chore(deps-dev): bump the dev-dependencies group across 1 directory with 4 updates by dependabot[bot] · Pull Request #689 · cipherstash/stack

dependabot · 2026-07-17T11:32:05Z

Bumps the dev-dependencies group with 4 updates in the / directory: js-yaml, @supabase/supabase-js, @clerk/backend and @supabase/postgrest-js.

Updates js-yaml from 4.2.0 to 4.3.0

Changelog

Sourced from js-yaml's changelog.

4.3.0, 3.15.0 - 2026-06-27

Security

Backported maxTotalMergeKeys option.

[5.2.0] - 2026-06-26

Added

Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Added maxAliases (-1) loader option to limit the number of YAML aliases per document.

Removed

maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

Fixed

Round-trip of integers with exponential form (>= 1e21)

[5.1.0] - 2026-06-23

Added

Collection tags can finalize an incrementally populated carrier into a different result value.

Changed

[breaking] quoteStyle now selects the preferred quote style; use the restored forceQuotes option to force quoting non-key strings.

[5.0.0] - 2026-06-20

Added

Added named exports for schemas, tags, parser events and AST utilities.

Reworked JSON_SCHEMA and CORE_SCHEMA with spec-compliant scalar resolution rules, and added YAML11_SCHEMA.

Added realMapTag for lossless mappings with non-string and complex keys. Object-based mappings now reject complex keys instead of stringifying them.

Added dump() transform option for changing the generated AST before rendering.

Added dump() options seqInlineFirst, flowBracketPadding, flowSkipCommaSpace, flowSkipColonSpace, quoteFlowKeys, quoteStyle and tagBeforeAnchor.

Added formal data layers (events and AST) for modular data pipelines.

Added low-level parser (to events), presenter and visitor APIs.

Added the YAML Test Suite to the test set.

Changed

See the migration guide for upgrade notes.

Rewritten in TypeScript and reorganized the public API around flat named exports.

... (truncated)

Commits

33d05b5 4.3.0 released
663bfab Drop demo publish, to not override new v5 one.
1cb8c7b Add v4-legacy tag for publish
02f27af Restore umd builds back to es5
8be84ed Fix es5 compatibility
59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
6842ef6 doc polish
See full diff in compare view

Updates @supabase/supabase-js from 2.110.1 to 2.110.2

Release notes

Sourced from @supabase/supabase-js's releases.

v2.110.2

2.110.2 (2026-07-09)

🩹 Fixes

auth: clear local session on signout failures (#2504)

❤️ Thank You

Luc Peng

v2.110.2-canary.0

2.110.2-canary.0 (2026-07-07)

🩹 Fixes

auth: clear local session on signout failures (#2504)

❤️ Thank You

Luc Peng

Changelog

Sourced from @supabase/supabase-js's changelog.

2.110.2 (2026-07-09)

This was a version bump only for @supabase/supabase-js to align it with other projects, there were no code changes.

Commits

559dfb0 chore(release): version 2.110.1 changelogs (#2505)
See full diff in compare view

Updates @clerk/backend from 3.11.2 to 3.11.3

Changelog

Sourced from @clerk/backend's changelog.

3.11.3

Patch Changes

Updated dependencies [8dbf343]:

@clerk/shared@4.25.2

Commits

See full diff in compare view

Updates @supabase/postgrest-js from 2.110.1 to 2.110.2

Release notes

Sourced from @supabase/postgrest-js's releases.

v2.110.2

2.110.2 (2026-07-09)

🩹 Fixes

auth: clear local session on signout failures (#2504)

❤️ Thank You

Luc Peng

v2.110.2-canary.0

2.110.2-canary.0 (2026-07-07)

🩹 Fixes

auth: clear local session on signout failures (#2504)

❤️ Thank You

Luc Peng

Changelog

Sourced from @supabase/postgrest-js's changelog.

2.110.2 (2026-07-09)

This was a version bump only for @supabase/postgrest-js to align it with other projects, there were no code changes.

Commits

559dfb0 chore(release): version 2.110.1 changelogs (#2505)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…ith 4 updates Bumps the dev-dependencies group with 4 updates in the / directory: [js-yaml](https://github.com/nodeca/js-yaml), [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js), [@clerk/backend](https://github.com/clerk/javascript/tree/HEAD/packages/backend) and [@supabase/postgrest-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/postgrest-js). Updates `js-yaml` from 4.2.0 to 4.3.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.2.0...4.3.0) Updates `@supabase/supabase-js` from 2.110.1 to 2.110.2 - [Release notes](https://github.com/supabase/supabase-js/releases) - [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md) - [Commits](https://github.com/supabase/supabase-js/commits/v2.110.2/packages/core/supabase-js) Updates `@clerk/backend` from 3.11.2 to 3.11.3 - [Release notes](https://github.com/clerk/javascript/releases) - [Changelog](https://github.com/clerk/javascript/blob/main/packages/backend/CHANGELOG.md) - [Commits](https://github.com/clerk/javascript/commits/@clerk/backend@3.11.3/packages/backend) Updates `@supabase/postgrest-js` from 2.110.1 to 2.110.2 - [Release notes](https://github.com/supabase/supabase-js/releases) - [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/postgrest-js/CHANGELOG.md) - [Commits](https://github.com/supabase/supabase-js/commits/v2.110.2/packages/core/postgrest-js) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: "@supabase/supabase-js" dependency-version: 2.110.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: "@clerk/backend" dependency-version: 3.11.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: "@supabase/postgrest-js" dependency-version: 2.110.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-07-17T11:32:06Z

Labels

The following labels could not be found: supply-chain. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

changeset-bot · 2026-07-17T11:32:08Z

⚠️ No Changeset found

Latest commit: 6ce215f

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

coderdan · 2026-07-19T06:00:44Z

Superseded by #699 — a maintainer take-over of this exact bump (byte-identical diff, re-based onto main) so it runs under the normal Actions CI context instead of the Dependabot secret store, which lacks the identity suites' CLERK_MACHINE_TOKEN and made the live jobs fail-loud here.

dependabot · 2026-07-19T06:00:46Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

Maintainer take-over of Dependabot PR #689 so the dependency bump runs under the normal Actions CI context (Dependabot PRs run under the Dependabot secret store, which lacks the identity suites' CLERK_MACHINE_TOKEN, so their live jobs fail-loud on something the bot can't fix). Diff is byte-identical to #689's commit, re-based onto current main; `pnpm install --frozen-lockfile` is green. Dev-dependency updates: - js-yaml 4.2.0 → 4.3.0 (semver-minor) - @supabase/supabase-js 2.110.1 → 2.110.2 (semver-patch) - @supabase/postgrest-js 2.110.1 → 2.110.2 (semver-patch) - @clerk/backend 3.11.2 → 3.11.3 (semver-patch) Closes #689. Claude-Session: https://claude.ai/code/session_01MxTTPaPP16m6br7Hoab94w

dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 17, 2026

dependabot Bot requested a review from a team as a code owner July 17, 2026 11:32

This was referenced Jul 19, 2026

ci: skip secret-consuming live jobs on Dependabot PRs #698

Closed

chore(deps-dev): bump dev-dependencies group (4 updates) — take-over of #689 #699

Merged

coderdan closed this Jul 19, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/dev-dependencies-31710e70d5 branch July 19, 2026 06:00

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps-dev): bump the dev-dependencies group across 1 directory with 4 updates#689

chore(deps-dev): bump the dev-dependencies group across 1 directory with 4 updates#689
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-31710e70d5

dependabot Bot commented on behalf of github Jul 17, 2026

Uh oh!

dependabot Bot commented on behalf of github Jul 17, 2026

Uh oh!

changeset-bot Bot commented Jul 17, 2026

Uh oh!

coderdan commented Jul 19, 2026

Uh oh!

dependabot Bot commented on behalf of github Jul 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 17, 2026

4.3.0, 3.15.0 - 2026-06-27

Security

[5.2.0] - 2026-06-26

Added

Removed

Fixed

[5.1.0] - 2026-06-23

Added

Changed

[5.0.0] - 2026-06-20

Added

Changed

v2.110.2

2.110.2 (2026-07-09)

🩹 Fixes

❤️ Thank You

v2.110.2-canary.0

2.110.2-canary.0 (2026-07-07)

🩹 Fixes

❤️ Thank You

2.110.2 (2026-07-09)

3.11.3

Patch Changes

v2.110.2

2.110.2 (2026-07-09)

🩹 Fixes

❤️ Thank You

v2.110.2-canary.0

2.110.2-canary.0 (2026-07-07)

🩹 Fixes

❤️ Thank You

2.110.2 (2026-07-09)

Uh oh!

dependabot Bot commented on behalf of github Jul 17, 2026

Labels

Uh oh!

changeset-bot Bot commented Jul 17, 2026

⚠️ No Changeset found

Uh oh!

coderdan commented Jul 19, 2026

Uh oh!

dependabot Bot commented on behalf of github Jul 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant