chore(deps): bump the supabase group across 1 directory with 2 updates

[dependabot]

Bumps the supabase group with 1 update in the / directory: @supabase/ssr.

Updates @supabase/ssr from 0.10.3 to 0.12.0

Release notes

Sourced from @​supabase/ssr's releases.

v0.12.0

0.12.0 (2026-06-09)

Features

• adds cookies.encode option allowing minimal cookie sizes (#126) (cf38b22)
• bump cookie to 1.0.2 (#113) (b4a77b4)
• cookies: add clearAuthCookiesAtScopes migration helper (#240) (4e47249)
• full rewrite using getAll and setAll cookie methods (#1) (b6ae192)
• improve cookie chunk handling via base64url+length encoding (#90) (6deb687)
• pass cache headers to setAll to prevent CDN caching of auth responses (#176) (14962d2)
• publish SSR under deprecated auth-helpers package names (#127) (e8b6102)
• release workflow RC versioning and publish reliability (#164) (81e68f4)
• update CI so it runs on release as well (#33) (4517996)
• update supabase-js to latest (#133) (d65044d)
• update supabase-js to latest (#145) (08bf7d6)
• upgrade cookie dependency and cleanup imports (#77) (9524528)

Bug Fixes

• add @​types/cookies to dependencies (#63) (47e5f16)
• add create*Client string in x-client-info (#85) (f271acc)
• allow cookies encode without getAll/setAll on browser client (#213) (89f3f28), closes #170
• allow use of createBrowserClient without window present (#20) (27d868d)
• auth: respect user-provided auth options in createBrowserClient (#167) (5f04837)
• check chunkedCookie is string in server client (#57) (549fe62)
• ci: remove packageManager field (#197) (6bf0226)
• cookies console warnings (#136) (64ff6b3)
• deprecate parse, serialize exports for more useful functions (#14) (0b5f881)
• enable tree-shaking for browser bundles (#216) (f009d71)
• fix createBrowserClient deprecation tsdoc (#17) (1df70ad)
• force release (#98) (66710e8)
• re-apply update CI so it runs on release as well (#49) (51d5a43)
• release: pin npm to 11.5.2 so OIDC trusted publisher works (#249) (4af89f7)
• remove optional dependencies (#41) (a48fe6f)
• remove usage of internal type params (#123) (8f3e89e)
• revert "update CI so it runs on release as well" (#44) (9d0e859)
• revert: "feat: improve cookie chunk handling via base64url+length encoding (#90)" (#100) (2ea8e23)
• set max-age default cookie option to 400 days (#54) (f4ed2e0)
• set cookies for password recovery event (#32) (7dc1837)
• set cookies when mfa challenge is verified (#27) (c217f53)
• tsconfig: set explicit rootDir to silence TS6059 in consumer IDEs (#211) (a77ee8a), closes #209
• update conventional commits ci to use main instead of master (#31) (bebce89)
• update README session docs (#159) (b859905)
• update type, remove unused imports, define AuthEvent type (#47) (4f4a375)
• use skipAutoInitialize to prevent SSR token refresh race condition (#131) (0b7be28)
• validate base64-prefixed chunked cookies decode to valid JSON (#210) (302cc0e)

... (truncated)

Changelog

Sourced from @​supabase/ssr's changelog.

0.12.0 (2026-06-09)

Features

• adds cookies.encode option allowing minimal cookie sizes (#126) (cf38b22)
• bump cookie to 1.0.2 (#113) (b4a77b4)
• cookies: add clearAuthCookiesAtScopes migration helper (#240) (4e47249)
• full rewrite using getAll and setAll cookie methods (#1) (b6ae192)
• improve cookie chunk handling via base64url+length encoding (#90) (6deb687)
• pass cache headers to setAll to prevent CDN caching of auth responses (#176) (14962d2)
• publish SSR under deprecated auth-helpers package names (#127) (e8b6102)
• release workflow RC versioning and publish reliability (#164) (81e68f4)
• update CI so it runs on release as well (#33) (4517996)
• update supabase-js to latest (#133) (d65044d)
• update supabase-js to latest (#145) (08bf7d6)
• upgrade cookie dependency and cleanup imports (#77) (9524528)

Bug Fixes

• add @​types/cookies to dependencies (#63) (47e5f16)
• add create*Client string in x-client-info (#85) (f271acc)
• allow cookies encode without getAll/setAll on browser client (#213) (89f3f28), closes #170
• allow use of createBrowserClient without window present (#20) (27d868d)
• auth: respect user-provided auth options in createBrowserClient (#167) (5f04837)
• check chunkedCookie is string in server client (#57) (549fe62)
• ci: remove packageManager field (#197) (6bf0226)
• cookies console warnings (#136) (64ff6b3)
• deprecate parse, serialize exports for more useful functions (#14) (0b5f881)
• enable tree-shaking for browser bundles (#216) (f009d71)
• fix createBrowserClient deprecation tsdoc (#17) (1df70ad)
• force release (#98) (66710e8)
• re-apply update CI so it runs on release as well (#49) (51d5a43)
• release: pin npm to 11.5.2 so OIDC trusted publisher works (#249) (4af89f7)
• remove optional dependencies (#41) (a48fe6f)
• remove usage of internal type params (#123) (8f3e89e)
• revert "update CI so it runs on release as well" (#44) (9d0e859)
• revert: "feat: improve cookie chunk handling via base64url+length encoding (#90)" (#100) (2ea8e23)
• set max-age default cookie option to 400 days (#54) (f4ed2e0)
• set cookies for password recovery event (#32) (7dc1837)
• set cookies when mfa challenge is verified (#27) (c217f53)
• tsconfig: set explicit rootDir to silence TS6059 in consumer IDEs (#211) (a77ee8a), closes #209
• update conventional commits ci to use main instead of master (#31) (bebce89)
• update README session docs (#159) (b859905)
• update type, remove unused imports, define AuthEvent type (#47) (4f4a375)
• use skipAutoInitialize to prevent SSR token refresh race condition (#131) (0b7be28)
• validate base64-prefixed chunked cookies decode to valid JSON (#210) (302cc0e)

0.11.0 (2026-06-05)

... (truncated)

Commits

• d8c9b60 chore(main): release 0.12.0 (#247)
• 4af89f7 fix(release): pin npm to 11.5.2 so OIDC trusted publisher works (#249)
• 164c7ab build(deps-dev): bump vitest from 1.6.1 to 4.1.0 in the npm_and_yarn group ac...
• 2fd3333 chore: update @​supabase/supabase-js to v2.108.0 (#248)
• dd766c4 chore(main): release 0.11.0 (#244)
• 932931e build(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#245)
• 4e47249 feat(cookies): add clearAuthCookiesAtScopes migration helper (#240)
• 34f2b6a chore: update @​supabase/supabase-js to v2.107.0 (#243)
• 4292d04 chore: update @​supabase/supabase-js to v2.106.1 (#236)
• a6896b1 chore: update @​supabase/supabase-js to v2.106.0 (#232)
• Additional commits viewable in compare view

Updates @supabase/supabase-js from 2.105.4 to 2.110.0

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.110.0

2.110.0 (2026-06-30)

🚀 Features

• repo: drop Node.js 20 support (#2482)

❤️ Thank You

• Katerina Skroumpelou @​mandarini

v2.110.0-canary.0

2.110.0-canary.0 (2026-06-30)

🚀 Features

• repo: drop Node.js 20 support (#2482)

❤️ Thank You

• Katerina Skroumpelou @​mandarini

v2.109.0

2.109.0 (2026-06-30)

🚀 Features

• auth: add custom_claims_allowlist to custom providers admin API (#2473)
• realtime: add postgres_changes filter builder, new operators and select (#2463)
• storage: expose purgeCache for buckets and single objects (#2429)

🩹 Fixes

• functions: honor a caller's Content-Type override regardless of casing (#2455)
• realtime: pin @​supabase/phoenix and browser test CDN deps (#2457)
• realtime: add replication connection system message option (#2470)
• storage: keep sortBy defaults when list() is given a partial sortBy (#2454)

❤️ Thank You

• Anubhav Anand @​i-anubhav-anand
• Cemal Kılıç @​cemalkilic
• Claude Opus 4.8 (1M context)
• Filipe Cabaço @​filipecabaco
• Katerina Skroumpelou @​mandarini
• Lenny
• Rodrigo Mansueli @​mansueli

v2.108.3-canary.2

2.108.3-canary.2 (2026-06-19)

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.110.0 (2026-06-30)

🚀 Features

• repo: drop Node.js 20 support (#2482)

❤️ Thank You

• Katerina Skroumpelou @​mandarini

2.109.0 (2026-06-30)

🩹 Fixes

• realtime: pin @​supabase/phoenix and browser test CDN deps (#2457)

❤️ Thank You

• Katerina Skroumpelou @​mandarini

2.108.2 (2026-06-15)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.108.0 (2026-06-08)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.107.0 (2026-06-02)

🚀 Features

• auth: remove navigator.locks-based mutex; introduce commit guard + dispose() (#2392)
• supabase: update X-Client-Info to structured metadata format (#2359)
• realtime: allow httpSend to send binary payload (#2400)

❤️ Thank You

• Claude Sonnet 4.6
• Eduardo Gurgel
• Guilherme Souza
• Katerina Skroumpelou @​mandarini
• Omar Al Matar @​Bewinxed

2.106.2 (2026-05-25)

🩹 Fixes

• misc: add react-native export condition for Hermes-safe resolution (#2393)

... (truncated)

Commits

• c3d5e6d feat(repo): drop Node.js 20 support (#2482)
• b2e02b9 chore(release): version 2.109.0 changelogs (#2481)
• dd2d4c2 fix(realtime): pin @​supabase/phoenix and browser test CDN deps (#2457)
• a25062e chore(release): version 2.108.2 changelogs (#2449)
• b3e5f2d chore(ci): unpin realtime version (#2432)
• 76f3f02 test(auth): add passkey unit and e2e coverage (#2442)
• 65fafe5 chore(release): version 2.108.0 changelogs (#2433)
• 57014e1 chore(release): version 2.107.0 changelogs (#2421)
• 54ec2b6 feat(auth): remove navigator.locks-based mutex; introduce commit guard + disp...
• 3397c92 feat(supabase): update X-Client-Info to structured metadata format (#2359)
• Additional commits viewable in compare view

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
atlas-hr	Ready	Preview, Comment	Jul 5, 2026 3:16am
atlas-hr-fq24	Ready	Preview, Comment	Jul 5, 2026 3:16am

[dependabot]

Dependabot can't access a private package registry without explicit configuration. Because of this, Dependabot cannot update this pull request.