Skip to content

chore(deps): bump the production-dependencies group with 4 updates - #765

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/main/production-dependencies-4a568ae575
Open

chore(deps): bump the production-dependencies group with 4 updates#765
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/main/production-dependencies-4a568ae575

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 9, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 4 updates: @supabase/supabase-js, framer-motion, lucide-react and next.

Updates @supabase/supabase-js from 2.118.0 to 2.119.0

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.119.0

2.119.0 (2026-11-04)

🚀 Features

  • postgrest: expose query builder options to .from method - custom fetch per request (#1570)
  • realtime: broadcast persistence (#2690)

🩹 Fixes

  • auth: deleteUser miscast empty object to User (#2773)
  • auth: global sign out cleared the local session when the server failed to log out (#2786)
  • realtime: include vsn in the unsupported serializer error (#2812)
  • storage: exists reports invalid JWT or missing bucket as missing file (#2783)
  • storage: ignore undefined FileOptions during upload (#2789)

❤️ Thank You

v2.119.0-canary.6

2.119.0-canary.6 (2026-11-04)

This was a version bump only, there were no code changes.

v2.119.0-canary.5

2.119.0-canary.5 (2026-11-03)

🚀 Features

  • realtime: broadcast persistence (#2690)

🩹 Fixes

  • realtime: include vsn in the unsupported serializer error (#2812)

❤️ Thank You

  • Claude Opus 5.5
  • Guilherme Souza

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.119.0 (2026-11-04)

🚀 Features

  • postgrest: expose query builder options to .from method - custom fetch per request (#1570)

❤️ Thank You

Commits
  • d2090f3 ci(repo): migrate test configs to supabase cli v3 (#2811)
  • ecab7fb docs(misc): document SDK compatibility with Platform Services (#2798)
  • 8181a4d chore(deps): bump playwright to 1.64.0 (#2777)
  • bb56484 feat(postgrest): expose query builder options to .from method - custom fetch ...
  • e428dfe chore(release): version 2.118.0 changelogs (#2766)
  • See full diff in compare view

Updates framer-motion from 14.9.0 to 14.9.1

Changelog

Sourced from framer-motion's changelog.

[14.9.1] 2026-11-04

Added

  • Ensure accelerated transform animations finish correctly.
  • AnimatePresence: Fix exit never starting when a child mounts already exiting.
  • AnimatePresence: Fix exit stuck after an open layoutId card switches to another item.
  • Ensure accelerated animations are cleaned up in WebKit.
Commits
  • 6be4a29 v14.9.1
  • 4216b2f Updating changelog
  • 30b1051 Latest
  • a2c76b9 Raise the motion/remix size limit to 49.2 kB
  • e945386 Keep the timeline running on the drag-animate test page
  • 625e6af Merge pull request #4035 from motiondivision/claude/project-thread-fx11r9
  • 405ebe2 Merge pull request #4043 from motiondivision/claude/project-thread-8iynk0
  • e835b8f Merge pull request #4045 from motiondivision/claude/project-thread-cb06bn
  • cc43fef Merge pull request #4050 from motiondivision/claude/project-thread-5hniaw
  • 0a0584b Keep values when an element is shown again only to exit
  • Additional commits viewable in compare view

Updates lucide-react from 1.66.0 to 1.70.0

Release notes

Sourced from lucide-react's releases.

Version 1.70.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.69.0...1.70.0

Version 1.69.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.68.0...1.69.0

Version 1.68.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.67.0...1.68.0

Version 1.67.0

What's Changed

... (truncated)

Commits

Updates next from 16.4.3 to 16.4.5

Release notes

Sourced from next's releases.

v16.4.5

This release contains security fixes for the following advisories:

Moderate

v16.4.4

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. The announced security released for November will be published tomorrow.

Core Changes

  • [lts-active] test: disable the reads fallback params after a client navigation deployment test (#100668)
  • [lts-active] Reload on missed Turbopack startup CSS updates (#100619)
  • [lts-active] Revert "Optimize strict module factory chunks (#98421)" (#100866)
  • [lts-active] Emit the Turbopack shared-runtime bootstrap in the PPR resume so it gets the CSP nonce (#100907)
  • [lts-active] [ci] Pin deploy test deployments to Node.js 22.x (#100886)
  • [lts-active] fix(analyze): use route summaries as the analyzer route index (#100974)
  • [lts-active] Use fast-jwt instead of jsonwebtoken (#100885)

Credits

Huge thanks to @​icyJoseph, @​mischnic, @​wbinnssmith, @​lukesandberg, and @​eps1lon for helping!

Commits
  • 4e5335a v16.4.5
  • 809be72 [lts-active] Strip internal middleware cookie headers from edge responses (#282)
  • 2842833 [lts-active] Fix stale compressed framing for forwarded fetch responses (#281)
  • 6596840 [lts-active] [use cache] Fix cache key when binary args are used (#280)
  • 18eeffb [lts-active] Fix shared shell poisoning from request-supplied placeholder par...
  • e66e656 [lts-active] [next/image] Fix false-positive AVIF/HEIC detection (#278)
  • d605874 [lts-active] Fix unstable_cache leaking cold 'use cache' fills across roo...
  • 80c96ed [lts-active] Fix outer 'use cache' entries reused across root param values ...
  • b175f52 v16.4.4
  • ba4a4c1 [lts-active] Use fast-jwt instead of jsonwebtoken (#100885)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Summary by CodeRabbit

  • Chores
    • Updated supporting components to newer versions. No direct changes to the app’s features or behavior are included.

@dependabot
chore(deps): bump the production-dependencies group with 4 updates
7119edc 
Bumps the production-dependencies group with 4 updates: [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js), [framer-motion](https://github.com/motiondivision/motion), [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) and [next](https://github.com/vercel/next.js).


Updates `@supabase/supabase-js` from 2.118.0 to 2.119.0
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.119.0/packages/core/supabase-js)

Updates `framer-motion` from 14.9.0 to 14.9.1
- [Changelog](https://github.com/motiondivision/motion/blob/main/CHANGELOG.md)
- [Commits](motiondivision/motion@v14.9.0...v14.9.1)

Updates `lucide-react` from 1.66.0 to 1.70.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.70.0/packages/lucide-react)

Updates `next` from 16.4.3 to 16.4.5
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.4.3...v16.4.5)

---
updated-dependencies:
- dependency-name: "@supabase/supabase-js"
  dependency-version: 2.119.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: framer-motion
  dependency-version: 14.9.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: lucide-react
  dependency-version: 1.70.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: next
  dependency-version: 16.4.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from TheVicky1 as a code owner November 9, 2026 06:28
@vercel

vercel Bot commented Nov 9, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
pact-os Ready Ready Preview Nov 9, 2026 6:31am UTC

@dependabot dependabot Bot added area:developer-experience Local setup scripts, linter rules, Git hooks, dev environment type:security Security hardening, RLS policy audit, input sanitization labels Nov 9, 2026
@coderabbitai

coderabbitai Bot commented Nov 9, 2026 •
edited
Loading

Copy link
Copy Markdown

Explain Change →

No actionable comments were generated in the recent review.

Walkthrough

Four dependency versions changed in package.json: @supabase/supabase-js, framer-motion, lucide-react, and next.

Changes: Dependency version updates

Layer / File(s) Summary
Update dependency versions
package.json		 The declared versions of @supabase/supabase-js, framer-motion, lucide-react, and next were updated.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Possibly related PRs

Suggested labels: type:security

Merge Risk: Minimal · up to 7119e

No merge-blocking issue was identified in the dependency updates.

Architecture risk: Low · up to 7119e

The change affects 1 system.

Changed systems: package.json

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

  • observed — package.json (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

  • observed — Modified behavior in package.json: Updated @supabase/supabase-js from ^2.118.0 to ^2.119.0, framer-motion from ^14.9.0 to ^14.9.1, lucide-react from ^1.66.0 to ^1.70.0, and next from 16.4.3 to 16.4.5.
Pre-merge checks: Passed 5

Check name Status Explanation
Description Check Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check Passed The title "chore(deps): bump the production-dependencies group with 4 updates" matches the changeset. The PR updates four production dependencies (@supabase/supabase-js, framer-motion, lucide-react, n…
Docstring Coverage Passed No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Full details: Title check

Explanation

The title "chore(deps): bump the production-dependencies group with 4 updates" matches the changeset. The PR updates four production dependencies (@supabase/supabase-js, framer-motion, lucide-react, next) in package.json, and the objectives confirm it is a grouped Dependabot update. The title names the type of change and the scope, but it does not name the four packages. That omission is acceptable because the title is specific enough for a reviewer scanning history to understand the primary change.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches

Generate unit tests (beta)

  • Commit to this branch
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Recent review info

Run configuration

  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: d27b9b34-eb60-4264-8735-680fadad7825
Commits

Reviewing files that changed from the base of the PR and between 0165c58 and 7119edc.

Files ignored due to path filters: 1

  • package-lock.json is excluded by !**/package-lock.json
Files selected for processing: 1

  • package.json

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

This branch was successfully deployed

1 active deployment
Preview — 7119edc8 Deployed Nov 9, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@TheVicky1 TheVicky1 Awaiting requested review from TheVicky1 TheVicky1 is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

area:developer-experience Local setup scripts, linter rules, Git hooks, dev environment type:security Security hardening, RLS policy audit, input sanitization

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants