fix(deps): update dependencies (minor)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@scalprum/core	0.9.3 → 0.10.0
@scalprum/react-core	0.11.2 → 0.13.0
@yarnpkg/core (source)	4.7.0 → 4.9.0
better-sqlite3	12.6.2 → 12.11.1
knex (source)	3.1.0 → 3.2.10
pg (source)	8.18.0 → 8.22.0
semver	7.7.4 → 7.8.5
yaml (source)	2.8.3 → 2.9.0

---

Release Notes

scalprum/scaffolding (@​scalprum/core)

v0.10.0

Compare Source

yarnpkg/berry (@​yarnpkg/core)

v4.9.0

Compare Source

v4.8.0

Compare Source

WiseLibs/better-sqlite3 (better-sqlite3)

v12.11.1

Compare Source

What's Changed

• Fix Electron v42 build errors on Windows by @​m4heshd in #​1488

Full Changelog: WiseLibs/better-sqlite3@v12.11.0...v12.11.1

v12.10.1

Compare Source

What's Changed

• Bump the github-actions group across 1 directory with 4 updates by @​dependabot[bot] in #​1451
• Fix V8 external API usage for Electron 42 by @​tstone-1 in #​1475

Full Changelog: WiseLibs/better-sqlite3@v12.10.0...v12.10.1

v12.10.0

Compare Source

What's Changed

• Update SQLite to version 3.53.1 by @​JoshuaWise in #​1467
• Add support for Node.js v26 prebuilds and remove EOL builds (Node.js v20, v23) by @​m4heshd in #​1468
• Temporarily rollback support for Electron v42 prebuilds by @​m4heshd in #​1470
• Enable percentile functions by @​Maxime-J in #​1447

Full Changelog: WiseLibs/better-sqlite3@v12.9.1...v12.10.0

v12.9.0

Compare Source

What's Changed

• Update SQLite to version 3.53.0 in #​1464

Full Changelog: WiseLibs/better-sqlite3@v12.8.0...v12.9.0

v12.8.0

Compare Source

What's Changed

• Readme: requires Node.js v20 or later by @​Prinzhorn in #​1443
• Update SQLite to version 3.51.3 in #​1460
• fix: use HolderV2() for PropertyCallbackInfo on V8 >= 12.5 by @​tstone-1 in #​1459

New Contributors

• @​tstone-1 made their first contribution in #​1459

Why SQLite v3.51.3 instead of v3.52.0

From the SQLite team:

Some important issues have been found with version 3.52.0. In order to give us time to deal with those issues, we plan to withdraw the 3.52.0 release. In its place, we will put up a new 3.51.3 patch release that includes a fix for the recently discovered WAL-reset bug as well as other patches. This will happen probably within about the next twelve hours.

Hence, if you were planning to upgrade to 3.52.0 tomorrow (Friday, 2026-03-14), perhaps it would be better to wait a day or so for 3.51.3.

At some point we will do version 3.52.1 which will hopefully resolve the issues that have arisen with the 3.52.0 release.

Full Changelog: WiseLibs/better-sqlite3@v12.7.1...v12.8.0

knex/knex (knex)

v3.2.10

Compare Source

Bug fixes

• fix: bump lodash to ^4.18.1, close #​6433 #​6446
• Fix: Properly Escape Aliases in Analytic Functions #​6392

Misc

• chore: auto-update the docs' knex version on publish #​6447
• chore: skip re-running tests on automated release commit #​6443
• chore: sync docker images we use to ghcr #​6445
• chore: fixes for release-drafter workflow #​6442
• chore: new publish/release workflow #​6441
• docs: Update changelog for version 3.2.9 #​6440
• docs: sync website changelog from 3.0.0 to 3.2.8 #​6426

v3.2.9

Compare Source

Bug fixes

• fix: support DELETE... LIMIT in dialects that support it (mysql), but continue to disallow ones that don't #​6429
• fix(postgres): escape double quotes in searchPath to prevent SQL injection #​6411
• fix(sqlite): append RETURNING statement when insert empty row #​5471
• fix: add type support for Array<Buffer> #​6428

v3.2.8

Compare Source

Bug fixes

• Reverts the breaking changes added in #​6227. This means that the ESM import of Knex is reverted to import { knex } from 'knex/knex.mjs #​6422
• fix(types): allow a QueryBuilder type as a value in an update #​6419

v3.2.7

Compare Source

Bug fixes

• fix sqlite DDL operations failing inside transactions #​6408
• fix: handle lowercase INFORMATION_SCHEMA keys in MySQL renameColumn #​6407
• fix: clone config in client constructor #​5633
• fix: remove __knexTxId from transaction connection on release #​5288
• fix: correct binding order in delete with subquery join #​6412
• chore: omit ./scripts from published package #​6356

v3.2.6

Compare Source

Bug fixes

• Fix module exports #​6406

v3.2.5

Compare Source

Bug fixes

• Fix ESM exports #​6405

v3.2.4

Compare Source

Bug fixes

• Fix ESM type exports #​6404

v3.2.3

Compare Source

What's Changed

• Prepare to release 3.2.3 hotfix by @​kibertoad in #​6401

Full Changelog: knex/knex@3.2.1...3.2.3

v3.2.2

Compare Source

v3.2.1

Compare Source

Bug fixes

• fix: bump lodash to ^4.18.1, close #​6433 #​6446
• Fix: Properly Escape Aliases in Analytic Functions #​6392

Misc

• chore: auto-update the docs' knex version on publish #​6447
• chore: skip re-running tests on automated release commit #​6443
• chore: sync docker images we use to ghcr #​6445
• chore: fixes for release-drafter workflow #​6442
• chore: new publish/release workflow #​6441
• docs: Update changelog for version 3.2.9 #​6440
• docs: sync website changelog from 3.0.0 to 3.2.8 #​6426

v3.2.0

Compare Source

New features

• Add migration lifecycle hooks (#​5541)
• Add SIMILAR TO operator (#​5303)
• Add dropUniqueIfExists (#​6069)
• Add 'validate' pool option (#​5120)
• PostgreSQL: default datetime/timestamp precision setting added (#​5311)
• Better-SQLite3: Support defaultSafeIntegers option (#​6320)
• Better-SQLite3: Improve safeIntegers support (#​6352)
• SQLite: Refactor transactions to allow setting the foreign_keys pragma for a transaction (#​6315)

Bug fixes

• Fix where in query with raw column (#​6323)
• Fix migrate up with completed migration (#​6342)
• Fix ESM export and typings (#​6227)
• Fix migration CLI and cli tests (#​6264)
• Fix recover from broken connection (#​5774)
• Prevent unexpected combinations of statements and clauses groups from executing (#​6314)
• Improve CLI error reporting in some edge cases (#​6265)
• PostgreSQL: clearer error when pg-query-stream is missing (#​6362)
• PostgreSQL: Fix streaming compatibility with pg-query-stream 4.14+ (#​6396)
• MySQL: Fix the operator "<=>" is not permitted (#​6158)
• MSSQL: Optimize stream.write (#​5693)
• SQLite: Fix whereILike issue (#​5687)

Types

• Fix usage of object type that is too broad (#​5373)
• Fix pluck typing issue when CompositeTableType is used (#​4609)
• Make types no longer allow knex to be called without tablename (#​6188)
• Add missing type definition for orderBy with a raw column/expression (#​5803)
• Add additional typing for column.index (#​5371)
• Update typings for increment/decrement (#​5674)
• Use syntax import from instead of import = require() (#​5258)
• Import knex as type in TS seed template (#​6094)
• Update index.d.ts (#​5767)
• Add @​types/minimatch v5 to fix TypeScript build (#​6240)

Tests

• Additional tests for JSON (de)serialization (#​4451)
• Run CI on Node 22 and remove dtslint (#​6165)

Chore

• Update to non-screamy versions of dependencies that have npm audit failures (#​6324)
• Upgrade pg to ^8.20.0, pg-query-stream to ^4.14.0 (#​6396)

brianc/node-postgres (pg)

v8.22.0

Compare Source

• Add support for sslnegotiation=direct for PostgreSQL 17+.

v8.21.0

Compare Source

• Handle SASL SCRAM server error responses properly.
• Add support for node@26.
• Add scramMaxIterations config option.
• Add client.getTransactionStatus() method.

v8.20.0

Compare Source

• Add onConnect callback to pg.Pool constructor options allowing for async initialization of newly created & connected pooled clients.

v8.19.0

Compare Source

• Deprecate interal query queue.
• Pass connection parameters to password callback.

npm/node-semver (semver)

v7.8.5

Compare Source

Bug Fixes

• 9c8692a #​878 include prereleases in tilde range lower bound with includePrerelease (#​878) (@​chatman-media)

v7.8.4

Compare Source

Bug Fixes

• e583226 #​874 reject numeric segments after x-ranges (@​pupuking723)

v7.8.3

Compare Source

Bug Fixes

• 046da7f #​872 align caret includePrerelease lower bounds (#​872) (@​wayyoungboy)

Chores

• 3485dda #​866 bump @​npmcli/eslint-config from 6.0.1 to 7.0.0 (#​866) (@​dependabot[bot])

v7.8.2

Compare Source

Bug Fixes

• bea6028 #​870 increment dotted prerelease identifiers (#​870) (@​liuzemei, @​SheldonNeo)

v7.8.1

Compare Source

Bug Fixes

• 17aa702 #​869 strip build metadata before comparator trimming (#​869) (@​owlstronaut)
• 5f3ca13 #​867 handle prerelease bounds in subset (#​867) (@​puneetdixit200, Puneet Dixit)

v7.8.0

Compare Source

Features

• 0d0a0a2 #​855 Add truncate function (#​855) (@​pjohnmeyer, @​owlstronaut)

Bug Fixes

• 3905343 #​859 Warn when defaulting to --inc=patch in CLI (@​pjohnmeyer)

Documentation

• c368af6 #​853 fix typos in documentation (#​853) (@​ankitkumar572005)
• 37776c3 #​846 fix BNF grammar to distinguish prerelease from build identifiers (#​846) (@​abhu85, @​claude)

Chores

• 9542e09 #​860 template-oss-apply (@​owlstronaut)
• 937bc2c #​860 template-oss-apply@5.0.0 (@​owlstronaut)
• 6946fef #​852 bump @​npmcli/template-oss from 4.29.0 to 4.30.0 (#​852) (@​dependabot[bot], @​npm-cli-bot)

eemeli/yaml (yaml)

v2.9.0

Compare Source

The changes here are really only patches, but I'm releasing this as a minor version to note a small change to the documentation of parseDocument() and parseAllDocuments(): I've removed the claim that they'll "never throw".

It remains the case that practically all non-malicious inputs will be handled without emitting an error, but there is a decent chance that code paths remain where e.g. a RangeError due to call stack exhaustion can be triggered by malicious inputs. Up to now, I've considered these as security vulnerabilities, and in fact it's the only category of error for which yaml CVEs have been issued so far.

Starting from this release, I'll be considering such errors as bugs, but not vulnerabilities. I do welcome people and/or LLMs looking for them, but please report them as normal issues rather than suspected security vulnerabilities. This also applies to previously undiscovered bugs in earlier releases.

• fix: Avoid calling Array.prototype.push.apply() with large source array
• fix(lexer): Avoid recursive calls that may exhaust the call stack

v2.8.4

Compare Source

• Disable alias resolution with maxAliasCount:0 (#​677)
• Handle invalid unicode escapes (e1a1a77)
• Apply minFractionDigits only to decimal strings (#​676)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[openshift-ci]

Hi @renovate[bot]. Thanks for your PR.

I'm waiting for a redhat-developer member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[github-actions]

Image was built and published successfully. It is available at:

• quay.io/rhdh-community/rhdh:pr-4336
• quay.io/rhdh-community/rhdh:pr-4336-c6dfaa45

[github-actions]

The container image build and publish workflows were skipped (either due to [skip-build] tag or no relevant changes with existing image).

[github-actions]

The container image build and publish workflows were skipped (either due to [skip-build] tag or no relevant changes with existing image).

[github-actions]

Image was built and published successfully. It is available at:

• quay.io/rhdh-community/rhdh:pr-4336
• quay.io/rhdh-community/rhdh:pr-4336-6cbed420

[github-actions]

Image was built and published successfully. It is available at:

• quay.io/rhdh-community/rhdh:pr-4336
• quay.io/rhdh-community/rhdh:pr-4336-706e40e1

[github-actions]

The container image build and publish workflows were skipped (either due to [skip-build] tag or no relevant changes with existing image).

[github-actions]

Image was built and published successfully. It is available at:

• quay.io/rhdh-community/rhdh:pr-4336
• quay.io/rhdh-community/rhdh:pr-4336-f41124cb

[alizard0]

/lgtm

[github-actions]

The container image build and publish workflows were skipped (either due to [skip-build] tag or no relevant changes with existing image).

[github-actions]

The container image build and publish workflows were skipped (either due to [skip-build] tag or no relevant changes with existing image).

[github-actions]

Image was built and published successfully. It is available at:

• quay.io/rhdh-community/rhdh:pr-4336
• quay.io/rhdh-community/rhdh:pr-4336-cb8d5c77

[github-actions]

The container image build workflow finished with status: failure.

[github-actions]

The container image build workflow finished with status: failure.

[github-actions]

The container image build workflow finished with status: cancelled.

[github-actions]

The container image build workflow finished with status: failure.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

The container image build workflow finished with status: failure.

[github-actions]

The container image build workflow finished with status: failure.

[github-actions]

The container image build workflow finished with status: failure.

[github-actions]

The container image build workflow finished with status: failure.

[github-actions]

The container image build workflow finished with status: failure.

[github-actions]

The container image build workflow finished with status: failure.

[github-actions]

The container image build workflow finished with status: failure.

[github-actions]

The container image build workflow finished with status: failure.

[github-actions]

The container image build workflow finished with status: failure.

[github-actions]

The container image build workflow finished with status: failure.

[github-actions]

The container image build workflow finished with status: failure.

[github-actions]

The container image build workflow finished with status: failure.

[github-actions]

The container image build workflow finished with status: failure.

[github-actions]

The container image build workflow finished with status: failure.

[github-actions]

The container image build workflow finished with status: failure.

[github-actions]

The container image build workflow finished with status: failure.

[github-actions]

The container image build workflow finished with status: cancelled.

[github-actions]

The container image build workflow finished with status: cancelled.

[github-actions]

The container image build workflow finished with status: failure.

[github-actions]

The container image build workflow finished with status: failure.

[github-actions]

The container image build workflow finished with status: failure.

[github-actions]

Image was built and published successfully. It is available at:

• quay.io/rhdh-community/rhdh:pr-4336
• quay.io/rhdh-community/rhdh:pr-4336-bef91059

[kim-tsao]

/lgtm

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud