Skip to content

build(deps): bump the npm-dependencies group across 1 directory with 13 updates - #117

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-58c647c7a3
Closed

build(deps): bump the npm-dependencies group across 1 directory with 13 updates#117
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-58c647c7a3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-dependencies group with 13 updates in the / directory:

Package From To
@tanstack/react-query 5.103.2 5.105.0
lucide-react 1.48.0 1.65.0
postgres 3.4.9 4.0.0
react 19.3.0 19.3.1
react-dom 19.3.0 19.3.1
viem 2.56.9 2.57.13
@cloudflare/vite-plugin 1.64.0 1.66.0
@cloudflare/workers-types 5.20260925.1 5.20261030.1
@types/node 26.6.2 26.6.6
@vitejs/plugin-react 6.1.1 6.1.2
knip 6.38.0 6.44.0
wrangler 4.152.0 4.156.0
vite-plus 1.4.0 1.5.0

Updates @tanstack/react-query from 5.103.2 to 5.105.0

Changelog

Sourced from @​tanstack/react-query's changelog.

5.105.0

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.105.0

5.104.5

Patch Changes

  • #12117 1f8d134 - Recompute useMutationState and useIsMutating results when their filters, selector, or query client change, without waiting for a mutation cache update.
  • Updated dependencies [f608f93]:
    • @​tanstack/query-core@​5.104.5

5.104.4

Patch Changes

  • #11328 c208861 - Allow queries with falsy errors to retry on mount when throwOnError returns false.

  • #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency

  • Updated dependencies [1fee044, fce89dd]:

    • @​tanstack/query-core@​5.104.4

5.104.3

Patch Changes

  • Updated dependencies [0f15bc9]:
    • @​tanstack/query-core@​5.104.3

5.104.2

Patch Changes

  • Updated dependencies [03e8c39]:
    • @​tanstack/query-core@​5.104.2

5.104.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.104.1

5.104.0

Minor Changes

... (truncated)

Commits
  • 5cc606e ci: Version Packages (#12301)
  • 14cc330 style(packages): write durations in 'count * unit * 1000' order (#12382)
  • d7c0418 chore(react-query/{useQuery,useInfiniteQuery}): remove the unused '@​eslint-re...
  • aa3e26b chore(react-query/{HydrationBoundary,utils}): explain why 'react-hooks-js/ref...
  • b2801aa test(react-query/useMutation): assert that the mutation settles in the cache ...
  • 43636c4 test(react-query/useMutation): wait for the mutation to settle after unmount ...
  • 1eed9d9 chore(*): explain why 'vitest-js/valid-expect' is disabled for the 'expectTyp...
  • 6bdeb13 test(*/useQuery): rename the 'throwOnError' callback parameter to 'err' to av...
  • 86b9f20 test(*/useMutationState): rename the built 'mutation' to 'existingMutation' t...
  • d09972b test(*): rename the 'queryKey' test helper to 'createKey' since it creates ke...
  • Additional commits viewable in compare view

Updates lucide-react from 1.48.0 to 1.65.0

Release notes

Sourced from lucide-react's releases.

Version 1.65.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.64.0...1.65.0

Version 1.64.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.63.0...1.64.0

Version 1.63.0

What's Changed

... (truncated)

Commits
  • 1668a0c chore(deps): bump rollup to 4.65.1 and keep typescript on v6 (#5110)
  • e8f86fc fix(lucide-react): ignore stale DynamicIcon loads after the name changes (#5060)
  • 6657faa chore(deps-dev): bump vite from 8.3.2 to 8.3.3 (#5052)
  • 1802f33 feat(lucide-react): add package exports for per-icon imports without changing...
  • 20aef31 chore(packages): Update sponsors (#5034)
  • fa238cf chore(deps): bump the react-deps group across 1 directory with 2 updates (#5026)
  • 3f1255e chore(deps-dev): bump @​vitejs/plugin-react (#4995)
  • 949bc6d test(lucide-react): add tests for DynamicIcon fallback and ref forwarding (#4...
  • 98331e2 chore(deps): bump the react-deps group across 1 directory with 3 updates (#4951)
  • 09aa9c5 chore(deps): Upgrade to vite 8 (#4950)
  • Additional commits viewable in compare view

Updates postgres from 3.4.9 to 4.0.0

Release notes

Sourced from postgres's releases.

v4.0.0

v4 rewrites everything below the public API: the pool, the connection, the protocol, startup and the socket layer. Queries, helpers, transactions, cursors, COPY, listen, subscribe, large objects and the options work as in 3.4.9, apart from the changes below.

