chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@supabase/ssr	^0.10.3 → ^0.12.0
@supabase/supabase-js (source)	^2.107.0 → ^2.108.0
typescript (source)	5.6.3 → 5.9.3
vue-tsc (source)	^3.3.3 → ^3.3.4

---

Release Notes

supabase/ssr (@​supabase/ssr)

v0.12.0

Compare Source

Features

• adds cookies.encode option allowing minimal cookie sizes (#​126) (cf38b22)
• bump cookie to 1.0.2 (#​113) (b4a77b4)
• cookies: add clearAuthCookiesAtScopes migration helper (#​240) (4e47249)
• full rewrite using getAll and setAll cookie methods (#​1) (b6ae192)
• improve cookie chunk handling via base64url+length encoding (#​90) (6deb687)
• pass cache headers to setAll to prevent CDN caching of auth responses (#​176) (14962d2)
• publish SSR under deprecated auth-helpers package names (#​127) (e8b6102)
• release workflow RC versioning and publish reliability (#​164) (81e68f4)
• update CI so it runs on release as well (#​33) (4517996)
• update supabase-js to latest (#​133) (d65044d)
• update supabase-js to latest (#​145) (08bf7d6)
• upgrade cookie dependency and cleanup imports (#​77) (9524528)

Bug Fixes

• add @​types/cookies to dependencies (#​63) (47e5f16)
• add create*Client string in x-client-info (#​85) (f271acc)
• allow cookies encode without getAll/setAll on browser client (#​213) (89f3f28), closes #​170
• allow use of createBrowserClient without window present (#​20) (27d868d)
• auth: respect user-provided auth options in createBrowserClient (#​167) (5f04837)
• check chunkedCookie is string in server client (#​57) (549fe62)
• ci: remove packageManager field (#​197) (6bf0226)
• cookies console warnings (#​136) (64ff6b3)
• deprecate parse, serialize exports for more useful functions (#​14) (0b5f881)
• enable tree-shaking for browser bundles (#​216) (f009d71)
• fix createBrowserClient deprecation tsdoc (#​17) (1df70ad)
• force release (#​98) (66710e8)
• re-apply update CI so it runs on release as well (#​49) (51d5a43)
• release: pin npm to 11.5.2 so OIDC trusted publisher works (#​249) (4af89f7)
• remove optional dependencies (#​41) (a48fe6f)
• remove usage of internal type params (#​123) (8f3e89e)
• revert "update CI so it runs on release as well" (#​44) (9d0e859)
• revert: "feat: improve cookie chunk handling via base64url+length encoding (#​90)" (#​100) (2ea8e23)
• set max-age default cookie option to 400 days (#​54) (f4ed2e0)
• set cookies for password recovery event (#​32) (7dc1837)
• set cookies when mfa challenge is verified (#​27) (c217f53)
• tsconfig: set explicit rootDir to silence TS6059 in consumer IDEs (#​211) (a77ee8a), closes #​209
• update conventional commits ci to use main instead of master (#​31) (bebce89)
• update README session docs (#​159) (b859905)
• update type, remove unused imports, define AuthEvent type (#​47) (4f4a375)
• use skipAutoInitialize to prevent SSR token refresh race condition (#​131) (0b7be28)
• validate base64-prefixed chunked cookies decode to valid JSON (#​210) (302cc0e)

supabase/supabase-js (@​supabase/supabase-js)

v2.108.0

Compare Source

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

microsoft/TypeScript (typescript)

v5.9.3: TypeScript 5.9.3

Compare Source

Note: this tag was recreated to point at the correct commit. The npm package contained the correct content.

For release notes, check out the release announcement

• fixed issues query for Typescript 5.9.0 (Beta).
• fixed issues query for Typescript 5.9.1 (RC).
• No specific changes for TypeScript 5.9.2 (Stable)
• fixed issues query for Typescript 5.9.3 (Stable).

Downloads are available on:

• npm

v5.9.2: TypeScript 5.9

Compare Source

Note: this tag was recreated to point at the correct commit. The npm package contained the correct content.

For release notes, check out the release announcement

• fixed issues query for Typescript 5.9.0 (Beta).
• fixed issues query for Typescript 5.9.1 (RC).
• No specific changes for TypeScript 5.9.2 (Stable)

Downloads are available on:

• npm

v5.8.3: TypeScript 5.8.3

Compare Source

Note: this tag was recreated to point at the correct commit. The npm package contained the correct content.

For release notes, check out the release announcement.

• fixed issues query for Typescript 5.8.0 (Beta).
• fixed issues query for Typescript 5.8.1 (RC).
• fixed issues query for Typescript 5.8.2 (Stable).
• fixed issues query for Typescript 5.8.3 (Stable).

Downloads are available on:

• npm

v5.8.2: TypeScript 5.8

Compare Source

For release notes, check out the release announcement.

• fixed issues query for Typescript 5.8.0 (Beta).
• fixed issues query for Typescript 5.8.1 (RC).
• fixed issues query for Typescript 5.8.2 (Stable).

Downloads are available on:

• npm

v5.7.3: TypeScript 5.7.3

Compare Source

For release notes, check out the release announcement.

• fixed issues query for Typescript 5.7.0 (Beta).
• fixed issues query for Typescript 5.7.1 (RC).
• fixed issues query for Typescript 5.7.2 (Stable).
• fixed issues query for Typescript 5.7.3 (Stable).

Downloads are available on npm

v5.7.2: TypeScript 5.7

Compare Source

For release notes, check out the release announcement.

• fixed issues query for Typescript 5.7.0 (Beta).
• fixed issues query for Typescript 5.7.1 (RC).
• fixed issues query for Typescript 5.7.2 (Stable).

Downloads are available on:

• npm

vuejs/language-tools (vue-tsc)

v3.3.4

Compare Source

language-core

• fix: only exclude already-set props from inherited attrs when checkRequiredFallthroughAttributes is enabled (#​6088) - Thanks to @​KazariEX!
• fix: camelize slot props regardless of htmlAttributes option (#​6089) - Thanks to @​KazariEX!
• fix: detect duplicate event listeners across name formats (#​6094) - Thanks to @​whysopaul!

language-service

• fix: respect var hoisting for destructured props hints (#​6092) - Thanks to @​KazariEX!

typescript-plugin

• fix: do not treat class and style as a boolean property (#​6081) - Thanks to @​KazariEX!

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
supabase	Error		Jun 10, 2026 9:59am
supabase-demo	Error		Jun 10, 2026 9:59am

[pkg-pr-new]

npm i https://pkg.pr.new/@nuxtjs/supabase@613

commit: 86b1207

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

Scope: all 3 workspace projects
? Verifying lockfile against supply-chain policies (1783 entries)...
✓ Lockfile passes supply-chain policies (1783 entries in 13.9s)
Progress: resolved 1, reused 0, downloaded 0, added 0
Progress: resolved 58, reused 0, downloaded 0, added 0
Progress: resolved 196, reused 0, downloaded 0, added 0
Progress: resolved 238, reused 0, downloaded 0, added 0
Progress: resolved 327, reused 0, downloaded 0, added 0
Progress: resolved 371, reused 0, downloaded 0, added 0
Progress: resolved 418, reused 0, downloaded 0, added 0
Progress: resolved 542, reused 0, downloaded 0, added 0
Progress: resolved 627, reused 0, downloaded 0, added 0
Progress: resolved 707, reused 0, downloaded 0, added 0
Progress: resolved 767, reused 0, downloaded 0, added 0
Progress: resolved 776, reused 0, downloaded 0, added 0
Progress: resolved 902, reused 0, downloaded 0, added 0
[WARN] Request took 11902ms: https://registry.npmjs.org/@typescript-eslint%2Feslint-plugin
Progress: resolved 949, reused 0, downloaded 0, added 0
Progress: resolved 1082, reused 0, downloaded 0, added 0
Progress: resolved 1146, reused 0, downloaded 0, added 0
Progress: resolved 1161, reused 0, downloaded 0, added 0
Progress: resolved 1174, reused 0, downloaded 0, added 0
Progress: resolved 1211, reused 0, downloaded 0, added 0
Progress: resolved 1240, reused 0, downloaded 0, added 0
Progress: resolved 1324, reused 0, downloaded 0, added 0
Progress: resolved 1496, reused 0, downloaded 1, added 0
[WARN] Request took 10295ms: https://registry.npmjs.org/@typescript-eslint%2Ftypescript-estree
Progress: resolved 1539, reused 0, downloaded 1, added 0
Progress: resolved 1566, reused 0, downloaded 1, added 0
Progress: resolved 1625, reused 0, downloaded 1, added 0
Progress: resolved 1629, reused 0, downloaded 1, added 0
Progress: resolved 1645, reused 0, downloaded 1, added 0
Progress: resolved 1783, reused 0, downloaded 1, added 0
[ERR_PNPM_NO_MATURE_MATCHING_VERSION] 7 versions do not meet the minimumReleaseAge constraint:
  @supabase/[email protected] was published at 2026-06-08T12:01:48.538Z, within the minimumReleaseAge cutoff (2026-06-08T09:58:37.582Z)
  @supabase/[email protected] was published at 2026-06-08T12:01:41.516Z, within the minimumReleaseAge cutoff (2026-06-08T09:58:37.582Z)
  @supabase/[email protected] was published at 2026-06-08T12:01:41.862Z, within the minimumReleaseAge cutoff (2026-06-08T09:58:37.582Z)
  @supabase/[email protected] was published at 2026-06-08T12:01:41.750Z, within the minimumReleaseAge cutoff (2026-06-08T09:58:37.582Z)
  @supabase/[email protected] was published at 2026-06-09T06:11:46.869Z, within the minimumReleaseAge cutoff (2026-06-08T09:58:37.582Z)
  @supabase/[email protected] was published at 2026-06-08T12:01:48.747Z, within the minimumReleaseAge cutoff (2026-06-08T09:58:37.582Z)
  @supabase/[email protected] was published at 2026-06-08T12:01:57.054Z, within the minimumReleaseAge cutoff (2026-06-08T09:58:37.582Z)