[Snyk] Upgrade dexie from 4.0.11 to 4.2.0 #24
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Snyk has created this PR to upgrade dexie from 4.0.11 to 4.2.0.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version is 15 versions ahead of your current version.
The recommended version was released 2 months ago.
Release notes
Package name: dexie
-
4.2.0 - 2025-08-13
- [email protected]
- [email protected]
- [email protected]
- [email protected]
- New add-on "y-dexie" that integrates the powerful Y.js library with dexie.
- Support "y-dexie" and Y.js in dexie-cloud-addon
- New hook
- Fix Named Export 'Dexie' Not Found in Production with Vite/Vinxi by @ thijssmudde in #2155
- fix: 'Dexie' Not Found in Production with Vite/Vinxi dexie-react-hooks by @ Contraboi in #2162
- @ thijssmudde made their first contribution in #2155
- @ davbl made their first contribution in #2165
- @ Contraboi made their first contribution in #2162
- Instead of
- Instead of
- No need to pass
With dexieCloud addon, make sure to pass yDexie first:
- Declare Y.Doc properties as
-
4.2.0-rc.1 - 2025-08-06
- Instead of
- Instead of
- No need to pass
With dexieCloud addon, make sure to pass yDexie first:
- Declare Y.Doc properties as
- New npm package "y-dexie" and removed the Y.js code from the "dexie" library. #2180
- Fix Named Export 'Dexie' Not Found in Production with Vite/Vinxi by @ thijssmudde in #2155
- fix: 'Dexie' Not Found in Production with Vite/Vinxi dexie-react-hooks by @ Contraboi in #2162
- @ thijssmudde made their first contribution in #2155
- @ davbl made their first contribution in #2165
- @ Contraboi made their first contribution in #2162
-
4.2.0-alpha.1 - 2025-08-01
-
4.1.0-beta.46 - 2025-04-02
-
4.1.0-beta.45 - 2025-03-31
-
4.1.0-beta.43 - 2025-02-07
- New constructor option
import * as Y from 'yjs';
- New schema feature:
- New Y.js provider for Dexie: DexieYProvider.
- Y properties are never nullish. If declared in the dexie schema, they'll exist on all objects from all queries (toArray(), get() etc).
- Y properties are not
- Y properties are readonly, except when adding new objects to a table (using table.add() or bulkAdd())
- If providing a custom Y.Doc to add() or bulkAdd() its udates will be cloned when added.
- If not providing the Y.Doc or setting the Y property to null when adding objects, there will still be an Y.Doc property on query results of the object, since Y props are defined by the schema and cannot be null or undefined.
- Y properties on dexie objects are readonly. You can not replace them with another document or update them using table.update() or collection.modify(). The only way to update Y.Docs is via the Y.js library methods on the document instance.
- Y properties are not loaded until using DexieYProvider.load() or the new react hook
- Y.Doc instances are kept in a global cache integrated with FinalizationRegistry. First time you access the getter, it will be created, and will stay in cache until it's garbage collected. This means that you'll always get the same Y.Doc instance when querying the same Y property of a the same object. This holds true even if the there are multiple obj instances representing the same ID in the database. All of these will hold one single instance of the Y.Doc because the cache is connected to the primary key of the parent object.
function MyComponent(commentId: string) {
from dexie GitHub release notesNew Stable Packages
What's Changed since Latest Stable ([email protected])
useDocument()in dexie-react-hooks for Y.js integration.New Contributors
Migration from 4.1.x-beta
Dexie 4.1.x has been tagged
@ nextand contained experimental Y.js support. The Y.js support has since been moved into its own add-on 'y-dexie'.If the built-in Y.js support in [email protected] has been used, a migration is needed:
npm install y-dexieimport { DexieYProvider } from 'dexie'-->import { DexieYProvider } from 'y-dexie'DexieyYProvider<Y.Doc>-->DexieYProvider.Yto Dexie constructor, but instead, pass theyDexieaddon:{ addons: [yDexie, dexieCloud] }prop:Y.Docinstead of justprop:YIf you need a sample PR of these changes, have a look at dexie/dexie-cloud-starter#8
Full Changelog: b415d92...a978fc0
Release Candidate of [email protected]
In contrast to previous 4.1.x betas, we've extracted the Y.js support from the "dexie" package into "y-dexie".
Migration from 4.1.x-beta
Only if the experimental Y.js support from 4.1.x beta was used, a migration is needed:
npm install y-dexieimport { DexieYProvider } from 'dexie'-->import { DexieYProvider } from 'y-dexie'DexieyYProvider<Y.Doc>-->DexieYProvider.Yto Dexie constructor, but instead, pass theyDexieaddon:{ addons: [yDexie, dexieCloud] }prop:Y.Docinstead of justprop:YIf you need a sample PR of these changes, have a look at dexie/dexie-cloud-starter#8
What's Changed since 4.1.0-beta.43
New Contributors
Full Changelog: 19a1778...a572b57
This release contains experimental support for integration with the Y.js library.
[email protected]
Yprovides the Y.js library to Dexie.import Dexie from "dexie";
const db = new Dexie("dbname", { Y });
<propertyName>:Y- declares virtual property (not an index) holding the Y.Doc instance.When using these options, every object retrieved from table containing
:Yspecifications, will contain an instance of a Y.Doc no matter if that property has been created or not. The property is neither enumerable nor own so JSON.stringify(obj) won't reveleal it. Accessing the Y.Doc will retrieve an empty, unloaded Y.Doc instance.Rules for Y properties on objects
own properties. They are set on the prototype of the returned object.useDocument()How it works
Internally, every declared Y property generates a dedicated table for Y.js updates tied to the parent table and the property name. Whenever a document is updated, a new entry in this table is added.
DexieYProvider is responsible of loading and observing updates in both directions.
Integrations
Y.js allows multiple providers on the same document. It is possible to combine DexieYProvider with other providers, but it is also possible for dexie addons to extend the provider behavior - such as adding awareness and sync.
[email protected]
This is the next verison of dexie-cloud-addon that extends the behavior of DexieYProvider to also support awareness and sync over websockets with Dexie Cloud Server.
Bugfixes
No double initial sync
Earlier versions of dexie-cloud-addon performed two initial sync phases also when
requireAuthwas specified. This is now optimized to only be done in a single authenticated initial sync.Better migration from vanilla dexie to dexie-cloud
A vanilla Dexie app with multiple versions and upgraders could not make it to the cloud earlier because we previously disallowed using upgraders between versions when using dexie-cloud-addon. With this version, we allow that but make sure that the change tracking and sync is disabled during upgrade transactions. This allows vanilla dexie apps for easier migrating to cloud by allowing them to run the upgraders needed and then activate dexie-cloud and sync.
New Example App
The Dexie Cloud Starter is a new nextjs app that make full use of online text editing, full-text search and dexie cloud authentication, Github SSO and data sharing in realms.
[email protected]
New hook
useDocument()makes use of DexieYProvider as a hook rather than loading and releasing imperatively.// Query comment object:
const comment = useLiveQuery(() => db.comments.get(comentId));
// Use it's document property (might be nullish):
const provider = useDocument(comment?.contentDoc);
// Pass provider and document to some Y.js compliant code in the ecosystem of such (unless nullish)...
return provider
? <CommentEditor doc={comment.contentDoc} provider={provider} />
: null;
}
4.1.0-alpha.23 - 2024-11-27
4.1.0-alpha.12 - 2024-10-16
4.1.0-alpha.8 - 2024-10-15
4.1.0-alpha.7 - 2024-10-15
4.1.0-alpha.6 - 2024-10-14
4.1.0-alpha.5 - 2024-10-13
4.1.0-alpha.4 - 2024-10-13
4.1.0-alpha.3 - 2024-10-11
4.1.0-alpha.2 - 2024-10-04
4.0.11 - 2025-01-15
Fixes issues #2103 and #2113
Make sure to upgrade both dexie and dexie-cloud-addon:
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.
For more information: