chore(deps)(deps): Bump the production-deps group across 1 directory with 12 updates

[dependabot]

Bumps the production-deps group with 12 updates in the / directory:

Package	From	To
@supabase/supabase-js	2.112.3	2.112.4
jose	6.2.9	6.2.10
react	19.2.3	19.2.8
react-native	0.86.2	0.87.1
react-native-safe-area-context	5.7.0	5.9.1
react-native-screens	4.26.2	4.27.0
@taiga-ui/cdk	5.19.0	5.21.0
@taiga-ui/core	5.19.0	5.21.0
@taiga-ui/i18n	5.19.0	5.21.0
@taiga-ui/icons	5.19.0	5.21.0
@taiga-ui/kit	5.19.0	5.21.0
@taiga-ui/styles	5.19.0	5.21.0

Updates @supabase/supabase-js from 2.112.3 to 2.112.4

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.112.4

2.112.4 (2026-08-24)

🩹 Fixes

• auth: convert stolen-lock AbortError when acquireTimeout is 0 (#2616)
• auth: warn on deprecated lock option and prevent unhandled refresh rejection (#2627)
• postgrest: move override fixtures out of generated types, repair codegen (#2605)
• realtime: respect custom logger for send() REST fallback warning (#2612)

❤️ Thank You

• Katerina Skroumpelou @​mandarini
• mmustafasenoglu @​mmustafasenoglu

v2.112.4-canary.3

2.112.4-canary.3 (2026-08-24)

🩹 Fixes

• auth: warn on deprecated lock option and prevent unhandled refresh rejection (#2627)

❤️ Thank You

• Katerina Skroumpelou @​mandarini

v2.112.4-canary.2

2.112.4-canary.2 (2026-08-24)

🩹 Fixes

• auth: convert stolen-lock AbortError when acquireTimeout is 0 (#2616)
• realtime: respect custom logger for send() REST fallback warning (#2612)

❤️ Thank You

• Katerina Skroumpelou @​mandarini
• mmustafasenoglu @​mmustafasenoglu

v2.112.4-canary.1

2.112.4-canary.1 (2026-08-12)

This was a version bump only, there were no code changes.

v2.112.4-canary.0

2.112.4-canary.0 (2026-08-11)

🩹 Fixes

• postgrest: move override fixtures out of generated types, repair codegen (#2605)

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.112.4 (2026-08-24)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

Commits

• c7397c1 chore(supabase): bump supabase cli to 2.113.0 (#2606)
• bbc167c chore(release): version 2.112.3 changelogs (#2608)
• See full diff in compare view

Updates jose from 6.2.9 to 6.2.10

Release notes

Sourced from jose's releases.

v6.2.10

Fixes

• jose: consume serialization members once (9bee285)
• jose: reject empty protected and JWE AAD members (8da4145)
• jose: validate serialized header values (b711d8f)
• jwe: conceal invalid decrypted CEK lengths (41fafe0)
• jwe: enforce AES-GCM tag boundaries (9a5b744)
• jwe: validate explicit encryption parameters (7a02697)
• jwk: accept empty octet-sequence keys (3f871e7)
• jwk: normalize key resolution inputs (f54ee7b)
• jwks: enforce verification key metadata (f9ba510)
• jwks: order overlapping remote reloads (9a1a913)
• jwks: reject invalid remote duration values (7bdb9e5)
• jwk: validate ext and key_ops parameters (4d91c37)
• jws: reject mixed payload encoding modes (dc69713)
• jws: validate unencoded payload strings (541f282)
• jwt: enforce explicit verification policies (b347182)
• jwt: prevent replacing protected headers (ae07d09)
• jwt: reject invalid duration inputs (282f9aa)
• jwt: validate builder claim values (ea03f83)
• jwt: validate unsecured protected headers (230c14e)
• key: validate generation and import options (15d880e)
• reject mixed b64 modes for empty General JWS payloads (61a2ef7)
• x509: reject DER truncated past its outer length (d8db9f6)

Documentation

• jwks: correct cache timestamp units (01a44d9)

Refactor

• jose: share binary input validation (eedb124)
• jose: share compact token processing internals (85e30ed)
• jwe: consolidate CBC decryption failures (1ee6f61)
• jwe: specialize compact processing (a998927)
• jwe: streamline single-recipient encryption (290aaa6)
• jwks: compact JWK Set shape validation (930c7df), references Array#every
• jwks: compact local key selection (4cb5ae5)
• jwks: compact remote resolver state (ef5eaf4)
• jws: specialize compact processing (021abf4)
• jwt: compact claim validation helpers (f390683)
• jwt: consolidate replicated claim checks (7dd5591)
• jwt: share producer claim state (52ba159)
• key: compact JWK algorithm selection (a6b29da)
• key: compact secret length parsing (cc03be8)

Changelog

Sourced from jose's changelog.

6.2.10 (2026-08-21)

Fixes

• jose: consume serialization members once (9bee285)
• jose: reject empty protected and JWE AAD members (8da4145)
• jose: validate serialized header values (b711d8f)
• jwe: conceal invalid decrypted CEK lengths (41fafe0)
• jwe: enforce AES-GCM tag boundaries (9a5b744)
• jwe: validate explicit encryption parameters (7a02697)
• jwk: accept empty octet-sequence keys (3f871e7)
• jwk: normalize key resolution inputs (f54ee7b)
• jwks: enforce verification key metadata (f9ba510)
• jwks: order overlapping remote reloads (9a1a913)
• jwks: reject invalid remote duration values (7bdb9e5)
• jwk: validate ext and key_ops parameters (4d91c37)
• jws: reject mixed payload encoding modes (dc69713)
• jws: validate unencoded payload strings (541f282)
• jwt: enforce explicit verification policies (b347182)
• jwt: prevent replacing protected headers (ae07d09)
• jwt: reject invalid duration inputs (282f9aa)
• jwt: validate builder claim values (ea03f83)
• jwt: validate unsecured protected headers (230c14e)
• key: validate generation and import options (15d880e)
• reject mixed b64 modes for empty General JWS payloads (61a2ef7)
• x509: reject DER truncated past its outer length (d8db9f6)

Documentation

• jwks: correct cache timestamp units (01a44d9)

Refactor

• jose: share binary input validation (eedb124)
• jose: share compact token processing internals (85e30ed)
• jwe: consolidate CBC decryption failures (1ee6f61)
• jwe: specialize compact processing (a998927)
• jwe: streamline single-recipient encryption (290aaa6)
• jwks: compact JWK Set shape validation (930c7df), references Array#every
• jwks: compact local key selection (4cb5ae5)
• jwks: compact remote resolver state (ef5eaf4)
• jws: specialize compact processing (021abf4)
• jwt: compact claim validation helpers (f390683)
• jwt: consolidate replicated claim checks (7dd5591)
• jwt: share producer claim state (52ba159)
• key: compact JWK algorithm selection (a6b29da)
• key: compact secret length parsing (cc03be8)

Commits

• 3eab152 chore(release): 6.2.10
• 021abf4 refactor(jws): specialize compact processing
• a998927 refactor(jwe): specialize compact processing
• eedb124 refactor(jose): share binary input validation
• 52ba159 refactor(jwt): share producer claim state
• 85e30ed refactor(jose): share compact token processing internals
• 0bd81d2 test(jose): cover hidden critical-header options
• 9cf7876 test(jose): reject callable object impostors
• f23cafd test(jose): preserve resolved key data properties
• 1ee6f61 refactor(jwe): consolidate CBC decryption failures
• Additional commits viewable in compare view

Updates react from 19.2.3 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

19.2.7 (June 1st, 2026)

React Server Components

• Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (#36566 by @​unstubbable)

19.2.6 (May 6th, 2026)

React Server Components

• Type hardening and performance improvements (#36425 by @​eps1lon and @​unstubbable)

19.2.5 (April 8th, 2026)

React Server Components

• Add more cycle protections (#36236 by @​eps1lon and @​unstubbable)

19.2.4 (January 26th, 2026)

React Server Components

• Add more DoS mitigations to Server Actions, and harden Server Components (#35632 by @​gnoff, @​lubieowoce, @​sebmarkbage, @​unstubbable)

Changelog

Sourced from react's changelog.

19.2.7 (June 1, 2026)

React Server Components

• Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (@​unstubbable #36566)

19.2.6 (May 6, 2026)

React Server Components

• Type hardening and performance improvements (@​eps1lon, @​unstubbable #36425)

19.2.5 (March 18, 2026)

React Server Components

• Add more cycle protections (@​eps1lon, @​unstubbable #36236)

19.2.4 (Jan 26, 2026)

React Server Components

• Add more DoS mitigations to Server Actions, and harden Server Components (@​gnoff, @​lubieowoce, @​sebmarkbage, @​unstubbable #35632)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• 6117d7c Version 19.2.7 (#36591)
• eaf3e95 Version 19.2.6
• 23f4f9f 19.2.5
• 90ab3f8 Version 19.2.4
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react since your current version.

Updates react-native from 0.86.2 to 0.87.1

Release notes

Sourced from react-native's releases.

0.87.1

Added

iOS specific

• SwiftPM: Added hard fail and clear error message when an autolinking plugin host is referenced as a dependency (90a539c92d by @​chrfalch)

Changed

• Hermes: Bump hermes-v1 to 250829098.0.17 (861e2d0bde by @​cipolleschi)

Fixed

• Animated: Animated.Value.addListener() types its callback payload as {value: number} rather than any (3eab03df4c by @​huntie)
• Animated: Animated.event() is typed as an event handler rather than any (3eb330a365 by @​huntie)

iOS specific

• Cocoapods: Keep the quotes on header search paths containing spaces in add_rn_third_party_dependencies (71c6bfbfdc by @​Kudo)
• SwiftPM: Reject colliding or invalid spm.modules names instead of silently dropping a module from the build (39cd1dfc4c by @​chrfalch)
• SwiftPM: Resolve Swift manifest naming collisions (962aeec5e5 by @​chrfalch)
• SwiftPM: Fixed not reading spm.name from react-native.config.js when scaffolding the Swift manifest (482acee824 by @​chrfalch)
• SwiftPM: Removed unused field spm.modules.publicHeaderFiles from react-native.config.js's spm section (5168f5f831 by Christian Falch)
• SwiftPM: SwiftPM pipeline now reads react-native.config.js with default exports correctly (ed76640ba6 by @​chrfalch)
• SwiftPM: Created constants for internal SwiftPM packages so that we can create guards to avoid collisions (d36aa4961d by @​chrfalch)
• SwiftPM: Set SWIFT_ACTIVE_COMPILATION_CONDITIONS = DEBUG when injecting SPM (4433cdbe62 by @​radoslawrolka)
• SwiftPM: Recover React-Core-prebuilt configuration swaps that were interrupted before the marker was updated (a772a7ca16 by @​adityasingh2400)
• SwiftPM: Fix Hermes runtime/compiler version mismatch causing "Wrong bytecode version" crashes in SwiftPM Release builds (ead93778a1 by @​nduaarte)

---

Hermes V1 dSYMS:

• Debug
• Release

ReactNativeDependencies dSYMs:

• Debug
• Release

ReactNative Core dSYMs:

• Debug
• Release

---

You can file issues or pick requests against this release here.

---

... (truncated)

Changelog

Sourced from react-native's changelog.

v0.87.1

Added

iOS specific

• SwiftPM: Added hard fail and clear error message when an autolinking plugin host is referenced as a dependency (90a539c92d by @​chrfalch)

Changed

• Hermes: Bump hermes-v1 to 250829098.0.17 (861e2d0bde by @​cipolleschi)

Fixed

• Animated: Animated.Value.addListener() types its callback payload as {value: number} rather than any (3eab03df4c by @​huntie)
• Animated: Animated.event() is typed as an event handler rather than any (3eb330a365 by @​huntie)

iOS specific

• Cocoapods: Keep the quotes on header search paths containing spaces in add_rn_third_party_dependencies (71c6bfbfdc by @​Kudo)
• SwiftPM: Reject colliding or invalid spm.modules names instead of silently dropping a module from the build (39cd1dfc4c by @​chrfalch)
• SwiftPM: Resolve Swift manifest naming collisions (962aeec5e5 by @​chrfalch)
• SwiftPM: Fixed not reading spm.name from react-native.config.js when scaffolding the Swift manifest (482acee824 by @​chrfalch)
• SwiftPM: Removed unused field spm.modules.publicHeaderFiles from react-native.config.js's spm section (5168f5f831 by Christian Falch)
• SwiftPM: SwiftPM pipeline now reads react-native.config.js with default exports correctly (ed76640ba6 by @​chrfalch)
• SwiftPM: Created constants for internal SwiftPM packages so that we can create guards to avoid collisions (d36aa4961d by @​chrfalch)
• SwiftPM: Set SWIFT_ACTIVE_COMPILATION_CONDITIONS = DEBUG when injecting SPM (4433cdbe62 by @​radoslawrolka)
• SwiftPM: Recover React-Core-prebuilt configuration swaps that were interrupted before the marker was updated (a772a7ca16 by @​adityasingh2400)
• SwiftPM: Fix Hermes runtime/compiler version mismatch causing "Wrong bytecode version" crashes in SwiftPM Release builds (ead93778a1 by @​nduaarte)

v0.87.0

Breaking

• Appearance: Fix return type of useColorScheme() hook (now ColorSchemeName | null) (ef6463c25d by @​huntie)
• Appearance: useColorScheme() no longer returns 'unspecified' (this was always the case, but is a breaking type change) (8ac88f481a by @​huntie)
• CLI: The react-native/core-cli-utils package is no longer published. It remains available in the React Native repo as a reference implementation. (9c3fddf9cd by @​huntie)
• Hermes: Remove Legacy Hermes from C++ code (f9476256bd by @​cipolleschi)
• JavaScript API: Deep imports to 'react-native/src/private/...' have been restricted, and are no longer visible to TypeScript. These subpaths still exist, but do not have type coverage. (142b6172a9 by @​huntie)
• JavaScript API: The NativeDialogManagerAndroid export is removed. (a793d21a7e by @​huntie)
• JavaScript API: The Touchable root export (undocumented) is removed. If you are extending Touchable as a type, please use ViewProps instead. (6fbf3062f9 by @​huntie)
• JavaScript API: react-native/rn-get-polyfills is removed — please use react-native/js-polyfills (package) (b6a535afee by @​huntie)
• Jest: react-native/jest-preset is removed — all projects must now migrate to react-native/jest-preset (package) (9ee21ddd9b by @​huntie)
• Legacy Architecture: Compile out RuntimeScheduler_Legacy under RCT_REMOVE_LEGACY_ARCH (d205267a5f by @​christophpurrer)
• LogBox: Set max font scaling in LogBox to avoid layout breaking (4aef2b0126 by @​pchalupa)
• Node: Require Node.js >= 22.13.0 (a0d39e7a9c by @​huntie)
• React Native DevTools: Remove support for connecting to the standalone react-devtools package via WebSocket. Use React Native DevTools instead. (f1971caa44 by @​huntie)
• Renderer: Remove RawPropsKey prefix and suffix (67381e157f by @​javache)
• Runtime: Remove the SceneTracker module from Libraries/Utilities, stop setting the active scene from AppRegistry.runApplication, and pass the app key as an optional second argument to WrapperComponentProvider (bbb5be9b41 by @​rubennorte)
• ScrollView: Remove deprecated boolean values support for ScrollView keyboardShouldPersistTaps (5bf3e38db2 by @​zoontek)

... (truncated)

Commits

• a59eff6 Release 0.87.1
• 1a6b526 [0.87] Regenerate ReactNativeApi snapshot with CI toolchain
• dda5dd3 [0.87] Regenerate ReactNativeApi snapshot
• 476887c Merge remote-tracking branch 'refs/remotes/origin/pr/58052' into 0.87-stable
• e6e404e Hold an app's spm.modules names to the same rules as a library's (#58060)
• c951129 Resolve SwiftPM manifest naming collisions (#58044)
• 33624ce Honor a library's spm.name when scaffolding its Package.swift (#58033)
• 617a82f Fail with clear error message when a dep depends on an autolinking plugin hos...
• 5e24a69 Drop the inert publicHeadersPath from spm.modules (#58059)
• 40af900 Read both export styles from a library's react-native.config.js (#58034)
• Additional commits viewable in compare view

Updates react-native-safe-area-context from 5.7.0 to 5.9.1

Release notes

Sourced from react-native-safe-area-context's releases.

Release 5.9.1

5.9.1 (2026-08-18)

Bug Fixes

• register src/paper/java as a Java source set on old architecture (#755) (780f599), closes #733 #754

Release 5.9.0

5.9.0 (2026-08-12)

Bug Fixes

• avoid NotFoundError when the measurement element is already detached (#746) (76dfb06)
• make nested SafeAreaProvider report its own frame and insets on web (#737) (2fa707d)
• update insets and frame on window resize on web (#736) (1fe7ec5)

Features

• Adopt AGP v9 (#733) (42c50a6)

Release 5.8.1

5.8.1 (2026-08-03)

Bug Fixes

• Move jest/mock into package build (fix TS under RN 0.87) (#745) (b9e2857)
• skip Fabric SafeAreaView state updates while detached from window (#735) (ae0e83f)

Features

• upgrade to react-native 0.85.0 with RNTA 5.3.2 (#732) (4d00f52)

Release 5.8.0

5.8.0 (2026-05-18)

Changes

• remove UIImplementation usage from SafeAreaView (#730) (ef89f4d)

Commits

• 63fab20 chore: release 5.9.1
• 780f599 fix: register src/paper/java as a Java source set on old architecture (#755)
• f65d4d9 chore: release 5.9.0
• 76dfb06 fix: avoid NotFoundError when the measurement element is already detached (#746)
• 2fa707d fix: make nested SafeAreaProvider report its own frame and insets on web (#737)
• 1fe7ec5 fix: update insets and frame on window resize on web (#736)
• 42c50a6 feat: Adopt AGP v9 (#733)
• b3cfc57 chore: release 5.8.1
• 2f7f2e9 rm tea.yaml
• b9e2857 fix: Move jest/mock into package build (fix TS under RN 0.87) (#745)
• Additional commits viewable in compare view

Updates react-native-screens from 4.26.2 to 4.27.0

Release notes

Sourced from react-native-screens's releases.

4.27.0

What's changed

This release adds support for React Native 0.87, fixing a runtime crash on iOS in the process. It also introduces the experimental ScrollToTopGuard component and fully migrates the Split component implementation from Swift to Objective-C.

✅ Improvements

• feat(Android, Stack v5): support sending multiple updates via view command (#4243)
• refactor(test): Add scenario for Stack v5 preventNativeDismiss with nested stack (#4279)
• feat(Stack v5, iOS): Implement basic view commands for iOS header menu (#4339)
• feat(experimental, iOS): add experimental ScrollToTopGuard component (#4454)
• refactor: change default value of backTitleVisible to true instead of 'true' (#4457)
• chore(iOS, Split): Migrate ReactMountingTransactionObserving to obj-c (#4458)
• chore(iOS, Split): Migrate Appearance-related logic to obj-c (#4459)
• chore: add support for react-native@0.87.0-rc.3 (#4461)
• chore(iOS, Split): Migrate RNSSplitNavigationController to obj-c (#4462)
• chore(iOS, Split): Migrate RNSSplitScreenController to obj-c (#4463)
• chore(iOS, Split): Migrate RNSSplitHostController to Obj-C with all associated classes (#4465)
• chore(iOS): Post Swift-removal cleanup (#4466)
• feat(ios, Stack v4): add subtitle support for UIMenu header button submenus (#4469)

🐞 Bugfixes

• fix(Android): defensively guard against an unexpected menuItem Id (#4450)
• fix(Android, Stack): don't add top inset to measured header height when it's disabled (#4452)
• fix(iOS, Stack v4): fall back to inheriting orientation if it's not defined on the screen (#4455)
• fix(iOS): Don't swap view controller's view during transition (#4456)
• fix(iOS, Tabs): re-layout tab bar after async icon load to prevent label truncation on iOS 26 (#4460)
• fix(Android): Fix crash when header gets update during screen removal (#4468)
• fix(Android, FormSheet v4): Cleanup inset and layout listener (#4470)
• fix(JS): Prevent using ViewInstance type (#4471)
• fix(iOS, Stack v5): use framework-style imports for React core headers (#4472)

Misc

• chore(examples): allow explicit undefined for defaultRouteName in TabsContainerStateInitArg (#4353)
• chore: block the possibility to create plain-text issues and update agents instructions (#4366)
• chore: Update workflows to include v4-main (#4396)
• chore: Remove nightly publishing flows from v4 and bump npm-package-publish (#4401)
• chore: bump react-navigation submodule version (#4451)
• chore: format RNSScreenShadowNode.cpp after #4357 (#4453)
• chore(Android): Fix incremental compilation in FabricExample broken by Kotlin 2.2 symlink issue (#4467)

Commits

• 42c1615 release: 4.27.0 (#4475)
• 2b55ed6 fix(iOS): Add missing RNSScrollToTopGuard stubs (#4480)
• 1ce9142 Revert "chore: backport #4411 (#4460)" (#4477)
• 973def6 chore: backport #4402 (#4472)
• d59af14 chore: backport #4447 (#4471)
• 23ba913 chore: backport #4449 (#4470)
• 9aa7d2a chore: backport #4107 (#4469)
• 2ac61a1 chore: backport #4444 (#4468)
• c993a72 chore: backport #4443 (#4467)
• 85f7a08 chore: backport #4426 (#4466)
• Additional commits viewable in compare view

Updates @taiga-ui/cdk from 5.19.0 to 5.21.0

Release notes

Sourced from @​taiga-ui/cdk's releases.

Release v5.21.0

5.21.0 (2026-08-24)

🚀 Features

• addon-mobile: BottomSheet add bar input to hide drag bar (#14777) (136a1cb)
• core: support labels for buttons (#14802) (ea9c09f)
• experimental: ScrollWheel add new component (#14748) (e1aaa80)
• kit: ComboBox abstract value handling so it can be overridden (#14795) (8a6a600)
• kit: update tests and documentation for tui-calendar-range component v5 (#14774) (336bbd6)

🐞 Bug Fixes

• addon-table: Table fix infinite tuiSortChange loop on simultaneous sort change (#14801) (109772a)
• core: DropdownHover rollback broken changes (#14782) (8ed2faa)
• kit: CalendarRange fix month display according to min/max limits (#14786) (1a45ee8)
• kit: InputInline fix for updateOn blur/submit (#14792) (8f6788c)
• kit: InputNumber add step support in tables (#14747) (ce0a8e5)
• kit: empty InputSlider fix (#14787) (7686cef)
• kit: textfield content overflow fix v5 (#14798) (c10561c)
• layout: BlockDetails fix alignment in dialog (#14741) (a41ba02)
• schematics: skip templateUrl resolution for non-literal expressions (#14793) (40bfc8b)
• schematics: warn on removed legacy TuiTextarea/NativeFocusable/TableBarsHost in v5 (#14776) (

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
pulseticker	Ready	Preview	Sep 2, 2026 8:04pm UTC

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.