[dependabot]

Bumps the npm-minor-and-patch group with 30 updates in the / directory:

Package	From	To
@bufbuild/protobuf	2.14.0	2.16.0
@connectrpc/connect	2.1.2	2.2.0
@connectrpc/connect-web	2.1.2	2.2.0
@prisma/adapter-pg	7.9.1	7.10.0
@prisma/client	7.9.1	7.10.0
@radix-ui/react-avatar	1.2.6	1.2.7
@radix-ui/react-dialog	1.1.23	1.2.0
@radix-ui/react-dropdown-menu	2.1.24	2.1.25
@radix-ui/react-popover	1.1.23	1.2.0
@radix-ui/react-progress	1.1.16	1.1.17
@radix-ui/react-separator	1.1.15	1.1.16
@radix-ui/react-slot	1.3.3	1.4.0
@radix-ui/react-switch	1.3.7	1.3.8
@radix-ui/react-tabs	1.1.21	1.1.22
@radix-ui/react-tooltip	1.2.16	1.3.0
lucide-react	1.33.0	1.55.0
next	16.3.1	16.4.0
pg	8.23.0	8.23.1
protobufjs	8.7.2	8.8.0
react	19.2.8	19.3.0
@types/react	19.2.18	19.3.0
react-dom	19.2.8	19.3.0
@types/react-dom	19.2.4	19.3.0
tailwind-merge	3.6.0	3.7.0
zod	4.4.3	4.6.5
@types/node	26.2.0	26.6.5
@types/react	19.2.18	19.3.0
@types/react-dom	19.2.4	19.3.0
autoprefixer	10.5.4	10.6.1
prisma	7.9.1	7.10.0
tsx	4.23.12	4.23.15
puppeteer	25.8.0	25.13.0

Updates @bufbuild/protobuf from 2.14.0 to 2.16.0

Release notes

Sourced from @​bufbuild/protobuf's releases.

v2.16.0

What's Changed

• Round JSON float32 values to float32 precision before range checks by @​YuEfSaEDU in bufbuild/protobuf-es#1536
• Export well-known Protobuf files with their full name by @​timostamm in bufbuild/protobuf-es#1538
• Update to protocolbuffers/protobuf v36.0 by @​timostamm in bufbuild/protobuf-es#1539
• Merge repeated map entry values when parsing binary by @​timostamm in bufbuild/protobuf-es#1543
• Add support for edition 2026 enum value json name option by @​anuraaga in bufbuild/protobuf-es#1546

New Contributors

• @​YuEfSaEDU made their first contribution in bufbuild/protobuf-es#1536

Full Changelog: bufbuild/protobuf-es@v2.15.0...v2.16.0

v2.15.0

What's Changed

• Add plugin option map_imports to point imports at packages by @​anuraaga in bufbuild/protobuf-es#1528

Full Changelog: bufbuild/protobuf-es@v2.14.1...v2.15.0

v2.14.1

What's Changed

This release deprecates configureTextEncoding() from @bufbuild/protobuf/wire. If you run @bufbuild/protobuf in an environment that does not provide the Text Encoding API, please migrate to a polyfill that installs TextEncoder (with the methods encode and optionally encodeInto) and TextDecoder (with the fatal: true constructor argument and the decode method) on globalThis instead. Please see #1517 for the rationale.

• Apply import_extension only to relative import paths by @​timostamm in bufbuild/protobuf-es#1515
• Stop sharing the text encoding implementation via globalThis by @​timostamm in bufbuild/protobuf-es#1517

Full Changelog: bufbuild/protobuf-es@v2.14.0...v2.14.1

Commits

• b3b232f Release 2.16.0 (#1547)
• d3a7e92 Add support for edition 2026 enum value json name option (#1546)
• 81a88c1 Merge commit from fork
• 5bff467 Merge repeated map entry values when parsing binary (#1543)
• c509f51 Bump protoc from 36.0.0 to 36.2.0 (#1521)
• 1a49124 Update to protocolbuffers/protobuf v36.0 (#1539)
• e3a289f Export well-known Protobuf files with their full name (#1538)
• b6c61ce Round JSON float32 values to float32 precision before range checks (#1536)
• f72f529 Release 2.15.0 (#1535)
• 09c98f1 Release 2.14.1 (#1518)
• Additional commits viewable in compare view

