Build(deps): Bump the minor-and-patch group with 6 updates

[dependabot]

Bumps the minor-and-patch group with 6 updates:

Package	From	To
next	16.3.1	16.3.2
@types/pg	8.21.0	8.23.1
eslint-config-next	16.3.1	16.3.2
supabase	2.114.0	2.115.0
vercel	59.1.3	59.5.0
vitest	4.1.10	4.1.11

Updates next from 16.3.1 to 16.3.2

Release notes

Sourced from next's releases.

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [backport] Scope app-entry export validation to files inside the app directory (#97357)
• [backport] Fix catch-all index page being served for every other slug (#97416)
• [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
• [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
• [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
• [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @​lubieowoce, @​unstubbable, @​timneutkens, @​mischnic, and @​eps1lon for helping!

Commits

• d0ac882 v16.3.2
• 81deb92 [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static ...
• cd714d9 [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
• 5ac2327 [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
• 0ccb3e7 [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
• f4dc7c8 [backport] Fix catch-all index page being served for every other slug (#97416)
• eba236b [backport] Scope app-entry export validation to files inside the app director...
• See full diff in compare view

Updates @types/pg from 8.21.0 to 8.23.1

Commits

• See full diff in compare view

Updates eslint-config-next from 16.3.1 to 16.3.2

Release notes

Sourced from eslint-config-next's releases.

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [backport] Scope app-entry export validation to files inside the app directory (#97357)
• [backport] Fix catch-all index page being served for every other slug (#97416)
• [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
• [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
• [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
• [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @​lubieowoce, @​unstubbable, @​timneutkens, @​mischnic, and @​eps1lon for helping!

Commits

• d0ac882 v16.3.2
• See full diff in compare view

Updates supabase from 2.114.0 to 2.115.0

Release notes

Sourced from supabase's releases.

v2.115.0

Supabase CLI v2.115.0 — 2026-08-18

This release changes two defaults you should know about before upgrading CI: schema diffing now uses the bundled pg-delta engine, and supabase test db fails when it finds zero tests. It also makes migrations faster and more consistent, and fixes supabase start on confined Docker installs.

⚠️ Breaking changes

• Schema diffing defaults to the bundled pg-delta engine — db diff, db pull, and declarative schema generate/sync now use the in-process pg-delta engine instead of the legacy implementation. Generated SQL and transaction-aware file splits can differ from previous output, and there is no automatic fallback — coverage gaps warn, and --strict-coverage makes them fatal. The declarative schema directory also defaults to supabase/schemas now, matching the legacy engine; if your tree lives under the old supabase/database default, move it or set declarative_schema_path = "./database" under [experimental.pgdelta] in supabase/config.toml. If the new engine blocks you, set SUPABASE_USE_PG_DELTA_NEXT=false to unblock yourself and open a GitHub issue describing what broke — the opt-out is temporary and will be removed in about a month. (#6102)
• supabase test db now fails when no tests run — a run where pg_prove finds zero pgTAP tests exits non-zero with no pgTAP tests found in <paths> instead of reporting success. Previously a typo'd path, an empty tests directory, or a bind-mount mismatch could leave CI green while testing nothing. If a pipeline legitimately runs zero tests, drop the supabase test db step. (#6210)
• --password now beats SUPABASE_DB_PASSWORD on db remote — db remote changes|commit prefer an explicit --password over the environment variable; previously the env var silently won due to a flag-binding bug. If your automation sets both, the flag value is now the one used. (#6162)

Highlights

• Faster, more consistent migrations — db reset and db push batch migration and seed statements again, cutting runs from minutes to seconds on Windows; migration list, db pull, and migration repair order migrations by version like db push, so an in-sync tree no longer shows phantom conflicts; and migration new writes the file before reporting success on Windows. (#6224, #6225, #6192)
• Link a preview branch directly — supabase link accepts a project ref, or the name or UUID of a branch of the currently linked project, both as the positional argument and via --project-ref. (#6168)
• Clearer errors — functions serve setup failures name the actual filesystem problem instead of An error occurred in Effect.tryPromise; a crashed db diff --use-migra run fails loudly instead of printing "No schema changes found"; and an unreachable database during batched migrations reports as a connection error. (#6191, #6240, #6234)

New features

• Per-function env files in functions serve — standalone supabase functions serve discovers supabase/functions/<slug>/.env for each function, alongside the shared supabase/functions/.env; --env-file overrides both. supabase start does not load these files. (#6182)
• Experimental projects create flags — --release-channel and --postgres-engine pick the release channel and Postgres engine for new projects. Both require --experimental and stay hidden from --help while in preview. (#6186)
• Silence the update notice — set SUPABASE_NO_UPDATE_NOTIFIER=1 to suppress the new-version notice printed after commands. (#6143)

Improvements

• supabase start polls booting services one at a time again, matching the Go CLI — concurrent health checks could burst Docker subprocesses and exhaust retries on constrained machines. (#6149)
• Piped text output respects backpressure instead of buffering in memory, so supabase db dump | <slow consumer> no longer risks running out of memory on large databases. (#6212)
• The bundled Go binary only includes the commands still proxied to it, shrinking the installed size. (#6162)

Bug fixes

• supabase start works with strictly confined Docker installs (such as Docker Snap) and remote Docker contexts: container secrets stream over stdin via docker cp instead of being staged as plaintext files in /tmp. (#6201)
• supabase functions serve <name> accepts its optional function-name argument again; the command still serves all discovered functions, matching the Go CLI. (#6173)
• Auth email template and notification content_path values resolve against the project root consistently. (#6160)

---

Plus 12 internal improvements and dependency updates.

Full changelog: supabase/cli@v2.114.0...v2.115.0

v2.115.0-beta.25

2.115.0-beta.25 (2026-08-18)

Bug Fixes

• stack: detect copied ordinary-folder identities (#6232) (18ae43a), closes #6218

v2.115.0-beta.24

2.115.0-beta.24 (2026-08-18)

Bug Fixes

... (truncated)

Commits

• 8877048 fix(cli): classify batch connection failures as connect errors (#6234)
• c3750c9 fix(cli): surface crashed migra diffs (CLI-2204) (#6240)
• 2728b7b fix(docker): bump supabase/postgres from 17.6.1.158 to 17.6.1.159 in /apps/cl...
• e2a0bf6 fix(deps): bump the npm-major group across 1 directory with 32 updates (#6243)
• 64d954d refactor(stack): simplify managed stack architecture (#6218)
• 4c6a165 fix(cli): order migrations consistently (#6225)
• 2920072 fix(cli): batch migration statements (CLI-2182) (#6224)
• d63a7db feat(cli): default database workflows to the bundled pg-delta engine (#6102)
• d408ee4 fix(cli): stop buffering piped output (#6212)
• 23a5ba1 fix(cli): fail test db when no tests ran (CLI-2194) (#6210)
• Additional commits viewable in compare view

Updates vercel from 59.1.3 to 59.5.0

Commits

• See full diff in compare view

Updates vitest from 4.1.10 to 4.1.11

Release notes

Sourced from vitest's releases.

v4.1.11

   🐞 Bug Fixes

• Revive global concurrency limit for test lifecycle [backport to v4]  -  by @​sheremet-va and @​hi-ogawa in vitest-dev/vitest#10992 (5146d)
• browser:
  • Encode iframeId in tester iframe URL [backport to v4]  -  by @​sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)
  • Trigger playwright/chromium gc on lower disk availability [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)
• mocker:
  • Restrict redirect mocks to the fs allowlist [backport to v4]  -  by @​sheremet-va in vitest-dev/vitest#10974 (fe5a1)

    View changes on GitHub

Commits

• 9bd8d46 chore: release v4.1.11 (#10995)
• 9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions