#1004 · stacks/bun-query-builder

This issue lists Buddy updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

[!CAUTION] 7 known vulnerabilities affect 4 dependencies in this repository.

Severity	Package	Current	Advisory	Fixed in
🟠 High	`kysely`	`^0.28.14`	GHSA-pv5w-4p9q-p3v2	`0.28.17`
🟠 High	`kysely`	`^0.28.11`	GHSA-8cpq-38p9-67gx	`0.28.14`
🟠 High	`kysely`	`^0.28.11`	GHSA-pv5w-4p9q-p3v2	`0.28.17`
🟠 High	`kysely`	`^0.28.11`	GHSA-wmrf-hv6w-mr66	`0.28.12`
🟠 High	`drizzle-orm`	`^0.45.1`	GHSA-gpj5-g38j-94v9	`0.45.2`
🟡 Moderate	`typeorm`	`^0.3.28`	GHSA-2rp8-mm9q-fp49	`0.3.31`
🟡 Moderate	`typeorm`	`^0.3.28`	GHSA-9ggv-8w38-r7pm	`0.3.29`

Capped dependencies

The following packages are held below their latest version by a range declared elsewhere in the dependency tree. Updating this repository cannot move them — the constraint has to be widened where it is declared.

Package	Installed	Reachable	Latest	Capped by
`chromium-bidi`	`7.3.2`	`7.3.2`	`159.0.8138-0`	`ts-pkgx` (`^7.2.0`)
`electron`	`37.10.3`	`37.10.3`	`46.0.0-alpha.4`	`ts-pkgx` (`^37.2.4`)
`@types/node`	`26.1.1`	`22.20.5`	`26.6.6`	`electron` (`^22.7.7`)
`dotenv`	`16.6.1`	`16.6.1`	`18.0.9`	`c12` (`^16.6.1`)
`got`	`11.8.6`	`11.8.6`	`16.2.0`	`@electron/get` (`^11.8.5`)
`cacheable-request`	`7.0.4`	`7.0.4`	`13.0.19`	`got` (`^7.0.2`)
`better-sqlite3`	`12.11.1`	`12.11.1`	`13.0.3`	`@prisma/adapter-better-sqlite3` (`^12.6.0`), `typeorm` (`^12.0.0`), `@bun-query-builder/benchmark` (`^12.11.1`)
`serialize-error`	`7.0.1`	`7.0.1`	`13.0.2`	`global-agent` (`^7.0.1`)
`fs-extra`	`8.1.0`	`8.1.0`	`11.4.1`	`@electron/get` (`^8.1.0`)
`emoji-regex`	`8.0.0`	`8.0.0`	`11.0.0`	`string-width` (`^8.0.0`)
`wrap-ansi`	`9.0.2`	`9.0.2`	`10.0.2`	`cliui` (`^9.0.0`)
`decompress-response`	`6.0.0`	`6.0.0`	`10.0.0`	`simple-get` (`^6.0.0`), `got` (`^6.0.0`)
`normalize-url`	`6.1.0`	`6.1.0`	`10.0.0`	`cacheable-request` (`^6.0.1`)
`get-stream`	`5.2.0`	`5.2.0`	`9.0.1`	`cacheable-request` (`^5.1.0`), `extract-zip` (`^5.1.0`)
`undici-types`	`8.3.0`	`8.3.0`	`8.12.3`	`@types/node` (`~8.3.0`)
`pure-rand`	`6.1.0`	`6.1.0`	`8.4.2`	`fast-check` (`^6.1.0`)
`@types/cacheable-request`	`6.0.3`	`6.0.3`	`8.3.6`	`got` (`^6.0.1`)
`@sindresorhus/is`	`4.6.0`	`4.6.0`	`8.1.0`	`got` (`^4.0.0`)
`@prisma/fetch-engine`	`6.19.3`	`6.19.3`	`8.1.0-dev.9`	`@prisma/engines` (`6.19.3`)
`@prisma/get-platform`	`6.19.3`	`6.19.3`	`8.1.0-dev.9`	`@prisma/fetch-engine` (`6.19.3`), `@prisma/engines` (`6.19.3`)
`@prisma/driver-adapter-utils`	`7.10.1`	`7.10.1`	`8.1.0-dev.9`	`@prisma/adapter-better-sqlite3` (`7.10.1`)
`@prisma/engines`	`6.19.3`	`6.19.3`	`8.1.0-dev.9`	`prisma` (`6.19.3`)
`@prisma/adapter-better-sqlite3`	`7.10.1`	`7.10.1`	`8.1.0-dev.9`	`@bun-query-builder/benchmark` (`^7.10.1`)
`@prisma/config`	`6.19.3`	`6.19.3`	`8.1.0-dev.9`	`prisma` (`6.19.3`)
`@prisma/engines-version`	`7.1.1-3.c2990dca591cba766e3b7ef5d9e8a84796e47ab7`	`7.1.1-3.c2990dca591cba766e3b7ef5d9e8a84796e47ab7`	`8.1.0-2.59be4fda12412a79eeb9c2ae727b6aa723593323`	`@prisma/fetch-engine` (`7.1.1-3.c2990dca591cba766e3b7ef5d9e8a84796e47ab7`), `@prisma/engines` (`7.1.1-3.c2990dca591cba766e3b7ef5d9e8a84796e47ab7`)
`deepmerge-ts`	`7.1.5`	`7.1.5`	`8.0.2`	`@prisma/config` (`7.1.5`)
`data-uri-to-buffer`	`6.0.2`	`6.0.2`	`8.0.0`	`ts-gif` (`^6.0.2`)
`roarr`	`2.15.4`	`2.15.4`	`7.21.7`	`global-agent` (`^2.15.3`)
`quick-lru`	`5.1.1`	`5.1.1`	`7.3.0`	`http2-wrapper` (`^5.1.1`)
`cac`	`6.7.14`	`6.7.14`	`7.1.0`	`@stacksjs/launchpad` (`^6.7.14`)
`@typescript/typescript-linux-x64`	`7.0.2`	`7.0.2`	`7.1.0-dev.20261102.1`	`typescript` (`7.0.2`)
`bl`	`4.1.0`	`4.1.0`	`7.0.14`	`tar-stream` (`^4.0.3`)
`matcher`	`3.0.0`	`3.0.0`	`7.0.0`	`global-agent` (`^3.0.0`)
`ansi-styles`	`6.2.3`	`6.2.3`	`7.0.0`	`wrap-ansi` (`^6.2.1`)
`ini`	`1.3.8`	`1.3.8`	`7.0.0`	`rc` (`~1.3.0`)
`cacheable-lookup`	`5.0.4`	`5.0.4`	`7.0.0`	`got` (`^5.0.3`)
`ansi-regex`	`5.0.1`	`5.0.1`	`6.5.0`	`strip-ansi` (`^5.0.1`)
`jsonfile`	`4.0.0`	`4.0.0`	`6.2.1`	`fs-extra` (`^4.0.0`)
`keyv`	`4.5.4`	`4.5.4`	`6.1.0`	`cacheable-request` (`^4.0.0`)
`buffer`	`5.7.1`	`5.7.1`	`6.0.3`	`bl` (`^5.5.0`)
`chokidar`	`4.0.3`	`4.0.3`	`6.0.0`	`c12` (`^4.0.3`)
`y18n`	`5.0.8`	`5.0.8`	`6.0.0-alpha.0`	`yargs` (`^5.0.5`)
`type-fest`	`0.13.1`	`0.13.1`	`5.10.0`	`serialize-error` (`^0.13.1`)
`readdirp`	`4.1.2`	`4.1.2`	`5.1.1`	`chokidar` (`^4.0.1`)
`is-fullwidth-code-point`	`3.0.0`	`3.0.0`	`5.1.0`	`string-width` (`^3.0.0`)
`@electron/get`	`2.0.3`	`2.0.3`	`5.1.0`	`electron` (`^2.0.0`)
`strip-json-comments`	`2.0.1`	`2.0.1`	`5.0.3`	`rc` (`~2.0.1`)
`@szmarczak/http-timer`	`4.0.6`	`4.0.6`	`5.0.1`	`got` (`^4.0.5`)
`escape-string-regexp`	`4.0.0`	`4.0.0`	`5.0.0`	`matcher` (`^4.0.0`)
`fast-check`	`3.23.2`	`3.23.2`	`4.10.2`	`effect` (`^3.23.1`)
`readable-stream`	`3.6.2`	`3.6.2`	`4.8.0`	`bl` (`^3.4.0`), `tar-stream` (`^3.1.1`)
`zod`	`3.25.76`	`3.25.76`	`4.6.7`	`chromium-bidi` (`^3.24.1`)
`@types/keyv`	`3.1.4`	`3.1.4`	`4.2.0`	`@types/cacheable-request` (`^3.1.4`)
`global-agent`	`3.0.0`	`3.0.0`	`4.1.6`	`@electron/get` (`^3.0.0`)
`kleur`	`3.0.3`	`3.0.3`	`4.1.5`	`prompts` (`^3.0.3`)
`effect`	`3.21.0`	`3.21.0`	`4.1.2`	`@prisma/config` (`3.21.0`)
`responselike`	`2.0.1`	`2.0.1`	`4.0.2`	`got` (`^2.0.0`), `cacheable-request` (`^2.0.0`)
`p-cancelable`	`2.1.1`	`2.1.1`	`4.0.1`	`got` (`^2.0.0`)
`lowercase-keys`	`2.0.0`	`2.0.0`	`4.0.1`	`got` (`^2.0.0`), `cacheable-request` (`^2.0.0`), `responselike` (`^2.0.0`)
`env-paths`	`2.2.1`	`2.2.1`	`4.0.0`	`@electron/get` (`^2.2.0`)
`c12`	`3.1.0`	`3.1.0`	`4.0.0-rc.4`	`@prisma/config` (`3.1.0`)
`ms`	`2.1.3`	`2.1.3`	`4.0.0-nightly.202508271359`	`debug` (`^2.1.3`)
`@types/yauzl`	`2.10.3`	`2.10.3`	`3.4.0`	`extract-zip` (`^2.9.1`)
`yauzl`	`2.10.0`	`2.10.0`	`3.4.0`	`extract-zip` (`^2.10.0`)
`giget`	`2.0.0`	`2.0.0`	`3.3.1`	`c12` (`^2.0.0`)
`tar-stream`	`2.2.0`	`2.2.0`	`3.2.2`	`tar-fs` (`^2.1.4`)
`tar-fs`	`2.1.5`	`2.1.5`	`3.1.3`	`prebuild-install` (`^2.0.0`)
`rc9`	`2.1.2`	`2.1.2`	`3.1.0`	`c12` (`^2.1.2`)
`argparse`	`2.0.1`	`2.0.1`	`3.0.4`	`js-yaml` (`^2.0.1`)
`@types/responselike`	`1.0.3`	`1.0.3`	`3.0.1`	`@types/cacheable-request` (`^1.0.0`), `got` (`^1.0.0`)
`chownr`	`1.1.4`	`1.1.4`	`3.0.0`	`tar-fs` (`^1.1.1`)
`http2-wrapper`	`1.0.3`	`1.0.3`	`2.2.4`	`got` (`^1.0.0-beta.5.2`)
`empathic`	`2.0.0`	`2.0.0`	`2.1.0`	`@prisma/config` (`2.0.0`)
`perfect-debounce`	`1.0.0`	`1.0.0`	`2.1.0`	`c12` (`^1.0.0`)
`universalify`	`0.1.2`	`0.1.2`	`2.0.1`	`fs-extra` (`^0.1.0`)
`clone-response`	`1.0.3`	`1.0.3`	`2.0.0`	`cacheable-request` (`^1.0.2`)
`file-uri-to-path`	`1.0.0`	`1.0.0`	`2.0.0`	`bindings` (`1.0.0`)
`sisteransi`	`1.0.5`	`1.0.5`	`2.0.0`	`prompts` (`^1.0.5`)
`dayjs`	`1.11.23`	`1.11.23`	`2.0.0-alpha.4`	`typeorm` (`^1.11.23`)
`playwright-core`	`1.61.1`	`1.61.1`	`1.65.0-alpha-2026-11-02`	`playwright` (`1.61.1`)
`@colors/colors`	`1.5.0`	`1.5.0`	`1.6.1`	`cli-table3` (`1.5.0`)
`bun-types`	`1.4.3`	`1.4.3`	`1.4.4`	`@types/bun` (`1.4.3`)
`buffer-crc32`	`0.2.13`	`0.2.13`	`1.0.0`	`yauzl` (`~0.2.3`)
`drizzle-orm`	`0.45.4`	`0.45.4`	`1.0.0-rc.5-ab785fc`	`@bun-query-builder/benchmark` (`^0.45.4`)
`@stacksjs/desktop`	`0.2.661`	`0.2.661`	`0.70.232`	`@stacksjs/stx` (`0.2.661`)
`@stacksjs/dtsx`	`0.11.21`	`0.11.21`	`0.11.23`	`bun-plugin-dtsx` (`0.11.21`)
`ts-pkgx`	`0.4.24`	`0.4.24`	`0.4.154`	`@stacksjs/launchpad` (`0.4.24`)
`confbox`	`0.2.4`	`0.2.4`	`0.3.2`	`pkg-types` (`^0.2.4`), `c12` (`^0.2.2`)
`@stacksjs/stx`	`0.2.661`	`0.2.661`	`0.2.784`	`bun-plugin-stx` (`0.2.661`)
`stx-router`	`0.2.661`	`0.2.661`	`0.2.784`	`@stacksjs/stx` (`0.2.661`), `bun-plugin-stx` (`0.2.661`)
`bun-plugin-stx`	`0.2.661`	`0.2.661`	`0.2.784`	`@stacksjs/stx` (`0.2.661`)
`@stacksjs/sanitizer`	`0.2.661`	`0.2.661`	`0.2.784`	`@stacksjs/stx` (`0.2.661`)

Detected dependencies

npm

package.json

@stacksjs/ts-validation ^0.5.6
@buddysh/buddy ^0.11.13
@stacksjs/bunpress ^0.2.22
@stacksjs/launchpad ^0.6.4
@stacksjs/ts-faker ^0.1.8
better-dx ^0.2.38
pickier ^0.1.76
ts-pantry ^0.11.114

package.json

@stacksjs/clapp ^0.2.16
@stacksjs/ts-faker ^0.1.8
@stacksjs/ts-validation ^0.5.6
dynamodb-tooling ^0.3.6
bunfig ^0.15.21

package.json

@prisma/adapter-better-sqlite3 ^7.10.1
@prisma/client 6.19.3
better-sqlite3 ^12.11.1
bun-query-builder workspace:*
chalk ^6.0.1
cli-table3 ^0.6.5
drizzle-orm ^0.45.4
kysely ^0.28.14
kysely-bun-sqlite ^0.4.0
mitata ^1.0.34
prisma 6.19.3
typeorm ^1.1.2
@types/bun ^1.4.3
typescript ^7.0.2

github-actions

.github/workflows/buddy-bot.yml

actions/checkout v7
oven-sh/setup-bun v2
shivammathur/setup-php v2

.github/workflows/release.yml

actions/checkout v7.0.1
pantry-pm/pantry/packages/action main
actions/upload-artifact v4
stacksjs/action-releaser v1.2.11

.github/workflows/ci.yml

actions/checkout v7.0.1
oven-sh/setup-bun v2.2.0
actions/cache v6.1.0
actions/checkout v7
pantry-pm/pantry/packages/action main

dependency-files

deps.yaml

bun ^1.3.14
mysql ^8.0.45
postgres ^18.0.0
sqlite ^3.52.0
libevent.org ^2
lz4.org ^1
openssl.org @1
zlib.net ^1.2
facebook.com/zstd ^1
curl.se >=6.0
thrysoee.dk/editline ^3
developers.yubico.com/libfido2 ^1
sourceforge.net/libtirpc *
gnu.org/gcc/libstdcxx @14
curl.se/ca-certs *
tukaani.org/xz ^5
nghttp2.org *
invisible-island.net/ncurses ^6
github.com/PJK/libcbor @0
systemd.io *
libexpat.github.io *
google.com/fullycapable *
github.com/util-linux/util-linux *
github.com/besser82/libxcrypt *
gnu.org/libidn2 *
gnutls.org *
sourceware.org/bzip2 @1
pcre.org/v2 *
gnu.org/gettext ^0
sqlite.org ^3
gnome.org/libxml2 ~2.13 # 2.14 changes the API
gnu.org/readline @8
freedesktop.org/p11-kit *
gnu.org/libunistring ^1
gnu.org/libtasn1 ^4
gnu.org/nettle ^3
gnu.org/gmp >=4.2
unbound.net ^1
sourceware.org/libffi ^3
gnu.org/libiconv *
kerberos.org *
gnu.org/binutils *
gnu.org/mpfr >=2.4.0
gnu.org/mpc >=0.8.0
darwin/x86-64 ^# since 15.1.0
gnome.org/libxslt *
unicode.org ^73

pantry.lock

typescript ^5.9.3
chalk ^5.6.2
prisma ^7.4.2
ts-mocker ^0.1.7
@prisma/client ^7.4.2
kysely ^0.28.11
@types/bun ^1.3.10
@stacksjs/ts-validation ^0.4.10
@stacksjs/ts-validation ^0.4.9
@stacksjs/launchpad 0.6.4
cli-table3 ^0.6.5
drizzle-orm ^0.45.1
bunfig ^0.15.6
better-sqlite3 ^12.6.2
better-dx 0.2.7
typeorm ^0.3.28
dynamodb-tooling ^0.3.2
@stacksjs/clapp ^0.2.0
ts-mocker ^0.1.5
@stacksjs/docs 0.70.23
mitata ^1.0.34

Check this box to trigger a request for Buddy to run again on this repository