Updates @connectrpc/connect from 2.1.2 to 2.2.0

Release notes

Sourced from @​connectrpc/connect's releases.

v2.2.0

What's Changed

[!IMPORTANT]

This release adds a security-related feature for servers: the request gate is a function that runs after the request headers are available. Throwing a ConnectError in the gate rejects a request before messages are read, decompressed, or parsed. Use this option to reject unauthenticated requests instead of interceptors. See the documentation for details.

We also recommend that you configure a message size limit for your server, see the readMaxBytes option.

• Disallow propagation of protocol headers by @​ajeetdsouza in connectrpc/connect-es#1717
• Fix Http2SessionManager.verify() never settling when the connection closes during verification by @​jackyzha0 in connectrpc/connect-es#1746
• Drop support for Node.js 20 by @​ajeetdsouza in connectrpc/connect-es#1777
• Add requestGate handler option by @​timostamm in connectrpc/connect-es#1781
• Stop delivering stream messages after cancellation by @​ajeetdsouza in connectrpc/connect-es#1792
• Enable gRPC in Cloudflare conformance tests by @​mar-cf in connectrpc/connect-es#1774

New Contributors

• @​jackyzha0 made their first contribution in connectrpc/connect-es#1746
• @​mar-cf made their first contribution in connectrpc/connect-es#1774

Full Changelog: connectrpc/connect-es@v2.1.2...v2.2.0

Commits

• 378bb8f Release 2.2.0 (#1796)
• d0c2c0f Stop delivering stream messages after cancellation (#1792)
• f16eb17 Simplify tests with type-narrowing assertions (#1782)
• 2548dac Add requestGate handler option (#1781)
• 86dc519 Use mock timers for timeout test (#1778)
• 61900e4 Bump @​bufbuild/buf from 1.66.1 to 1.72.0 (#1762)
• e86b489 Migrate jasmine to node:test (#1730)
• a8e1588 Disallow propagation of protocol headers (#1717)
• See full diff in compare view

Updates @connectrpc/connect-web from 2.1.2 to 2.2.0

Release notes

Sourced from @​connectrpc/connect-web's releases.

v2.2.0

What's Changed

[!IMPORTANT]

This release adds a security-related feature for servers: the request gate is a function that runs after the request headers are available. Throwing a ConnectError in the gate rejects a request before messages are read, decompressed, or parsed. Use this option to reject unauthenticated requests instead of interceptors. See the documentation for details.

We also recommend that you configure a message size limit for your server, see the readMaxBytes option.

• Disallow propagation of protocol headers by @​ajeetdsouza in connectrpc/connect-es#1717
• Fix Http2SessionManager.verify() never settling when the connection closes during verification by @​jackyzha0 in connectrpc/connect-es#1746
• Drop support for Node.js 20 by @​ajeetdsouza in connectrpc/connect-es#1777
• Add requestGate handler option by @​timostamm in connectrpc/connect-es#1781
• Stop delivering stream messages after cancellation by @​ajeetdsouza in connectrpc/connect-es#1792
• Enable gRPC in Cloudflare conformance tests by @​mar-cf in connectrpc/connect-es#1774

New Contributors

• @​jackyzha0 made their first contribution in connectrpc/connect-es#1746
• @​mar-cf made their first contribution in connectrpc/connect-es#1774

Full Changelog: connectrpc/connect-es@v2.1.2...v2.2.0

Commits

• 378bb8f Release 2.2.0 (#1796)
• fca66b5 Bump webdriverio from 9.31.2 to 9.31.4 in the webdriver group (#1784)
• 355b1fd Bump webdriverio from 9.19.2 to 9.31.2 in the webdriver group across 1 direct...
• e10098f Remove Browserstack tests (#1731)
• e86b489 Migrate jasmine to node:test (#1730)
• See full diff in compare view

Updates @prisma/adapter-pg from 7.9.1 to 7.10.0

Release notes

Sourced from @​prisma/adapter-pg's releases.

7.10.0

Prisma ORM 7.10.0

Prisma ORM 7.10.0 introduces a compatibility package for running Prisma 7 alongside newer Prisma versions, secures Prisma Studio's local server, and includes fixes across Prisma Client and the PostgreSQL, MariaDB, Neon, SQLite, and Prisma Postgres Serverless adapters.

Highlights

Run Prisma 7 alongside Prisma 8

This release introduces @prisma/prisma7, a compatibility package that lets you retain a matching Prisma 7 CLI and configuration while installing Prisma 8 in the same project.

Once 7.10.0 is released, a side-by-side installation can use:

npm install --save-dev prisma@8 @prisma/prisma7@7.10.0
npm install @prisma/client@7.10.0

Use prisma for the directly installed Prisma 8 CLI and prisma7 for Prisma 7:

npx prisma --version
npx prisma7 --version
npx prisma7 generate
npx prisma7 migrate dev
npx prisma7 db push

Prisma 7 now prefers version-specific configuration files, allowing its configuration to coexist with Prisma 8's prisma.config.* files:

// prisma7.config.ts
import { defineConfig } from '@prisma/prisma7/config'
export default defineConfig({
schema: 'prisma/schema.prisma',
migrations: {
path: 'prisma/migrations',
},
})

Without an explicit --config option, Prisma 7 searches for:

1. Root-level prisma7.config.* files.
2. .config/prisma7.* files.
3. Existing prisma.config.* files as a backwards-compatible fallback.

The supported extensions are .js, .ts, .mjs, .cjs, .mts, and .cts. An explicit config path always takes precedence:

... (truncated)

Commits

• 3fa65ac fix(p2002): correct modelName in nested create unique constraint errors #2959...
• a180209 fix(adapter-pg): map PostgreSQL deadlocks to P2034 (#29717)
• 800f1d1 fix(adapter-pg): preserve constraint name for unique violations (23505) (#29587)
• 7ef2104 fix(postgres): handle SQLSTATE 23001 for RESTRICT violations (#29554)
• See full diff in compare view

Updates @prisma/client from 7.9.1 to 7.10.0

Release notes

Sourced from @​prisma/client's releases.

7.10.0

Prisma ORM 7.10.0

Prisma ORM 7.10.0 introduces a compatibility package for running Prisma 7 alongside newer Prisma versions, secures Prisma Studio's local server, and includes fixes across Prisma Client and the PostgreSQL, MariaDB, Neon, SQLite, and Prisma Postgres Serverless adapters.

Highlights

Run Prisma 7 alongside Prisma 8

This release introduces @prisma/prisma7, a compatibility package that lets you retain a matching Prisma 7 CLI and configuration while installing Prisma 8 in the same project.

Once 7.10.0 is released, a side-by-side installation can use:

npm install --save-dev prisma@8 @prisma/prisma7@7.10.0
npm install @prisma/client@7.10.0

Use prisma for the directly installed Prisma 8 CLI and prisma7 for Prisma 7:

npx prisma --version
npx prisma7 --version
npx prisma7 generate
npx prisma7 migrate dev
npx prisma7 db push

Prisma 7 now prefers version-specific configuration files, allowing its configuration to coexist with Prisma 8's prisma.config.* files:

// prisma7.config.ts
import { defineConfig } from '@prisma/prisma7/config'
export default defineConfig({
schema: 'prisma/schema.prisma',
migrations: {
path: 'prisma/migrations',
},
})

Without an explicit --config option, Prisma 7 searches for:

1. Root-level prisma7.config.* files.
2. .config/prisma7.* files.
3. Existing prisma.config.* files as a backwards-compatible fallback.

The supported extensions are .js, .ts, .mjs, .cjs, .mts, and .cts. An explicit config path always takes precedence:

... (truncated)

Commits

• 05c1b88 Teach Prisma 7 to prefer versioned config files (#30020)
• cf2bc1f Rename prisma7 package to @​prisma/prisma7 (#30002)
• ce5a34c Complete downstream actionable Prisma 7 guidance propagation (#29994)
• 3f13ec6 Complete CLI-owned prisma7 distribution identity (#29969)
• 179ba0c feat(prisma7): add side-by-side CLI wrapper (#29949)
• 3fa65ac fix(p2002): correct modelName in nested create unique constraint errors #2959...
• 6b6d9e9 chore(deps): update engines to 7.10.0-4.0edf323efd1d98336f3f0a68684b56f689b90...
• b64e33c chore(deps): update engines to 7.10.0-3.9d90ce2c89d5c95a1148aef15e5561ab6c490...
• 2046f9b feat(client): expose ModelName to compute function in Result extensions (#29782)
• f2b3abd chore(deps): update engines to 7.10.0-1.6d040c802892de6d56c7e0061b7a10b3e6a0c...
• Additional commits viewable in compare view

Updates @radix-ui/react-avatar from 1.2.6 to 1.2.7

Changelog

Sourced from @​radix-ui/react-avatar's changelog.

1.2.7

• Updated dependencies: @radix-ui/react-primitive@2.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-dialog from 1.1.23 to 1.2.0

Changelog

Sourced from @​radix-ui/react-dialog's changelog.

1.2.0

• Added support for multiple aria-describedby attributes.
• Fixed nested, portalled layers being unusable inside a modal layer. A non-modal popover rendered inside a modal Dialog previously broke some user interactions because the modal layer's trapped FocusScope reclaimed focus, and its RemoveScroll only allowed scrolling within the modal content.
• Updated dependencies: @radix-ui/react-focus-scope@1.2.0, @radix-ui/react-slot@1.4.0, @radix-ui/react-dismissable-layer@1.1.20, @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11, @radix-ui/react-portal@1.1.18

Commits

• See full diff in compare view

Updates @radix-ui/react-dropdown-menu from 2.1.24 to 2.1.25

Changelog

Sourced from @​radix-ui/react-dropdown-menu's changelog.

2.1.25

• Updated dependencies: @radix-ui/react-menu@2.1.25, @radix-ui/react-primitive@2.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-popover from 1.1.23 to 1.2.0

Changelog

Sourced from @​radix-ui/react-popover's changelog.

1.2.0

• Added Popover.Title and Popover.Description parts that provide accessible names and descriptions for popover content.
• Fixed nested, portalled layers being unusable inside a modal layer. A non-modal popover rendered inside a modal Dialog previously broke some user interactions because the modal layer's trapped FocusScope reclaimed focus, and its RemoveScroll only allowed scrolling within the modal content.
• Updated dependencies: @radix-ui/react-focus-scope@1.2.0, @radix-ui/react-slot@1.4.0, @radix-ui/react-dismissable-layer@1.1.20, @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11, @radix-ui/react-popper@1.3.8, @radix-ui/react-portal@1.1.18

Commits

• See full diff in compare view

Updates @radix-ui/react-progress from 1.1.16 to 1.1.17

Changelog

Sourced from @​radix-ui/react-progress's changelog.

1.1.17

• Updated dependencies: @radix-ui/react-primitive@2.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-separator from 1.1.15 to 1.1.16

Changelog

Sourced from @​radix-ui/react-separator's changelog.

1.1.16

• Updated dependencies: @radix-ui/react-primitive@2.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-slot from 1.3.3 to 1.4.0

Changelog

Sourced from @​radix-ui/react-slot's changelog.

1.4.0

• Added support for multiple aria-describedby attributes.
• Fixed compatibility issues with React Server Components.

Commits

• See full diff in compare view

Updates @radix-ui/react-switch from 1.3.7 to 1.3.8

Changelog

Sourced from @​radix-ui/react-switch's changelog.

1.3.8

• Updated dependencies: @radix-ui/react-use-size@1.1.5, @radix-ui/react-primitive@2.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-tabs from 1.1.21 to 1.1.22

Changelog

Sourced from @​radix-ui/react-tabs's changelog.

1.1.22

• Fixed a bug where a focused element inside Tabs.Content did not fire a blur event before the tab switched. Tabs.Trigger now moves focus before the tab's state change.
• Updated dependencies: @radix-ui/react-roving-focus@1.1.20, @radix-ui/react-direction@1.1.5, @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-tooltip from 1.2.16 to 1.3.0

Changelog

Sourced from @​radix-ui/react-tooltip's changelog.

1.3.0

• Added support for multiple aria-describedby attributes.
• Updated dependencies: @radix-ui/react-slot@1.4.0, @radix-ui/react-dismissable-layer@1.1.20, @radix-ui/react-visually-hidden@1.2.12, @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11, @radix-ui/react-popper@1.3.8, @radix-ui/react-portal@1.1.18

Commits

• See full diff in compare view

Updates lucide-react from 1.33.0 to 1.55.0

Release notes

Sourced from lucide-react's releases.

Version 1.55.0

What's Changed

• feat(icons): added mail-dot icon by @​elenakovelskikh in lucide-icons/lucide#3230
• ci(lint): split lint jobs and annotate Prettier and JSON schema errors in PRs by @​ericfennis in lucide-icons/lucide#4982
• chore(deps-dev): bump sharp from 0.35.4 to 0.35.5 by @​dependabot[bot] in lucide-icons/lucide#4987
• chore(deps): bump next from 16.3.6 to 16.3.8 by @​dependabot[bot] in lucide-icons/lucide#4988
• test(lucide): add tests for empty icons error and DocumentFragment root in createIcons by @​grzdev in lucide-icons/lucide#4967
• feat(icons): added phone-log icon by @​Levi-Bensley in lucide-icons/lucide#3598
• chore(copilot-instruction): Adjust instruction text to allow more then 4 use-cases by @​ericfennis in lucide-icons/lucide#4989
• feat(icons): added wifi-lock icon by @​benhaube in lucide-icons/lucide#4913
• feat(icons): Add handle-bottom-right icon by @​ocavue in lucide-icons/lucide#1793
• test(lucide-react): add tests for DynamicIcon fallback and ref forwarding by @​grzdev in lucide-icons/lucide#4966
• feat(icons): added screw icon by @​edik17 in lucide-icons/lucide#4932
• feat(icons): added user-round-star icon by @​karsa-mistmere in lucide-icons/lucide#3469
• feat(icons): added shield-house icon by @​benhaube in lucide-icons/lucide#4602

New Contributors

• @​grzdev made their first contribution in lucide-icons/lucide#4967
• @​Levi-Bensley made their first contribution in lucide-icons/lucide#3598
• @​edik17 made their first contribution in lucide-icons/lucide#4932

Full Changelog: lucide-icons/lucide@1.54.0...1.55.0

Version 1.54.0

What's Changed

• feat(icons): added lens icon by @​rrod497 in lucide-icons/lucide#4923

Full Changelog: lucide-icons/lucide@1.53.0...1.54.0

Version 1.53.0

What's Changed

• chore(deps-dev): bump preact from 10.29.8 to 11.0.0 in the preact-deps group by @​dependabot[bot] in lucide-icons/lucide#4961
• chore(deps): bump vue from 3.5.42 to 3.5.43 in the vue-deps group by @​dependabot[bot] in lucide-icons/lucide#4958
• fix(site): Fix reset button and rename absolute stroke width to non-scaling stroke by @​ericfennis in lucide-icons/lucide#4956
• chore(deps-dev): bump simple-git from 3.36.0 to 4.0.1 by @​dependabot[bot] in lucide-icons/lucide#4968
• chore(deps-dev): bump the angular-deps group across 1 directory with 11 updates by @​dependabot[bot] in lucide-icons/lucide#4960
• chore(categories): Add description field to categories by @​ericfennis in lucide-icons/lucide#4909
• feat(icons): added groceries icon by @​rrod497 in lucide-icons/lucide#4907
• fix(icons): changed pen-tool icon by @​karsa-mistmere in lucide-icons/lucide#4972
• feat(icons): added new hiking-stick icon by @​kamilasw in lucide-icons/lucide#4711
• feat(icons): added scratch-blocks icon by @​mc20000-01 in lucide-icons/lucide#4969
• fix(icons): changed soup and salad icons by @​karsa-mistmere in lucide-icons/lucide#4971

New Contributors

• @​mc20000-01 made their first contribution in lucide-icons/lucide#4969

Full Changelog: lucide-icons/lucide@1.52.0...1.53.0

Version 1.52.0

... (truncated)

Commits

• 949bc6d test(lucide-react): add tests for DynamicIcon fallback and ref forwarding (#4...
• 98331e2 chore(deps): bump the react-deps group across 1 directory with 3 updates (#4951)
• 09aa9c5 chore(deps): Upgrade to vite 8 (#4950)
• e042fec fix(packages): declare @types/react as an optional peer dependency (#4892)
• f06ac67 chore(typchecking): More typecheck jobs for all packages (#4885)
• 94e4cb9 chore(dependencies): Update dependencies (#4806)
• 99d25bd feat(packages): extract icon build logic into @lucide/shared (#4409)
• See full diff in compare view

Updates next from 16.3.1 to 16.4.0

Release notes

Sourced from next's releases.

v16.4.0

Check out the 16.4 announcement post to get an overview of the changes.

Core Changes

• Show compiler plugin warning in more situations: #75682
• fix(scripts): correct typo in rm.mjs error message: #87015
• docs: improve clarity and punctuation in README: #86096
• Fix debug build paths Pages Router support entries: #93529
• bundle-analyzer: record historical snapshots on each analyze run: #93520
• fix: detect proxy.ts correctly with compound pageExtensions: #93246
• feat(turbopack): support false values for resolveAlias config: #93331

Misc Changes

• docs: correction to dynamicParams migration: #96624
• docs: proxy event argument: #96435
• docs: remove experimental note from runtime prefetching: #96615
• Preserve per-segment prefetching after dynamic navigation: #96583
• Rename static generation stream option to waitForAllReady: #96564
• Remove obsolete static generation plumbing: #96563
• [turbopack] Drop dead writes to exports: #96381
• [turbopack] Ignore writes to exports after a module.exports = {} writes: #96380
• [turbopack] Add test for sideEffects with optimizePackageImports: #96549
• [turbopack] Strip leading BOM before parsing CSS: #96678
• Upgrade React from cbb046ab-20260731 to 7dfc7ccd-20260803: #96550
• docs: use relative doc links in instant-navigation error pages: #96672
• Turbopack: terminate failed plugin worker threads: #96592
• Fix HTML-limited bot matching in prerender bypass rules: #96584
• [ci] Fix create_release_branch for new repo permissions: #96641
• test: skip action module instance deploy test: #96629
• docs: quote the dynamicParams build error in a blockquote: #96633
• [react-sync] Open pull requests as the bot that authors the commits: #96682
• [Bench] Fixes for pure Fizz bench: #96771
• Derive foreground cache revalidation from the consumer: #96731
• Fix race when navigating Back before hydration: #96252
• docs: present each Skill as steps in the AI agents guide: #96751
• Reuse completed cache entries for the rest of a request: #96727
• Upgrade React from 7dfc7ccd-20260803 to 11eddecd-20260805: #96735
• Remove WorkStore execution mode: #96674
• Remove cache revalidation execution mode reads: #96670
• Separate App Route render and prerender pipelines: #96662
• Remove App Page execution mode reads: #96660
• test: fix missing await in css-chunking test: #96725
• docs (Skills): stop assuming app/ at the root and port 3000: #96696
• Implement next/font BeforeResolvePlugins as ImportMappingReplacement: #95808
• Use Tailwind Turbopack loader in create-next-app: #96606
• docs: instant navigation quick start with an adoption prompt: #96663
• Separate App Page render and prerender pipelines: #96659
• Move App Router execution intent to entrypoints: #96640

... (truncated)

Commits

• e273d5b v16.4.0
• fdf41d6 [ai-upgrade] discover upgrade models and reasoning efforts from agent CLIs (#...
• c3e76ad v16.4.0-canary.63
• 47c6cc8 Document next analyze export in the package bundling guide (#99735)
• 5b10604 Revert stabilization of forbidden() and unauthorized() (#99734)
• f3a6f97 Preserve configured output directories during static export (#99507)
• b22e5a2 Rename skill to next-bundle-optimizer and document its usage (#99731)
• 74dc549 [turbo-tasks-backend] Clean up task state before publishing execution complet...
• ccf8c15 v16.4.0-canary.62
• b8c7c7f Improve static route error guidance (#99724)
• Additional commits viewable in compare view

Updates pg from 8.23.0 to 8.23.1

Changelog

Sourced from pg's changelog.

All major and minor releases are briefly explained below.

For richer information consult the commit log on github with referenced pull requests.

We do not include break-fix version release in this file.

Commits

• 0980cef Publish
• 2759b2c fix(pg): run a named statement with an empty text more than once (#3781)
• 7feb7df fix(pg): expose detail and hint on errors from the native client (#3780)
• 9683053 fix(pg): do not treat Sync as connection ending (#3772)
• 4589038 fix: validate server certificate against host when connecting to an IP addres...
• 9808955 cleanup: Fix typo in comment
• 2b02f64 fix: avoid mutating query config (#3720)
• 0cef6af Reject portal based queries in pipeline mode instead of misrouting rows (#3737)
• 2991480 Deprecate serializing invalid Dates (#3731)
• c940d7c Fail pipelined queries when the connection dies instead of hanging (#3736)
• Additional commits viewable in compare view

Updates protobufjs from 8.7.2 to 8.8.0

Release notes

Sourced from protobufjs's releases.

protobufjs: v8.8.0

8.8.0 (2026-08-26)

Features

• Support Edition 2026 (#2414) (8845d2a)

Bug Fixes

• Harden ProtoJSON and Text Format parsing (#2418) (9f0bc74)
• Limit Any.fromObject recursion (#2419) (3dd064e)
• Preserve symbol visibility (#2415) (ef47921)
• Respect declared lengths while decoding (#2420) (1650d74)

Changelog

Sourced from protobufjs's changelog.

8.8.0 (2026-08-26)

Features

• Support Edition 2026 (#2414) (8845d2a)

Bug Fixes

• deps: update protoc-gen-es benchmark target to v2.14.0 (#2411) (2fd85aa)
• Harden ProtoJSON and Text Format parsing (#2418) (9f0bc74)
• Limit Any.fromObject recursion (#2419) (3dd064e)
• Preserve symbol visibility (#2415) (ef47921)
• Respect declared lengths while decoding (#2420) (1650d74)

Commits

• 1169f5d chore: release master (#2412)
• 824faea chore(deps-dev): Bump brace-expansion from 1.1.11 to 1.1.18 (#2421)
• 3d84b37 chore: Update jsdoc-template submodule
• d0046ce chore(deps): update dev dependencies (#2407)
• 1650d74 fix: Respect declared lengths while decoding (#2420)
• 9f0bc74 fix: Harden ProtoJSON and Text Format parsing (#2418)
• 3dd064e fix: Limit Any.fromObject recursion (#2419)
• ef47921 fix: Preserve symbol visibility (#2415)
• 8845d2a feat: Support Edition 2026 (#2414)
• 2fd85aa fix(deps): update protoc-gen-es benchmark target to v2.14.0 (#2411)
• See full diff...

  Description has been truncated

[dependabot]

Labels

The following labels could not be found: dependencies, javascript. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.