chore(deps): bump the npm-major group with 8 updates

[dependabot]

Bumps the npm-major group with 8 updates:

Package	From	To
pkg-pr-new	0.0.82	0.0.86
jose	6.2.4	6.2.5
@types/react	19.2.17	19.2.18
posthog-node	5.46.1	5.47.0
fumadocs-core	16.13.0	16.14.0
fumadocs-mdx	15.2.0	15.2.1
fumadocs-ui	16.13.0	16.14.0
@types/react-dom	19.2.3	19.2.4

Updates pkg-pr-new from 0.0.82 to 0.0.86

Commits

• cc27684 release: v0.0.86
• 7ec965c release: v0.0.85
• 41bf979 release: v0.0.84
• 80d1b1b release: v0.0.83
• See full diff in compare view

Updates jose from 6.2.4 to 6.2.5

Release notes

Sourced from jose's releases.

v6.2.5

Fixes

• compare claim values for falsy validation options (eb86956)
• forward key management parameters for a single JWE recipient (2d4f801)
• handle a zero-length JWE additional authenticated data (16ca398)
• reject a generateKeyPair crv option the algorithm does not imply (76364e9)
• reject an unencoded payload in the JWS Compact Serialization (01d053f)
• reject characters outside the Base64URL alphabet (0ebb971), references #879
• reject duplicate "crit" values when producing (31d60e1)
• reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (5df3fed)
• reject truncated ASN.1 key data (7a16c66)
• surface non-ASCII token segments as JOSE errors (194fe11)
• types: correct JWK and CryptoKey types (62a196d)
• types: correct key resolver and JWT header types (e95f8c4)
• validate the clockTolerance and currentDate options are finite (ab2f18d)

Documentation

• correct subpaths and API documentation (2daec38)
• document consumer-supplied type parameters (9e9f66c)
• stop claiming the JWK "use" parameter is used during import (47a07b2)
• update CHANGELOG.md (fc51bf5)

Refactor

• assert key shape and type from the entry (971057e)
• avoid 32-bit truncation of the AES-CBC-HMAC AAD bit length (1c8c6e9)
• correct swapped JWE unprotected header type error messages (894c498)
• describe each JWS algorithm once (7375028)
• discriminate a key once (0b59a69)
• fold single-consumer modules into their consumers (c2f0ca3)
• generate and import keys from the entry (da69b68)
• keep JWE out of the JWKS and embedded-JWK paths (241dd48)
• keep JWS and JWE out of each other's bundles (2a98564)
• parse a Protected Header in one place (30f72af)
• resolve the content encryption algorithm once (98b50ab)
• tighten key property checks (fe0dc3b)
• types: add discriminated JOSE error types (f7f764e)
• types: add JOSE identifier unions and JWK narrowing (2a20f49)
• types: improve key and result inference (cb25e77)
• types: trim published declaration comments (544f179)
• unify base64 decode errors (3a91833)
• validate each token once rather than once per layer (bbdae09)
• write each algorithm identifier once (73d83b5)

Changelog

Sourced from jose's changelog.

6.2.5 (2026-07-29)

Fixes

• compare claim values for falsy validation options (eb86956)
• forward key management parameters for a single JWE recipient (2d4f801)
• handle a zero-length JWE additional authenticated data (16ca398)
• reject a generateKeyPair crv option the algorithm does not imply (76364e9)
• reject an unencoded payload in the JWS Compact Serialization (01d053f)
• reject characters outside the Base64URL alphabet (0ebb971), references #879
• reject duplicate "crit" values when producing (31d60e1)
• reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (5df3fed)
• reject truncated ASN.1 key data (7a16c66)
• surface non-ASCII token segments as JOSE errors (194fe11)
• types: correct JWK and CryptoKey types (62a196d)
• types: correct key resolver and JWT header types (e95f8c4)
• validate the clockTolerance and currentDate options are finite (ab2f18d)

Documentation

• correct subpaths and API documentation (2daec38)
• document consumer-supplied type parameters (9e9f66c)
• stop claiming the JWK "use" parameter is used during import (47a07b2)
• update CHANGELOG.md (fc51bf5)

Refactor

• assert key shape and type from the entry (971057e)
• avoid 32-bit truncation of the AES-CBC-HMAC AAD bit length (1c8c6e9)
• correct swapped JWE unprotected header type error messages (894c498)
• describe each JWS algorithm once (7375028)
• discriminate a key once (0b59a69)
• fold single-consumer modules into their consumers (c2f0ca3)
• generate and import keys from the entry (da69b68)
• keep JWE out of the JWKS and embedded-JWK paths (241dd48)
• keep JWS and JWE out of each other's bundles (2a98564)
• parse a Protected Header in one place (30f72af)
• resolve the content encryption algorithm once (98b50ab)
• tighten key property checks (fe0dc3b)
• types: add discriminated JOSE error types (f7f764e)
• types: add JOSE identifier unions and JWK narrowing (2a20f49)
• types: improve key and result inference (cb25e77)
• types: trim published declaration comments (544f179)
• unify base64 decode errors (3a91833)
• validate each token once rather than once per layer (bbdae09)
• write each algorithm identifier once (73d83b5)

Commits

• 3bac350 chore(release): 6.2.5
• 544f179 refactor(types): trim published declaration comments
• ef6b73e ci: enforce the family split and check the built dist
• c2f0ca3 refactor: fold single-consumer modules into their consumers
• 0b59a69 refactor: discriminate a key once
• 30f72af refactor: parse a Protected Header in one place
• 73d83b5 refactor: write each algorithm identifier once
• da69b68 refactor: generate and import keys from the entry
• 971057e refactor: assert key shape and type from the entry
• 98b50ab refactor: resolve the content encryption algorithm once
• Additional commits viewable in compare view

Updates @types/react from 19.2.17 to 19.2.18

Commits

• See full diff in compare view

Updates posthog-node from 5.46.1 to 5.47.0

Release notes

Sourced from posthog-node's releases.

posthog-node@5.47.0

5.47.0

Minor Changes

• #4308 6e7f3ae Thanks @​ablaszkiewicz! - Emit the release id that posthog-cli injects into your bundle as $release_id on $exception events, so PostHog can attach exceptions to a release without joining through symbol sets. Adds getInjectedReleaseId() to @posthog/core. The property is only attached when an injected release id can be read. (2026-07-30)

Patch Changes

• Updated dependencies [6e7f3ae]:
  • @​posthog/core@​1.46.0

Changelog

Sourced from posthog-node's changelog.

5.47.0

Minor Changes

• #4308 6e7f3ae Thanks @​ablaszkiewicz! - Emit the release id that posthog-cli injects into your bundle as $release_id on $exception events, so PostHog can attach exceptions to a release without joining through symbol sets. Adds getInjectedReleaseId() to @posthog/core. The property is only attached when an injected release id can be read. (2026-07-30)

Patch Changes

• Updated dependencies [6e7f3ae]:
  • @​posthog/core@​1.46.0

Commits

• 4ef8a41 chore: update versions and lockfile [version bump]
• 6e7f3ae feat: emit $release_id from the injected release id (#4308)
• 3b2e68d fix: prevent Jest worker resource leaks (#4247)
• See full diff in compare view

Updates fumadocs-core from 16.13.0 to 16.14.0

Release notes

Sourced from fumadocs-core's releases.

fumadocs@16.14.0

• @​fumadocs/base-ui@​16.14.0
• fumadocs-core@16.14.0
• fumadocs-ui@16.14.0

Replace Orama with ZBSearch, zero-config i18n search

The built-in search engine moved from @orama/orama to ZBSearch, a near drop-in successor. All module paths and APIs are unchanged, and search now works with every language out of the box: the new default multilingual mode uses Unicode word segmentation, so i18n search needs zero config.

import { createFromSource } from 'fumadocs-core/search/server';
// no localeMap, no @orama/tokenizers, CJK included
export const { GET } = createFromSource(source);

All locales now share a single search database — results are filtered by the locale of your pages at query time. Same for static mode:

import { staticClient } from 'fumadocs-core/search/client/orama-static';
const client = staticClient({ locale });

Renames

• oramaStaticClient → staticClient (old name kept as deprecated alias)
• initOrama → initDB, it now creates a ZBSearch instance and is optional — the exported data restores the tokenizer on load

Deprecated

• localeMap is no longer needed. It still works for language-specific stemming/stop-words and keeps the legacy per-locale databases when specified.

Notes for advanced usage

• language, components, plugins and search options are now typed against ZBSearch instead of @orama/orama — custom tokenizers or plugins written for Orama must be swapped to their ZBSearch equivalents.
• The exported static search data is now a ZBSearch database (i18n exports became a single unified database), so server and client should be on the same fumadocs-core version.
• @orama/orama and @orama/tokenizers can be removed from your dependencies unless you use them directly. Orama Cloud integrations (fumadocs-core/search/orama-cloud) are unaffected.

Commits

• 81c88c6 Version Packages (#3445)
• 4108f03 chore: fix example builds
• a279c17 fix(mdx): workaround for base ui issues
• f29a484 refactor(*): migrate non-rsc examples to macro api
• f845513 feat(mdx): browser helpers for macro
• e0d374c refactor(*): migrate examples & docs to macro API
• 4047bf7 feat(mdx): improve vite plugin usage
• b1636d5 chore: bump deps
• d1245c4 refactor(ui): build tailwind css via tsdown hooks
• 693bb19 docs: mention MDX macro usage
• Additional commits viewable in compare view

Updates fumadocs-mdx from 15.2.0 to 15.2.1

Release notes

Sourced from fumadocs-mdx's releases.

fumadocs-mdx@15.2.1

Support simpler fumadocsMdx vite plugin usage

Use the fumadocsMdx method instead for better syntax around macro usage.

Support browser helpers for Macro API

Use preload & lazy body renderer on non-rsc environment.

Commits

• 81c88c6 Version Packages (#3445)
• 4108f03 chore: fix example builds
• a279c17 fix(mdx): workaround for base ui issues
• f29a484 refactor(*): migrate non-rsc examples to macro api
• f845513 feat(mdx): browser helpers for macro
• e0d374c refactor(*): migrate examples & docs to macro API
• 4047bf7 feat(mdx): improve vite plugin usage
• b1636d5 chore: bump deps
• d1245c4 refactor(ui): build tailwind css via tsdown hooks
• 693bb19 docs: mention MDX macro usage
• Additional commits viewable in compare view

Updates fumadocs-ui from 16.13.0 to 16.14.0

Release notes

Sourced from fumadocs-ui's releases.

fumadocs@16.14.0

• @​fumadocs/base-ui@​16.14.0
• fumadocs-core@16.14.0
• fumadocs-ui@16.14.0

Replace Orama with ZBSearch, zero-config i18n search

The built-in search engine moved from @orama/orama to ZBSearch, a near drop-in successor. All module paths and APIs are unchanged, and search now works with every language out of the box: the new default multilingual mode uses Unicode word segmentation, so i18n search needs zero config.

import { createFromSource } from 'fumadocs-core/search/server';
// no localeMap, no @orama/tokenizers, CJK included
export const { GET } = createFromSource(source);

All locales now share a single search database — results are filtered by the locale of your pages at query time. Same for static mode:

import { staticClient } from 'fumadocs-core/search/client/orama-static';
const client = staticClient({ locale });

Renames

• oramaStaticClient → staticClient (old name kept as deprecated alias)
• initOrama → initDB, it now creates a ZBSearch instance and is optional — the exported data restores the tokenizer on load

Deprecated

• localeMap is no longer needed. It still works for language-specific stemming/stop-words and keeps the legacy per-locale databases when specified.

Notes for advanced usage

• language, components, plugins and search options are now typed against ZBSearch instead of @orama/orama — custom tokenizers or plugins written for Orama must be swapped to their ZBSearch equivalents.
• The exported static search data is now a ZBSearch database (i18n exports became a single unified database), so server and client should be on the same fumadocs-core version.
• @orama/orama and @orama/tokenizers can be removed from your dependencies unless you use them directly. Orama Cloud integrations (fumadocs-core/search/orama-cloud) are unaffected.

Commits

• 81c88c6 Version Packages (#3445)
• 4108f03 chore: fix example builds
• a279c17 fix(mdx): workaround for base ui issues
• f29a484 refactor(*): migrate non-rsc examples to macro api
• f845513 feat(mdx): browser helpers for macro
• e0d374c refactor(*): migrate examples & docs to macro API
• 4047bf7 feat(mdx): improve vite plugin usage
• b1636d5 chore: bump deps
• d1245c4 refactor(ui): build tailwind css via tsdown hooks
• 693bb19 docs: mention MDX macro usage
• Additional commits viewable in compare view

Updates @types/react-dom from 19.2.3 to 19.2.4

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 27f8ee0226

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Regenerate the embedded functions template

Bumping jose here changes the dependency that bundleServeMainTemplate() inlines into the edge-runtime bootstrap, but the committed Go-sidecar artifact was not regenerated. The existing serve-main-go-template.unit.test.ts compares apps/cli-go/internal/functions/serve/templates/main.bundled.js against a fresh bundle and the checked-in bundle still contains the old jose bundle/version, so test:core will fail and the Go binary continues embedding stale code until pnpm generate:go-serve-template (or the equivalent script) updates the artifact.

Useful? React with 👍 / 👎.

[github-actions]

Supabase CLI preview

npx --yes https://pkg.pr.new/supabase/cli/supabase@27f8ee022671a38bc6e3f1d57969ac3598201e9d

Preview package for commit 27f8ee0.