chore(deps): bump the production group across 1 directory with 12 updates by dependabot[bot] · Pull Request #299 · bejranonda/ExternalBrain

dependabot · 2026-10-26T18:30:46Z

Bumps the production group with 12 updates in the / directory:

Package	From	To
@modelcontextprotocol/sdk	`1.32.1`	`1.32.2`
pg-boss	`12.18.2`	`12.38.0`
zod	`4.4.3`	`4.6.7`
next	`16.3.8`	`16.4.3`
react	`19.2.5`	`19.3.1`
react-dom	`19.2.5`	`19.3.1`
zustand	`5.0.12`	`5.0.16`
pino	`10.3.1`	`10.4.0`
@prisma/adapter-pg	`7.8.0`	`7.10.1`
@prisma/client	`7.8.0`	`7.10.1`
@prisma/client-runtime-utils	`7.8.0`	`7.10.1`
pg	`8.20.0`	`8.23.1`

Updates @modelcontextprotocol/sdk from 1.32.1 to 1.32.2

Release notes

Sourced from @modelcontextprotocol/sdk's releases.

1.32.2

What's Changed

fix: add explicit | undefined to Transport optional properties (v1.x backport of #1766) by @kishormorol in modelcontextprotocol/typescript-sdk#2814

[v1.x] fix: allow registering after connect() when the capability was declared by @claude[bot] in modelcontextprotocol/typescript-sdk#2958

chore: bump version to 1.32.2 by @claude[bot] in modelcontextprotocol/typescript-sdk#3089

New Contributors

@kishormorol made their first contribution in modelcontextprotocol/typescript-sdk#2814

Full Changelog: modelcontextprotocol/typescript-sdk@1.32.1...1.32.2

Commits

3b73021 chore: bump version to 1.32.2 (#3089)
fa56d81 [v1.x] fix: allow registering after connect() when the capability was declare...
6919e95 fix: add explicit | undefined to Transport optional properties (v1.x backport...
See full diff in compare view

Updates pg-boss from 12.18.2 to 12.38.0

Release notes

Sourced from pg-boss's releases.

12.38.0

Schema version: 46. A migration runs on upgrade; see Upgrading.

Maintenance, job expiry and the bulk deletes work in batches, each in its own transaction, so a large backlog or an outage never turns into one long transaction.

findJobs(), getQueues(), getSchedules(), getBlockedKeys(), getDependencies(), getDependents(), getInstances() and getBamEntries() return at most 1,000 rows by default, in a fixed order, take a limit up to 100,000, and page with after.

deleteQueuedJobs(), deleteStoredJobs() and deleteAllJobs() resolve to how many jobs they deleted.

previewRedrive() takes a limit and reads at most that many jobs of each kind.

A work() handler that outruns its timeout holds its worker until it returns, with a handler_overrun warning.

With persistWarnings, handler_overrun, a failed LISTEN/NOTIFY listener and a disabled xmin_horizon check are written to the warning table.

Background migrations run back to back once one is pending, in order within a migration and table, and stop() waits for one only up to its timeout.

Performance tuning for monitoring and for update() and upsert() by key.

Batched maintenance and expiry

The retention sweep deleted every expired job of a table in one statement, and the orphaned dependency cleanup did the same for job_dependency. After an outage, a large backlog, or a lowered retention, that one statement could run for a long time, holding its row locks and the xmin horizon (and so autovacuum) for all of it. Both now walk each queue a batch at a time, each batch in its own transaction.

The timeout and heartbeat expiry sweeps fail expired jobs in batches too, so a fleet that stopped with many jobs active recovers in short transactions.

Without table partitioning (noTablePartitioning, as on CockroachDB), queue_stats retention deletes old snapshots in batches, on every supervise pass. With partitioning it still drops whole days.

A stop() between batches leaves the rest for the next pass.

Bulk deletes

deleteQueuedJobs(), deleteStoredJobs() and deleteAllJobs() delete in batches, and resolve to how many jobs they deleted instead of undefined:
const deleted = await boss.deleteStoredJobs('email-send')
deleteAllJobs() on a partitioned queue, or with no name, still empties the table with TRUNCATE, which reports no count, so it resolves to null. deleteQueue() on a queue in the shared table deletes its jobs in batches first, then the queue.

These deletes are no longer atomic. A failure partway leaves the batches before it deleted, and

... (truncated)

Commits

2c1005b versioning
a9bd9a6 update deps
b7a5e25 docs: vitepress 2.0.0-alpha.20 (#966)
400f1be bounded maintenance and reads, schema v46 (#961)
c91e31f Merge pull request #964 from timgit/dependabot/npm_and_yarn/docs/source-map-j...
a6a092e Merge pull request #965 from timgit/dependabot/npm_and_yarn/packages/dashboar...
114d16e ci: bump source-map-js from 1.2.1 to 1.2.2 in /docs
4310dcf ci: bump source-map-js from 1.2.1 to 1.2.2 in /packages/dashboard
cfc68b0 Merge pull request #963 from timgit/dependabot/github_actions/actions-2f4c4b3894
5cd0d2e ci: bump actions/setup-node from 7.0.0 to 7.1.0 in the actions group
Additional commits viewable in compare view

Updates zod from 4.4.3 to 4.6.7

Release notes

Sourced from zod's releases.

v4.6.7

Commits:

b500a2ee95134f81d74da7911d7378dd2853d042 4.6.7

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini

9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales

34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note

74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)

b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors

8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze

bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles

c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)

a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)

a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)

529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6

9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why

v4.6.5

Commits:

d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post

f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections

de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)

56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)

ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"

cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""

0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5

59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)

ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)

2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump

f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged

75d63ee1 docs: show only the .properties() method form in the 4.6 post

46da9572 docs: match the error-message examples to what the parsers emit

... (truncated)

Commits

b500a2e 4.6.7
9c21983 ci: stage at verbose so a failed OIDC token exchange says why
529f78d 4.6.6
a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
c42596b release: hold the run on the release-approval environment until the staged ve...
bacad51 docs: square the Code for Japan logo to match the other bronze tiles
8fb2faf docs: crop the Code for Japan logo and list it first in bronze
b2ef983 docs: add Code for Japan to bronze sponsors
74304ce release: stage npm versions instead of publishing them (#6622)
Additional commits viewable in compare view

Updates next from 16.3.8 to 16.4.3

Release notes

Sourced from next's releases.

v16.4.3

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

v16.4.2

[lts-active] Fix extensionless Google font URLs in both bundlers (#100277)

[lts-active] Don't load the app-page runtime in proxy.ts (#100423)

[lts-active] Revert "Turbopack: loader change invalidation (#95732)" (#100438)

[lts-active][cd] Gate release bot credentials behind GitHub environments (#100123)

[lts-active] test: Pin react-virtualized (#100545)

[lts-active][cd] Move release un-draft to a follow-up job in bot-autonomous (#100572)

[lts-active] Keep OpenTelemetry request traces together (#100349, #100294, #100324, #100350, #100552, #100583) (#100542)

[lts-active] Avoid loading standalone React in server bootstrap (#100610)

Credits

Huge thanks to @mischnic, @lukesandberg, @acdlite, @eps1lon, and @sokra for helping!

v16.4.2

What's Changed

[lts-active] turbo-tasks snapshot consistency fixes (#99644, #99732, #99649) by @lukesandberg in vercel/next.js#100002

[lts-active] Turbopack: backport Pages Router dev module graph chaining (#98823, #99910, #100091) by @sokra in vercel/next.js#100008

[lts-active] fix(next-code-frame): snap visible window to char boundaries by @lukesandberg in vercel/next.js#100212

[lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependency edges by @lukesandberg in vercel/next.js#100209

[lts-active] Turbopack: Ignore realpath errors during module resolution, matching node's behavior by @lukesandberg in vercel/next.js#100217

[lts-active] Backport docs fixes since v16.4.0 by @icyJoseph in vercel/next.js#100246

[lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions by @lukesandberg in vercel/next.js#100211

[lts-active] Backport additional documentation fixes since v16.4.0 by @aurorascharff in vercel/next.js#100262

Full Changelog: vercel/next.js@v16.4.1...v16.4.2

v16.4.1

This release contains security fixes for the following advisories:

Critical:

Unauthenticated Remote Code Execution in use cache functions returning typed arrays

Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

Denial of Service in App Router using Server Actions

v16.4.0

Check out the 16.4 announcement post to get an overview of the changes.

Core Changes

Show compiler plugin warning in more situations: #75682

... (truncated)

Commits

29bbeab v16.4.3
5117201 [lts-active] Avoid loading standalone React in server bootstrap (#100610)
37d603b [lts-active] Keep OpenTelemetry request traces together (#100349, #100294, #1...
cf9d27d [lts-active][cd] Move release un-draft to a follow-up job in bot-autonomous (...
3f6a632 [lts-active] test: Pin react-virtualized (#100545)
f715bba [lts-active][cd] Gate release bot credentials behind GitHub environments (#10...
c864c78 [lts-active] Revert "Turbopack: loader change invalidation (#95732)" (#100438)
f3ff943 [lts-active] Don't load the app-page runtime in proxy.ts (#100423)
f697cf5 [lts-active] Fix extensionless Google font URLs in both bundlers (#100277)
2864b17 v16.4.2
Additional commits viewable in compare view

Updates react from 19.2.5 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

Improve transport protocol (#37845 by @unstubbable and @eps1lon)

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

<ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@sebmarkbage, @jackpope, @gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)

Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@jackpope, @sebmarkbage, @eps1lon, @Dhakshin2007, @chirokas, @teamleaderleo, @fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@gnoff: #37143, #37241)

Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@gnoff #37193)

Notable changes

Enable Trusted Types API integration (@rickhanlonii #35816)

Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@acdlite #37290)

Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@hoxyq, @eps1lon: #37104, #37203, #37491)

All Changes

React

Fast Refresh Fixes

Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@sophiebits #36965)

Fix Fast Refresh so edits to a memo() comparison function take effect (@sophiebits #36964)

Fix Fast Refresh crash when an edit changes the kind of a component's type (@sophiebits #36963)

Unify hot reload type resolution for Fast Refresh (@sophiebits #36962)

Fix Fast Refresh to remount correctly when an edit changes the component kind (@sophiebits #36950)

Double invoke effects in StrictMode after Fast Refresh (@eps1lon #35962)

Performance Track Fixes

Prevent crash when accessing $$typeof in Performance Tracks (@eps1lon #35679)

Handle non-string function names in Performance Tracks (@eps1lon #35659)

Use minus (-) instead of en dash for removed props in Performance Tracks (@eps1lon #35649)

Handle arrays with bigints in deep objects in Performance Tracks (@eps1lon #35648)

Don't enumerate typed array props in Performance Tracks in DEV (@UditDewan #36913)

Bail out of diffing wide objects and arrays in Performance Tracks (@eps1lon #34742)

Clear potentially large performance measures in DEV (@hoxyq #34803)

Fix missing else branch for renders with no props change in Performance Tracks (@hoxyq #34837)

Activity Fixes

Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@sophiebits #36947)

Hide portal contents when an Activity is hidden (@acdlite #35091)

Prevent metadata hoisting in hidden <Activity> trees (@ronnakamoto #34983)

... (truncated)

Changelog

Sourced from react's changelog.

19.3.0 (September 9, 2026)

New React Features

<ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@sebmarkbage, @jackpope, @gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)

Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@jackpope, @sebmarkbage, @eps1lon, @Dhakshin2007, @chirokas, @teamleaderleo, @fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@gnoff: #37143, #37241)

Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@gnoff #37193)

Notable changes

Enable Trusted Types API integration (@rickhanlonii #35816)

Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@acdlite #37290)

Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@hoxyq, @eps1lon: #37104, #37203, #37491)

All Changes

React

Fast Refresh Fixes

Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@sophiebits #36965)

Fix Fast Refresh so edits to a memo() comparison function take effect (@sophiebits #36964)

Fix Fast Refresh crash when an edit changes the kind of a component's type (@sophiebits #36963)

Unify hot reload type resolution for Fast Refresh (@sophiebits #36962)

Fix Fast Refresh to remount correctly when an edit changes the component kind (@sophiebits #36950)

Double invoke effects in StrictMode after Fast Refresh (@eps1lon #35962)

Performance Track Fixes

Prevent crash when accessing $$typeof in Performance Tracks (@eps1lon #35679)

Handle non-string function names in Performance Tracks (@eps1lon #35659)

Use minus (-) instead of en dash for removed props in Performance Tracks (@eps1lon #35649)

Handle arrays with bigints in deep objects in Performance Tracks (@eps1lon #35648)

Don't enumerate typed array props in Performance Tracks in DEV (@UditDewan #36913)

Bail out of diffing wide objects and arrays in Performance Tracks (@eps1lon #34742)

Clear potentially large performance measures in DEV (@hoxyq #34803)

Fix missing else branch for renders with no props change in Performance Tracks (@hoxyq #34837)

Activity Fixes

Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@sophiebits #36947)

Hide portal contents when an Activity is hidden (@acdlite #35091)

Prevent metadata hoisting in hidden <Activity> trees (@ronnakamoto #34983)

Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@acdlite #35074)

Don't unhide a node if a direct parent Offscreen is still hidden (@sebmarkbage #34821)

Don't show internal <Offscreen> component in error messages (@rickhanlonii #35763)

Warn in DEV when a component appears to have been unblocked by a conditional use() (@hoxyq, @eps1lon: #37104, #37203, #37491)

Render transitions independently instead of entangling them into a single render (@acdlite #37290)

Fix hang when updating a dehydrated boundary inside a hidden tree (@gaearon #37135)

Don't reacquire Host Singletons during dev effect validation (@gnoff #37113)

Only remove properties from Host Singletons on release (@gnoff #37112)

... (truncated)

Commits

61aa00d [19.3.x][Flight] Improve transport protocol (#37845)
2dc7da7 [test] Bump Jest to 30.4 (#37382)
4f93894 docs: remove stale parentType param from validateChildKeys JSDoc (#36928)
dbc3750 Update required references to GitHub repo (#36752)
900ae09 [flow] Bump flow to v0.317.0 (#36701)
fbb1370 [flow] Bump flow to v0.307.1 (#36199)
56922cf [react-native-renderer] Delete Paper (legacy) renderer (#36285)
74568e8 [Flight] Transport AggregateErrors.errors (#36156)
e66ef64 [tests] remove withoutStack from assertConsole helpers (#35498)
db71391 [Fiber] Instrument the lazy initializer thenable in all cases (#35521)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react since your current version.

Updates react-dom from 19.2.5 to 19.3.1

Release notes

Sourced from react-dom's releases.

19.3.1 (October 14th, 2026)

React Server Components

Improve transport protocol (#37845 by @unstubbable and @eps1lon)

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

<ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@sebmarkbage, @jackpope, @gaearon: #31975, #31987, #31996,

…ates Bumps the production group with 12 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.32.1` | `1.32.2` | | [pg-boss](https://github.com/timgit/pg-boss) | `12.18.2` | `12.38.0` | | [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.6.7` | | [next](https://github.com/vercel/next.js) | `16.3.8` | `16.4.3` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.5` | `19.3.1` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.5` | `19.3.1` | | [zustand](https://github.com/pmndrs/zustand) | `5.0.12` | `5.0.16` | | [pino](https://github.com/pinojs/pino) | `10.3.1` | `10.4.0` | | [@prisma/adapter-pg](https://github.com/prisma/orm/tree/HEAD/packages/adapter-pg) | `7.8.0` | `7.10.1` | | [@prisma/client](https://github.com/prisma/orm/tree/HEAD/packages/client) | `7.8.0` | `7.10.1` | | [@prisma/client-runtime-utils](https://github.com/prisma/orm/tree/HEAD/packages/client-runtime-utils) | `7.8.0` | `7.10.1` | | [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.20.0` | `8.23.1` | Updates `@modelcontextprotocol/sdk` from 1.32.1 to 1.32.2 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](modelcontextprotocol/typescript-sdk@1.32.1...1.32.2) Updates `pg-boss` from 12.18.2 to 12.38.0 - [Release notes](https://github.com/timgit/pg-boss/releases) - [Commits](timgit/pg-boss@12.18.2...12.38.0) Updates `zod` from 4.4.3 to 4.6.7 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.4.3...v4.6.7) Updates `next` from 16.3.8 to 16.4.3 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.3.8...v16.4.3) Updates `react` from 19.2.5 to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react) Updates `react-dom` from 19.2.5 to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom) Updates `zustand` from 5.0.12 to 5.0.16 - [Release notes](https://github.com/pmndrs/zustand/releases) - [Commits](pmndrs/zustand@v5.0.12...v5.0.16) Updates `pino` from 10.3.1 to 10.4.0 - [Release notes](https://github.com/pinojs/pino/releases) - [Commits](pinojs/pino@v10.3.1...v10.4.0) Updates `@prisma/adapter-pg` from 7.8.0 to 7.10.1 - [Release notes](https://github.com/prisma/orm/releases) - [Commits](https://github.com/prisma/orm/commits/7.10.1/packages/adapter-pg) Updates `@prisma/client` from 7.8.0 to 7.10.1 - [Release notes](https://github.com/prisma/orm/releases) - [Commits](https://github.com/prisma/orm/commits/7.10.1/packages/client) Updates `@prisma/client-runtime-utils` from 7.8.0 to 7.10.1 - [Release notes](https://github.com/prisma/orm/releases) - [Commits](https://github.com/prisma/orm/commits/7.10.1/packages/client-runtime-utils) Updates `pg` from 8.20.0 to 8.23.1 - [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md) - [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.1/packages/pg) --- updated-dependencies: - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.32.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production - dependency-name: pg-boss dependency-version: 12.38.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: zod dependency-version: 4.6.7 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: next dependency-version: 16.4.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: react dependency-version: 19.3.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: react-dom dependency-version: 19.3.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: zustand dependency-version: 5.0.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production - dependency-name: pino dependency-version: 10.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: "@prisma/adapter-pg" dependency-version: 7.10.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: "@prisma/client" dependency-version: 7.10.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: "@prisma/client-runtime-utils" dependency-version: 7.10.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: pg dependency-version: 8.23.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production ... Signed-off-by: dependabot[bot] <support@github.com>

coderabbitai · 2026-10-26T18:30:57Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

Source mode: Auto
Repository: bejranonda/ExternalBrain
Branch: main
File: .coderabbit.yaml
Commit: 41eb994
Layers: Repository YAML
Review profile: CHILL
Plan: Advanced
Run ID: f9165d70-f046-4634-aef3-6ac33b639947

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 26, 2026

Navigation Menu

Repository navigation

chore(deps): bump the production group across 1 directory with 12 updates - #299

chore(deps): bump the production group across 1 directory with 12 updates#299
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-d2283ce994

dependabot Bot commented on behalf of github Oct 26, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 26, 2026

Review skipped

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

1.32.2

What's Changed

New Contributors

12.38.0

Batched maintenance and expiry

Bulk deletes

v4.6.7

Commits:

v4.6.6

Commits:

v4.6.5

Commits:

v4.6.4

v4.6.3

v16.4.3

Core Changes

Credits

v16.4.2

What's Changed

v16.4.1

v16.4.0

Core Changes

19.3.1 (October 14th, 2026)

React Server Components

19.3.0 (September 9, 2026)

New React Features

New React DOM Features

Notable changes

All Changes

React

19.3.0 (September 9, 2026)

New React Features

New React DOM Features

Notable changes

All Changes

React

19.3.1 (October 14th, 2026)

React Server Components

19.3.0 (September 9, 2026)

New React Features

Uh oh!

coderabbitai Bot commented Oct 26, 2026

Review skipped

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Oct 26, 2026 •

edited

Loading