Skip to content

chore(deps): bump the airlock-npm group across 1 directory with 15 updates - #34

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/airlock-npm-9056c34e15
Closed

chore(deps): bump the airlock-npm group across 1 directory with 15 updates#34
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/airlock-npm-9056c34e15

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 5, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the airlock-npm group with 15 updates in the / directory:

Package From To
playwright-core 1.62.1 1.63.0
yaml 2.9.0 2.9.1
zod 4.4.3 4.6.5
@types/node 24.13.3 24.19.1
pg 8.23.0 8.23.1
@truefoundry/trueforge-sdk 0.1.3 0.2.1
@truefoundry/trueforge-ui 0.2.4 0.4.1
next 16.3.3 16.3.8
react 19.2.8 19.3.0
@types/react 19.2.18 19.3.0
react-dom 19.2.8 19.3.0
@types/react-dom 19.2.5 19.3.0
@eslint/eslintrc 3.3.6 3.3.7
@types/react 19.2.18 19.3.0
@types/react-dom 19.2.5 19.3.0
eslint 9.39.5 10.12.0
eslint-config-next 16.3.3 16.3.8

Updates playwright-core from 1.62.1 to 1.63.0

Release notes

Sourced from playwright-core's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits
  • 1b025d7 chore: mark v1.63.0 (#42569)
  • 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
  • 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
  • e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
  • 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
  • 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
  • 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
  • 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
  • 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
  • bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
  • Additional commits viewable in compare view

Updates yaml from 2.9.0 to 2.9.1

Release notes

Sourced from yaml's releases.

v2.9.1

  • Limit recursive merge aliases (#685, #713)
  • Simplify line unfolding during quoted string parsing (#714)
Commits

Updates zod from 4.4.3 to 4.6.5

Release notes

Sourced from zod's releases.

v4.6.5

Commits:

  • d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post
  • f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
  • de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)
  • 56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)
  • ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"
  • cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""
  • 0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5
  • 59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

  • d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)
  • ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)
  • 2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
  • f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

  • 413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged
  • 75d63ee1 docs: show only the .properties() method form in the 4.6 post
  • 46da9572 docs: match the error-message examples to what the parsers emit

v4.6.2

A patch on top of 4.6.1.

v4.6.1

A patch on top of 4.6.0.

v4.6.0

Zod 4.6 is now available.

npm install zod@latest

At a glance:

... (truncated)

Commits
  • 59bbc03 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump
  • 0f3f5ee 4.6.5
  • cc4cd4e Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, ref...
  • ca0229a Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed w...
  • 56222cd feat(instanceof): key the .properties() shape off the instance type (#6600)
  • de65a5c docs: lead the properties section with the check and add a Zod Mini tab (#6598)
  • f1448f7 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
  • d2b135c docs: add the 4.6.x patch highlights to the 4.6 post
  • 2bb0871 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
  • 743aedb 4.6.4
  • Additional commits viewable in compare view

Updates @types/node from 24.13.3 to 24.19.1

Commits

Updates pg from 8.23.0 to 8.23.1

Changelog

Sourced from pg's changelog.

All major and minor releases are briefly explained below.

For richer information consult the commit log on github with referenced pull requests.

We do not include break-fix version release in this file.

Commits
  • 0980cef Publish
  • 2759b2c fix(pg): run a named statement with an empty text more than once (#3781)
  • 7feb7df fix(pg): expose detail and hint on errors from the native client (#3780)
  • 9683053 fix(pg): do not treat Sync as connection ending (#3772)
  • 4589038 fix: validate server certificate against host when connecting to an IP addres...
  • 9808955 cleanup: Fix typo in comment
  • 2b02f64 fix: avoid mutating query config (#3720)
  • 0cef6af Reject portal based queries in pipeline mode instead of misrouting rows (#3737)
  • 2991480 Deprecate serializing invalid Dates (#3731)
  • c940d7c Fail pipelined queries when the connection dies instead of hanging (#3736)
  • Additional commits viewable in compare view

Updates @truefoundry/trueforge-sdk from 0.1.3 to 0.2.1

Release notes

Sourced from @​truefoundry/trueforge-sdk's releases.

@​truefoundry/trueforge-sdk@​0.2.1

Patch Changes

  • 829ac6e: Regenerate SDK from updated OpenAPI spec.
  • 829ac6e: Regenerate SDK from updated OpenAPI spec.
  • 829ac6e: Regenerate SDK from updated OpenAPI spec.
  • 33cbe52: Default MCP tool approval to @write and @destructive again. Unlabeled tools still run without a pause unless named or covered by @all.
  • 829ac6e: Regenerate SDK from updated OpenAPI spec.

@​truefoundry/trueforge-sdk@​0.2.1-rc.0

Patch Changes

  • 829ac6e: Regenerate SDK from updated OpenAPI spec.

@​truefoundry/trueforge-sdk@​0.2.0

Minor Changes

  • 74eae6c: Remove pagination from list MCP servers across the API, SDK, and UI; return and search the complete configured MCP catalog client-side.

Patch Changes

  • 648273b: Regenerate SDK from updated OpenAPI spec.
  • 648273b: Regenerate SDK from updated OpenAPI spec.
  • 648273b: Regenerate SDK from updated OpenAPI spec.
  • 648273b: Regenerate SDK from updated OpenAPI spec.
  • 648273b: Regenerate SDK from updated OpenAPI spec.
  • 648273b: Regenerate SDK from updated OpenAPI spec.
  • 648273b: Regenerate SDK from updated OpenAPI spec.
  • 648273b: Regenerate SDK from updated OpenAPI spec.
  • 648273b: Regenerate SDK from updated OpenAPI spec.
  • 648273b: Regenerate SDK from updated OpenAPI spec.
  • 648273b: Regenerate SDK from updated OpenAPI spec.
  • 648273b: Regenerate SDK from updated OpenAPI spec.
  • 648273b: Regenerate SDK from updated OpenAPI spec.
  • 2dcb3a0: Add created_by_me to list sessions and list schedules so callers can restrict results to resources they created (excluding managed-agent visibility).
  • a000b47: List sessions accepts metadata[key]=value query params (OpenAPI deepObject) for exact metadata containment filtering. Bare JSON-string metadata query params are rejected. Metadata keys are limited to 32 characters and cannot include [] or whitespace so they do not collide with the bracket query form.
  • 9501536: [truefoundry] Make MCPServerManifest a type-discriminated oneOf of RemoteMCPServerManifest and TrueFoundryMCPServerManifest.
  • 0ec8dc6: Omit session total_cost_in_usd when cost is unavailable (instead of defaulting to 0), matching turn metrics.
  • dc2151f: Paginate GET /api/v1/agents with limit / page_token and a pagination envelope; optional agent_name filters by case-insensitive substring. Agents library uses rows-per-page and prev/next against the token-paginated API. Schedule create and the schedules listing agent filter use a searchable agent combobox backed by the same filtered list API.
  • 134dcb9: Python SDK is_event_delta / merge_event_delta (PyPI version locksteps with this package on Version Packages).
  • 52987a7: Add internal.agents.getCodeSnippets API under the new SDK internal namespace.
  • 38ce068: Add tenant-unique optional session external_id, Sessions.getOrCreateByExternalId, and an idempotent POST /internal/sessions/get-or-create-by-external-id endpoint and SDK method.
  • b654052: Add caller-owned session metadata (Record<string, string> with size limits) on create, update, and read. Persist as a new session.metadata jsonb column; leave session custom unchanged.
  • 11865b4: Add optional session source. Persist as nullable JSONB with a list filter index; expose on session responses and list via source_type / source_id. Schedule dispatch sets source on create; public create/update do not accept it.
  • 4c1260e: [truefoundry] Wire TrueFoundry MCP authorize, status, and delete through ServiceFoundry; stub list auth_status; gate oauth2 invoke mid-turn with authRequired; paginate MCP server lists. UI treats SFY consent code/error on the FE landing like local DCR success/failure.
  • 44f9cbe: [truefoundry] TrueFoundry mode: env-backed Daytona | truefoundry sandbox via TRUEFOUNDRY_SANDBOX_* (static SETTINGS JSON). Settings OpenAPI stays Daytona-only (SandboxProviderManifest); truefoundry is store-internal (StoredSandboxProviderManifest).
  • f175245: [truefoundry] Add TrueFoundry-managed MCP list/get (SFY registry, gateway proxy URL, create/update 424).

@​truefoundry/trueforge-sdk@​0.2.0-rc.9

Patch Changes

... (truncated)

Changelog

Sourced from @​truefoundry/trueforge-sdk's changelog.

[0.2.1] - 2026-09-29

[0.2.1-rc.0] - 2026-09-22

0.2.1

Patch Changes

  • 829ac6e: Regenerate SDK from updated OpenAPI spec.
  • 829ac6e: Regenerate SDK from updated OpenAPI spec.
  • 829ac6e: Regenerate SDK from updated OpenAPI spec.
  • 33cbe52: Default MCP tool approval to @write and @destructive again. Unlabeled tools still run without a pause unless named or covered by @all.
  • 829ac6e: Regenerate SDK from updated OpenAPI spec.

[0.2.0] - 2026-09-18

0.2.1-rc.0

Patch Changes

  • 829ac6e: Regenerate SDK from updated OpenAPI spec.

[0.2.0-rc.9] - 2026-09-17

0.2.0

Minor Changes

  • 74eae6c: Remove pagination from list MCP servers across the API, SDK, and UI; return and search the complete configured MCP catalog client-side.

Patch Changes

  • 648273b: Regenerate SDK from updated OpenAPI spec.
  • 648273b: Regenerate SDK from updated OpenAPI spec.
  • 648273b: Regenerate SDK from updated OpenAPI spec.
  • 648273b: Regenerate SDK from updated OpenAPI spec.
  • 648273b: Regenerate SDK from updated OpenAPI spec.
  • 648273b: Regenerate SDK from updated OpenAPI spec.
  • 648273b: Regenerate SDK from updated OpenAPI spec.
  • 648273b: Regenerate SDK from updated OpenAPI spec.
  • 648273b: Regenerate SDK from updated OpenAPI spec.
  • 648273b: Regenerate SDK from updated OpenAPI spec.
  • 648273b: Regenerate SDK from updated OpenAPI spec.
  • 648273b: Regenerate SDK from updated OpenAPI spec.
  • 648273b: Regenerate SDK from updated OpenAPI spec.
  • 2dcb3a0: Add created_by_me to list sessions and list schedules so callers can restrict results to resources they created (excluding managed-agent visibility).
  • a000b47: List sessions accepts metadata[key]=value query params (OpenAPI deepObject) for exact metadata containment filtering. Bare JSON-string metadata query params are rejected. Metadata keys are limited to 32 characters and cannot include [] or whitespace so they do not collide with the bracket query form.
  • 9501536: [truefoundry] Make MCPServerManifest a type-discriminated oneOf of RemoteMCPServerManifest and TrueFoundryMCPServerManifest.
  • 0ec8dc6: Omit session total_cost_in_usd when cost is unavailable (instead of defaulting to 0), matching turn metrics.
  • dc2151f: Paginate GET /api/v1/agents with limit / page_token and a pagination envelope; optional agent_name filters by case-insensitive substring. Agents library uses rows-per-page and prev/next against the token-paginated API. Schedule create and the schedules listing agent filter use a searchable agent combobox backed by the same filtered list API.

... (truncated)

Commits
  • ebbf6c0 Version Packages (#849)
  • 33cbe52 Restore default MCP tool approval to write and destructive (#895)
  • 4726a31 Add feature to share chat with anyone in the tenant (#859)
  • bbc4f7d fix: add paused to turn state, add mcp auth_continue event. (#866)
  • 0c82412 enh: add API for POST events and add to event stream (#812)
  • 5adde28 feat: add table for turn inbound events (#805)
  • 346221b Version Packages (rc) (#838)
  • 829ac6e Support web search providers in stanalone and OIDC mode (#833)
  • 8b1d98e Version Packages (#801)
  • 5ae0781 Rewrite changelog to tag truefoundry specific items
  • Additional commits viewable in compare view

Updates @truefoundry/trueforge-ui from 0.2.4 to 0.4.1

Release notes

Sourced from @​truefoundry/trueforge-ui's releases.

@​truefoundry/trueforge-ui@​0.4.1

Patch Changes

  • Updated dependencies [66fb42f]
  • Updated dependencies [5e6527f]
    • @​truefoundry/trueforge-assistant-ui-runtime@​0.2.1

@​truefoundry/trueforge-ui@​0.4.0

Minor Changes

  • c6b78d9: Make sandbox provider port types identity-only; move Daytona lifecycle fields (execTimeoutMs, auto-stop/archive/delete intervals) onto host DaytonaSandboxConfig.
  • f4ee3dc: Share sessions with tenant members (popover, shared PATCH, share routes), toast and redirect on forbidden/missing deep links, and stop the New Chat → named-history max-update-depth loop.
  • a855122: Rename the published runtime package to @truefoundry/trueforge-assistant-ui-runtime, move it into the TrueForge workspace, rename its public runtime APIs to TrueForge, and remove the legacy TrueFoundry server adapter and server configuration.
  • 829ac6e: Add OSS web-search provider settings and catalog (Parallel): singleton settings/catalog APIs, optional API key, and UI adapter without mode config so built-in web search works outside TrueFoundry mode.
  • 829ac6e: Add web-search provider settings catalog port and Settings UI so admins can configure Parallel web search (API key + mode) in standalone/OIDC deployments.

Patch Changes

  • c783700: Show schedule tasks, agent context, and failed run reasons in the schedules table.
  • dd421b7: Add an action to restore the recent 30-day session list from a timestamp-pinned session.
  • 73e146e: Make the compaction threshold an Auto/Custom selector: Auto omits trigger (runtime derives ~80% of the model context window); Custom reveals a number input defaulting to 50000.
  • 33cbe52: Default MCP tool approval to @write and @destructive again. Unlabeled tools still run without a pause unless named or covered by @all.
  • ff0cee5: Improve session timeline tooltips with sandbox tool details and grouped sub-agent tool calls.
  • 72a1168: Use the shared searchable agent picker in the sessions filter.
  • ad66480: Hide tool approval Allow/Deny actions and the "Awaiting Response" spinner for paused approvals on session detail (read-only replay).
  • fdd8520: Drive Agents and Schedules table pagination from API next/previous page tokens instead of row-count heuristics.
  • 20f4179: Refresh trueforge light theme tokens toward indigo-tinted surfaces and cooler gray text.
  • 0da3794: Stop the MCP OAuth opener from closing the popup as soon as the callback broadcasts, so the success/failure screen can show before the popup closes itself.
  • Updated dependencies [829ac6e]
  • Updated dependencies [829ac6e]
  • Updated dependencies [829ac6e]
  • Updated dependencies [c783700]
  • Updated dependencies [c6b78d9]
  • Updated dependencies [33cbe52]
  • Updated dependencies [f4ee3dc]
  • Updated dependencies [fdd8520]
  • Updated dependencies [829ac6e]
  • Updated dependencies [a855122]
  • Updated dependencies [829ac6e]
  • Updated dependencies [829ac6e]
    • @​truefoundry/trueforge-sdk@​0.2.1
    • @​truefoundry/trueforge-assistant-ui-runtime@​0.2.0

@​truefoundry/trueforge-ui@​0.4.0-rc.0

Minor Changes

  • a855122: Rename the published runtime package to @truefoundry/trueforge-assistant-ui-runtime, move it into the TrueForge workspace, rename its public runtime APIs to TrueForge, and remove the legacy TrueFoundry server adapter and server configuration.
  • 829ac6e: Add OSS web-search provider settings and catalog (Parallel): singleton settings/catalog APIs, optional API key, and UI adapter without mode config so built-in web search works outside TrueFoundry mode.
  • 829ac6e: Add web-search provider settings catalog port and Settings UI so admins can configure Parallel web search (API key + mode) in standalone/OIDC deployments.

... (truncated)

Changelog

Sourced from @​truefoundry/trueforge-ui's changelog.

0.4.1

Patch Changes

  • Updated dependencies [66fb42f]
  • Updated dependencies [5e6527f]
    • @​truefoundry/trueforge-assistant-ui-runtime@​0.2.1

0.4.0

Minor Changes

  • c6b78d9: Make sandbox provider port types identity-only; move Daytona lifecycle fields (execTimeoutMs, auto-stop/archive/delete intervals) onto host DaytonaSandboxConfig.
  • f4ee3dc: Share sessions with tenant members (popover, shared PATCH, share routes), toast and redirect on forbidden/missing deep links, and stop the New Chat → named-history max-update-depth loop.
  • a855122: Rename the published runtime package to @truefoundry/trueforge-assistant-ui-runtime, move it into the TrueForge workspace, rename its public runtime APIs to TrueForge, and remove the legacy TrueFoundry server adapter and server configuration.
  • 829ac6e: Add OSS web-search provider settings and catalog (Parallel): singleton settings/catalog APIs, optional API key, and UI adapter without mode config so built-in web search works outside TrueFoundry mode.
  • 829ac6e: Add web-search provider settings catalog port and Settings UI so admins can configure Parallel web search (API key + mode) in standalone/OIDC deployments.

Patch Changes

  • c783700: Show schedule tasks, agent context, and failed run reasons in the schedules table.
  • dd421b7: Add an action to restore the recent 30-day session list from a timestamp-pinned session.
  • 73e146e: Make the compaction threshold an Auto/Custom selector: Auto omits trigger (runtime derives ~80% of the model context window); Custom reveals a number input defaulting to 50000.
  • 33cbe52: Default MCP tool approval to @write and @destructive again. Unlabeled tools still run without a pause unless named or covered by @all.
  • ff0cee5: Improve session timeline tooltips with sandbox tool details and grouped sub-agent tool calls.
  • 72a1168: Use the shared searchable agent picker in the sessions filter.
  • ad66480: Hide tool approval Allow/Deny actions and the "Awaiting Response" spinner for paused approvals on session detail (read-only replay).
  • fdd8520: Drive Agents and Schedules table pagination from API next/previous page tokens instead of row-count heuristics.
  • 20f4179: Refresh trueforge light theme tokens toward indigo-tinted surfaces and cooler gray text.
  • 0da3794: Stop the MCP OAuth opener from closing the popup as soon as the callback broadcasts, so the success/failure screen can show before the popup closes itself.
  • Updated dependencies [829ac6e]
  • Updated dependencies [829ac6e]
  • Updated dependencies [829ac6e]
  • Updated dependencies [c783700]
  • Updated dependencies [c6b78d9]
  • Updated dependencies [33cbe52]
  • Updated dependencies [f4ee3dc]
  • Updated dependencies [fdd8520]
  • Updated dependencies [829ac6e]
  • Updated dependencies [a855122]
  • Updated dependencies [829ac6e]
  • Updated dependencies [829ac6e]
    • @​truefoundry/trueforge-sdk@​0.2.1
    • @​truefoundry/trueforge-assistant-ui-runtime@​0.2.0

0.4.0-rc.0

Minor Changes

  • a855122: Rename the published runtime package to @truefoundry/trueforge-assistant-ui-runtime, move it into the TrueForge workspace, rename its public runtime APIs to TrueForge, and remove the legacy TrueFoundry server adapter and server configuration.

... (truncated)

Commits
  • 75e877f Version Packages (#931)
  • ebbf6c0 Version Packages (#849)
  • 33cbe52 Restore default MCP tool approval to write and destructive (#895)
  • fdd8520 fix: paginate Agents and Schedules tables from API page tokens (#863)
  • ad66480 Fix: Hide tool approval actions in session details (#883)
  • 20f4179 Update trueforge light theme color tokens (#885)
  • f4ee3dc feat: Add session sharing with configurable permissions (#860)
  • 72a1168 chore: allow search in sessions agent filter (#864)
  • c783700 chore: show task details and failure reasons in schedule (#870)
  • bbc4f7d fix: add paused to turn state, add mcp auth_continue event. (#866)
  • Additional commits viewable in compare view

Updates next from 16.3.3 to 16.3.8

Release notes

Sourced from next's releases.

v16.3.8

This release contains security fixes for the following advisories:

High:

Medium:

Low:

v16.3.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • turbo-tasks-backend: fix strongly consistent read hanging on a canceled task (#98931)

Credits

Huge thanks to @​lukesandberg for helping!

v16.3.6

This release contains a security fix for GHSA-vcvr-r3jv-pc5j: Remote Code Execution in next/og ImageResponse

v16.3.5

The following bug fixes have been backported. It does not include all pending features/changes on canary.

  • next/image: Skip 0-byte entries when initializing disk LRU cache (#98185)
  • next/image: Reject empty images when reading/writing to the disk cache (#98186)
  • Emit whole-app server NFTs when output: 'standalone' is used with an adapter (#98167)
  • Add CSP nonce to script tags of loading and template files (#98403)
  • Fix use cache prerender signal retention (#98448)

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

  • testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
  • Fix build error when aliasing typescript to @​typescript/typescript6 (#97997)
  • Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

... (truncated)

Commits
  • b0fad0d v16.3.8
  • 719e4c6 [lts-active] Scope response cache keys to their source route (#218)
  • e92db45 [lts-active] Fix metadata propagation for deduplicated nested caches (#223)
  • 40c2ba9 [lts-active] Match Next data paths case-sensitively (#196)
  • 2d9f50a [lts-active] Fix MCP middleware DNS rebinding (#213)
  • bd9214f [lts-active] Fix draft mode leaks through cross-request 'use cache' dedupli...
  • 8db4a62 [lts-active][webpack] Ensure dynamicParams is respected in `opengraph-image...
  • e002ad6 [lts-active] fix(next/image): Pin DNS resolution when fetching external image...
  • 4c20699 v16.3.7
  • 2521aec [backport] turbo-tasks-backend: fix strongly consistent read hanging on a can...
  • Additional commits viewable in compare view

Updates react from 19.2.8 to 19.3.0

Release notes

Sourced from react's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

New React DOM Features

  • browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
    • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

All Changes

React

  • Fast Refresh Fixes
  • Performance Track Fixes
    • Prevent crash when accessing $$typeof in Performance Tracks (@​eps1lon #35679)
    • Handle non-string function names in Performance Tracks (@​eps1lon #35659)
    • Use minus (-) instead of en dash for removed props in Performance Tracks (@​eps1lon #35649)
    • Handle arrays with bigints in deep objects in Performance Tracks (@​eps1lon #35648)
    • Don't enumerate typed array props in Performance Tracks in DEV (@​UditDewan #36913)...

      Description has been truncated

@dependabot
chore(deps): bump the airlock-npm group across 1 directory with 15 up…
0b047cc 
…dates

Bumps the airlock-npm group with 15 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [playwright-core](https://github.com/microsoft/playwright) | `1.62.1` | `1.63.0` |
| [yaml](https://github.com/eemeli/yaml) | `2.9.0` | `2.9.1` |
| [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.6.5` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `24.13.3` | `24.19.1` |
| [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.23.0` | `8.23.1` |
| [@truefoundry/trueforge-sdk](https://github.com/truefoundry/trueforge/tree/HEAD/packages/trueforge-sdk) | `0.1.3` | `0.2.1` |
| [@truefoundry/trueforge-ui](https://github.com/truefoundry/trueforge/tree/HEAD/packages/trueforge-ui) | `0.2.4` | `0.4.1` |
| [next](https://github.com/vercel/next.js) | `16.3.3` | `16.3.8` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.8` | `19.3.0` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.18` | `19.3.0` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.8` | `19.3.0` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.5` | `19.3.0` |
| [@eslint/eslintrc](https://github.com/eslint/eslintrc) | `3.3.6` | `3.3.7` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.18` | `19.3.0` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.5` | `19.3.0` |
| [eslint](https://github.com/eslint/eslint) | `9.39.5` | `10.12.0` |
| [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.3.3` | `16.3.8` |



Updates `playwright-core` from 1.62.1 to 1.63.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.62.1...v1.63.0)

Updates `yaml` from 2.9.0 to 2.9.1
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.9.0...v2.9.1)

Updates `zod` from 4.4.3 to 4.6.5
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.4.3...v4.6.5)

Updates `@types/node` from 24.13.3 to 24.19.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `pg` from 8.23.0 to 8.23.1
- [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md)
- [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.1/packages/pg)

Updates `@truefoundry/trueforge-sdk` from 0.1.3 to 0.2.1
- [Release notes](https://github.com/truefoundry/trueforge/releases)
- [Changelog](https://github.com/truefoundry/trueforge/blob/main/packages/trueforge-sdk/CHANGELOG.md)
- [Commits](https://github.com/truefoundry/trueforge/commits/@truefoundry/trueforge-sdk@0.2.1/packages/trueforge-sdk)

Updates `@truefoundry/trueforge-ui` from 0.2.4 to 0.4.1
- [Release notes](https://github.com/truefoundry/trueforge/releases)
- [Changelog](https://github.com/truefoundry/trueforge/blob/@truefoundry/trueforge-ui@0.4.1/packages/trueforge-ui/CHANGELOG.md)
- [Commits](https://github.com/truefoundry/trueforge/commits/@truefoundry/trueforge-ui@0.4.1/packages/trueforge-ui)

Updates `next` from 16.3.3 to 16.3.8
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.3.3...v16.3.8)

Updates `react` from 19.2.8 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react)

Updates `@types/react` from 19.2.18 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `react-dom` from 19.2.8 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react-dom)

Updates `@types/react-dom` from 19.2.5 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `@eslint/eslintrc` from 3.3.6 to 3.3.7
- [Release notes](https://github.com/eslint/eslintrc/releases)
- [Changelog](https://github.com/eslint/eslintrc/blob/main/CHANGELOG.md)
- [Commits](eslint/eslintrc@eslintrc-v3.3.6...eslintrc-v3.3.7)

Updates `@types/react` from 19.2.18 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `@types/react-dom` from 19.2.5 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `eslint` from 9.39.5 to 10.12.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v9.39.5...v10.12.0)

Updates `eslint-config-next` from 16.3.3 to 16.3.8
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.8/packages/eslint-config-next)

---
updated-dependencies:
- dependency-name: playwright-core
  dependency-version: 1.63.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: airlock-npm
- dependency-name: yaml
  dependency-version: 2.9.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: airlock-npm
- dependency-name: zod
  dependency-version: 4.6.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: airlock-npm
- dependency-name: "@types/node"
  dependency-version: 24.19.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: airlock-npm
- dependency-name: pg
  dependency-version: 8.23.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: airlock-npm
- dependency-name: "@truefoundry/trueforge-sdk"
  dependency-version: 0.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: airlock-npm
- dependency-name: "@truefoundry/trueforge-ui"
  dependency-version: 0.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: airlock-npm
- dependency-name: next
  dependency-version: 16.3.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: airlock-npm
- dependency-name: react
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: airlock-npm
- dependency-name: "@types/react"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: airlock-npm
- dependency-name: react-dom
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: airlock-npm
- dependency-name: "@types/react-dom"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: airlock-npm
- dependency-name: "@eslint/eslintrc"
  dependency-version: 3.3.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: airlock-npm
- dependency-name: "@types/react"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: airlock-npm
- dependency-name: "@types/react-dom"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: airlock-npm
- dependency-name: eslint
  dependency-version: 10.12.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: airlock-npm
- dependency-name: eslint-config-next
  dependency-version: 16.3.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: airlock-npm
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 5, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 8, 2026

Copy link
Copy Markdown
Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 8, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/airlock-npm-9056c34e15 branch October 8, 2026 20:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants