Skip to content

build(deps): bump the npm-dependencies group across 1 directory with 16 updates - #119

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-cc546dac9e
Open

build(deps): bump the npm-dependencies group across 1 directory with 16 updates#119
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-cc546dac9e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 13, 2026 •
edited by cubic-dev-ai Bot
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-dependencies group with 16 updates in the / directory:

Package From To
@tanstack/react-query 5.103.2 5.106.1
lucide-react 1.48.0 1.70.0
postgres 3.4.9 4.1.0
react 19.3.0 19.3.1
react-dom 19.3.0 19.3.1
viem 2.56.9 2.57.16
@cloudflare/vite-plugin 1.64.0 1.67.0
@cloudflare/workers-types 5.20260925.1 5.20261106.1
@tailwindcss/vite 4.3.3 4.3.4
@types/node 26.6.2 26.6.6
@vitejs/plugin-react 6.1.1 6.2.1
eslint-plugin-react-you-might-not-need-an-effect 1.0.2 1.1.0
knip 6.38.0 6.44.1
tailwindcss 4.3.3 4.3.4
wrangler 4.152.0 4.158.0
vite-plus 1.4.0 1.6.0

Updates @tanstack/react-query from 5.103.2 to 5.106.1

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.106.1

Patch Changes

  • #12528 c4ed956 - fix({query,react-query,preact-query}-devtools): always render the devtools left-to-right regardless of the page direction or browser language
  • Updated dependencies [c4ed956]:
    • @​tanstack/query-devtools@​5.106.1
    • @​tanstack/react-query@​5.106.1

@​tanstack/react-query-next-experimental@​5.106.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.106.1

@​tanstack/react-query-persist-client@​5.106.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-persist-client-core@​5.106.1
    • @​tanstack/react-query@​5.106.1

@​tanstack/react-query@​5.106.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.106.1

@​tanstack/react-query-devtools@​5.106.0

Patch Changes

  • #12499 46d0477 - Let inline devtools panels fill their container height while keeping a 500px default height when the container has no set height.
  • Updated dependencies [46d0477, f69b28a, 1176d37, 254350f]:
    • @​tanstack/query-devtools@​5.106.0
    • @​tanstack/react-query@​5.106.0

@​tanstack/react-query-next-experimental@​5.106.0

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.106.0

@​tanstack/react-query-persist-client@​5.106.0

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-persist-client-core@​5.106.0
    • @​tanstack/react-query@​5.106.0

@​tanstack/react-query@​5.106.0

Patch Changes

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.106.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.106.1

5.106.0

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.106.0

5.105.3

Patch Changes

5.105.2

Patch Changes

  • #12230 1e1caa5 - Update the observer options before subscribing so revealing an <Activity> tree whose query key changed while hidden no longer fetches the previous key.

  • #12480 8d0dc27 - Exclude status from the filters accepted by QueryClient.isMutating, useIsMutating, and injectIsMutating. These APIs always count mutations with status: 'pending'.

  • Updated dependencies [2ee2fd9, 8d0dc27, e69cac6, f2215d2, 86e7957, b6576b3, af0e0ef, 05d9b6a]:

    • @​tanstack/query-core@​5.105.2

5.105.1

Patch Changes

  • #11373 7ccba6e - fix({react,preact,angular,solid,vue}-query/infiniteQueryOptions): correct the overload selected for a possibly-undefined 'initialData'

  • #12390 18e54bf - Exclude fetchStatus from the filters accepted by QueryClient.isFetching, useIsFetching, and injectIsFetching. These APIs always count queries with fetchStatus: 'fetching'.

  • Updated dependencies [6f8a48d, 18e54bf]:

    • @​tanstack/query-core@​5.105.1

5.105.0

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.105.0

5.104.5

... (truncated)

Commits

Updates lucide-react from 1.48.0 to 1.70.0

Release notes

Sourced from lucide-react's releases.

Version 1.70.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.69.0...1.70.0

Version 1.69.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.68.0...1.69.0

Version 1.68.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.67.0...1.68.0

Version 1.67.0

What's Changed

... (truncated)

Commits
  • b196797 Update deps (#5146)
  • 588113e test(build-icons): cover Windows file URL imports (#4862)
  • 14cab02 feat(site): Add sponsor page (#5132)
  • 1668a0c chore(deps): bump rollup to 4.65.1 and keep typescript on v6 (#5110)
  • e8f86fc fix(lucide-react): ignore stale DynamicIcon loads after the name changes (#5060)
  • 6657faa chore(deps-dev): bump vite from 8.3.2 to 8.3.3 (#5052)
  • 1802f33 feat(lucide-react): add package exports for per-icon imports without changing...
  • 20aef31 chore(packages): Update sponsors (#5034)
  • fa238cf chore(deps): bump the react-deps group across 1 directory with 2 updates (#5026)
  • 3f1255e chore(deps-dev): bump @​vitejs/plugin-react (#4995)
  • Additional commits viewable in compare view

Updates postgres from 3.4.9 to 4.1.0

Release notes

Sourced from postgres's releases.

v4.1.0

New

  • query_timeout (#1278). Seconds a query may take, waiting for a connection and running together, before it is canceled and rejects with QUERY_TIMEOUT. Off by default. Unlike statement_timeout it also ends a query whose server or network has gone silent, which TCP alone takes many minutes to notice. Transaction control queries and forEach are limited too; cursors, streams and sql.listen are not.
  • cancel_timeout, 5 seconds by default: how long a canceled query may take to end before its connection is closed.
  • sql.batch([queries]) sends queries in one round trip with a single Sync: outside a transaction they commit or roll back together, and the batch rejects with the failing query's position in error.index.
  • json on a transform (#1169). The built-in transforms rename the keys of JSON values in results but send JSON values as they are. json: false leaves JSON values as they are both ways, and json: true renames their keys when sending too, with the transform's column.to. Without it nothing changes.
  • eager_types: true reads array types and domains when the pool starts instead of when a query first meets one.
  • sql.identifier(...parts) (#1292). An identifier from its parts, each quoted as it is and joined with ., for a name that contains a dot, which sql(name) reads as a separator: sql.identifier('acme.inc', 'users') gives "acme.inc"."users". The transform is not applied. With no parts it throws NO_PARTS.
  • Node.js 18 is supported again: engines is >=18 and CI runs it. Nothing in Postgres.js needs 20; using, await using and tracing are used where the runtime has them. Loading it with require still needs Node.js 20.19 or 22.12.
  • sql`...`.parsers(parsers) (#1294). A query's own parsers, for its rows only: by type, { [oid]: parse }, on top of the instance's types, or a function that gets each column and returns the parser for it, null for the server's text. A library that knows how to decode some queries' columns can decode them once, inside the row reader, while every other query on the instance and its pool keeps the instance's parsers. Such a query receives every column as text, so bytea and the integer arrays otherwise read in binary reach its parsers as text. A query without .parsers() reads its rows as before.

Fixed

  • sql.listen keeps its connection after the last unlisten() (#1298). The connection was closed so the process could exit (#1022), which made every following listen() connect again: about 3.5 ms instead of 0.1 ms per listen. It now stays open without keeping the process alive once nothing is listened.
  • PGSSLMODE is read (#1307). It was ignored, so PGSSLMODE=verify-full connected in plain text without an error. This may change how existing setups connect: require now uses TLS and fails against a server without it, and verify-ca and verify-full check the certificate against Node's CAs, not ~/.postgresql/root.crt or PGSSLROOTCERT. A url or an ssl option still comes first.
  • An insert helper after a quoted schema and an unquoted table builds the insert (#1304). In insert into ${ sql('s') }.t ${ sql(row) } or insert into "s".t, the quoted schema and the table were read as two words, so the row was taken for a list of identifiers and threw x.replace is not a function.
  • sql.listen keeps reconnecting when its first reconnect fails (#1285, #1286). After the listen connection closed, it was reopened once, and if that attempt failed, as it does while a restarting server still refuses connections, nothing tried again, so onlisten was never called and notifications were lost. A failed reconnect is now retried after backoff, until it succeeds, the channel is unlistened or the pool ends.
  • A canceled query whose server never answers no longer waits forever. .cancel(), .signal() and now query_timeout send a cancel request and waited for the server to end the query, so a server or network gone silent left both the query and the promise .cancel() returns pending until TCP gave up. This applies to every cancel, also without query_timeout: when the server doesn't answer within cancel_timeout, the connection is closed and the pool connects again. Whether the queries on it ran is unknown, so they reject with CONNECTION_DESTROYED (a timed out one with QUERY_TIMEOUT) whose cause is CANCEL_UNANSWERED, not with 57014. The cancel request's own connection is limited by cancel_timeout too, and a cancel is no longer sent for a query whose result has already arrived, where it could only hit the query after it. A cancel request whose own connection fails, as over TLS to a server gone silent, no longer crashes the process with an unhandled rejection. A query that times out while it waits behind another one on its connection is canceled only after it has had its own query_timeout once its turn comes, instead of the moment its turn comes, when it had usually finished and the cancel stopped the next query; if the server sends nothing for cancel_timeout while it waits, the connection is closed. A query waiting for types to be read rejects with QUERY_TIMEOUT without closing its connection, and the read of array types and domains is limited by query_timeout too.
  • sslrootcert, sslcert and sslkey in a url are used (#1308). They were sent to the server as startup parameters, so ?sslrootcert=system failed with unrecognized configuration parameter. Files are read into ca, cert and key. As in libpq, a root certificate with require or verify-ca checks the CA but not the host name, and verify-full checks both, as does ssl: true. A file without an sslmode means require.
  • A transaction the server ends rejects with the server's error (#1283, #1284). When a transaction_timeout (25P04), an idle_in_transaction_session_timeout (25P03) or pg_terminate_backend (57P01) ended the session, sql.begin rejected with CONNECTION_CLOSED, so a timeout or a termination looked the same as a network drop; it now rejects with the FATAL error the server sent before closing, as a query in flight already did, and a later query on that connection rejects with CONNECTION_CLOSED that has it as cause. A server restart or failover ends sessions with 57P01, so code that retries a transaction on CONNECTION_CLOSED should retry on that code too. A FATAL in answer to COMMIT rejects with CONNECTION_CLOSED that has it as cause, as the outcome is unknown, as it is when the connection is lost during COMMIT.
  • A server certificate is verified against an IP host (#1309). With ssl: 'verify-full' or ssl: true and an IP as the host, a connection upgraded to TLS checked the certificate against localhost, so a certificate for localhost from a trusted CA passed for any IP and a correct certificate for the IP failed. Direct TLS was not affected.
  • A savepoint or nested begin rejects when its transaction's connection is lost (#1281, #1282). One whose callback was still running when the connection went resolved with the callback's result after the transaction had already rejected; it now rejects with the transaction's error.
  • A connection closed while the pool reads its array and domain types counts as a failed connection attempt (#1279). Reconnecting follows backoff and waiting queries reject once connect_timeout has passed, instead of reconnecting as fast as the server accepts for as long as it keeps closing. With connect_timeout set to 0, null or false the pool now keeps trying for as long as it takes, as the option says, also after a refused or closed startup, which used to reject the waiting queries at once.
  • A query failed by a FATAL error gives that error to the queries pipelined behind it as well, instead of CONNECTION_CLOSED.
  • A FATAL error with the severity only in the S field is recognised as one. The non-localized V field is optional in the protocol: PostgreSQL sends it since 9.6, and a pooler that builds its own errors, such as PgBouncer, may send only the localized S. Such an error was not seen as FATAL, so the query, a sql.begin and the queries pipelined behind it rejected with CONNECTION_CLOSED without a cause instead of with the error. error.severity now falls back to severity_local when V is missing.
  • Each query on a connection that closes gets its own error. They shared one error object, so every query pipelined on the connection reported the first one's query and parameters.
  • A cached prepared statement no longer keeps the query that prepared it (#1287). Each connection's entry for a prepared statement kept that query's values and rows for as long as the statement stayed cached, up to 1,000 statements per connection, so an app with many distinct statements grew by their results until every cache was full: about 1.1 GB with 10 connections and 50-row results. They are let go once the query settles. On 4.0.0, prepare: false avoids it.
  • Destroying a copy ... to stdout stream frees the connection (#1306). After destroy(), breaking out of for await or a failed pipeline, the connection stayed paused for good and the queries behind it never ran. The rest of the copy is now read and dropped, so the connection is free once the server has sent it. The query is not canceled, so in a transaction the next query still succeeds.

Performance

  • An ssl object with a ca builds its TLS context once (#1280). The connections made with it share one context instead of each parsing the whole ca list again, so with a provider's CA bundle a new connection takes about half the time and CPU, and a burst of them no longer blocks the event loop. Replacing one of the object's values, as with a renewed cert, builds a new context for the connections after it.
  • A new statement whose untyped values are all numbers or null is prepared, described and run in one round trip, as one whose parameter types are all known is, since those values are written the same for any type the server picks; one with other values only the server can type is still described first, once per connection.
  • Array types and domains are read when a query first meets a type the pool does not know (an oid from 16384 up), instead of when the pool starts: a pool that only uses built-in types never sends that query, and a new pool's first query costs no more than any other. The connection that met the type waits for it, read on another connection. With custom types given by name they are still read at startup, as their oids are needed before the first query. Leases and values typed as a type the pool hasn't read yet still wait for it. A read whose connection fails is retried after backoff, and once connect_timeout has passed the connections waiting for it are closed and their queries reject, as for a failed startup. eager_types: true reads them when the pool starts, as before.
  • timestamptz, and timestamp and date read as UTC, are decoded straight from the bytes when they use the built-in parsers, with the text parser for anything else (BC, infinity, years before 1000); about 20% more rows per second for rows with timestamps.
  • bytea and arrays of int2, int4, int8 and bool are fetched in binary once a prepared statement's columns are known on the connection, when they use the built-in parsers: the values are the same as from the text, about 4.5 times faster to read for bytea and 3 times for an int4[]. A custom parser for the type or its elements, and raw(), still get the text.
  • A connection that becomes ready while others are still opening no longer takes the queries meant for those; 50 connections opened at once each run one of 50 queries.

v4.0.0

v4 rewrites everything below the public API: the pool, the connection, the protocol, startup and the socket layer. Queries, helpers, transactions, cursors, COPY, listen, subscribe, large objects and the options work as in 3.4.9, apart from the changes below.

Security

  • A NUL character in a connection parameter can no longer add parameters (also in v3). A database, user or connection value such as 'db\0user\0postgres' was sent as further startup parameters, so an app that put untrusted input there, as with a database per tenant, could be made to log in as another user where that user needs no password, or with replication or options set. A NUL in any protocol string, also in query text and identifiers, now rejects with NUL_CHARACTER.
  • A column named __proto__ is an own property (also in v3). It became the prototype of the row, so a JSON value in it, for instance from a column alias built from user input, made the row inherit its properties (row.isAdmin), in query results and in sql.subscribe rows alike.

Upgrading from v3

The README has an upgrade guide, with a query that shows whether the change in parameter types concerns you.

... (truncated)

Changelog

Sourced from postgres's changelog.

v4.1.0 - 5 November 2026

New

  • query_timeout (#1278). Seconds a query may take, waiting for a connection and running together, before it is canceled and rejects with QUERY_TIMEOUT. Off by default. Unlike statement_timeout it also ends a query whose server or network has gone silent, which TCP alone takes many minutes to notice. Transaction control queries and forEach are limited too; cursors, streams and sql.listen are not.
  • cancel_timeout, 5 seconds by default: how long a canceled query may take to end before its connection is closed.
  • sql.batch([queries]) sends queries in one round trip with a single Sync: outside a transaction they commit or roll back together, and the batch rejects with the failing query's position in error.index.
  • json on a transform (#1169). The built-in transforms rename the keys of JSON values in results but send JSON values as they are. json: false leaves JSON values as they are both ways, and json: true renames their keys when sending too, with the transform's column.to. Without it nothing changes.
  • eager_types: true reads array types and domains when the pool starts instead of when a query first meets one.
  • sql.identifier(...parts) (#1292). An identifier from its parts, each quoted as it is and joined with ., for a name that contains a dot, which sql(name) reads as a separator: sql.identifier('acme.inc', 'users') gives "acme.inc"."users". The transform is not applied. With no parts it throws NO_PARTS.
  • Node.js 18 is supported again: engines is >=18 and CI runs it. Nothing in Postgres.js needs 20; using, await using and tracing are used where the runtime has them. Loading it with require still needs Node.js 20.19 or 22.12.
  • sql`...`.parsers(parsers) (#1294). A query's own parsers, for its rows only: by type, { [oid]: parse }, on top of the instance's types, or a function that gets each column and returns the parser for it, null for the server's text. A library that knows how to decode some queries' columns can decode them once, inside the row reader, while every other query on the instance and its pool keeps the instance's parsers. Such a query receives every column as text, so bytea and the integer arrays otherwise read in binary reach its parsers as text. A query without .parsers() reads its rows as before.

Fixed

  • sql.listen keeps its connection after the last unlisten() (#1298). The connection was closed so the process could exit (#1022), which made every following listen() connect again: about 3.5 ms instead of 0.1 ms per listen. It now stays open without keeping the process alive once nothing is listened.
  • PGSSLMODE is read (#1307). It was ignored, so PGSSLMODE=verify-full connected in plain text without an error. This may change how existing setups connect: require now uses TLS and fails against a server without it, and verify-ca and verify-full check the certificate against Node's CAs, not ~/.postgresql/root.crt or PGSSLROOTCERT. A url or an ssl option still comes first.
  • An insert helper after a quoted schema and an unquoted table builds the insert (#1304). In insert into ${ sql('s') }.t ${ sql(row) } or insert into "s".t, the quoted schema and the table were read as two words, so the row was taken for a list of identifiers and threw x.replace is not a function.
  • sql.listen keeps reconnecting when its first reconnect fails (#1285, #1286). After the listen connection closed, it was reopened once, and if that attempt failed, as it does while a restarting server still refuses connections, nothing tried again, so onlisten was never called and notifications were lost. A failed reconnect is now retried after backoff, until it succeeds, the channel is unlistened or the pool ends.
  • A canceled query whose server never answers no longer waits forever. .cancel(), .signal() and now query_timeout send a cancel request and waited for the server to end the query, so a server or network gone silent left both the query and the promise .cancel() returns pending until TCP gave up. This applies to every cancel, also without query_timeout: when the server doesn't answer within cancel_timeout, the connection is closed and the pool connects again. Whether the queries on it ran is unknown, so they reject with CONNECTION_DESTROYED (a timed out one with QUERY_TIMEOUT) whose cause is CANCEL_UNANSWERED, not with 57014. The cancel request's own connection is limited by cancel_timeout too, and a cancel is no longer sent for a query whose result has already arrived, where it could only hit the query after it. A cancel request whose own connection fails, as over TLS to a server gone silent, no longer crashes the process with an unhandled rejection. A query that times out while it waits behind another one on its connection is canceled only after it has had its own query_timeout once its turn comes, instead of the moment its turn comes, when it had usually finished and the cancel stopped the next query; if the server sends nothing for cancel_timeout while it waits, the connection is closed. A query waiting for types to be read rejects with QUERY_TIMEOUT without closing its connection, and the read of array types and domains is limited by query_timeout too.
  • sslrootcert, sslcert and sslkey in a url are used (#1308). They were sent to the server as startup parameters, so ?sslrootcert=system failed with unrecognized configuration parameter. Files are read into ca, cert and key. As in libpq, a root certificate with require or verify-ca checks the CA but not the host name, and verify-full checks both, as does ssl: true. A file without an sslmode means require.
  • A transaction the server ends rejects with the server's error (#1283, #1284). When a transaction_timeout (25P04), an idle_in_transaction_session_timeout (25P03) or pg_terminate_backend (57P01) ended the session, sql.begin rejected with CONNECTION_CLOSED, so a timeout or a termination looked the same as a network drop; it now rejects with the FATAL error the server sent before closing, as a query in flight already did, and a later query on that connection rejects with CONNECTION_CLOSED that has it as cause. A server restart or failover ends sessions with 57P01, so code that retries a transaction on CONNECTION_CLOSED should retry on that code too. A FATAL in answer to COMMIT rejects with CONNECTION_CLOSED that has it as cause, as the outcome is unknown, as it is when the connection is lost during COMMIT.
  • A server certificate is verified against an IP host (#1309). With ssl: 'verify-full' or ssl: true and an IP as the host, a connection upgraded to TLS checked the certificate against localhost, so a certificate for localhost from a trusted CA passed for any IP and a correct certificate for the IP failed. Direct TLS was not affected.
  • A savepoint or nested begin rejects when its transaction's connection is lost (#1281, #1282). One whose callback was still running when the connection went resolved with the callback's result after the transaction had already rejected; it now rejects with the transaction's error.
  • A connection closed while the pool reads its array and domain types counts as a failed connection attempt (#1279). Reconnecting follows backoff and waiting queries reject once connect_timeout has passed, instead of reconnecting as fast as the server accepts for as long as it keeps closing. With connect_timeout set to 0, null or false the pool now keeps trying for as long as it takes, as the option says, also after a refused or closed startup, which used to reject the waiting queries at once.
  • A query failed by a FATAL error gives that error to the queries pipelined behind it as well, instead of CONNECTION_CLOSED.
  • A FATAL error with the severity only in the S field is recognised as one. The non-localized V field is optional in the protocol: PostgreSQL sends it since 9.6, and a pooler that builds its own errors, such as PgBouncer, may send only the localized S. Such an error was not seen as FATAL, so the query, a sql.begin and the queries pipelined behind it rejected with CONNECTION_CLOSED without a cause instead of with the error. error.severity now falls back to severity_local when V is missing.
  • Each query on a connection that closes gets its own error. They shared one error object, so every query pipelined on the connection reported the first one's query and parameters.
  • A cached prepared statement no longer keeps the query that prepared it (#1287). Each connection's entry for a prepared statement kept that query's values and rows for as long as the statement stayed cached, up to 1,000 statements per connection, so an app with many distinct statements grew by their results until every cache was full: about 1.1 GB with 10 connections and 50-row results. They are let go once the query settles. On 4.0.0, prepare: false avoids it.
  • Destroying a copy ... to stdout stream frees the connection (#1306). After destroy(), breaking out of for await or a failed pipeline, the connection stayed paused for good and the queries behind it never ran. The rest of the copy is now read and dropped, so the connection is free once the server has sent it. The query is not canceled, so in a transaction the next query still succeeds.

Performance

  • An ssl object with a ca builds its TLS context once (#1280). The connections made with it share one context instead of each parsing the whole ca list again, so with a provider's CA bundle a new connection takes about half the time and CPU, and a burst of them no longer blocks the event loop. Replacing one of the object's values, as with a renewed cert, builds a new context for the connections after it.
  • A new statement whose untyped values are all numbers or null is prepared, described and run in one round trip, as one whose parameter types are all known is, since those values are written the same for any type the server picks; one with other values only the server can type is still described first, once per connection.
  • Array types and domains are read when a query first meets a type the pool does not know (an oid from 16384 up), instead of when the pool starts: a pool that only uses built-in types never sends that query, and a new pool's first query costs no more than any other. The connection that met the type waits for it, read on another connection. With custom types given by name they are still read at startup, as their oids are needed before the first query. Leases and values typed as a type the pool hasn't read yet still wait for it. A read whose connection fails is retried after backoff, and once connect_timeout has passed the connections waiting for it are closed and their queries reject, as for a failed startup. eager_types: true reads them when the pool starts, as before.
  • timestamptz, and timestamp and date read as UTC, are decoded straight from the bytes when they use the built-in parsers, with the text parser for anything else (BC, infinity, years before 1000); about 20% more rows per second for rows with timestamps.
  • bytea and arrays of int2, int4, int8 and bool are fetched in binary once a prepared statement's columns are known on the connection, when they use the built-in parsers: the values are the same as from the text, about 4.5 times faster to read for bytea and 3 times for an int4[]. A custom parser for the type or its elements, and raw(), still get the text.
  • A connection that becomes ready while others are still opening no longer takes the queries meant for those; 50 connections opened at once each run one of 50 queries.

v4.0.0 - 29 October 2026

v4 rewrites everything below the public API: the pool, the connection, the protocol, startup and the socket layer. Queries, helpers, transactions, cursors, COPY, listen, subscribe, large objects and the options work as in 3.4.9, apart from the changes below.

Security

  • A NUL character in a connection parameter can no longer add parameters (also in v3). A database, user or connection value such as 'db\0user\0postgres' was sent as further startup parameters, so an app that put untrusted input there, as with a database per tenant, could be made to log in as another user where that user needs no password, or with replication or options set. A NUL in any protocol string, also in query text and identifiers, now rejects with NUL_CHARACTER.
  • A column named __proto__ is an own property (also in v3). It became the prototype of the row, so a JSON value in it, for instance from a column alias built from user input, made the row inherit its properties (row.isAdmin), in query results and in sql.subscribe rows alike.

Upgrading from v3

... (truncated)

Commits
  • d84da74 4.1.0
  • ed622d1 Don't use prepublish
  • 4755e68 Please the linter
  • f7e795f Update changelog
  • 45b226f Verify the server certificate against an IP host instead of localhost
  • 4ffacc8 Keep the full check for ssl true with certificates in the url
  • 84b8e28 Use sslrootcert, sslcert and sslkey from a url instead of sending them to the...
  • 19db087 Add PGSSLMODE to the changelog
  • 607b20b Read PGSSLMODE
  • 875edc3 Drain a destroyed copy read stream instead of canceling it
  • Additional commits viewable in compare view

Updates react from 19.3.0 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

Commits

Updates react-dom from 19.3.0 to 19.3.1

Release notes

Sourced from react-dom's releases.

19.3.1 (October 14th, 2026)

React Server Components

Commits

Updates viem from 2.56.9 to 2.57.16

Release notes

Sourced from viem's releases.

viem@2.57.16

Patch Changes

  • #5395 c60ca26e030706610bcf61689331008a30a3db2a Thanks @​jxom! - viem/tempo: gatewayActions paid in the Gateway currency the Client account held most of, threw Gateway.InsufficientFundsError (with the account's balances) when it couldn't pay, and explained how to pay in Gateway.PaymentRequiredError.

  • #5392 9348d386a9f62fd6713124e25360d6040e4a34cf Thanks @​gakonst! - Stopped retrying JSON-RPC method-not-found (-32601) and method-not-supported (-32004) errors from non-2xx HTTP responses, since a retry gets the same refusal.

  • #5392 9348d386a9f62fd6713124e25360d6040e4a34cf Thanks @​gakonst! - Reduced per-request overhead of the http, webSocket and ipc transports by building the onFetchRequest Request only when the hook is set and the TimeoutError only when a request times out, and fetched the withdrawal receipt once in the ZKsync finalizeWithdrawal and isWithdrawalFinalized actions.

  • #5392 9348d386a9f62fd6713124e25360d6040e4a34cf Thanks @​gakonst! - Cached signature hashes in toSignatureHash, so selector lookups in decodeFunctionData, decodeEventLog, decodeErrorResult and encodeFunctionData no longer hash every ABI item on each call.

  • #5391 721d6824516514195c0a98971731c6d81b2f9032 Thanks @​jxom! - viem/tempo: Added experimental Gateway and gatewayActions (client.ai, client.bucket, client.compute, client.kv), with standalone Actions.ai, Actions.bucket, Actions.compute, and Actions.kv, with client.gateway.getCapabilities, Actions.gateway.getCapabilities and defaults for every option (gatewayActions()), for wallet-paid inference (including streamed text), object storage, metered and streamed CPU and GPU compute, and key-value state on a Tempo Gateway paid with a local Client account through the optional mppx peer dependency, with Tempo Wallet through the Accounts SDK, or with an app-supplied payment-aware fetchDescription has been truncated

    Summary by cubic

    Bumps 16 npm dependencies including a major postgres upgrade (3.4.9 → 4.1.0) and patch-level react/react-dom changes. Routine dependency maintenance keeps the stack current; the postgres v4 release rewrites the internal pool, connection, and protocol layers while keeping the public API largely stable.

    Notable changes

    • postgres v4 fixes two security issues (NUL character connection-parameter injection and __proto__ row prototype pollution) and now reads PGSSLMODE — connections that previously fell back to plain text may now use TLS or fail.
    • postgres ships an upgrade guide; check it for parameter-typing changes that could affect queries.
    • lucide-react renamed *-warning and *-alert icons to *-exclamation-point; imports using the old names must be updated.
    • @tanstack/react-query count APIs (useIsFetching, useIsMutating) no longer accept status/fetchStatus filters.
    • viem stops retrying JSON-RPC method-not-found/not-supported errors from non-2xx responses and adds experimental Tempo Gateway actions (viem/tempo).

    Performance

    • postgres decodes timestamps ~20% faster and reads bytea and integer arrays in binary (3–4.5x faster); TLS contexts with a ca are built once per pool instead of per connection.
    • viem caches signature hashes for ABI decode/encode and trims per-request overhead on http, webSocket, and ipc transports.

    Written for commit 01909210fd7a2553449d56dc19ef997d1099a162. Summary will update on new commits.

@dependabot
build(deps): bump the npm-dependencies group across 1 directory with …
0190921 
…16 updates

Bumps the npm-dependencies group with 16 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.103.2` | `5.106.1` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.48.0` | `1.70.0` |
| [postgres](https://github.com/porsager/postgres) | `3.4.9` | `4.1.0` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.3.0` | `19.3.1` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.3.0` | `19.3.1` |
| [viem](https://github.com/wevm/viem) | `2.56.9` | `2.57.16` |
| [@cloudflare/vite-plugin](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vite-plugin-cloudflare) | `1.64.0` | `1.67.0` |
| [@cloudflare/workers-types](https://github.com/cloudflare/workerd) | `5.20260925.1` | `5.20261106.1` |
| [@tailwindcss/vite](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite) | `4.3.3` | `4.3.4` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.2` | `26.6.6` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.1.1` | `6.2.1` |
| [eslint-plugin-react-you-might-not-need-an-effect](https://github.com/nickjvandyke/eslint-plugin-react-you-might-not-need-an-effect) | `1.0.2` | `1.1.0` |
| [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) | `6.38.0` | `6.44.1` |
| [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.3.3` | `4.3.4` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.152.0` | `4.158.0` |
| [vite-plus](https://github.com/voidzero-dev/vite-plus/tree/HEAD/packages/cli) | `1.4.0` | `1.6.0` |



Updates `@tanstack/react-query` from 5.103.2 to 5.106.1
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.106.1/packages/react-query)

Updates `lucide-react` from 1.48.0 to 1.70.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.70.0/packages/lucide-react)

Updates `postgres` from 3.4.9 to 4.1.0
- [Release notes](https://github.com/porsager/postgres/releases)
- [Changelog](https://github.com/porsager/postgres/blob/master/CHANGELOG.md)
- [Commits](porsager/postgres@v3.4.9...v4.1.0)

Updates `react` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react)

Updates `react-dom` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom)

Updates `viem` from 2.56.9 to 2.57.16
- [Release notes](https://github.com/wevm/viem/releases)
- [Commits](https://github.com/wevm/viem/compare/viem@2.56.9...viem@2.57.16)

Updates `@cloudflare/vite-plugin` from 1.64.0 to 1.67.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Changelog](https://github.com/cloudflare/workers-sdk/blob/@cloudflare/vite-plugin@1.67.0/packages/vite-plugin-cloudflare/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vite-plugin@1.67.0/packages/vite-plugin-cloudflare)

Updates `@cloudflare/workers-types` from 5.20260925.1 to 5.20261106.1
- [Release notes](https://github.com/cloudflare/workerd/releases)
- [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md)
- [Commits](https://github.com/cloudflare/workerd/commits)

Updates `@tailwindcss/vite` from 4.3.3 to 4.3.4
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.4/packages/@tailwindcss-vite)

Updates `@types/node` from 26.6.2 to 26.6.6
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@vitejs/plugin-react` from 6.1.1 to 6.2.1
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.2.1/packages/plugin-react)

Updates `eslint-plugin-react-you-might-not-need-an-effect` from 1.0.2 to 1.1.0
- [Release notes](https://github.com/nickjvandyke/eslint-plugin-react-you-might-not-need-an-effect/releases)
- [Changelog](https://github.com/nickjvandyke/eslint-plugin-react-you-might-not-need-an-effect/blob/main/CHANGELOG.md)
- [Commits](nickjvandyke/eslint-plugin-react-you-might-not-need-an-effect@v1.0.2...v1.1.0)

Updates `knip` from 6.38.0 to 6.44.1
- [Release notes](https://github.com/webpro-nl/knip/releases)
- [Commits](https://github.com/webpro-nl/knip/commits/knip@6.44.1/packages/knip)

Updates `tailwindcss` from 4.3.3 to 4.3.4
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.4/packages/tailwindcss)

Updates `wrangler` from 4.152.0 to 4.158.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.158.0/packages/wrangler)

Updates `vite-plus` from 1.4.0 to 1.6.0
- [Release notes](https://github.com/voidzero-dev/vite-plus/releases)
- [Commits](https://github.com/voidzero-dev/vite-plus/commits/v1.6.0/packages/cli)

---
updated-dependencies:
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.106.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: lucide-react
  dependency-version: 1.70.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: postgres
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: react
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: react-dom
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: viem
  dependency-version: 2.57.16
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: "@cloudflare/vite-plugin"
  dependency-version: 1.67.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: "@cloudflare/workers-types"
  dependency-version: 5.20261106.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: "@tailwindcss/vite"
  dependency-version: 4.3.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: "@types/node"
  dependency-version: 26.6.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.2.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: eslint-plugin-react-you-might-not-need-an-effect
  dependency-version: 1.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: knip
  dependency-version: 6.44.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: tailwindcss
  dependency-version: 4.3.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: wrangler
  dependency-version: 4.158.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: vite-plus
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from a team November 13, 2026 12:19
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 13, 2026
@socket-security

socket-security Bot commented Nov 13, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updated@​voidzero-dev/​vite-plus-core@​1.4.0 ⏵ 1.6.098 +110077 +199 +1100
Updatedlucide-react@​1.48.0 ⏵ 1.70.01001009796 +180
Updated@​types/​node@​26.6.2 ⏵ 26.6.6100 +110081 +194100
Updatedtailwindcss@​4.3.3 ⏵ 4.3.4100 +110084 +198100
Updatedreact@​19.3.0 ⏵ 19.3.11001008497100
Updated@​cloudflare/​vite-plugin@​1.64.0 ⏵ 1.67.096 -110085 -198 +1100
Updated@​tailwindcss/​vite@​4.3.3 ⏵ 4.3.41001008998100
Updatedpostgres@​3.4.9 ⏵ 4.1.09810010090 +3100
Updated@​tanstack/​react-query@​5.103.2 ⏵ 5.106.1991009198 +1100
Updatedwrangler@​4.152.0 ⏵ 4.158.09810092 +196100
Updatedreact-dom@​19.3.0 ⏵ 19.3.110010092 +198100
Updatedknip@​6.38.0 ⏵ 6.44.193 -61009596100
Updatedeslint-plugin-react-you-might-not-need-an-effect@​1.0.2 ⏵ 1.1.0100 +110010094 +1100
Updated@​vitejs/​plugin-react@​6.1.1 ⏵ 6.2.1100 +1100100 +195100
Updated@​cloudflare/​workers-types@​5.20260925.1 ⏵ 5.20261106.1100 +110096 +199100
Updatedviem@​2.56.9 ⏵ 2.57.1697100100 +198 +1100
Updatedvite-plus@​1.4.0 ⏵ 1.6.098 +1100100100 +1100

View full report

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Nov 13, 2026

Copy link
Copy Markdown
Contributor

🚀 Deploying Preview to Cloudflare 🚀

Preview Deployments by commit

Status Deployment URL Commit Updated (UTC) See this deployment's details
  • Build: Failed ❌

View logs ↗		 0190921 2026-11-13T12:20:47.251Z View logs ↗

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants