[dependabot]

Bumps the npm group with 24 updates:

Package	From	To
@notionhq/client	5.3.0	5.27.1
cloudinary	2.8.0	2.11.0
feed	5.1.0	5.2.1
react	19.2.0	19.3.1
@types/react	19.2.2	19.3.0
react-dom	19.2.0	19.3.1
@types/react-dom	19.2.2	19.3.0
rehype-pretty-code	0.14.1	0.14.5
zod	4.1.13	4.6.7
@tailwindcss/postcss	4.1.16	4.3.3
@testing-library/react	16.3.0	16.3.3
@types/node	20.19.27	20.19.43
@vitest/ui	4.0.15	4.1.12
cheerio	1.1.2	1.2.0
fast-check	4.9.0	4.10.2
happy-dom	20.0.11	20.14.6
prettier	3.6.2	3.9.10
satori	0.18.3	0.62.0
sharp	0.34.5	0.35.5
shiki	3.15.0	3.23.0
tailwindcss	4.1.16	4.3.3
tsx	4.21.0	4.23.15
turbopack-inline-svg-loader	1.0.2	1.0.3
vitest	4.0.15	4.1.12

Updates @notionhq/client from 5.3.0 to 5.27.1

Release notes

Sourced from @​notionhq/client's releases.

v5.27.1

What’s changed

Bug fixes

• Cloudflare Workers and Deno workers are no longer treated as browsers (#809)
  • Since v5.27.0, creating a client with auth in Cloudflare Workers or a Deno worker thread threw BrowserTokenNotAllowedError, and the client stopped sending its user-agent header there. Both work again.
  • A worker now counts as a browser only when its global object is an instance of WorkerGlobalScope and it has an importScripts function. Browser pages, web workers, shared workers, and service workers are still blocked.
  • If you added dangerouslyAllowBrowser: true as a workaround on a server runtime, you can remove it.

Internals

• The version bump workflow checks contract changes against the last release tag, so a reviewed type change can merge before its minor release without landing in a patch (#807).

Links

• Full Changelog: makenotion/notion-sdk-js@v5.27.0...v5.27.1
• NPM Package: https://www.npmjs.com/package/@​notionhq/client/v/5.27.1

v5.27.0

What’s changed

Behavior changes

• Tokens are blocked in browsers by default (#791)
  • In a browser page, web worker, or service worker, constructing a client with auth throws BrowserTokenNotAllowedError. Per-request auth and OAuth client credentials reject with the same error before anything is sent. Anyone who can load the page can read the token and act as the connection.
  • Pass dangerouslyAllowBrowser: true to opt out, for example in jsdom tests. A client without a token still works in a browser, such as one whose baseUrl points at your own server. See the README's "Browser usage" section.

New capabilities

• Agent Skills API (#804)
  • Adds client.plugins.list(), client.plugins.retrieve(), and client.skills.retrieve(). The retrieve methods return a signed archive URL. They don't download or extract files.
• Typed databases (#790)
  • client.databases.create() accepts database_type of tasks, projects, or skills. Database and data source responses include a read-only database_type.

API response types

These changes match what the Agents API (public beta) returns today. Code that matched the old literals needs a small update.

• Personal agent ID is notion_ai (#806, from #774)
  • Agent response IDs can be notion_ai. The personal agent in QueryAgentsResponse has id: "notion_ai" instead of 33333333-3333-3333-3333-333333333333. Requests still accept the old UUID.
• Personal agent insights (#806, from #780)
  • client.agents.retrieveInsights() responses allow notion_ai for id and agent_type.
• Personal agent name is a string (#806, from #803)
  • Owners can rename their personal agent, so it's no longer always "Notion Agent".
• stream.end has no last_sequence (#806, from #773)
  • The API stopped sending it. Resume with event IDs.
• Session stream events are generated (#786). Event shapes are unchanged.

Docs and internals

... (truncated)

Commits

• 0ffdbba Bump version to v5.27.1 (#811)
• 3cf7286 Stop treating Cloudflare Workers and Deno workers as browsers (#809)
• 37d6d24 Allow reviewed contract changes before their minor release (#807)
• 25a755e Bump version to v5.27.0 (#806)
• 37025ab [AI] Add doc comments to property discriminators in Query sessions filter p...
• ebd7740 [AI] Document empty bounded pages in query sessions response (#788)
• a641494 [AI] Remove redacted tool-call input/output/error fields and update `ve...
• c996c38 Block Notion tokens in a browser unless dangerouslyAllowBrowser is set (#791)
• 5126811 [SDK] Add typed Skills and plugin directory methods (#804)
• 978d690 [AI] Update Create file upload parameter doc comments (#796)
• Additional commits viewable in compare view

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates cloudinary from 2.8.0 to 2.11.0

Release notes

Sourced from cloudinary's releases.

Version 2.11.0

• add support for image_file in visual_search Admin API (#740)
• add clear_invalid support to UploadAPI#explicit (#736)
• add support for 429 Too Many Requests HTTP status code (#735)

Version 2.10.1

• chore: remove create_slideshow — slideshow API has been sunset
• docs: add agent-readable documentation and repository metadata

Version 2.10.0

• feat: add last login filtering support to Users API (#725)
• chore: updated dependencies (#732)
• feat: add debug mode to capture request IDs for support debugging (#731)

Version 2.9.0

• chore: url parse replaced by native url + multiple fixes and rewrites (#730)
• Fix: use native promises, closes #711, closes #686
• feat: add support for dedicated_for parameter in update_access_key (#723)
• feat: add allow_dynamic_list_values parameter support to add_metadata… (#724)

Changelog

Sourced from cloudinary's changelog.

2.11.0 / 2026-08-27

• add support for image_file in visual_search Admin API (#740)
• add clear_invalid support to UploadAPI#explicit (#736)
• add support for 429 Too Many Requests HTTP status code (#735)

2.10.1 / 2026-08-19

• chore: remove create_slideshow — slideshow API has been sunset
• docs: add agent-readable documentation and repository metadata

2.10.0 / 2026-04-25

• feat: add last login filtering support to Users API (#725)
• chore: updated dependencies (#732)
• feat: add debug mode to capture request IDs for support debugging (#731)

2.9.0 / 2026-01-16

• chore: url parse replaced by native url + multiple fixes and rewrites (#730)
• Fix: use native promises, closes #711, closes #686
• feat: add support for dedicated_for parameter in update_access_key (#723)
• feat: add allow_dynamic_list_values parameter support to add_metadata… (#724)

Commits

• ea1d28a Version 2.11.0
• 14cf4e0 chore: update context7 account
• f75fb55 feat: add support for image_file in visual_search Admin API (#740)
• 1a3695b feat: add clear_invalid support to UploadAPI#explicit (#736)
• 4ec1894 feat: add support for 429 Too Many Requests HTTP status code (#735)
• e681d84 docs: split transform-and-deliver into image and video pairs
• 34c21a3 Version 2.10.1
• 0956154 docs: Add agent-readable documentation and code examples
• b86b32b fix(ci): pin @​types/node to restore dtslint, add Node 26 to matrix
• fbfd00d Merge pull request #738 from cloudinary/chore/remove-slideshow-api
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by const-cloudinary, a new releaser for cloudinary since your current version.

Updates feed from 5.1.0 to 5.2.1

Release notes

Sourced from feed's releases.

5.2.1

What's Changed

• fix exports field in package.json by @​yshrsmz in jpmonette/feed#238
• fix(rss/atom): sanitize enclosure URLs containing & by @​chick-p in jpmonette/feed#228

New Contributors

• @​yshrsmz made their first contribution in jpmonette/feed#238
• @​chick-p made their first contribution in jpmonette/feed#228

Full Changelog: jpmonette/feed@5.2.0...5.2.1

5.2.0

What's Changed

• Set copyright as optional for feed by @​lluisemper in jpmonette/feed#217
• feat(rss): relax tag output condition to allow name-only by @​huanjuedadehen in jpmonette/feed#220
• fix: treat description as optional rss2 to avoid "undefined" output by @​Krinkle in jpmonette/feed#223
• perf(rss/atom/json): Use .forEach() instead of .map() when resulting array is unused by @​Greenheart in jpmonette/feed#234
• docs: Show current default value for generator in example by @​Greenheart in jpmonette/feed#232
• fix: make copyright and id optional by @​dword-design in jpmonette/feed#219
• Hotfix for allowing multiple atom:link tags in the RSS2 feed by @​aletorrado in jpmonette/feed#235
• Add stylesheet support to rss and atom by @​kunatastic in jpmonette/feed#216
• release 5.2.0 by @​jpmonette in jpmonette/feed#236

New Contributors

• @​lluisemper made their first contribution in jpmonette/feed#217
• @​huanjuedadehen made their first contribution in jpmonette/feed#220
• @​Krinkle made their first contribution in jpmonette/feed#223
• @​Greenheart made their first contribution in jpmonette/feed#234
• @​dword-design made their first contribution in jpmonette/feed#219
• @​aletorrado made their first contribution in jpmonette/feed#235
• @​kunatastic made their first contribution in jpmonette/feed#216

Full Changelog: jpmonette/feed@5.1.0...5.2.0

Commits

• 78d021e add 5.2.1
• fcc8900 fix(rss/atom): sanitize enclosure URLs containing & (#228)
• ebf7792 fix exports field (#238)
• 0dd65a5 release 5.2.0 (#236)
• 4b913e3 Add stylesheet support to rss and atom (#216)
• 6745292 Hotfix for allowing multiple atom:link tags in the RSS2 feed (#235)
• 17d1013 fix: make copyright and id optional (#219)
• 8ba1675 Show current default value for generator in example (#232)
• 0e7456a perf(rss/atom/json): Use .forEach() instead of .map() when resulting arra...
• 14e3fc6 fix: treat description as optional rss2 to avoid "undefined" output (#223)
• Additional commits viewable in compare view

Updates react from 19.2.0 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

• Improve transport protocol (#37845 by @​unstubbable and @​eps1lon)

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)
• Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@​jackpope, @​sebmarkbage, @​eps1lon, @​Dhakshin2007, @​chirokas, @​teamleaderleo, @​fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

• browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
  • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

• Enable Trusted Types API integration (@​rickhanlonii #35816)
• Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@​acdlite #37290)
• Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@​hoxyq, @​eps1lon: #37104, #37203, #37491)

All Changes

React

• Fast Refresh Fixes
  • Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@​sophiebits #36965)
  • Fix Fast Refresh so edits to a memo() comparison function take effect (@​sophiebits #36964)
  • Fix Fast Refresh crash when an edit changes the kind of a component's type (@​sophiebits #36963)
  • Unify hot reload type resolution for Fast Refresh (@​sophiebits #36962)
  • Fix Fast Refresh to remount correctly when an edit changes the component kind (@​sophiebits #36950)
  • Double invoke effects in StrictMode after Fast Refresh (@​eps1lon #35962)
• Performance Track Fixes
  • Prevent crash when accessing $$typeof in Performance Tracks (@​eps1lon #35679)
  • Handle non-string function names in Performance Tracks (@​eps1lon #35659)
  • Use minus (-) instead of en dash for removed props in Performance Tracks (@​eps1lon #35649)
  • Handle arrays with bigints in deep objects in Performance Tracks (@​eps1lon #35648)
  • Don't enumerate typed array props in Performance Tracks in DEV (@​UditDewan #36913)
  • Bail out of diffing wide objects and arrays in Performance Tracks (@​eps1lon #34742)
  • Clear potentially large performance measures in DEV (@​hoxyq #34803)
  • Fix missing else branch for renders with no props change in Performance Tracks (@​hoxyq #34837)
• Activity Fixes
  • Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@​sophiebits #36947)
  • Hide portal contents when an Activity is hidden (@​acdlite #35091)
  • Prevent metadata hoisting in hidden <Activity> trees (@​ronnakamoto #34983)

... (truncated)

Changelog

Sourced from react's changelog.

19.3.0 (September 9, 2026)

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)
• Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@​jackpope, @​sebmarkbage, @​eps1lon, @​Dhakshin2007, @​chirokas, @​teamleaderleo, @​fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

• browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
  • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

• Enable Trusted Types API integration (@​rickhanlonii #35816)
• Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@​acdlite #37290)
• Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@​hoxyq, @​eps1lon: #37104, #37203, #37491)

All Changes

React

• Fast Refresh Fixes
  • Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@​sophiebits #36965)
  • Fix Fast Refresh so edits to a memo() comparison function take effect (@​sophiebits #36964)
  • Fix Fast Refresh crash when an edit changes the kind of a component's type (@​sophiebits #36963)
  • Unify hot reload type resolution for Fast Refresh (@​sophiebits #36962)
  • Fix Fast Refresh to remount correctly when an edit changes the component kind (@​sophiebits #36950)
  • Double invoke effects in StrictMode after Fast Refresh (@​eps1lon #35962)
• Performance Track Fixes
  • Prevent crash when accessing $$typeof in Performance Tracks (@​eps1lon #35679)
  • Handle non-string function names in Performance Tracks (@​eps1lon #35659)
  • Use minus (-) instead of en dash for removed props in Performance Tracks (@​eps1lon #35649)
  • Handle arrays with bigints in deep objects in Performance Tracks (@​eps1lon #35648)
  • Don't enumerate typed array props in Performance Tracks in DEV (@​UditDewan #36913)
  • Bail out of diffing wide objects and arrays in Performance Tracks (@​eps1lon #34742)
  • Clear potentially large performance measures in DEV (@​hoxyq #34803)
  • Fix missing else branch for renders with no props change in Performance Tracks (@​hoxyq #34837)
• Activity Fixes
  • Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@​sophiebits #36947)
  • Hide portal contents when an Activity is hidden (@​acdlite #35091)
  • Prevent metadata hoisting in hidden <Activity> trees (@​ronnakamoto #34983)
  • Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@​acdlite #35074)
  • Don't unhide a node if a direct parent Offscreen is still hidden (@​sebmarkbage #34821)
  • Don't show internal <Offscreen> component in error messages (@​rickhanlonii #35763)
• Warn in DEV when a component appears to have been unblocked by a conditional use() (@​hoxyq, @​eps1lon: #37104, #37203, #37491)
• Render transitions independently instead of entangling them into a single render (@​acdlite #37290)
• Fix hang when updating a dehydrated boundary inside a hidden tree (@​gaearon #37135)
• Don't reacquire Host Singletons during dev effect validation (@​gnoff #37113)
• Only remove properties from Host Singletons on release (@​gnoff #37112)

... (truncated)

Commits

• 61aa00d [19.3.x][Flight] Improve transport protocol (#37845)
• 2dc7da7 [test] Bump Jest to 30.4 (#37382)
• 4f93894 docs: remove stale parentType param from validateChildKeys JSDoc (#36928)
• dbc3750 Update required references to GitHub repo (#36752)
• 900ae09 [flow] Bump flow to v0.317.0 (#36701)
• fbb1370 [flow] Bump flow to v0.307.1 (#36199)
• 56922cf [react-native-renderer] Delete Paper (legacy) renderer (#36285)
• 74568e8 [Flight] Transport AggregateErrors.errors (#36156)
• e66ef64 [tests] remove withoutStack from assertConsole helpers (#35498)
• db71391 [Fiber] Instrument the lazy initializer thenable in all cases (#35521)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react since your current version.

Updates @types/react from 19.2.2 to 19.3.0

Commits

• See full diff in compare view

Updates react-dom from 19.2.0 to 19.3.1

Release notes

Sourced from react-dom's releases.

19.3.1 (October 14th, 2026)

React Server Components

• Improve transport protocol (#37845 by @​unstubbable and @​eps1lon)

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540,

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.