Security

  • A NUL character in a connection parameter can no longer add parameters (also in v3). A database, user or connection value such as 'db\0user\0postgres' was sent as further startup parameters, so an app that put untrusted input there, as with a database per tenant, could be made to log in as another user where that user needs no password, or with replication or options set. A NUL in any protocol string, also in query text and identifiers, now rejects with NUL_CHARACTER.
  • A column named __proto__ is an own property (also in v3). It became the prototype of the row, so a JSON value in it, for instance from a column alias built from user input, made the row inherit its properties (row.isAdmin), in query results and in sql.subscribe rows alike.

Upgrading from v3

The README has an upgrade guide, with a query that shows whether the change in parameter types concerns you.

  • The server decides the type of every parameter (infer: false by default) (#392). v3 typed a Date as timestamptz, a boolean, a Buffer, a bigint and arrays of these from JavaScript; v4 sends them without a type and writes each value for the type the server asks for, as libpq does. timestamptz columns, values written to a column of their own type, strings, numbers and anything cast work as before. Outside UTC, a Date written to or compared with a timestamp or date column is taken as UTC instead of the session's local time, and a timestamp is read as UTC, so it comes back as the instant that was written whatever the time zone. A Date where the query doesn't decide its type, such as in date_trunc('day', ${ date }), needs a cast (${ date }::timestamptz). infer: true keeps v3's behaviour.
  • Runtimes. Node.js 20 or later, Bun, and Cloudflare Workers; Deno through its Node.js compatibility. The CommonJS and Deno builds are gone: Postgres.js is an ES module, which require can load on Node.js 20.19 and 22.12 and later (require('postgres').default).
  • sql.array() is removed. Pass the array as it is, with a cast where the query doesn't decide its type: ${ ids }::int[]. Calling sql.array() throws ARRAY_REMOVED.
  • A transaction the server rolled back rejects. When the server answers COMMIT with ROLLBACK, sql.begin rejects with TRANSACTION_ROLLED_BACK; v3 took it as a commit.
  • A released connection stays released. A query on a reserved sql after release(), or on a transaction's sql after it has committed or rolled back, rejects; v3 ran it on whatever connection it then had. Releasing a reserved connection while its own BEGIN is still open closes it instead of returning an open transaction to the pool.
  • An unsafe begin outside sql.begin, a reserved connection or max: 1 rejects with UNSAFE_TRANSACTION and is rolled back. A query that looks like it may open a transaction runs alone on its connection, so nothing else lands in it, and any query that leaves its connection in a transaction is rolled back and rejected. v3 rejected BEGIN but left the transaction open. A script that opens and closes its own transaction in one query, such as a migration file with BEGIN and COMMIT, runs; v3 ran it and still rejected it.
  • A query that cannot be built or serialized inside a transaction aborts the transaction, in sql.begin (#1236, #1238) or one opened by hand on a reserved connection, just as a server error would: the queries after it fail with 25P02 and a later COMMIT answers ROLLBACK. v3 skipped the query and let the rest commit.
  • Domains that exist when the pool starts are read and written as their base type, so a domain over int[] comes back as an array of numbers; v3 returned the text.
  • A connection refused for too many connections (53300) is retried with backoff until connect_timeout has passed, and the waiting queries reject with that error only then. Such a refusal is often momentary: connections opened at the same time against a connection limit can all be refused while the server counts them. v3 rejected the queries of the refused connection at once.
  • No host matching target_session_attrs rejects with CONNECTION_DESTROYED instead of retrying forever.
  • An unknown authentication type rejects with AUTH_TYPE_NOT_IMPLEMENTED instead of waiting for the connect timeout.
  • A replication error with no onerror is logged. When the sql.subscribe stream fails and none of its subscriptions has an onerror, the error goes to console.error before the stream reconnects; v3 dropped it. Pass onerror to handle or silence it.
  • infinity timestamps are Infinity and -Infinity, both ways, instead of an invalid Date.
  • TypeScript: the types are an ES module with a default export and named types (import postgres, { type Sql } from 'postgres'). A reserved connection is no longer typed as having begin and end, which it never had.

New

  • Scheduling across connections: when every connection is busy, a query is pipelined on the connection where it should be done soonest, from how long each statement took before and how long what is in flight has run, and slow queries are kept together once the rest of the pool is needed for quick ones. In simulations of mixed workloads, the p99 of quick queries fell 2 to 100 times; on PostgreSQL, a 1 ms lookup no longer waits behind a report on a busy pool (p99.9 from 792 ms to 5 ms). scheduler: false pipelines on the busy connection with the fewest queries in flight instead; v3 went round-robin over the busy connections. With max: 1 it is off, as there is only one connection.
  • queue_timeout: seconds a query, transaction or reserve may wait for a connection before it rejects with QUEUE_TIMEOUT, unsent (#1036, #824).
  • .signal(abortSignal) on a query: aborting rejects it if it is still waiting, or cancels it if it is running.
  • Canceling a cursor between batches stops it. .cancel() or an aborted .signal() while the cursor's callback runs, or while an async iterator over it is between batches, fetches no more rows, closes the portal and rejects with 57014. v3 sent a cancel request that the idle server ignored, so the cursor ran on to the end (or, arriving late, could cancel the next query).
  • sql` and `.join(items) joins fragments and values with a fragment as separator, leaving out falsy items and adding spaces where missing (#807, #813).
  • Nested sql.begin inside a transaction runs in a savepoint (#985).
  • sql.rollback() rolls back a transaction, or the savepoint it is called in, without throwing; sql.begin resolves with the callback's result (#500).
  • Pipelining anywhere in a transaction is documented and tested: queries in a Promise.all between awaited ones are sent together and run in the order they were made (#951).
  • Custom types by name: to and from can be type names, looked up when the pool starts, with array types, for extension types such as pgvector (#1115, #719).
  • using and await using: sql ends the pool and a reserved connection is released when it goes out of scope (#886, #1094).
  • unref_sockets: true lets the process exit while connections are idle, like allowExitOnIdle in node-postgres (#869, #918).
  • min: connections kept open once the pool is used; idle_timeout closes only those above it (#672).
  • user as a function, called each time a connection opens, like password, for credentials that rotate (#881).
  • Password file: with no password given, PGPASSFILE or ~/.pgpass is read as libpq reads it (#964).
  • Named arguments: an object in the parentheses of a function call becomes name => value arguments, make_interval(${ sql({ days: 1 }) }) (#1040).
  • Errors are documented with their fields and how to tell them apart (#1140).
  • COPY row count: a copy ... from stdin writable has count and command once it has finished, with the number of rows the server copied (#465).
  • Persistent replication slots: slot: 'name' keeps the slot of sql.subscribe across restarts and streams from where it was last confirmed. A transaction is confirmed only once its handlers have finished, a handler that fails gets its transaction delivered again, and handlers may be async: they run one after the other in commit order while the stream waits.
  • More from sql.subscribe: truncate events, and the lsn, time and xid of the transaction on every change. Reconnecting retries with backoff.
  • Channel binding: over TLS, SCRAM authenticates with SCRAM-SHA-256-PLUS (tls-server-end-point) when the server offers it, binding the login to the server certificate. channel_binding is 'prefer' by default, 'require' or 'disable' as in libpq, also from the url or PGCHANNELBINDING; 'require' rejects an unbound connection with CHANNEL_BINDING_REQUIRED (#1008).
  • Direct TLS on Node.js with sslnegotiation: 'direct' (PostgreSQL 17+) is opened as TLS from the first byte and is the fastest encrypted connection.

... (truncated)

Changelog

Sourced from postgres's changelog.

v4.0.0 - 29 October 2026

v4 rewrites everything below the public API: the pool, the connection, the protocol, startup and the socket layer. Queries, helpers, transactions, cursors, COPY, listen, subscribe, large objects and the options work as in 3.4.9, apart from the changes below.

Security

  • A NUL character in a connection parameter can no longer add parameters (also in v3). A database, user or connection value such as 'db\0user\0postgres' was sent as further startup parameters, so an app that put untrusted input there, as with a database per tenant, could be made to log in as another user where that user needs no password, or with replication or options set. A NUL in any protocol string, also in query text and identifiers, now rejects with NUL_CHARACTER.
  • A column named __proto__ is an own property (also in v3). It became the prototype of the row, so a JSON value in it, for instance from a column alias built from user input, made the row inherit its properties (row.isAdmin), in query results and in sql.subscribe rows alike.

Upgrading from v3

The README has an upgrade guide, with a query that shows whether the change in parameter types concerns you.

  • The server decides the type of every parameter (infer: false by default) (#392). v3 typed a Date as timestamptz, a boolean, a Buffer, a bigint and arrays of these from JavaScript; v4 sends them without a type and writes each value for the type the server asks for, as libpq does. timestamptz columns, values written to a column of their own type, strings, numbers and anything cast work as before. Outside UTC, a Date written to or compared with a timestamp or date column is taken as UTC instead of the session's local time, and a timestamp is read as UTC, so it comes back as the instant that was written whatever the time zone. A Date where the query doesn't decide its type, such as in date_trunc('day', ${ date }), needs a cast (${ date }::timestamptz). infer: true keeps v3's behaviour.
  • Runtimes. Node.js 20 or later, Bun, and Cloudflare Workers; Deno through its Node.js compatibility. The CommonJS and Deno builds are gone: Postgres.js is an ES module, which require can load on Node.js 20.19 and 22.12 and later (require('postgres').default).
  • sql.array() is removed. Pass the array as it is, with a cast where the query doesn't decide its type: ${ ids }::int[]. Calling sql.array() throws ARRAY_REMOVED.
  • A transaction the server rolled back rejects. When the server answers COMMIT with ROLLBACK, sql.begin rejects with TRANSACTION_ROLLED_BACK; v3 took it as a commit.
  • A released connection stays released. A query on a reserved sql after release(), or on a transaction's sql after it has committed or rolled back, rejects; v3 ran it on whatever connection it then had. Releasing a reserved connection while its own BEGIN is still open closes it instead of returning an open transaction to the pool.
  • An unsafe begin outside sql.begin, a reserved connection or max: 1 rejects with UNSAFE_TRANSACTION and is rolled back. A query that looks like it may open a transaction runs alone on its connection, so nothing else lands in it, and any query that leaves its connection in a transaction is rolled back and rejected. v3 rejected BEGIN but left the transaction open. A script that opens and closes its own transaction in one query, such as a migration file with BEGIN and COMMIT, runs; v3 ran it and still rejected it.
  • A query that cannot be built or serialized inside a transaction aborts the transaction, in sql.begin (#1236, #1238) or one opened by hand on a reserved connection, just as a server error would: the queries after it fail with 25P02 and a later COMMIT answers ROLLBACK. v3 skipped the query and let the rest commit.
  • Domains that exist when the pool starts are read and written as their base type, so a domain over int[] comes back as an array of numbers; v3 returned the text.
  • A connection refused for too many connections (53300) is retried with backoff until connect_timeout has passed, and the waiting queries reject with that error only then. Such a refusal is often momentary: connections opened at the same time against a connection limit can all be refused while the server counts them. v3 rejected the queries of the refused connection at once.
  • No host matching target_session_attrs rejects with CONNECTION_DESTROYED instead of retrying forever.
  • An unknown authentication type rejects with AUTH_TYPE_NOT_IMPLEMENTED instead of waiting for the connect timeout.
  • A replication error with no onerror is logged. When the sql.subscribe stream fails and none of its subscriptions has an onerror, the error goes to console.error before the stream reconnects; v3 dropped it. Pass onerror to handle or silence it.
  • infinity timestamps are Infinity and -Infinity, both ways, instead of an invalid Date.
  • TypeScript: the types are an ES module with a default export and named types (import postgres, { type Sql } from 'postgres'). A reserved connection is no longer typed as having begin and end, which it never had.

New

  • Scheduling across connections: when every connection is busy, a query is pipelined on the connection where it should be done soonest, from how long each statement took before and how long what is in flight has run, and slow queries are kept together once the rest of the pool is needed for quick ones. In simulations of mixed workloads, the p99 of quick queries fell 2 to 100 times; on PostgreSQL, a 1 ms lookup no longer waits behind a report on a busy pool (p99.9 from 792 ms to 5 ms). scheduler: false pipelines on the busy connection with the fewest queries in flight instead; v3 went round-robin over the busy connections. With max: 1 it is off, as there is only one connection.
  • queue_timeout: seconds a query, transaction or reserve may wait for a connection before it rejects with QUEUE_TIMEOUT, unsent (#1036, #824).
  • .signal(abortSignal) on a query: aborting rejects it if it is still waiting, or cancels it if it is running.
  • Canceling a cursor between batches stops it. .cancel() or an aborted .signal() while the cursor's callback runs, or while an async iterator over it is between batches, fetches no more rows, closes the portal and rejects with 57014. v3 sent a cancel request that the idle server ignored, so the cursor ran on to the end (or, arriving late, could cancel the next query).
  • sql` and `.join(items) joins fragments and values with a fragment as separator, leaving out falsy items and adding spaces where missing (#807, #813).
  • Nested sql.begin inside a transaction runs in a savepoint (#985).
  • sql.rollback() rolls back a transaction, or the savepoint it is called in, without throwing; sql.begin resolves with the callback's result (#500).
  • Pipelining anywhere in a transaction is documented and tested: queries in a Promise.all between awaited ones are sent together and run in the order they were made (#951).
  • Custom types by name: to and from can be type names, looked up when the pool starts, with array types, for extension types such as pgvector (#1115, #719).
  • using and await using: sql ends the pool and a reserved connection is released when it goes out of scope (#886, #1094).
  • unref_sockets: true lets the process exit while connections are idle, like allowExitOnIdle in node-postgres (#869, #918).
  • min: connections kept open once the pool is used; idle_timeout closes only those above it (#672).
  • user as a function, called each time a connection opens, like password, for credentials that rotate (#881).
  • Password file: with no password given, PGPASSFILE or ~/.pgpass is read as libpq reads it (#964).
  • Named arguments: an object in the parentheses of a function call becomes name => value arguments, make_interval(${ sql({ days: 1 }) }) (#1040).
  • Errors are documented with their fields and how to tell them apart (#1140).
  • COPY row count: a copy ... from stdin writable has count and command once it has finished, with the number of rows the server copied (#465).
  • Persistent replication slots: slot: 'name' keeps the slot of sql.subscribe across restarts and streams from where it was last confirmed. A transaction is confirmed only once its handlers have finished, a handler that fails gets its transaction delivered again, and handlers may be async: they run one after the other in commit order while the stream waits.
  • More from sql.subscribe: truncate events, and the lsn, time and xid of the transaction on every change. Reconnecting retries with backoff.
  • Channel binding: over TLS, SCRAM authenticates with SCRAM-SHA-256-PLUS (tls-server-end-point) when the server offers it, binding the login to the server certificate. channel_binding is 'prefer' by default, 'require' or 'disable' as in libpq, also from the url or PGCHANNELBINDING; 'require' rejects an unbound connection with CHANNEL_BINDING_REQUIRED (#1008).

... (truncated)

Commits

Updates react from 19.3.0 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

Commits

Updates react-dom from 19.3.0 to 19.3.1

Release notes

Sourced from react-dom's releases.

19.3.1 (October 14th, 2026)

React Server Components

Commits

Updates viem from 2.56.9 to 2.57.13

Release notes

Sourced from viem's releases.

viem@2.57.13

Patch Changes

  • #5310 7e015cb1d72e6b54e4468d7dd60aa59a51fe8d9b Thanks @​BaronOdon! - Added Molibra chain.

  • #5314 c0d52cdcb262744a64e742e4cf891cbbde9ccdc9 Thanks @​jxom! - viem/tempo: Keyed Relay.accounts stored configs by chain ID so account_getConfig no longer serves a config stored for another chain (configs stored under the previous key are no longer read), added a resolveConfig option that resolves and stores configs the store does not hold, and reduced round trips by reading the commitment without a prior block number request and writing each config once.

  • #5332 de39e106022f313a16c3b7367d8330753748c516 Thanks @​jxom! - viem/tempo: Added signMessage and signTypedData support to Account.fromConfig configurable accounts, which sign the EIP-191 or EIP-712 digest with the same configurable signature envelope as sign.

  • #5325 2220ab8f52cf7fcf5420502d30272175b49065ca Thanks @​Slokh! - viem/tempo: Fixed formatting of Tempo transactions whose nonce exceeds Number.MAX_SAFE_INTEGER (such as TIP-1106 expiring-nonce discriminators), which made getTransaction, getBlock with includeTransactions and waitForTransactionReceipt replacement checks throw IntegerOutOfRangeError. Formatted Tempo transactions now carry nonce as an exact bigint, matching ox.

  • #5337 609f2bf5a127774904cbc9d97f0e9be7b45c3a7d Thanks @​jxom! - viem/tempo: Fixed Relay.feePayer not reporting base-fee floor rejections when the Tempo node returns fee cap less than base fee.

  • #5336 35e551ed4189d28749f0d12e67177a10e574f4f0 Thanks @​jxom! - viem/tempo: Fixed fillTransaction returning a number nonce on Tempo transactions when a nonce was passed and no fee payer signed the filled transaction.

  • #5330 1f9c2f00e6b18b194aa510ee09f4ae684af2e976 Thanks @​jxom! - Fixed watchEvent and watchContractEvent in the eth_getLogs fallback stalling for good when the blocks since the last poll exceeded the RPC Provider's block range, log count, or response size limit, repeating logs when an RPC node reported a lower block number, emitting logs from before a fromBlock past the latest block, ignoring fromBlock: 1n, and missing logs from the first polling interval without fromBlock.

viem@2.57.12

Patch Changes

... (truncated)

Commits
  • 6075b96 chore: version package (#5315)
  • 609f2bf fix(tempo): detect fee cap less than base fee rejections in `Relay.feePayer...
  • 35e551e fix(tempo): keep fillTransaction nonce as bigint when a nonce is requeste...
  • 9a2b41b fix(tempo): carry exact bigint nonces and keep formatter types (#5335)
  • 92e78aa chore(ci): consolidate pnpm setup actions (#5333)
  • d18ea6d chore: raise viem/chains size limits
  • 9f07ca9 fix(tempo): keep nonce a number and add exact nonceExact (#5334)
  • de39e10 feat(tempo): support signMessage and signTypedData on configurable accoun...
  • 1f9c2f0 fix: event watchers stop delivering logs once eth_getLogs hits an RPC limit...
  • dcd6198 chore: use vendored shared actions (#5328)
  • Additional commits viewable in compare view

Updates @cloudflare/vite-plugin from 1.64.0 to 1.66.0

Release notes

Sourced from @​cloudflare/vite-plugin's releases.

@​cloudflare/vite-plugin@​1.66.0

Minor Changes

  • #16539 046db08 Thanks @​petebacondarwin! - Update the development registry to use the canonical Cloudflare path

    Upgrade Miniflare to 5.20261023.1-beta and Wrangler to 4.154.0. Vite plugin v1 now uses CLOUDFLARE_DEV_REGISTRY_PATH or <Cloudflare config directory>/dev-registry/v5 for Worker discovery. MINIFLARE_REGISTRY_PATH is no longer read. When mixing Vite and Wrangler development sessions, set the same CLOUDFLARE_DEV_REGISTRY_PATH for both because Wrangler retains its legacy default.

  • #16407 9ec1101 Thanks @​petebacondarwin! - Support remote Hyperdrive bindings in Vite plugin v1 development and preview

    Set remote: true on a Hyperdrive binding in wrangler.jsonc to connect to its deployed configuration without a local database connection string. The retained remote proxy exposes the binding's connection string and socket streams, and remote session cleanup...

    Description has been truncated

    Summary by cubic

    Bumps 13 npm dependencies, most notably Postgres.js from 3.4.9 to 4.0.0, a major rewrite of the connection pool, protocol, and transactions that raises query throughput under load and fixes two security issues (NUL injection in connection parameters, __proto__ prototype pollution). The rest are patch and minor updates to React, @tanstack/react-query, viem, Cloudflare tooling, and dev tooling.

    Migration

    • Postgres postgres 4: the server decides parameter types by default (was client-side), DateTime values written to timestamp/date columns are UTC instead of local time, and sql.array() is removed.
    • Postgres postgres 4: the CommonJS and Deno builds are gone, and unsafe BEGIN, transactions the server rolled back, and queries after release() now reject instead of silently running.
    • @cloudflare/vite-plugin reads the dev registry from CLOUDFLARE_DEV_REGISTRY_PATH; mixing Vite and Wrangler dev sessions requires setting the same path for both.
    • The new Postgres scheduler pipelines queries to the connection that will finish soonest, cutting p99 latency for quick queries 2–100× in simulated mixed workloads.

    Bug Fixes

    • viem fixes event watchers stalling when RPC block-range limits are hit, retries HTTP requests against Retry-After headers, and fixes EIP-7702 transaction hash encoding for authorization yParity above 1.
    • @tanstack/react-query recomputes useMutationState/useIsMutating when filters or client change, and retries queries with falsy errors on mount when throwOnError returns false.
    • react/react-dom 19.3.1 improves the Server Components transport protocol, and lucide-react ignores stale DynamicIcon loads after the icon name changes.

    Written for commit c84fa50. Summary will update on new commits.

@dependabot
build(deps): bump the npm-dependencies group across 1 directory with …
c84fa50 
…13 updates

Bumps the npm-dependencies group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.103.2` | `5.105.0` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.48.0` | `1.65.0` |
| [postgres](https://github.com/porsager/postgres) | `3.4.9` | `4.0.0` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.3.0` | `19.3.1` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.3.0` | `19.3.1` |
| [viem](https://github.com/wevm/viem) | `2.56.9` | `2.57.13` |
| [@cloudflare/vite-plugin](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vite-plugin-cloudflare) | `1.64.0` | `1.66.0` |
| [@cloudflare/workers-types](https://github.com/cloudflare/workerd) | `5.20260925.1` | `5.20261030.1` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.2` | `26.6.6` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.1.1` | `6.1.2` |
| [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) | `6.38.0` | `6.44.0` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.152.0` | `4.156.0` |
| [vite-plus](https://github.com/voidzero-dev/vite-plus/tree/HEAD/packages/cli) | `1.4.0` | `1.5.0` |



Updates `@tanstack/react-query` from 5.103.2 to 5.105.0
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.105.0/packages/react-query)

Updates `lucide-react` from 1.48.0 to 1.65.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.65.0/packages/lucide-react)

Updates `postgres` from 3.4.9 to 4.0.0
- [Release notes](https://github.com/porsager/postgres/releases)
- [Changelog](https://github.com/porsager/postgres/blob/master/CHANGELOG.md)
- [Commits](porsager/postgres@v3.4.9...v4.0.0)

Updates `react` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react)

Updates `react-dom` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom)

Updates `viem` from 2.56.9 to 2.57.13
- [Release notes](https://github.com/wevm/viem/releases)
- [Commits](https://github.com/wevm/viem/compare/viem@2.56.9...viem@2.57.13)

Updates `@cloudflare/vite-plugin` from 1.64.0 to 1.66.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Changelog](https://github.com/cloudflare/workers-sdk/blob/@cloudflare/vite-plugin@1.66.0/packages/vite-plugin-cloudflare/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vite-plugin@1.66.0/packages/vite-plugin-cloudflare)

Updates `@cloudflare/workers-types` from 5.20260925.1 to 5.20261030.1
- [Release notes](https://github.com/cloudflare/workerd/releases)
- [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md)
- [Commits](https://github.com/cloudflare/workerd/commits)

Updates `@types/node` from 26.6.2 to 26.6.6
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@vitejs/plugin-react` from 6.1.1 to 6.1.2
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.2/packages/plugin-react)

Updates `knip` from 6.38.0 to 6.44.0
- [Release notes](https://github.com/webpro-nl/knip/releases)
- [Commits](https://github.com/webpro-nl/knip/commits/knip@6.44.0/packages/knip)

Updates `wrangler` from 4.152.0 to 4.156.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.156.0/packages/wrangler)

Updates `vite-plus` from 1.4.0 to 1.5.0
- [Release notes](https://github.com/voidzero-dev/vite-plus/releases)
- [Commits](https://github.com/voidzero-dev/vite-plus/commits/v1.5.0/packages/cli)

---
updated-dependencies:
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.105.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: lucide-react
  dependency-version: 1.65.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: postgres
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: react
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: react-dom
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: viem
  dependency-version: 2.57.13
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: "@cloudflare/vite-plugin"
  dependency-version: 1.66.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: "@cloudflare/workers-types"
  dependency-version: 5.20261030.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: "@types/node"
  dependency-version: 26.6.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.1.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: knip
  dependency-version: 6.44.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: wrangler
  dependency-version: 4.156.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: vite-plus
  dependency-version: 1.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from a team November 6, 2026 12:19
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 6, 2026
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Nov 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🚀 Deploying Preview to Cloudflare 🚀

Preview Deployments by commit

Status Deployment URL Commit Updated (UTC) See this deployment's details
  • Build: Failed ❌

View logs ↗		 c84fa50 2026-11-06T12:20:15.030Z View logs ↗

@socket-security

socket-security Bot commented Nov 6, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updated@​voidzero-dev/​vite-plus-core@​1.4.0 ⏵ 1.5.098 +110077 +198 -1100
Updatedlucide-react@​1.48.0 ⏵ 1.65.010010099 +296 +180
Updated@​types/​node@​26.6.2 ⏵ 26.6.6100 +110081 +195100
Updatedpostgres@​3.4.9 ⏵ 4.0.0100 +110010081 -6100
Updatedreact@​19.3.0 ⏵ 19.3.11001008497100
Updated@​cloudflare/​vite-plugin@​1.64.0 ⏵ 1.66.099 +11008798 +1100
Updated@​tanstack/​react-query@​5.103.2 ⏵ 5.105.0991009198100
Updatedwrangler@​4.152.0 ⏵ 4.156.098 +110092 +196 +1100
Updatedreact-dom@​19.3.0 ⏵ 19.3.110010092 +198100
Updated@​vitejs/​plugin-react@​6.1.1 ⏵ 6.1.2100 +1100100 +195100
Updatedknip@​6.38.0 ⏵ 6.44.099 +110095 +196 +1100
Updated@​cloudflare/​workers-types@​5.20260925.1 ⏵ 5.20261030.1100 +110096 +199100
Updatedviem@​2.56.9 ⏵ 2.57.1397100100 +198 +1100
Updatedvite-plus@​1.4.0 ⏵ 1.5.098 +110010099 -1100

View full report

@dependabot @github

dependabot Bot commented on behalf of github Nov 13, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Nov 13, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm-dependencies-58c647c7a3 branch November 13, 2026 12:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants