chore(deps): update pnpm workspace dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@types/pg (source)	^8.18.0 → ^8.20.0
diff	^8.0.3 → ^8.0.4
dotenv	^17.3.1 → ^17.4.2
kysely (source)	^0.28.12 → ^0.28.16
mysql2 (source)	^3.20.0 → ^3.22.3
react (source)	^19.2.4 → ^19.2.5
react-dom (source)	^19.2.4 → ^19.2.5
tinyglobby (source)	^0.2.15 → ^0.2.16
tsdown (source)	^0.21.4 → ^0.21.10

---

Release Notes

kpdecker/jsdiff (diff)

v8.0.4

Compare Source

• #​667 - fix another bug in diffWords when used with an Intl.Segmenter. If the text to be diffed included a combining mark after a whitespace character (i.e. roughly speaking, an accented space), diffWords would previously crash. Now this case is handled correctly.

motdotla/dotenv (dotenv)

v17.4.2

Compare Source

v17.4.1

Compare Source

v17.4.0

Compare Source

kysely-org/kysely (kysely)

v0.28.16: 0.28.16

Compare Source

Hey 👋

A small batch of bug fixes. Please report any issues. 🤞😰🤞

0.29 is getting closer btw. 🌶️

🚀 Features

🐞 Bugfixes

• fix: FilterObject allows any defined value when query context has no tables (TB is never). by @​igalklebanov in #​1791

📖 Documentation

• add socket security badge. by @​igalklebanov in db646ac
• chore: make socket security badge reflect current specific version. by @​igalklebanov in 5597144
• support multi-entry point tsdoc without index module. by @​igalklebanov in 6998915
• fix broken tsdoc references. by @​igalklebanov in 5a0f14b

📦 CICD & Tooling

• chore(pnpm): add strictDepBuilds: true. by @​igalklebanov in 2301610
• chore: harden dependencies, pnpm. by @​igalklebanov in f4f1d9e
• chore: re-add ignore-workspace-root-check. by @​igalklebanov in ab6d00e
• add openssf scorecard. by @​igalklebanov in 521156b
• chore: bump dependencies and github actions. by @​igalklebanov in #​1789
• chore: change verifyDepsBeforeRun to "prompt". by @​igalklebanov in 20548bc

⚠️ Breaking Changes

🐤 New Contributors

What's Changed

Full Changelog: kysely-org/kysely@v0.28.15...v0.28.16

v0.28.15: 0.28.15

Compare Source

Hey 👋

The introduction of dehydration in JSON functions/helpers caused an unexpected bug for consumers that have some columns defined as '${number}', e.g. '1' | '2' (also when wrapped in ColumnType or similar). Such columns, when participating in a JSON function/helper would dehydrate to number instead of staying as string.

Why dehydrate numeric strings to numbers in the first place? Select types in kysely describe the data after underlying driver's (e.g. pg) data transformation. Some drivers transform numeric columns to strings to be safe. When these columns participate in JSON functions, they lose original column data types - drivers don't know they need to transform to string - they return as-is.

This release introduces a special helper type that wraps your column type definition and tells kysely to NOT dehydrate it in JSON functions/helpers.

import type { NonDehydrateable } from 'kysely'

interface Database {
  my_table: {
    a_column: '1' | '2' | '3', // dehydrates to `number`
    another_column: NonDehydrateable<'1' | '2' | '3'>, // stays `'1' | '2' | '3'`
    column_too: NonDehydrateable<ColumnType<'1' | '2' | '3'>> // stays `'1' | '2' | '3'`
  }
}

🚀 Features

• feat: add NonDehydrateable<T> to allow opt-out from dehydration in JSON functions/helpers. by @​igalklebanov in #​1697

🐞 Bugfixes

PostgreSQL 🐘

• fix: PostgreSQL introspector unnecessarily slow in result processing. by @​igalklebanov & @​rubenferreira97 in #​1774

📖 Documentation

• Add complex function helpers section to documentation by @​mifi & @​igalklebanov in #​1758

📦 CICD & Tooling

• chore: bump TypeScript to 6. by @​igalklebanov in #​1769
• chore: bump dependencies. by @​igalklebanov in #​1775

⚠️ Breaking Changes

🐤 New Contributors

• @​rubenferreira97 made their first contribution in #​1774

Full Changelog: kysely-org/kysely@v0.28.14...v0.28.15

v0.28.14: 0.28.14

Compare Source

Hey 👋

A small batch of bug fixes. Please report any issues. 🤞😰🤞

🚀 Features

🐞 Bugfixes

MySQL 🐬

• fix: string literals are injectable on MySQL when backslash escapes (\\') are used. by @​igalklebanov in #​1754 & 054e801

📖 Documentation

• Add Node SQLite link to dialects documentation by @​wolfie in #​1709 & #​1755
• docs: document immediate value behavior in case() then/else by @​alexchenai in #​1753

📦 CICD & Tooling

• bump deno kysely dependency. by @​igalklebanov in 9e02f3b

⚠️ Breaking Changes

🐤 New Contributors

• @​wolfie made their first contribution in #​1709
• @​alexchenai made their first contribution in #​1753

Full Changelog: kysely-org/kysely@v0.28.13...v0.28.14

v0.28.13: 0.28.13

Compare Source

Hey 👋

A small batch of bug fixes. Please report any issues. 🤞😰🤞

🚀 Features

🐞 Bugfixes

• fix: missing sideEffects: false in root package.json resulting in bigger bundles in various bundlers. by @​igalklebanov in #​1746
• fix: Insertable allows non-objects when a table has no required columns. by @​igalklebanov in #​1747

PostgreSQL 🐘

• fix: ON COMMIT clause not being output when using .as(query) in CREATE TABLE queries. by @​igalklebanov in #​1748

📖 Documentation

📦 CICD & Tooling

• chore: fix node tests tsconfig.json for TypeScript native. by @​igalklebanov in #​1749
• chore: bump dependencies. by @​igalklebanov in #​1750
• chore: bump GitHub actions. by @​igalklebanov in #​1751

⚠️ Breaking Changes

🐤 New Contributors

Full Changelog: kysely-org/kysely@v0.28.12...v0.28.13

sidorares/node-mysql2 (mysql2)

v3.22.3

Compare Source

Bug Fixes

• allow resetOnRelease in connection config validation (#​4278) (e72f923)

v3.22.2

Compare Source

Bug Fixes

• promise: point rejection stacks at caller for promise API (#​4267) (c79a3f3)

v3.22.1

Compare Source

Bug Fixes

• async stack traces not pointing to correct source, regression introduced by #​4257 (#​4265) (5b6206c)
• packet: return INVALID_DATE for zero dates with numeric timezone offset (#​1019) (#​4258) (cb5adcc)

v3.22.0

Compare Source

Features

• disable mysql_clear_password plugin by default (#​4236) (884bec5), closes #​1617
• implement COM_RESET_CONNECTION with pool integration (#​4148) (49a64cc)

Performance Improvements

• defer Error object creation to error handlers in promise wrappers (#​4257) (ab131de)

v3.21.1

Compare Source

Bug Fixes

• limit client flags to server capabilities (#​4227) (e1930b8)
• use Number.isSafeInteger for supportBigNumbers boundary check (#​4225) (295264b)

v3.21.0

Compare Source

Features

• add support for query attributes (#​4223) (d732f78)
• types: export ExecuteValues and QueryValues from entry point (9fafd6f)

facebook/react (react)

v19.2.5: 19.2.5 (April 8th, 2026)

Compare Source

React Server Components

• Add more cycle protections (#​36236 by @​eps1lon and @​unstubbable)

SuperchupuDev/tinyglobby (tinyglobby)

v0.2.16

Compare Source

Fixed

• Upgraded picomatch to 4.0.4, mitigating any potential exposure to
  CVE-2026-33671
  and CVE-2026-33672

Changed

• Overhauled and optimized most internals by Torathion
• Ignore patterns are no longer compiled twice by webpro

rolldown/tsdown (tsdown)

v0.21.10

Compare Source

   🚀 Features

• Upgrade rolldown  -  by @​sxzz (8a449)

    View changes on GitHub

v0.21.9

Compare Source

   🚀 Features

• Upgrade rolldown  -  by @​sxzz (2d74e)
• config: Track transitive config dependencies for watch reload  -  by @​sxzz in #​919 (16e27)
• exports: Add bin to publishConfig when devExports is enabled  -  by @​sxzz in #​911 (60592)
• plugin: Add tsdownConfig and tsdownConfigResolved plugin hooks  -  by @​sxzz in #​918 (665e5)

   🐞 Bug Fixes

• Skip package.json writting when content is deeply equal  -  by @​ocavue and @​sxzz in #​913 (d8e1c)
• Skip Node.js version check in Bun  -  by @​sxzz (38afd)
• css: Detect css modules from full id for vue virtual sfc styles  -  by @​sxzz in #​917 (e6021)

    View changes on GitHub

v0.21.8

Compare Source

   🚀 Features

• Upgrade rolldown  -  by @​sxzz (7f887)
• attw: Improve ignoreRules type to autocomplete known values  -  by @​mrlubos in #​892 (c8f5c)
• create-tsdown: Add Vite Plus template option  -  by @​sxzz (daed0)
• exports: Add extensions option for subpath export keys  -  by @​SinhSinhAn and @​sxzz in #​899 (1bb7a)
• target: Add support for baseline-widely-available target  -  by @​sxzz in #​896 (d6a16)

   🐞 Bug Fixes

• Export type only for cjs dts re-export  -  by @​sxzz (25510)
• Exclude shim file from bundled dependency hint  -  by @​sxzz in #​909 (3f8de)
• dts: Skip cjs dts reexport for non-entry chunks  -  by @​sxzz (5fee2)

    View changes on GitHub

v0.21.7

Compare Source

   🚀 Features

• Add module option for attw and publint to allow passing imported modules directly  -  by @​sxzz (31e90)

   🐞 Bug Fixes

• deps: Add skipNodeModulesBundle dep subpath e2e tests and fix docs  -  by @​sxzz (deff7)

    View changes on GitHub

v0.21.6

Compare Source

   🚀 Features

• Upgrade rolldown to v1.0.0-rc.12  -  by @​sxzz (51292)
• config:
  • Pass root config to workspace config functions  -  by @​sxzz (76169)
  • Use mergeConfig for workspace config merging and support variadic overrides  -  by @​sxzz (148aa)
• dts:
  • Add cjsReexport option to eliminate dual module type hazard  -  by @​mandarini and @​sxzz in #​856 (875c1)
• exports:
  • Add bin option to auto-generate package.json bin field  -  by @​sxzz in #​869 (7ebd6)

   🐞 Bug Fixes

• css:
  • Compile preprocessor langs in virtual CSS modules  -  by @​sxzz in #​865 (7b2e0)
  • Strip .module from CSS output filenames  -  by @​sxzz in #​866 (03ade)
  • Default splitting to true in unbundle mode for CSS inject  -  by @​sxzz in #​867 (a4da6)
  • Split CSS plugin into pre/post phases for scoped CSS support  -  by @​sxzz in #​870 (ff0c4)
• entry:
  • Correctly output relative paths in logger output  -  by @​sxzz (00050)

    View changes on GitHub

v0.21.5

Compare Source

   🚀 Features

• Update rolldown to 1.0.0-rc.10  -  by @​wChenonly in #​845 (41411)
• Support typescript v6  -  by @​ocavue in #​858 (bffc4)

   🐞 Bug Fixes

• css:
  • Run final minification on merged CSS output  -  by @​sxzz in #​853 (475df)
  • Don't override internal importer  -  by @​Laupetin in #​860 (af40e)
  • Use aliased exports for CSS module keys  -  by @​wChenonly and @​sxzz in #​840 (bb6de)
• deps:
  • External optionalDependencies by default  -  by @​sxzz (cd24d)
  • Resolve subpath extensions for packages without exports field  -  by @​sxzz in #​863 (c5150)
  • Correctly resolve root @types packages for dts deep imports  -  by @​brc-dd and @​sxzz in #​852 (0b276)

    View changes on GitHub

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 39b0b61

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

Allure Test Report for this PR:

✅ Allure Report | History

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

[pkg-pr-new]

create-studiocms

npm i https://pkg.pr.new/create-studiocms@1538

effectify

npm i https://pkg.pr.new/effectify@1538

studiocms

npm i https://pkg.pr.new/studiocms@1538

@studiocms/auth0

npm i https://pkg.pr.new/@studiocms/auth0@1538

@studiocms/blog

npm i https://pkg.pr.new/@studiocms/blog@1538

@studiocms/cloudinary-image-service

npm i https://pkg.pr.new/@studiocms/cloudinary-image-service@1538

@studiocms/devapps

npm i https://pkg.pr.new/@studiocms/devapps@1538

@studiocms/discord

npm i https://pkg.pr.new/@studiocms/discord@1538

@studiocms/github

npm i https://pkg.pr.new/@studiocms/github@1538

@studiocms/google

npm i https://pkg.pr.new/@studiocms/google@1538

@studiocms/html

npm i https://pkg.pr.new/@studiocms/html@1538

@studiocms/markdoc

npm i https://pkg.pr.new/@studiocms/markdoc@1538

@studiocms/markdown-remark

npm i https://pkg.pr.new/@studiocms/markdown-remark@1538

@studiocms/md

npm i https://pkg.pr.new/@studiocms/md@1538

@studiocms/mdx

npm i https://pkg.pr.new/@studiocms/mdx@1538

@studiocms/s3-storage

npm i https://pkg.pr.new/@studiocms/s3-storage@1538

@studiocms/upgrade

npm i https://pkg.pr.new/@studiocms/upgrade@1538

@studiocms/wysiwyg

npm i https://pkg.pr.new/@studiocms/wysiwyg@1538

@withstudiocms/api-spec

npm i https://pkg.pr.new/@withstudiocms/api-spec@1538

@withstudiocms/auth-kit

npm i https://pkg.pr.new/@withstudiocms/auth-kit@1538

@withstudiocms/cli-kit

npm i https://pkg.pr.new/@withstudiocms/cli-kit@1538

@withstudiocms/component-registry

npm i https://pkg.pr.new/@withstudiocms/component-registry@1538

@withstudiocms/config-utils

npm i https://pkg.pr.new/@withstudiocms/config-utils@1538

@withstudiocms/effect

npm i https://pkg.pr.new/@withstudiocms/effect@1538

@withstudiocms/internal_helpers

npm i https://pkg.pr.new/@withstudiocms/internal_helpers@1538

@withstudiocms/kysely

npm i https://pkg.pr.new/@withstudiocms/kysely@1538

@withstudiocms/sdk

npm i https://pkg.pr.new/@withstudiocms/sdk@1538

@withstudiocms/template-lang

npm i https://pkg.pr.new/@withstudiocms/template-lang@1538

commit: 39b0b61