

5.51.1

Patch Changes

• #4614 3593c43 Thanks @​iamomiid! - The Node SDK now sends the raw gzip bytes as the request body instead of wrapping them in a Blob. On Node 24.16 and later, reading a Blob request body leaks a native BlobReader that is never released, so a service calling capture() and flush() once per request grew by roughly 2.3 KB of heap per event and never gave it back. This completes the work in #4423: switching to node:zlib removed the compression-time Blob reads, but the body itself was still a Blob and still got read once per request. Compression behaviour, headers and the wire format are unchanged, and the edge build keeps using CompressionStream. (2026-08-24)
• Updated dependencies [3593c43]:
  • @​posthog/core@​1.48.9

5.51.0

Minor Changes

• #4564 233ac88 Thanks @​marandaneto! - Fall back to remote evaluation when a requested flag is missing from loaded local definitions. This changes scoped calls that previously omitted the flag without making a request. (2026-08-24)

5.50.0

Minor Changes

• #4484 557140e Thanks @​posthog! - FeatureFlagEvaluations.isEnabled() now accepts an optional defaultValue option, returned whenever the flag has no value (missing key, not loaded, or a failed request). A flag with a present value — including false and variant strings — always wins over defaultValue. Purely additive; omitting the option preserves the existing false-on-miss behavior. (2026-08-21)

5.49.4

Patch Changes

• #4569 00d22ea Thanks @​v11t! - fix getFeatureFlagResult returning null variant instead of undefined when remotely evaluated (2026-08-21)

5.49.3

Patch Changes

• #4583 6322f09 Thanks @​turnipdabeets! - Fix logs and metrics being silently dropped when an attribute holds a very large integer, a function, a symbol, a sparse array, or a truncated emoji. Cap log and metric attributes at 20 levels of nesting, 1,000 entries per object and 10,000 values in total, marking anything beyond as [Truncated]. Type OtlpAnyValue.intValue as string | number — code reading that field must handle both. (2026-08-21)
• Updated dependencies [6322f09]:
  • @​posthog/core@​1.48.7

5.49.2

Patch Changes

• #4578 bae46bf Thanks @​marandaneto! - Drop events when a before-send hook throws instead of sending the unmodified event. (2026-08-20)
• Updated dependencies [bae46bf, aef2f49]:
  • @​posthog/core@​1.48.6

Commits

• 0540533 chore: update versions and lockfile [version bump]
• 3593c43 fix(node): send gzip bytes instead of a Blob request body (#4614)
• cedf844 chore: update versions and lockfile [version bump]
• 233ac88 feat(node): fall back for requested flags missing locally (#4564)
• 3508c05 chore: update versions and lockfile [version bump]
• 557140e feat(node): isEnabled() accepts a caller-supplied default value (#4484)
• 6ccc78e chore: update versions and lockfile [version bump]
• 00d22ea fix(node): return undefined instead of null variant in getFeatureFlagResult (...
• 0832e6e chore: update versions and lockfile [version bump]
• 960cef8 chore: update versions and lockfile [version bump]
• Additional commits viewable in compare view

Updates fumadocs-core from 16.14.4 to 16.15.1

Release notes

Sourced from fumadocs-core's releases.

fumadocs@16.15.1

• @​fumadocs/base-ui@​16.15.1
• fumadocs-core@16.15.1
• fumadocs-ui@16.15.1

Forward dynamic loader from fumadocs-core/source

Read structured data from page.data.structuredData()

Search indexing no longer falls back to (await page.data.load()).structuredData. Runtime content sources expose structuredData() on page data instead, sharing the compile with load():

const structuredData = await page.data.structuredData();

The renderer returned by load() still carries structuredData, existing code keeps working.

fumadocs@16.15.0

• @​fumadocs/base-ui@​16.15.0
• fumadocs-core@16.15.0
• fumadocs-ui@16.15.0

Redesign source API

Content sources can hook into the static loader they are attached to, and dynamic sources can opt out of the loader's in-memory file cache.

configureStatic runs when a source is attached to loader(), and again whenever dynamicLoader() builds a new static loader:

export function createMySource(): DynamicSource {
  return {
    cache: 'custom',
    async files() {
      return loadFiles();
    },
    configureStatic({ loader, source }) {
      // `loader` is the created static loader
      // `source` is the record key when using named sources
    },
    configure(loader, { source }) {
      loader.invalidate();
    },
  };
}

• cache: 'memory' (default): files() is called once until invalidate().
• cache: 'custom': the source caches itself. dynamicLoader() re-runs files() on get() and rebuilds only when the file list is shallowly different (by identity).

Integrations

... (truncated)

Commits

• 78e836b Version Packages (#3494)
• 5e7826f backward compat
• 31afd1b feat(python): support runtime content source
• b65dac8 docs: rewrite content generators section
• 59a993c refactor(core): unify structured data across content sources
• d87c629 chore: simplify cache
• 2c4ebff feat(notion): forward dynamic loader from fumadocs-core/source
• f548dab Version Packages (#3491)
• 992beee fix(mdx): encode import query
• 01b920c feat(sanity): adopt to Next.js cache API
• Additional commits viewable in compare view

Updates fumadocs-mdx from 15.2.3 to 15.3.1

Release notes

Sourced from fumadocs-mdx's releases.

fumadocs-mdx@15.3.1

Scope lastModified git log to the content directory

git log is scoped to the collection's content directory instead of buffering the repository's entire history in every worker.

Fix Vite dev server crash on declaration-only dependencies

The injected Vite config no longer pre-bundles packages without runtime JavaScript, such as @types/mdx. Pre-bundling them made esbuild parse .d.ts files and fail on imports that only exist in type space, crashing the dev server.

Encode import.meta.glob query values

The Vite codegen passed the query to import.meta.glob as an object, letting the bundler serialize it. Rolldown inlines the values as-is, so a macro id such as src/lib/source.ts#docs left an unescaped / in the content file's module id and relative imports from that module (e.g. images from ![Banner](https://github.com/fuma-nama/fumadocs/blob/HEAD/logo.png)) failed to resolve, since the importer's directory is derived from the raw id.

The query is now serialized (and percent-encoded) by Fumadocs itself, matching what the Node.js codegen already did.

fumadocs-mdx@15.3.0

Sätteri 0.10

@fumadocs/satteri now requires satteri ^0.10.3, and the plugins were rewritten on its new capabilities:

• Exports (frontmatter, toc, structuredData, …) are emitted by an after document hook instead of an anchor marker appended to the source, so plugins no longer see (or need to skip) the anchor node.
• remark-steps, remark-admonition and remark-code-tab still detect their targets through node visitors (so documents without the construct cost nothing), but process each parent exactly once in an after hook, replacing the per-visit dedup workarounds.
• remark-llms stringifies the document root from a before hook instead of subscribing to 19 node types to find it.
• Markdown documents compile through Sätteri's own markdownToJs; the hand-assembled pipeline is gone. Raw HTML in .md files is still dropped, matching the previous behavior.
• rehype-katex parses KaTeX output with Sätteri's htmlToHast, dropping the hast-util-from-html dependency.
• No plugin reads node.position, so Sätteri now skips source-position tracking entirely (~15% faster parse).

Breaking: ExtraPluginHooks.beforeToJs was removed. Seed ctx.data from a Sätteri before hook on the plugin definition instead — it also receives the document root:

import { defineMdastPlugin } from 'satteri';
defineMdastPlugin({
name: 'my-plugin',
before(root, ctx) {
ctx.data.myValue ??= [];
},
});

Commits

• f548dab Version Packages (#3491)
• 992beee fix(mdx): encode import query
• 01b920c feat(sanity): adopt to Next.js cache API
• 967cb9b perf(mdx): add queue to index-file generation
• 21ac4f8 perf(notion): cache asset request
• 771d556 fix(core): heading & text results from algolia client
• e15eaf4 fix(api-docs): ignore self-recursive $ref
• 442d24c perf(core): shiki checks
• 36c53f3 perf(mdx): scope lastModified git log to the content directory
• 030bc4e perf(asyncapi): cache the document proxy in toStaticData
• Additional commits viewable in compare view

Updates fumadocs-ui from 16.14.4 to 16.15.1

Release notes

Sourced from fumadocs-ui's releases.

fumadocs@16.15.1

• @​fumadocs/base-ui@​16.15.1
• fumadocs-core@16.15.1
• fumadocs-ui@16.15.1

Forward dynamic loader from fumadocs-core/source

Read structured data from page.data.structuredData()

Search indexing no longer falls back to (await page.data.load()).structuredData. Runtime content sources expose structuredData() on page data instead, sharing the compile with load():

const structuredData = await page.data.structuredData();

The renderer returned by load() still carries structuredData, existing code keeps working.

fumadocs@16.15.0

• @​fumadocs/base-ui@​16.15.0
• fumadocs-core@16.15.0
• fumadocs-ui@16.15.0

Redesign source API

Content sources can hook into the static loader they are attached to, and dynamic sources can opt out of the loader's in-memory file cache.

configureStatic runs when a source is attached to loader(), and again whenever dynamicLoader() builds a new static loader:

export function createMySource(): DynamicSource {
  return {
    cache: 'custom',
    async files() {
      return loadFiles();
    },
    configureStatic({ loader, source }) {
      // `loader` is the created static loader
      // `source` is the record key when using named sources
    },
    configure(loader, { source }) {
      loader.invalidate();
    },
  };
}

• cache: 'memory' (default): files() is called once until invalidate().
• cache: 'custom': the source caches itself. dynamicLoader() re-runs files() on get() and rebuilds only when the file list is shallowly different (by identity).

Integrations

... (truncated)

Commits

• 78e836b Version Packages (#3494)
• 5e7826f backward compat
• 31afd1b feat(python): support runtime content source
• b65dac8 docs: rewrite content generators section
• 59a993c refactor(core): unify structured data across content sources
• d87c629 chore: simplify cache
• 2c4ebff feat(notion): forward dynamic loader from fumadocs-core/source
• f548dab Version Packages (#3491)
• 992beee fix(mdx): encode import query
• 01b920c feat(sanity): adopt to Next.js cache API
• Additional commits viewable in compare view

Updates next from 16.3.1 to 16.3.2

Release notes

Sourced from next's releases.

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [backport] Scope app-entry export validation to files inside the app directory (#97357)
• [backport] Fix catch-all index page being served for every other slug (#97416)
• [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
• [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
• [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
• [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @​lubieowoce, @​unstubbable, @​timneutkens, @​mischnic, and @​eps1lon for helping!

Commits

• d0ac882 v16.3.2
• 81deb92 [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static ...
• cd714d9 [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
• 5ac2327 [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
• 0ccb3e7 [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
• f4dc7c8 [backport] Fix catch-all index page being served for every other slug (#97416)
• eba236b [backport] Scope app-entry export validation to files inside the app director...
• See full diff in compare view

Updates @types/node from 26.2.0 to 26.3.0

Commits

• See full diff in compare view

Updates @types/react-dom from 19.2.4 to 19.2.5

Commits

• See full diff in compare view

Updates @vitest/coverage-istanbul from 4.1.10 to 4.1.11

Release notes

Sourced from @​vitest/coverage-istanbul's releases.

v4.1.11

   🐞 Bug Fixes

• Revive global concurrency limit for test lifecycle [backport to v4]  -  by @​sheremet-va and @​hi-ogawa in vitest-dev/vitest#10992 (5146d)
• browser:
  • Encode iframeId in tester iframe URL [backport to v4]  -  by @​sheremet-vaDescription has been truncated