[Snyk] Upgrade dexie from 4.0.11 to 4.2.0

[stephencornwell]

Snyk has created this PR to upgrade dexie from 4.0.11 to 4.2.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 15 versions ahead of your current version.

• The recommended version was released 2 months ago.

Release notes

Package name: dexie

• 4.2.0 - 2025-08-13
  

  New Stable Packages

  • [email protected]
  • [email protected]
  • [email protected]
  • [email protected]

  What's Changed since Latest Stable ([email protected])

  • New add-on "y-dexie" that integrates the powerful Y.js library with dexie.
  • Support "y-dexie" and Y.js in dexie-cloud-addon
  • New hook useDocument() in dexie-react-hooks for Y.js integration.
  • Fix Named Export 'Dexie' Not Found in Production with Vite/Vinxi by @ thijssmudde in #2155
  • fix: 'Dexie' Not Found in Production with Vite/Vinxi dexie-react-hooks by @ Contraboi in #2162

  New Contributors

  • @ thijssmudde made their first contribution in #2155
  • @ davbl made their first contribution in #2165
  • @ Contraboi made their first contribution in #2162

  Migration from 4.1.x-beta

  Dexie 4.1.x has been tagged @ next and contained experimental Y.js support. The Y.js support has since been moved into its own add-on 'y-dexie'.

  If the built-in Y.js support in [email protected] has been used, a migration is needed:

  1. npm install y-dexie
  2. Instead of import { DexieYProvider } from 'dexie' --> import { DexieYProvider } from 'y-dexie'
  3. Instead of DexieyYProvider<Y.Doc> --> DexieYProvider.
  4. No need to pass Y to Dexie constructor, but instead, pass the yDexie addon:

     import yDexie from 'y-dexie';
     ...
     const db = new Dexie('foo', { addons: [yDexie] });

     With dexieCloud addon, make sure to pass yDexie first: { addons: [yDexie, dexieCloud] }
  5. Declare Y.Doc properties as prop:Y.Doc instead of just prop:Y

     db.version(1).stores({
       friends: `
         ++id,
         name,
         age,
         friendNotes: Y.Doc` // where friendNotes holds the Y.Doc instance
     });

  If you need a sample PR of these changes, have a look at dexie/dexie-cloud-starter#8

  Full Changelog: b415d92...a978fc0

• 4.2.0-rc.1 - 2025-08-06
  

  Release Candidate of [email protected]

  In contrast to previous 4.1.x betas, we've extracted the Y.js support from the "dexie" package into "y-dexie".

  Migration from 4.1.x-beta

  Only if the experimental Y.js support from 4.1.x beta was used, a migration is needed:

  1. npm install y-dexie
  2. Instead of import { DexieYProvider } from 'dexie' --> import { DexieYProvider } from 'y-dexie'
  3. Instead of DexieyYProvider<Y.Doc> --> DexieYProvider.
  4. No need to pass Y to Dexie constructor, but instead, pass the yDexie addon:

     import yDexie from 'y-dexie';
     ...
     const db = new Dexie('foo', { addons: [yDexie] });

     With dexieCloud addon, make sure to pass yDexie first: { addons: [yDexie, dexieCloud] }
  5. Declare Y.Doc properties as prop:Y.Doc instead of just prop:Y

     db.version(1).stores({
       friends: `
         ++id,
         name,
         age,
         friendNotes: Y.Doc` // where friendNotes holds the Y.Doc instance
     });

  If you need a sample PR of these changes, have a look at dexie/dexie-cloud-starter#8

  What's Changed since 4.1.0-beta.43

  • New npm package "y-dexie" and removed the Y.js code from the "dexie" library. #2180
  • Fix Named Export 'Dexie' Not Found in Production with Vite/Vinxi by @ thijssmudde in #2155
  • fix: 'Dexie' Not Found in Production with Vite/Vinxi dexie-react-hooks by @ Contraboi in #2162

  New Contributors

  • @ thijssmudde made their first contribution in #2155
  • @ davbl made their first contribution in #2165
  • @ Contraboi made their first contribution in #2162

  Full Changelog: 19a1778...a572b57

• 4.2.0-alpha.1 - 2025-08-01
• 4.1.0-beta.46 - 2025-04-02
• 4.1.0-beta.45 - 2025-03-31
• 4.1.0-beta.43 - 2025-02-07
  

  This release contains experimental support for integration with the Y.js library.

  [email protected]

  • New constructor option Y provides the Y.js library to Dexie.
    import * as Y from 'yjs';
    import Dexie from "dexie";

    const db = new Dexie("dbname", { Y });

  • New schema feature: <propertyName>:Y - declares virtual property (not an index) holding the Y.Doc instance.

    db.version(1).stores({
      comments: 'id, title, contentDoc:Y'
    });

  • New Y.js provider for Dexie: DexieYProvider.

    const comment = await db.comments.get(commentId);
    try {
      DexieYProvider.load(comment.contentDoc);
      await comment.contentDoc.whenLoaded; // waits until loaded.
      // At this point the doc is loaded, observed and you
      // can invoke anything from the Y.js ecosystem, such
      // as a Tiptap or Prosemirror editor.
    } finally {
      DexieYProvider.release(comment.contentDoc);
    }

  When using these options, every object retrieved from table containing :Y specifications, will contain an instance of a Y.Doc no matter if that property has been created or not. The property is neither enumerable nor own so JSON.stringify(obj) won't reveleal it. Accessing the Y.Doc will retrieve an empty, unloaded Y.Doc instance.

  Rules for Y properties on objects

  • Y properties are never nullish. If declared in the dexie schema, they'll exist on all objects from all queries (toArray(), get() etc).
  • Y properties are not own properties. They are set on the prototype of the returned object.
  • Y properties are readonly, except when adding new objects to a table (using table.add() or bulkAdd())
  • If providing a custom Y.Doc to add() or bulkAdd() its udates will be cloned when added.
  • If not providing the Y.Doc or setting the Y property to null when adding objects, there will still be an Y.Doc property on query results of the object, since Y props are defined by the schema and cannot be null or undefined.
  • Y properties on dexie objects are readonly. You can not replace them with another document or update them using table.update() or collection.modify(). The only way to update Y.Docs is via the Y.js library methods on the document instance.
  • Y properties are not loaded until using DexieYProvider.load() or the new react hook useDocument()
  • Y.Doc instances are kept in a global cache integrated with FinalizationRegistry. First time you access the getter, it will be created, and will stay in cache until it's garbage collected. This means that you'll always get the same Y.Doc instance when querying the same Y property of a the same object. This holds true even if the there are multiple obj instances representing the same ID in the database. All of these will hold one single instance of the Y.Doc because the cache is connected to the primary key of the parent object.

  How it works

  Internally, every declared Y property generates a dedicated table for Y.js updates tied to the parent table and the property name. Whenever a document is updated, a new entry in this table is added.

  DexieYProvider is responsible of loading and observing updates in both directions.

  Integrations

  Y.js allows multiple providers on the same document. It is possible to combine DexieYProvider with other providers, but it is also possible for dexie addons to extend the provider behavior - such as adding awareness and sync.

  [email protected]

  This is the next verison of dexie-cloud-addon that extends the behavior of DexieYProvider to also support awareness and sync over websockets with Dexie Cloud Server.

  Bugfixes

  No double initial sync

  Earlier versions of dexie-cloud-addon performed two initial sync phases also when requireAuth was specified. This is now optimized to only be done in a single authenticated initial sync.

  Better migration from vanilla dexie to dexie-cloud

  A vanilla Dexie app with multiple versions and upgraders could not make it to the cloud earlier because we previously disallowed using upgraders between versions when using dexie-cloud-addon. With this version, we allow that but make sure that the change tracking and sync is disabled during upgrade transactions. This allows vanilla dexie apps for easier migrating to cloud by allowing them to run the upgraders needed and then activate dexie-cloud and sync.

  New Example App

  The Dexie Cloud Starter is a new nextjs app that make full use of online text editing, full-text search and dexie cloud authentication, Github SSO and data sharing in realms.

  [email protected]

  New hook useDocument() makes use of DexieYProvider as a hook rather than loading and releasing imperatively.

  function MyComponent(commentId: string) {
  // Query comment object:
  const comment = useLiveQuery(() => db.comments.get(comentId));

  // Use it's document property (might be nullish):
  const provider = useDocument(comment?.contentDoc);

  // Pass provider and document to some Y.js compliant code in the ecosystem of such (unless nullish)...
  return provider
  ? <CommentEditor doc={comment.contentDoc} provider={provider} />
  : null;
  }

  
  


• 
  4.1.0-alpha.23 - 2024-11-27
  


• 
  4.1.0-alpha.12 - 2024-10-16
  


• 
  4.1.0-alpha.8 - 2024-10-15
  


• 
  4.1.0-alpha.7 - 2024-10-15
  


• 
  4.1.0-alpha.6 - 2024-10-14
  


• 
  4.1.0-alpha.5 - 2024-10-13
  


• 
  4.1.0-alpha.4 - 2024-10-13
  


• 
  4.1.0-alpha.3 - 2024-10-11
  


• 
  4.1.0-alpha.2 - 2024-10-04
  


• 
  4.0.11 - 2025-01-15
  

  Fixes issues #2103 and #2113

  Make sure to upgrade both dexie and dexie-cloud-addon:

  npm install dexie@latest
  npm install dexie-cloud-addon@latest
  

from dexie GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs