build(deps): bump the web-minor-patch group across 3 directories with 11 updates by dependabot[bot] · Pull Request #132 · MSKazemi/novafabric

dependabot · 2026-10-05T22:58:27Z

Bumps the web-minor-patch group with 5 updates in the /packages/nova-dashboard directory:

Package	From	To
@react-three/drei	`10.7.8`	`10.7.9`
@react-three/fiber	`9.7.0`	`9.8.1`
three	`0.186.0`	`0.186.1`
vite	`8.3.0`	`8.3.2`
vitest	`5.0.1`	`5.0.3`
vitest	`5.0.1`	`5.0.3`
vitest	`5.0.1`	`5.0.3`

Bumps the web-minor-patch group with 2 updates in the /packages/nova-sdk-ts directory: vitest and @types/node.
Bumps the web-minor-patch group with 6 updates in the /web directory:

Package	From	To
vitest	`5.0.1`	`5.0.3`
vitest	`5.0.1`	`5.0.3`
@xyflow/react	`12.11.6`	`12.12.0`
astro	`7.3.3`	`7.3.5`
lucide-react	`1.47.0`	`1.50.0`
shiki	`4.4.3`	`4.5.0`
jsdom	`30.1.0`	`30.1.1`
vitest	`5.0.1`	`5.0.3`

Updates @react-three/drei from 10.7.8 to 10.7.9

Release notes

Sourced from @react-three/drei's releases.

v10.7.9

10.7.9 (2026-09-25)

Bug Fixes

AccumulativeShadows: keep scene.environment out of the light map (#2833) (1397c37)

keep SoftShadows compatible with newer three versions (#2846) (66b9bda)

Commits

66b9bda fix: keep SoftShadows compatible with newer three versions (#2846)
1397c37 fix(AccumulativeShadows): keep scene.environment out of the light map (#2833)
See full diff in compare view

Updates @react-three/fiber from 9.7.0 to 9.8.1

Release notes

Sourced from @react-three/fiber's releases.

v9.8.1

The main changes here are bug fixes:

Activity now works completely inside of R3F, even across boundaries with React DOM. Ie, an Activity that wraps the Canvas.

In some cases a renderer would not be disposed when the Canvas was unmounted. This is fixed and we clarify in which instances we auto-dispose.

What's Changed

fix(core): dispose the renderer R3F creates when its root unmounts by @tonyblu331 in pmndrs/react-three-fiber#3942

fix(core): preserve visibility across Activity and Suspense hiding by @krispya in pmndrs/react-three-fiber#3944

fix(web): keep a Canvas root alive while hides it by @tonyblu331 in pmndrs/react-three-fiber#3943

fix(core): stop Canvas rerenders from resetting runtime settings by @krispya in pmndrs/react-three-fiber#3945

fix(core): bridge Activity visibility into Canvas scenes by @krispya in pmndrs/react-three-fiber#3946

New Contributors

@tonyblu331 made their first contribution in pmndrs/react-three-fiber#3942

Full Changelog: pmndrs/react-three-fiber@v9.8.0...v9.8.1

v9.8.0

The headline feature is that R3F is now compatible with React 19.3.0. We don't fully support all of the new APIs, but it will not longer conflict to run the latest and greatest React.

In addition we fixed some long standing bugs:

React roots are configured synchronously and then gated on the renderer if it need async, for example with WebGPURenderer. This means that you won't get awkward out of sync issues.

Strict Mode no longer causes problems for our canvas. This was related to the async support added a while ago as well.

Have fun!

What's Changed

fix: corrected broken links by @dor-rondel in pmndrs/react-three-fiber#3872

feat: support React 19.3 by @cades in pmndrs/react-three-fiber#3916

fix(core): don't tear down a root remounted during the unmount grace period by @abernier in pmndrs/react-three-fiber#3869

feat(core): configure and render roots synchronously by @krispya in pmndrs/react-three-fiber#3925

New Contributors

@dor-rondel made their first contribution in pmndrs/react-three-fiber#3872

@cades made their first contribution in pmndrs/react-three-fiber#3916

Full Changelog: pmndrs/react-three-fiber@v9.7.0...v9.8.0

Commits

53ec672 RELEASING: Releasing 1 package(s)
e0e9c2d fix(core): bridge Activity visibility into Canvas scenes (#3946)
138bfb0 fix(core): stop Canvas rerenders from resetting runtime settings (#3945)
2bcc153 fix(web): keep a Canvas root alive while <Activity> hides it (#3943)
8965ba4 fix(core): preserve visibility across Activity and Suspense hiding (#3944)
9ac7562 fix(core): dispose the renderer R3F creates when its root unmounts (#3942)
7db6056 RELEASING: Releasing 1 package(s)
bc240cc feat(core): configure and render roots synchronously (#3925)
f0f1cdf fix(core): don't tear down a root remounted during the unmount grace period (...
4ae2f81 feat: support React 19.3 (#3916)
Additional commits viewable in compare view

Updates three from 0.186.0 to 0.186.1

Commits

See full diff in compare view

Updates vite from 8.3.0 to 8.3.2

Release notes

Sourced from vite's releases.

v8.3.2

Bug Fixes

build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#23611) (64e0a21)

bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)

bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)

deps: update all non-major dependencies (#23601) (9944fa6)

deps: update rolldown-related dependencies (#23602) (88c1741)

html: resolve percent-encoded srcset urls (#23609) (53f1ce7)

limit size of object and array printing via forwardConsole (#23565) (e64a587)

merge build.rolldownOptions.output.minify correctly (#23536) (bba3bb8)

optimize-deps: avoid "unsupported" warnings for browser:false mappings (#23590) (5e4b9ca)

optimizer: preserve excluded optional peer require fallbacks (#23600) (a2bd6fa)

pass queries to renderBuiltUrl (#23586) (744269e)

server: handle file watcher errors without crashing (#23503) (6894f5c)

server: release previous environments after initialization (#23499) (5a3a010)

ssr: encode whitespace in module runner sourceURL (#23513) (bbc8812)

worker: align worker urls in client and server when using terser (#23614) (24bd331)

Performance Improvements

avoid encoding intermediate source maps (#23461) (89574f6)

build: avoid quadratic link scan in the preload helper (#23510) (cf5c028)

only register time middleware when debug logging is enabled (#23621) (94d0080)

Documentation

fix dead og-image PNG links in vite6/vite7 changelog entries (#23594) (1929b4c)

Miscellaneous Chores

deps: update vitest monorepo to v5 (#23604) (24339f4)

Code Refactoring

use tinyexec instead of cross-spawn (#23583) (db915e5)

Tests

bundled-dev: accept a rolldown dev runtime with no helper imports (#23606) (634745d)

v8.3.1

Bug Fixes

deps: update all non-major dependencies (#23482) (3c752c8)

deps: update all non-major dependencies (#23537) (e8990c4)

deps: update rolldown-related dependencies (#23483) (9aecbbf)

handle server.ws: false in mergeConfig (#23511) (f68c0d5)

merge build.rolldownOptions.output.comments correctly (#23514) (4aba8d8)

optimizer: don't skip imports whose binding starts with type (#23540) (39330f4)

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.2 (2026-10-01)

Bug Fixes

build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#23611) (64e0a21)

bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)

bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)

deps: update all non-major dependencies (#23601) (9944fa6)

deps: update rolldown-related dependencies (#23602) (88c1741)

html: resolve percent-encoded srcset urls (#23609) (53f1ce7)

limit size of object and array printing via forwardConsole (#23565) (e64a587)

merge build.rolldownOptions.output.minify correctly (#23536) (bba3bb8)

optimize-deps: avoid "unsupported" warnings for browser:false mappings (#23590) (5e4b9ca)

optimizer: preserve excluded optional peer require fallbacks (#23600) (a2bd6fa)

pass queries to renderBuiltUrl (#23586) (744269e)

server: handle file watcher errors without crashing (#23503) (6894f5c)

server: release previous environments after initialization (#23499) (5a3a010)

ssr: encode whitespace in module runner sourceURL (#23513) (bbc8812)

worker: align worker urls in client and server when using terser (#23614) (24bd331)

Performance Improvements

avoid encoding intermediate source maps (#23461) (89574f6)

build: avoid quadratic link scan in the preload helper (#23510) (cf5c028)

only register time middleware when debug logging is enabled (#23621) (94d0080)

Documentation

fix dead og-image PNG links in vite6/vite7 changelog entries (#23594) (1929b4c)

Miscellaneous Chores

deps: update vitest monorepo to v5 (#23604) (24339f4)

Code Refactoring

use tinyexec instead of cross-spawn (#23583) (db915e5)

Tests

bundled-dev: accept a rolldown dev runtime with no helper imports (#23606) (634745d)

8.3.1 (2026-09-24)

Bug Fixes

deps: update all non-major dependencies (#23482) (3c752c8)

deps: update all non-major dependencies (#23537) (e8990c4)

deps: update rolldown-related dependencies (#23483) (9aecbbf)

handle server.ws: false in mergeConfig (#23511) (f68c0d5)

merge build.rolldownOptions.output.comments correctly (#23514) (4aba8d8)

optimizer: don't skip imports whose binding starts with type (#23540) (39330f4)

... (truncated)

Commits

1003321 release: v8.3.2 (#23623)
24bd331 fix(worker): align worker urls in client and server when using terser (#23614)
94d0080 perf: only register time middleware when debug logging is enabled (#23621)
89574f6 perf: avoid encoding intermediate source maps (#23461)
5a3a010 fix(server): release previous environments after initialization (#23499)
1929b4c docs: fix dead og-image PNG links in vite6/vite7 changelog entries (#23594)
6894f5c fix(server): handle file watcher errors without crashing (#23503)
cf5c028 perf(build): avoid quadratic link scan in the preload helper (#23510)
bba3bb8 fix: merge build.rolldownOptions.output.minify correctly (#23536)
5e4b9ca fix(optimize-deps): avoid "unsupported" warnings for browser:false mappings (...
Additional commits viewable in compare view

Updates vitest from 5.0.1 to 5.0.3

Release notes

Sourced from vitest's releases.

v5.0.3

   🐞 Bug Fixes

Isolate result.status between repeats runs - by @hi-ogawa, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11218 (5dbeb)

Don't print an interceptor warning in browser mode - by @sheremet-va in vitest-dev/vitest#11377 (15cc0)

Don't retry when test.fails expectedly failed - by @hi-ogawa, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11219 (b2458)

Scope cache key generators to projects - by @ecoyoung in vitest-dev/vitest#11281 and vitest-dev/vitest#11301 (92ba7)

browser:

Delay server listen until tests start running - by @sheremet-va in vitest-dev/vitest#11366 (7d8ed)

Check mock path boundaries - by @saryn17, Ryosei Sato and @sheremet-va in vitest-dev/vitest#11361 and vitest-dev/vitest#11362 (1c388)

Keep config of browser-consumed environments - by @kasperpeulen and Claude in vitest-dev/vitest#11378 (aafc0)

Ignore page crash while cancelling - by @sheremet-va in vitest-dev/vitest#11386 (7c367)

toMatchScreenshot uses wrong reference on retried tests - by @macarie in vitest-dev/vitest#11393 (c22ab)

cache:

Revalidate imports of cached modules - by @sheremet-va in vitest-dev/vitest#11381 (38f98)

deps:

Pin why-is-node-running to 3.2.1 to avoid users running into ERR_PNPM_TRUST_DOWNGRADE - by @AriPerkkio in vitest-dev/vitest#11403 (f6c9a)

expect:

Pass current equality testers to expect.extend asymmetric matchers - by @hi-ogawa, Hiroshi Ogawa and Claude in vitest-dev/vitest#11401 (3e794)

jsdom:

Support Blob on jsdom 30.1 - by @sheremet-va in vitest-dev/vitest#11379 (6c49b)

pool:

Preserve unique pool ids when groupOrder is set - by @mtorp in vitest-dev/vitest#11392 (50312)

ui:

Split-pane handle overlapping iframe - by @macarie in vitest-dev/vitest#11221 (f91db)

vitest:

Remove root temp dir on close - by @abhinav-phi in vitest-dev/vitest#11248 (7c711)

vm:

Do not optimize deps from index.html - by @ezefernandezyf, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11329 and vitest-dev/vitest#11360 (caf28)

Don't reuse scripts across vite environments - by @MO2k4, Martin Oehlert and Claude in vitest-dev/vitest#11395 (346d3)

    View changes on GitHub

v5.0.2

   🐞 Bug Fixes

Bind process in case global is overwritten - by @AriPerkkio in vitest-dev/vitest#11343 (0b792)

detect-async-leaks:

Ignore process.stdio handles - by @AriPerkkio in vitest-dev/vitest#11333 (0fd6b)

expect:

Fix toMatchObject with asymmetric matchers - by @ShreeBohara, Claude Opus 5, @hi-ogawa, Hiroshi Ogawa and Codex (GPT-5) in vitest-dev/vitest#11100 (42523)

jsdom:

Fix Request with Blob body on jsdom 28+ - by @harshit-d3v in vitest-dev/vitest#11295 (d1c3e)

reporter:

agent to respect --silent - by @Raj4478 and @AriPerkkio in vitest-dev/vitest#11271 (5b95e)

reporters:

Handle concurrent createReport calls - by @7rulnik in vitest-dev/vitest#11278 (e8e55)

hanging-process to use ESM entrypoint - by @AriPerkkio in vitest-dev/vitest#11316 (4e91e)

spy:

Fix stack overflow when spying Set.prototype.add - by @fengmk2 in vitest-dev/vitest#11299 (a0a93)

... (truncated)

Commits

33cadea chore: release v5.0.3 (#11409)
346d389 fix(vm): don't reuse scripts across vite environments (#11395)
f6c9a49 fix(deps): pin why-is-node-running to 3.2.1 to avoid users running into `...
062c75d chore: fix standalone docs build, update exports maps (#11394)
caf2887 fix(vm): do not optimize deps from index.html (fix #11329) (#11360)
50312eb fix(pool): preserve unique pool ids when groupOrder is set (#11392)
7c36748 fix(browser): ignore page crash while cancelling (#11386)
92ba7fc fix: scope cache key generators to projects (fix #11281) (#11301)
38f9885 fix(cache): revalidate imports of cached modules (#11381)
b24585f fix: don't retry when test.fails expectedly failed (#11219)
Additional commits viewable in compare view

Updates vitest from 5.0.1 to 5.0.3

Release notes

Sourced from vitest's releases.

v5.0.3

   🐞 Bug Fixes

Isolate result.status between repeats runs - by @hi-ogawa, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11218 (5dbeb)

Don't print an interceptor warning in browser mode - by @sheremet-va in vitest-dev/vitest#11377 (15cc0)

Don't retry when test.fails expectedly failed - by @hi-ogawa, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11219 (b2458)

Scope cache key generators to projects - by @ecoyoung in vitest-dev/vitest#11281 and vitest-dev/vitest#11301 (92ba7)

browser:

Delay server listen until tests start running - by @sheremet-va in vitest-dev/vitest#11366 (7d8ed)

Check mock path boundaries - by @saryn17, Ryosei Sato and @sheremet-va in vitest-dev/vitest#11361 and vitest-dev/vitest#11362 (1c388)

Keep config of browser-consumed environments - by @kasperpeulen and Claude in vitest-dev/vitest#11378 (aafc0)

Ignore page crash while cancelling - by @sheremet-va in vitest-dev/vitest#11386 (7c367)

toMatchScreenshot uses wrong reference on retried tests - by @macarie in vitest-dev/vitest#11393 (c22ab)

cache:

Revalidate imports of cached modules - by @sheremet-va in vitest-dev/vitest#11381 (38f98)

deps:

Pin why-is-node-running to 3.2.1 to avoid users running into ERR_PNPM_TRUST_DOWNGRADE - by @AriPerkkio in vitest-dev/vitest#11403 (f6c9a)

expect:

Pass current equality testers to expect.extend asymmetric matchers - by @hi-ogawa, Hiroshi Ogawa and Claude in vitest-dev/vitest#11401 (3e794)

jsdom:

Support Blob on jsdom 30.1 - by @sheremet-va in vitest-dev/vitest#11379 (6c49b)

pool:

Preserve unique pool ids when groupOrder is set - by @mtorp in vitest-dev/vitest#11392 (50312)

ui:

Split-pane handle overlapping iframe - by @macarie in vitest-dev/vitest#11221 (f91db)

vitest:

Remove root temp dir on close - by @abhinav-phi in vitest-dev/vitest#11248 (7c711)

vm:

Do not optimize deps from index.html - by @ezefernandezyf, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11329 and vitest-dev/vitest#11360 (caf28)

Don't reuse scripts across vite environments - by @MO2k4, Martin Oehlert and Claude in vitest-dev/vitest#11395 (346d3)

    View changes on GitHub

v5.0.2

   🐞 Bug Fixes

Bind process in case global is overwritten - by @AriPerkkio in vitest-dev/vitest#11343 (0b792)

detect-async-leaks:

Ignore process.stdio handles - by @AriPerkkio in vitest-dev/vitest#11333 (0fd6b)

expect:

Fix toMatchObject with asymmetric matchers - by @ShreeBohara, Claude Opus 5, @hi-ogawa, Hiroshi Ogawa and Codex (GPT-5) in vitest-dev/vitest#11100 (42523)

jsdom:

Fix Request with Blob body on jsdom 28+ - by @harshit-d3v in vitest-dev/vitest#11295 (d1c3e)

reporter:

agent to respect --silent - by @Raj4478 and @AriPerkkio in vitest-dev/vitest#11271 (5b95e)

reporters:

Handle concurrent createReport calls - by @7rulnik in vitest-dev/vitest#11278 (e8e55)

hanging-process to use ESM entrypoint - by @AriPerkkio in vitest-dev/vitest#11316 (4e91e)

spy:

Fix stack overflow when spying Set.prototype.add - by @fengmk2 in vitest-dev/vitest#11299 (a0a93)

... (truncated)

Commits

33cadea chore: release v5.0.3 (#11409)
346d389 fix(vm): don't reuse scripts across vite environments (#11395)
f6c9a49 fix(deps): pin why-is-node-running to 3.2.1 to avoid users running into `...
062c75d chore: fix standalone docs build, update exports maps (#11394)
caf2887 fix(vm): do not optimize deps from index.html (fix #11329) (#11360)
50312eb fix(pool): preserve unique pool ids when groupOrder is set (#11392)
7c36748 fix(browser): ignore page crash while cancelling (#11386)
92ba7fc fix: scope cache key generators to projects (fix #11281) (#11301)
38f9885 fix(cache): revalidate imports of cached modules (#11381)
b24585f fix: don't retry when test.fails expectedly failed (#11219)
Additional commits viewable in compare view

Updates vitest from 5.0.1 to 5.0.3

Release notes

Sourced from vitest's releases.

v5.0.3

🐞 Bug Fixes

Isolate result.status between repeats runs - by @hi-ogawa, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11218 (5dbeb)

Don't print an interceptor warning in browser mode - by @sheremet-va in vitest-dev/vitest#11377 (15cc0)

Don't retry when test.fails expectedly failed - by @hi-ogawa, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11219 (b2458)

Scope cache key generators to projects - by @ecoyoung in vitest-dev/vitest#11281 and vitest-dev/vitest#11301 (92ba7)

browser:

Delay server listen until tests start running - by @sheremet-va in vitest-dev/vitest#11366 (7d8ed)

Check mock path boundaries - by @saryn17, Ryosei Sato and @sheremet-va in vitest-dev/vitest#11361 and vitest-dev/vitest#11362 (1c388)

Keep config of browser-consumed environments - by @kasperpeulen and Claude in vitest-dev/vitest#11378 (aafc0)

Ignore page crash while cancelling - by @sheremet-va in vitest-dev/vitest#11386 (7c367)

toMatchScreenshot uses wrong reference on retried tests - by @macarie in vitest-dev/vitest#11393 (c22ab)

cache:

Revalidate imports of cached modules - by @sheremet-va in vitest-dev/vitest#11381 (38f98)

deps:

Pin why-is-node-running to 3.2.1 to avoid users running into ERR_PNPM_TRUST_DOWNGRADE - by @AriPerkkio in vitest-dev/vitest#11403 (f6c9a)

expect:

Pass current equality testers to expect.extend asymmetric matchers - by @hi-ogawa, Hiroshi Ogawa and Claude in vitest-dev/vitest#11401 (3e794)

jsdom:

Support Blob on jsdom 30.1 - by @sheremet-va in vitest-dev/vitest#11379 (6c49b)

pool:

Preserve unique pool ids when groupOrder is set - by @mtorp in vitest-dev/vitest#11392 (50312)

ui:

Split-pane handle overlapping iframe - by @macarie in vitest-dev/vitest#11221 (f91db)

Bumps [@astrojs/react](https://github.com/withastro/astro/tree/HEAD/packages/integrations/react) from 6.0.6 to 7.0.0. - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/react/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/react@7.0.0/packages/integrations/react) --- updated-dependencies: - dependency-name: "@astrojs/react" dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [ip-address](https://github.com/beaugunderson/ip-address) from 10.4.0 to 10.7.2. - [Release notes](https://github.com/beaugunderson/ip-address/releases) - [Commits](beaugunderson/ip-address@v10.4.0...v10.7.2) --- updated-dependencies: - dependency-name: ip-address dependency-version: 10.7.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [devalue](https://github.com/sveltejs/devalue) from 5.9.2 to 5.9.4. - [Release notes](https://github.com/sveltejs/devalue/releases) - [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md) - [Commits](sveltejs/devalue@v5.9.2...v5.9.4) --- updated-dependencies: - dependency-name: devalue dependency-version: 5.9.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.7 to 3.1.8. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.7...v3.1.8) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.8 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 5.0.9 to 5.0.12. - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v5.0.9...v5.0.12) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 5.0.12 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

…75/4176/4177 and PYSEC-2026-4141)

The test pinned 2026-04-01 as a recent capsule against a 180-day window, so it started failing on 2026-09-28 and has kept CI red since.

… 11 updates Bumps the web-minor-patch group with 5 updates in the /packages/nova-dashboard directory: | Package | From | To | | --- | --- | --- | | [@react-three/drei](https://github.com/pmndrs/drei) | `10.7.8` | `10.7.9` | | [@react-three/fiber](https://github.com/pmndrs/react-three-fiber) | `9.7.0` | `9.8.1` | | [three](https://github.com/mrdoob/three.js) | `0.186.0` | `0.186.1` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.3.0` | `8.3.2` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.1` | `5.0.3` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.1` | `5.0.3` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.1` | `5.0.3` | Bumps the web-minor-patch group with 2 updates in the /packages/nova-sdk-ts directory: [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) and [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node). Bumps the web-minor-patch group with 6 updates in the /web directory: | Package | From | To | | --- | --- | --- | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.1` | `5.0.3` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.1` | `5.0.3` | | [@xyflow/react](https://github.com/xyflow/xyflow/tree/HEAD/packages/react) | `12.11.6` | `12.12.0` | | [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.3.3` | `7.3.5` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.47.0` | `1.50.0` | | [shiki](https://github.com/shikijs/shiki/tree/HEAD/packages/shiki) | `4.4.3` | `4.5.0` | | [jsdom](https://github.com/jsdom/jsdom) | `30.1.0` | `30.1.1` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.1` | `5.0.3` | Updates `@react-three/drei` from 10.7.8 to 10.7.9 - [Release notes](https://github.com/pmndrs/drei/releases) - [Changelog](https://github.com/pmndrs/drei/blob/master/release.config.js) - [Commits](pmndrs/drei@v10.7.8...v10.7.9) Updates `@react-three/fiber` from 9.7.0 to 9.8.1 - [Release notes](https://github.com/pmndrs/react-three-fiber/releases) - [Commits](pmndrs/react-three-fiber@v9.7.0...v9.8.1) Updates `three` from 0.186.0 to 0.186.1 - [Release notes](https://github.com/mrdoob/three.js/releases) - [Commits](https://github.com/mrdoob/three.js/commits) Updates `vite` from 8.3.0 to 8.3.2 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.3.2/packages/vite) Updates `vitest` from 5.0.1 to 5.0.3 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.3/packages/vitest) Updates `vitest` from 5.0.1 to 5.0.3 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.3/packages/vitest) Updates `vitest` from 5.0.1 to 5.0.3 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.3/packages/vitest) Updates `vitest` from 5.0.1 to 5.0.3 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.3/packages/vitest) Updates `@types/node` from 26.6.1 to 26.6.4 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `vitest` from 5.0.1 to 5.0.3 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.3/packages/vitest) Updates `vitest` from 5.0.1 to 5.0.3 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.3/packages/vitest) Updates `vitest` from 5.0.1 to 5.0.3 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.3/packages/vitest) Updates `vitest` from 5.0.1 to 5.0.3 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.3/packages/vitest) Updates `@xyflow/react` from 12.11.6 to 12.12.0 - [Release notes](https://github.com/xyflow/xyflow/releases) - [Changelog](https://github.com/xyflow/xyflow/blob/main/packages/react/CHANGELOG.md) - [Commits](https://github.com/xyflow/xyflow/commits/@xyflow/react@12.12.0/packages/react) Updates `astro` from 7.3.3 to 7.3.5 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@7.3.5/packages/astro) Updates `lucide-react` from 1.47.0 to 1.50.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.50.0/packages/lucide-react) Updates `shiki` from 4.4.3 to 4.5.0 - [Release notes](https://github.com/shikijs/shiki/releases) - [Commits](https://github.com/shikijs/shiki/commits/v4.5.0/packages/shiki) Updates `jsdom` from 30.1.0 to 30.1.1 - [Release notes](https://github.com/jsdom/jsdom/releases) - [Commits](jsdom/jsdom@v30.1.0...v30.1.1) Updates `vitest` from 5.0.1 to 5.0.3 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.3/packages/vitest) --- updated-dependencies: - dependency-name: "@react-three/drei" dependency-version: 10.7.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: web-minor-patch - dependency-name: "@react-three/fiber" dependency-version: 9.8.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: web-minor-patch - dependency-name: three dependency-version: 0.186.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: web-minor-patch - dependency-name: vite dependency-version: 8.3.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: web-minor-patch - dependency-name: vitest dependency-version: 5.0.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: web-minor-patch - dependency-name: vitest dependency-version: 5.0.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: web-minor-patch - dependency-name: vitest dependency-version: 5.0.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: web-minor-patch - dependency-name: vitest dependency-version: 5.0.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: web-minor-patch - dependency-name: "@types/node" dependency-version: 26.6.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: web-minor-patch - dependency-name: vitest dependency-version: 5.0.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: web-minor-patch - dependency-name: vitest dependency-version: 5.0.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: web-minor-patch - dependency-name: vitest dependency-version: 5.0.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: web-minor-patch - dependency-name: vitest dependency-version: 5.0.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: web-minor-patch - dependency-name: "@xyflow/react" dependency-version: 12.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: web-minor-patch - dependency-name: astro dependency-version: 7.3.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: web-minor-patch - dependency-name: lucide-react dependency-version: 1.50.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: web-minor-patch - dependency-name: shiki dependency-version: 4.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: web-minor-patch - dependency-name: jsdom dependency-version: 30.1.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: web-minor-patch - dependency-name: vitest dependency-version: 5.0.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: web-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps the actions group with 1 update in the / directory: [actions/upload-artifact](https://github.com/actions/upload-artifact). Updates `actions/upload-artifact` from 4 to 7 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v4...v7) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [source-map-js](https://github.com/7rulnik/source-map-js) from 1.2.1 to 1.2.2. - [Release notes](https://github.com/7rulnik/source-map-js/releases) - [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md) - [Commits](7rulnik/source-map-js@v1.2.1...v1.2.2) --- updated-dependencies: - dependency-name: source-map-js dependency-version: 1.2.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [smol-toml](https://github.com/squirrelchat/smol-toml) from 1.7.1 to 1.9.0. - [Release notes](https://github.com/squirrelchat/smol-toml/releases) - [Commits](squirrelchat/smol-toml@v1.7.1...v1.9.0) --- updated-dependencies: - dependency-name: smol-toml dependency-version: 1.9.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [sharp](https://github.com/lovell/sharp) from 0.35.4 to 0.35.5. - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.35.4...v0.35.5) --- updated-dependencies: - dependency-name: sharp dependency-version: 0.35.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [proxy-addr](https://github.com/jshttp/proxy-addr) from 2.0.7 to 2.0.8. - [Release notes](https://github.com/jshttp/proxy-addr/releases) - [Changelog](https://github.com/jshttp/proxy-addr/blob/master/HISTORY.md) - [Commits](jshttp/proxy-addr@v2.0.7...v2.0.8) --- updated-dependencies: - dependency-name: proxy-addr dependency-version: 2.0.8 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [compression](https://github.com/expressjs/compression) from 1.8.1 to 1.8.2. - [Release notes](https://github.com/expressjs/compression/releases) - [Changelog](https://github.com/expressjs/compression/blob/master/HISTORY.md) - [Commits](expressjs/compression@v1.8.1...v1.8.2) --- updated-dependencies: - dependency-name: compression dependency-version: 1.8.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [werkzeug](https://github.com/pallets/werkzeug) from 3.1.8 to 3.1.9. - [Release notes](https://github.com/pallets/werkzeug/releases) - [Changelog](https://github.com/pallets/werkzeug/blob/main/CHANGES.rst) - [Commits](pallets/werkzeug@3.1.8...3.1.9) --- updated-dependencies: - dependency-name: werkzeug dependency-version: 3.1.9 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [mako](https://github.com/sqlalchemy/mako) from 1.4.1 to 1.4.2. - [Release notes](https://github.com/sqlalchemy/mako/releases) - [Changelog](https://github.com/sqlalchemy/mako/blob/main/CHANGES) - [Commits](https://github.com/sqlalchemy/mako/commits) --- updated-dependencies: - dependency-name: mako dependency-version: 1.4.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [multidict](https://github.com/aio-libs/multidict) from 6.7.1 to 6.9.1. - [Release notes](https://github.com/aio-libs/multidict/releases) - [Changelog](https://github.com/aio-libs/multidict/blob/master/CHANGES.rst) - [Commits](aio-libs/multidict@v6.7.1...v6.9.1) --- updated-dependencies: - dependency-name: multidict dependency-version: 6.9.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

…in via 9faadff)

Bump http-cache-semantics (4.3.0), source-map-js and brace-expansion in the dashboard and sdk-ts lockfiles via lockfile-only npm update. basic-ftp (GHSA-c475-qrg2-pj4r) has no reachable fix (dev-only lhci chain, newest get-uri still pins ^5.3.1): add a time-boxed waiver in the repo's established form.

…_environment The CI unit job failed three test_diff_environment cases because colour codes split the phrases the assertions search for. _flat() now removes SGR escapes first.

"produced by" next to a model-id field name matched the AI-attribution pattern; the line describes a file format, so say "emitted by".

…0 release and audit fixes)

MSKazemi · 2026-10-08T15:11:04Z

CI repair update — 2026-10-08

Merged #142 (197a10e) into this Dependabot web/dependency group via 73801e1, retaining both sides instead of choosing one lockfile. Used a three-way JSON merge against the common main baseline on six manifest/lockfile files (web, packages/nova-sdk-ts, packages/nova-dashboard), reporting no unresolved field-level conflicts. Preserved @astrojs/react 7 and the prior security patches from #142, plus this PR's newer Astro, Vite, Three.js, TypeScript tooling, and web packages. Checked that lockfile root manifests match package.json declarations and direct dependencies resolve to lockfile entries. CI is newly running and must pass before merge. No release-branch merge has occurred. AI-assisted branch integration.

dependabot · 2026-10-08T21:37:47Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot and others added 8 commits September 28, 2026 22:59

deps: bump urllib3 to 2.8.0 and PyJWT to 2.15.1 (clears PYSEC-2026-41…

a3f4841

…75/4176/4177 and PYSEC-2026-4141)

tests: make the EU AI Act retention test relative to now

63e60d4

The test pinned 2026-04-01 as a recent capsule against a 180-day window, so it started failing on 2026-09-28 and has kept CI red since.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 5, 2026

dependabot Bot requested a review from MSKazemi as a code owner October 5, 2026 22:58

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 5, 2026

dependabot Bot and others added 17 commits October 5, 2026 22:59

Merge dependabot/uv/werkzeug-3.1.9

7fc6609

Merge dependabot/uv/mako-1.4.2

777a303

Merge dependabot/uv/multidict-6.9.1

33e148a

Merge dependabot/npm_and_yarn/web/proxy-addr-2.0.8

7ce9b38

Merge dependabot/npm_and_yarn/web/devalue-5.9.4

477a6c7

Merge dependabot/npm_and_yarn/web/brace-expansion-5.0.12

19584e9

Merge dependabot/npm_and_yarn/web/source-map-js-1.2.2

369edce

Merge dependabot/npm_and_yarn/web/sharp-0.35.5

475d61e

MSKazemi added 11 commits October 7, 2026 22:14

Merge dependabot/npm_and_yarn/web/compression-1.8.2

d79d1cc

Merge dependabot/npm_and_yarn/web/smol-toml-1.9.0

9fd43e3

Merge dependabot/npm_and_yarn/web/fast-uri-3.1.8

e54cc8d

Merge dependabot/npm_and_yarn/web/ip-address-10.7.2

4825d8a

Merge chore/bump-urllib3-pyjwt (lockfile only; test fix already on ma…

9c91efd

…in via 9faadff)

Merge dependabot/github_actions/actions-674967a53d

77921a5

Merge dependabot/npm_and_yarn/web/astrojs/react-7.0.0

21c2bb2

test(diff): strip ANSI before matching Rich error panels in test_diff…

90ba66c

…_environment The CI unit job failed three test_diff_environment cases because colour codes split the phrases the assertions search for. _flat() now removes SGR escapes first.

docs(changelog): reword one line the attribution pre-push scan misreads

8e0b99d

"produced by" next to a model-id field name matched the AI-attribution pattern; the line describes a file format, so say "emitted by".

docs(changelog): reword a second line the attribution scan misreads

e1f120f

MSKazemi mentioned this pull request Oct 7, 2026

deps: consolidate bot PRs and clear the audit gates #142

Closed

MSKazemi added 8 commits October 8, 2026 03:04

fix(sdk-ts): regenerate OpenAPI types

2fcc91c

fix(metadata-store): grant delete to app role

34dfa34

fix(metadata-store): migrate delete grants

8452db2

test(metadata-store): exercise delete under real RLS

3d17fa5

test(metadata-store): pin v005 delete grant migration

8423a5e

fix(sdk-ts): match generated cursor docs

547bb7c

Merge main into deps/consolidate-bot-prs-2026-10-07 (preserve v0.104.…

197a10e

…0 release and audit fixes)

Merge consolidated CI fixes into web dependency update PR #132

73801e1

dependabot Bot closed this Oct 8, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/packages/nova-dashboard/web-minor-patch-db0a39c2cf branch October 8, 2026 21:37

Navigation Menu

Repository navigation

build(deps): bump the web-minor-patch group across 3 directories with 11 updates - #132

build(deps): bump the web-minor-patch group across 3 directories with 11 updates#132
dependabot[bot] wants to merge 44 commits into
mainfrom
dependabot/npm_and_yarn/packages/nova-dashboard/web-minor-patch-db0a39c2cf

dependabot Bot commented on behalf of github Oct 5, 2026 •

edited

Loading

Uh oh!

MSKazemi commented Oct 8, 2026

Uh oh!

dependabot Bot commented on behalf of github Oct 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v10.7.9

10.7.9 (2026-09-25)

Bug Fixes

v9.8.1

What's Changed

New Contributors

v9.8.0

What's Changed

New Contributors

v8.3.2

Bug Fixes

Performance Improvements

Documentation

Miscellaneous Chores

Code Refactoring

Tests

v8.3.1

Bug Fixes

8.3.2 (2026-10-01)

Bug Fixes

Performance Improvements

Documentation

Miscellaneous Chores

Code Refactoring

Tests

8.3.1 (2026-09-24)

Bug Fixes

v5.0.3

🐞 Bug Fixes

View changes on GitHub

v5.0.2

🐞 Bug Fixes

v5.0.3

🐞 Bug Fixes

View changes on GitHub

v5.0.2

🐞 Bug Fixes

v5.0.3

🐞 Bug Fixes

Uh oh!

MSKazemi commented Oct 8, 2026

CI repair update — 2026-10-08

Uh oh!

dependabot Bot commented on behalf of github Oct 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Oct 5, 2026 •

edited

Loading