fix(deps): bump the production-deps group across 1 directory with 13 updates

[dependabot]

Bumps the production-deps group with 13 updates in the / directory:

Package	From	To
@aws-sdk/client-s3	3.1109.0	3.1141.0
@nestjs/throttler	6.5.0	6.7.1
@prisma/adapter-pg	7.9.1	7.10.0
@prisma/client	7.9.1	7.10.0
pdfkit	0.19.1	0.20.2
pg	8.22.0	8.23.0
prisma	7.9.1	7.10.0
lucide-react	1.31.0	1.48.0
react	19.2.8	19.3.0
react-dom	19.2.8	19.3.0
react-hook-form	7.85.0	7.88.0
sonner	2.0.7	2.0.8
tailwind-merge	3.6.0	3.7.0

Updates @aws-sdk/client-s3 from 3.1109.0 to 3.1141.0

Release notes

Sourced from @​aws-sdk/client-s3's releases.

v3.1141.0

3.1141.0(2026-09-25)

Chores

• codegen: smithy-aws-typescript-codegen 0.54.0 (#8314) (ad80ce3e)

New Features

• client-connect: Agent Privacy During Hold is a new privacy capability for Amazon Connect Voice that prevents agent audio from being captured in call recordings or Contact Lens conversational analytics during hold. When enabled, agents are automatically muted on entering hold and unmuted on resuming the contact (03527f9e)
• client-qconnect: Release shapes for the proactive agentic recommendations and the multi-knowledge base search features. Increases the maximum length of QuickResponseContent. (e008332b)
• client-bedrock-agent: Adds support for calling VPC configuration API's in Bedrock. These configurations allow the use of On Prem connectors in Bedrock Managed Knowledge bases (18524dc6)
• client-mediaconnect: This release adds support for RTMP push router outputs in AWS Elemental MediaConnect. (5bd8d80b)
• client-securityagent: This release adds the ListActorMessages operation, which returns the multi-factor authentication messages received at an actor's server-generated email address (10e53d50)
• client-arc-region-switch: Adds a service quota checker to Region switch to verify quota parity between your primary and standby Region, and automatically submit quota limit increases. Adds an optional EC2 Auto Scaling and ECS setting that waits for instances or tasks in the scaled-up Region to be healthy in target groups. (cca33e38)
• client-bedrock-agentcore-control: Amazon Bedrock AgentCore Payments now supports credential rotation for payment connectors, letting you rotate API and wallet secrets for Quick Create payment auths from the console. This release also adds Type and Creation type columns to the payment managers views. (adca591f)
• client-neptune-graph: Add GraphIdentifier filter for ListImportTasks (9b9aea9b)
• client-rekognition: This release adds support for Feedback and Metadata in the GetFaceLivenessSessionResults response. Feedback returns codes explaining why a Face Liveness check produced its result. Metadata includes the client SDK type. (0831c361)
• client-glue: add support for table level federation (a44458b7)
• client-wellarchitected: This change releases the Well-Architected Agent, a generative AI service that analyzes a customer's AWS environment and delivers personalized, prioritized recommendations across cost, security, performance, and resilience. (d0656586)

---

For list of updated packages, view updated-packages.md in assets-3.1141.0.zip

v3.1140.0

3.1140.0(2026-09-24)

Documentation Changes

• client-route53resolver: Documentation updates for Route 53 Resolver. Clarifies which Outpost Resolver operations apply to first-generation AWS Outposts and that Resolver is managed automatically on second-generation Outposts. Adds Local Network Interface subnet compatibility notes for Resolver endpoints. (b4432aba)
• client-iot: Fixed ListV2LoggingLevels and DeleteV2LoggingLevel documentation to include all supported target-types (4dcf76d5)

New Features

• clients: update client endpoints as of 2026-09-24 (29a8566c)
• client-eventbridgev2: Introducing Amazon EventBridge enhanced Custom event bus, a new shareable event bus for organizational-scale event-driven applications feature ordered delivery, deduplication, open event formats, and cross-account bus sharing. (69fbe6a2)
• client-datazone: Amazon DataZone now supports the TOOLING blueprint category on CreateEnvironmentBlueprint, UpdateEnvironmentBlueprint, GetEnvironmentBlueprint, and ListEnvironmentBlueprints, for custom tooling blueprints. CreateConnection now accepts roleArn in iamProperties. (591cd6f5)
• client-elasticache: Added tagging support for ElastiCache Global DataStore. (0fa9da59)
• client-marketplace-discovery: AWS Marketplace Discovery API now supports localized responses and SigV4a request signing. It returns new fulfillment details, including AMI architecture, EBS volume and security group information, SaaS quick-launch status, and SageMaker input and output MIME types. (510673e3)
• client-redshift-data: Updates to the ListDatabases and WorkgroupName validation (218c24e1)
• client-securityagent: Added support for Confluence export, enabling customers to publish security findings to Confluence pages. (81408527)
• client-cloudwatch: This release adds Create, Get, Update, and DeleteResourceMetricsConfiguration to enable detailed metric collection for an AWS resource, and adds UpdateOTelEnrichment plus include and exclude filters on StartOTelEnrichment so you can choose which metric namespaces CloudWatch enriches. (765cc1ce)
• client-eventbridge: Adds a ManagedBy field to the DescribeEventBus and ListEventBuses responses, identifying the AWS service that created an event bus on your behalf. (28a639b2)

Tests

• undici-http-handler: update bidi stream e2e test to nova-2-sonic model (#8313) (d9a37d9d)

... (truncated)

Changelog

Sourced from @​aws-sdk/client-s3's changelog.

3.1141.0 (2026-09-25)

Note: Version bump only for package @​aws-sdk/client-s3

3.1140.0 (2026-09-24)

Note: Version bump only for package @​aws-sdk/client-s3

3.1139.0 (2026-09-23)

Note: Version bump only for package @​aws-sdk/client-s3

3.1138.0 (2026-09-22)

Note: Version bump only for package @​aws-sdk/client-s3

3.1137.0 (2026-09-21)

Note: Version bump only for package @​aws-sdk/client-s3

3.1136.0 (2026-09-18)

Note: Version bump only for package @​aws-sdk/client-s3

3.1135.0 (2026-09-17)

... (truncated)

Commits

• 5bc8d9a Publish v3.1141.0
• 6050a38 Publish v3.1140.0
• 03d54a8 Publish v3.1139.0
• c68e50e Publish v3.1138.0
• 9a10476 chore(codegen): sync for MetricsRecorder support and core error/retry fixes (...
• 6b43247 Publish v3.1137.0
• d6b94db Publish v3.1136.0
• 2d5f18d Publish v3.1135.0
• 0d6310b Publish v3.1134.0
• 615a1ca Publish v3.1133.0
• Additional commits viewable in compare view

Updates @nestjs/throttler from 6.5.0 to 6.7.1

Release notes

Sourced from @​nestjs/throttler's releases.

v6.7.1

Patch Changes

• e8368b3: Set rate limit headers through res.setHeader() when the response has no res.header() method, so the guard no longer throws res.header is not a function on custom HTTP adapters. The logic lives in a new protected setResponseHeader() method that subclasses can override.
• a482ef9: Coerce numeric strings for limit, ttl and blockDuration to numbers, as returned for example by ConfigService.get<number>() for environment variables. Previously Date.now() + '60000' concatenated instead of adding, which silently corrupted every expiry and X-RateLimit-Reset. A value that is not numeric now fails with an error naming the option and the throttler.
• a9a28b9: Respect an explicit 0 for limit, ttl and blockDuration in @Throttle() and the module options instead of falling back to the default. blockDuration: 0 now means "no extra block": the in-memory storage rejects requests while the window is full and lets them through again as soon as the oldest hit expires, without recording the rejected ones.
• bf81677: Import shared interfaces from the public Nest package entry point for Nest 12 compatibility.
• caaabc9: Stop the in-memory storage from retaining request contexts. It used to schedule one setTimeout per counted hit, and each timer kept the request's AsyncLocalStorage stores (for example an ORM's per-request entity manager) in memory until the TTL expired. It now records when each hit expires and prunes expired hits on access. The idle-record sweep is also no longer tied to the context of the first request. With blockDuration: 0, Retry-After now reports when the oldest hit expires rather than when the window ends.
• 7703c10: Log a warning when no throttler is configured. The guard limits nothing in that case and previously said nothing at boot, so ThrottlerModule.forRoot() and ThrottlerModule.forRoot([]) looked like a working setup.

v6.7.0

Minor Changes

• 7004a97: Normalize IPv6 source addresses in the default tracker, and evict expired records from the in-memory storage.

  The built-in getTracker returned req.ip verbatim, so a client holding an IPv6 allocation could send every request from a different address within its own subnet and never share a counter, defeating the rate limit. Addresses are now masked to a /64 before being used as the tracker; the prefix length is configurable via the new ipv6SubnetPrefix module option. IPv4 addresses, IPv4-mapped addresses, the loopback, and custom getTracker implementations are unaffected.

  ThrottlerStorageService also never removed records, so a stream of requests from distinct trackers grew the internal map for the lifetime of the process. Idle records are now swept out once their window has fully elapsed. Limiting behaviour is unchanged: a record is only dropped after every pending hit has expired and any block has lapsed.

  Note that the tracker string for IPv6 clients changes shape (2001:db8:0:1::/64), so storage keys rotate once on upgrade.

v6.6.0

Minor Changes

• c342bad: Declare the supported Node versions in engines, matching the range the CI matrix tests
• c625e98: Update to allow for support for Nest version 12

Changelog

Sourced from @​nestjs/throttler's changelog.

6.7.1

Patch Changes

• e8368b3: Set rate limit headers through res.setHeader() when the response has no res.header() method, so the guard no longer throws res.header is not a function on custom HTTP adapters. The logic lives in a new protected setResponseHeader() method that subclasses can override.
• a482ef9: Coerce numeric strings for limit, ttl and blockDuration to numbers, as returned for example by ConfigService.get<number>() for environment variables. Previously Date.now() + '60000' concatenated instead of adding, which silently corrupted every expiry and X-RateLimit-Reset. A value that is not numeric now fails with an error naming the option and the throttler.
• a9a28b9: Respect an explicit 0 for limit, ttl and blockDuration in @Throttle() and the module options instead of falling back to the default. blockDuration: 0 now means "no extra block": the in-memory storage rejects requests while the window is full and lets them through again as soon as the oldest hit expires, without recording the rejected ones.
• bf81677: Import shared interfaces from the public Nest package entry point for Nest 12 compatibility.
• caaabc9: Stop the in-memory storage from retaining request contexts. It used to schedule one setTimeout per counted hit, and each timer kept the request's AsyncLocalStorage stores (for example an ORM's per-request entity manager) in memory until the TTL expired. It now records when each hit expires and prunes expired hits on access. The idle-record sweep is also no longer tied to the context of the first request. With blockDuration: 0, Retry-After now reports when the oldest hit expires rather than when the window ends.
• 7703c10: Log a warning when no throttler is configured. The guard limits nothing in that case and previously said nothing at boot, so ThrottlerModule.forRoot() and ThrottlerModule.forRoot([]) looked like a working setup.

6.7.0

Minor Changes

• 7004a97: Normalize IPv6 source addresses in the default tracker, and evict expired records from the in-memory storage.

  The built-in getTracker returned req.ip verbatim, so a client holding an IPv6 allocation could send every request from a different address within its own subnet and never share a counter, defeating the rate limit. Addresses are now masked to a /64 before being used as the tracker; the prefix length is configurable via the new ipv6SubnetPrefix module option. IPv4 addresses, IPv4-mapped addresses, the loopback, and custom getTracker implementations are unaffected.

  ThrottlerStorageService also never removed records, so a stream of requests from distinct trackers grew the internal map for the lifetime of the process. Idle records are now swept out once their window has fully elapsed. Limiting behaviour is unchanged: a record is only dropped after every pending hit has expired and any block has lapsed.

  Note that the tracker string for IPv6 clients changes shape (2001:db8:0:1::/64), so storage keys rotate once on upgrade.

6.6.0

Minor Changes

• c342bad: Declare the supported Node versions in engines, matching the range the CI matrix tests
• c625e98: Update to allow for support for Nest version 12

6.4.0

6.5.1

Patch Changes

• 603cb82: handles edge case where multiple clients making frequent requests interfere with each other

Commits

• 91f4912 Merge pull request #2706 from nestjs/changeset-release/master
• c5e8c90 chore: version packages
• 9ec3aa3 Merge pull request #2668 from nestjs/renovate/major-nest-monorepo
• 5d3b9ae Merge pull request #2712 from nestjs/fix/coerce-numeric-options
• 4335230 Merge pull request #2711 from nestjs/fix/timer-free-storage
• a482ef9 fix(guard): coerce numeric string options
• e082222 chore(deps): update nest monorepo to v12
• caaabc9 fix(storage): do not retain request contexts in timers
• 4ab8c63 Merge pull request #2697 from nestjs/renovate/node-24.x
• c36f011 Merge pull request #2703 from nestjs/renovate/nest-graphql-monorepo
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​nestjs/throttler since your current version.

Updates @prisma/adapter-pg from 7.9.1 to 7.10.0

Release notes

Sourced from @​prisma/adapter-pg's releases.

7.10.0

Prisma ORM 7.10.0

Prisma ORM 7.10.0 introduces a compatibility package for running Prisma 7 alongside newer Prisma versions, secures Prisma Studio's local server, and includes fixes across Prisma Client and the PostgreSQL, MariaDB, Neon, SQLite, and Prisma Postgres Serverless adapters.

Highlights

Run Prisma 7 alongside Prisma 8

This release introduces @prisma/prisma7, a compatibility package that lets you retain a matching Prisma 7 CLI and configuration while installing Prisma 8 in the same project.

Once 7.10.0 is released, a side-by-side installation can use:

npm install --save-dev prisma@8 @prisma/prisma7@7.10.0
npm install @prisma/client@7.10.0

Use prisma for the directly installed Prisma 8 CLI and prisma7 for Prisma 7:

npx prisma --version
npx prisma7 --version
npx prisma7 generate
npx prisma7 migrate dev
npx prisma7 db push

Prisma 7 now prefers version-specific configuration files, allowing its configuration to coexist with Prisma 8's prisma.config.* files:

// prisma7.config.ts
import { defineConfig } from '@prisma/prisma7/config'
export default defineConfig({
schema: 'prisma/schema.prisma',
migrations: {
path: 'prisma/migrations',
},
})

Without an explicit --config option, Prisma 7 searches for:

1. Root-level prisma7.config.* files.
2. .config/prisma7.* files.
3. Existing prisma.config.* files as a backwards-compatible fallback.

The supported extensions are .js, .ts, .mjs, .cjs, .mts, and .cts. An explicit config path always takes precedence:

... (truncated)

Commits

• 3fa65ac fix(p2002): correct modelName in nested create unique constraint errors #2959...
• a180209 fix(adapter-pg): map PostgreSQL deadlocks to P2034 (#29717)
• 800f1d1 fix(adapter-pg): preserve constraint name for unique violations (23505) (#29587)
• 7ef2104 fix(postgres): handle SQLSTATE 23001 for RESTRICT violations (#29554)
• See full diff in compare view

Updates @prisma/client from 7.9.1 to 7.10.0

Release notes

Sourced from @​prisma/client's releases.

7.10.0

Prisma ORM 7.10.0

Prisma ORM 7.10.0 introduces a compatibility package for running Prisma 7 alongside newer Prisma versions, secures Prisma Studio's local server, and includes fixes across Prisma Client and the PostgreSQL, MariaDB, Neon, SQLite, and Prisma Postgres Serverless adapters.

Highlights

Run Prisma 7 alongside Prisma 8

This release introduces @prisma/prisma7, a compatibility package that lets you retain a matching Prisma 7 CLI and configuration while installing Prisma 8 in the same project.

Once 7.10.0 is released, a side-by-side installation can use:

npm install --save-dev prisma@8 @prisma/prisma7@7.10.0
npm install @prisma/client@7.10.0

Use prisma for the directly installed Prisma 8 CLI and prisma7 for Prisma 7:

npx prisma --version
npx prisma7 --version
npx prisma7 generate
npx prisma7 migrate dev
npx prisma7 db push

Prisma 7 now prefers version-specific configuration files, allowing its configuration to coexist with Prisma 8's prisma.config.* files:

// prisma7.config.ts
import { defineConfig } from '@prisma/prisma7/config'
export default defineConfig({
schema: 'prisma/schema.prisma',
migrations: {
path: 'prisma/migrations',
},
})

Without an explicit --config option, Prisma 7 searches for:

1. Root-level prisma7.config.* files.
2. .config/prisma7.* files.
3. Existing prisma.config.* files as a backwards-compatible fallback.

The supported extensions are .js, .ts, .mjs, .cjs, .mts, and .cts. An explicit config path always takes precedence:

... (truncated)

Commits

• 05c1b88 Teach Prisma 7 to prefer versioned config files (#30020)
• cf2bc1f Rename prisma7 package to @​prisma/prisma7 (#30002)
• ce5a34c Complete downstream actionable Prisma 7 guidance propagation (#29994)
• 3f13ec6 Complete CLI-owned prisma7 distribution identity (#29969)
• 179ba0c feat(prisma7): add side-by-side CLI wrapper (#29949)
• 3fa65ac fix(p2002): correct modelName in nested create unique constraint errors #2959...
• 6b6d9e9 chore(deps): update engines to 7.10.0-4.0edf323efd1d98336f3f0a68684b56f689b90...
• b64e33c chore(deps): update engines to 7.10.0-3.9d90ce2c89d5c95a1148aef15e5561ab6c490...
• 2046f9b feat(client): expose ModelName to compute function in Result extensions (#29782)
• f2b3abd chore(deps): update engines to 7.10.0-1.6d040c802892de6d56c7e0061b7a10b3e6a0c...
• Additional commits viewable in compare view

Updates pdfkit from 0.19.1 to 0.20.2

Release notes

Sourced from pdfkit's releases.

v0.20.2

• Fix bundlers and file tracers packing the ESM copies of the standard font metrics instead of the CommonJS ones the Node build actually loads, which left Cannot find module errors for every standard font at runtime, by resolving the internal #standard-fonts/* mapping to a single file under all conditions
• Fix doc.file() throwing when the same in-memory attachment is embedded twice under one name, because the creation and modified dates the deduplication check compares are absent for sources that are not read from disk
• Fix doc.text() throwing unsupported number: NaN when lineBreak: false is combined with underline, strike, link or goTo, because the rendered width was computed from the line wrapper's measurements, which are never produced when wrapping is disabled

v0.20.1

• Add a Node ESM build so import 'pdfkit' in Node resolves to the Node build (real file system, native zlib, Node streams, self-registering standard fonts) instead of the browser bundle

v0.20.0

Highlights

TLDR: "A PDF generation library for Node.js" -> "A JavaScript PDF generation library"

Standard Font Support rewritten

Standard font support has been rewritten to use pre-parsed font metrics instead of parsing raw AFM definitions at runtime. The new approach is more efficient (less runtime overhead and memory usage) and reduces the size of the browser bundle significantly. Standalone build which bundles all standard fonts is down to 1.3MB from 2.3MB.

In Node, font metrics are loaded lazily as before, while in browser builds, except the standalone one, each font must be imported from pdfkit/standard-fonts/* and registered with registerStdFonts(). Previously, to use a standard font in browser was necessary to use a bundler.

See usage example in output helpers section below.

Removal of Node specific dependencies

Buffer is no longer used internally. Uint8Array is now the minimum denominator for binary data in both Node and browsers. Since Buffer is a Uint8Array subclass, this change is fully backward compatible.

Native fs, zlib and ReadableStream are conditionally imported only in Node. Browser builds use minimal implementations. This approach gives us the best of both worlds: Node builds still use the native modules, while browser ones are portable.

Many thanks to @​diegomura for his help in removing the Node specific dependencies.

registerFile API

The new registerFile(path, data) API allows registering in-memory files globally. The data argument must be a Uint8Array. Passing undefined as data unregisters the path.

In browsers, it can be used as a simplified virtual file system. In Node, this is useful for registering fonts, images and other resources that are not available on disk. The native file system is still used when the path is not registered.

import { PDFDocument, registerFile } from 'pdfkit';
const response = await fetch('/fonts/Roboto-Regular.ttf');
const fontData = new Uint8Array(await response.arrayBuffer());
registerFile('fonts/Roboto-Regular.ttf', fontData);
const doc = new PDFDocument();
// register an alias for the font path
doc.registerFont('Roboto', 'fonts/Roboto-Regular.ttf');
// or use the path directly
doc.font('fonts/Roboto-Regular.ttf');
</tr></table>

... (truncated)

Changelog

Sourced from pdfkit's changelog.

[v0.20.2] - 2026-08-29

• Fix bundlers and file tracers packing the ESM copies of the standard font metrics instead of the CommonJS ones the Node build actually loads, which left Cannot find module errors for every standard font at runtime, by resolving the internal #standard-fonts/* mapping to a single file under all conditions
• Fix doc.file() throwing when the same in-memory attachment is embedded twice under one name, because the creation and modified dates the deduplication check compares are absent for sources that are not read from disk
• Fix doc.text() throwing unsupported number: NaN when lineBreak: false is combined with underline, strike, link or goTo, because the rendered width was computed from the line wrapper's measurements, which are never produced when wrapping is disabled

[v0.20.1] - 2026-08-23

• Add a Node ESM build so import 'pdfkit' in Node resolves to the Node build (real file system, native zlib, Node streams, self-registering standard fonts) instead of the browser bundle

[v0.20.0] - 2026-08-23

• [BREAKING CHANGE] Remove the virtual file system (pdfkit/virtual-fs). Browser builds no longer depend on fs: use registerFile to register Uint8Array data under a path, pass a Uint8Array or ArrayBuffer directly to registerFont, image and file, or pass a data URL directly to image and file
• Add registerFile(path, data, options) to globally register in-memory files in Node and browsers, with optional birthtime and ctime metadata. Passing undefined as data unregisters the path
• [BREAKING CHANGE] Export PDFDocument, LineWrapper and registerFile as named exports from the main Node and browser entry points while preserving the default PDFDocument export
• Add experimental toBlob(document) and toBytes(document) output helpers under pdfkit/output
• Accept already-parsed fontkit Font instances in doc.font() and registerFont
• Load the PDF/A ICC profile from disk only when needed in Node, while continuing to bundle it in browser builds
• Add tools to convert raw AFM standard-font definitions into parsed or compact runtime JavaScript modules
• [BREAKING CHANGE] Use generated standard-font data instead of parsing raw AFM definitions at runtime. Node loads font metrics lazily; browser applications must import each font they use from pdfkit/standard-fonts/* and register it with registerStdFonts()
• [BREAKING CHANGE] Restrict AcroForm options to documented mappings and explicit escape hatches.
• [BREAKING CHANGE] Stop automatically uppercasing annotation option keys.
• [BREAKING CHANGE] Throw from addNamedEmbeddedFile when no ref is given, instead of writing an unparseable undefined token into the /EmbeddedFiles name tree
• Do not mutate options passed to doc.annotate() and its convenience methods (link, note, strike, lineAnnotation, rectAnnotation, ellipseAnnotation, textAnnotation, fileAnnotation)
• Persist font options when adding a new page. Fixes #1739
• Use Uint8Array instead of Node's Buffer internally
• Fix date text field formatting emitting invalid JavaScript, so the format was never applied. Fixes #1546
• Fix indentAllLines applying the indent again on every paragraph and every page break, and keep it applied across continued text. Fixes #1606
• Fix a hole in a sparse array being skipped entirely, which shifted every later entry down one
• Encrypt strings inside name trees. Fixes #1513

Commits

• 8d72a71 v0.20.2
• 70c9ad5 Document the parameter list each destination type takes (#1785)
• e04b677 Fix doc.text() throwing NaN with lineBreak false and underline/strike/link/go...
• c6f57c6 fix: resolve #standard-fonts/* to one file under every condition (#1782)
• b87b5ac Fix case-insensitive lookup for named CSS colors (#1780)
• 69671d9 Fix doc.file() throwing when the same in-memory attachment is added twice (#1...
• 1f1abb8 Bump ip-address from 10.2.0 to 10.4.0 (#1761)
• f58c4c7 Bump postcss from 8.5.15 to 8.5.25 (#1762)
• f048bdd v0.20.1
• 910c86a Add Node ESM build: route the node import condition to a real Node bundle (#1...
• Additional commits viewable in compare view

Updates pg from 8.22.0 to 8.23.0

Changelog

Sourced from pg's changelog.

pg@8.23.0

• Add support for query pipelineing.

Commits

• df274d1 Publish
• eb19d0f Add opt-in query pipelining (#3652)
• See full diff in compare view

Updates prisma from 7.9.1 to 7.10.0

Commits

• See full diff in compare view

Attestation changes

This version has no provenance attestation, while the previous version (7.9.1) was attested. Review the package versions before updating.

Updates lucide-react from 1.31.0 to 1.48.0

Release notes

Sourced from lucide-react's releases.

Version 1.48.0

What's Changed

• feat(icons): added briefcase-plus icon by @​tylerkade in lucide-icons/lucide#4757
• feat(icons): added square-sparkles icon by @​nananecy in lucide-icons/lucide#3610
• feat(icons): added line-dot-left-horizontal icon by @​nathan-de-pachtere in lucide-icons/lucide#3855
• fix(packages/svelte,solid): fix shared type imports in Solid and Svelte by @​karsa-mistmere in lucide-icons/lucide#4846
• chore(deps-dev): bump react-native from 0.76.9 to 0.87.1 in the react-native-deps group across 1 directory by @​dependabot[bot] in lucide-icons/lucide#4673
• feat(packages): export __iconNode data across framework packages by @​lx3133584 in lucide-icons/lucide#4761
• fix(icons): Tweak card-sim chip by @​danielbayley in lucide-icons/lucide#3649
• feat(icons): added line-dot-top-vertical icon by @​nathan-de-pachtere in lucide-icons/lucide#3856
• feat(icons): added line-dot-bottom-vertical icon by @​nathan-de-pachtere in lucide-icons/lucide#3857
• fix(packages/react-native): pass testID to the rendered Svg element by @​OlegBezr in lucide-icons/lucide#4881
• chore(@​lucide/vue): Fix types @lucide/vue package and added workflow for it. by @​ericfennis in lucide-icons/lucide#4883
• test(packages/shared): cover buildLucideIconForReact by @​vugarbbakhishov-hub in lucide-icons/lucide#4872
• feat(site): Better icon detail page and add unreleased flag by @​ericfennis in lucide-icons/lucide#4877
• fix(icons): changed map-pinned icon by @​jguddas in lucide-icons/lucide#4880
• fix(icons): changed mail-pen by @​karsa-mistmere in lucide-icons/lucide#4899
• chore(deps-dev): bump the angular-deps group across 1 directory with 14 updates by @​dependabot[bot] in lucide-icons/lucide#4895
• chore(deps): bump the vue-deps group with 3 updates by @​dependabot[bot] in lucide-icons/lucide#4893
• chore(typchecking): More typecheck jobs for all packages by @​ericfennis in lucide-icons/lucide#4885
• feat(icons): add house-cog icon by @​ajaxjiang96 in lucide-icons/lucide#4904

New Contributors

• @​nananecy made their first contribution in lucide-icons/lucide#3610
• @​OlegBezr made their first contribution in lucide-icons/lucide#4881
• @​vugarbbakhishov-hub made their first contribution in lucide-icons/lucide#4872
• @​ajaxjiang96 made their first contribution in lucide-icons/lucide#4904

Full Changelog: lucide-icons/lucide@1.47.0...1.48.0

Version 1.47.0

What's Changed

• feat(icons): add lambda icon by @​UbaidUllah9962 in lucide-icons/lucide#4017
• feat(icons): delegated faucet icon from lab by @​karsa-mistmere in lucide-icons/lucide#4764
• feat(icons): added door-closed-package icon by @​karsa-mistmere in lucide-icons/lucide#4814
• feat(icons): added 'nepali-rupee' icon by @​sarajdhakal in lucide-icons/lucide#4608
• feat(icons): added tube-lotion icon by @​AlecRust in lucide-icons/lucide#4029
• feat(icons): Added cupcake icon by @​briz123 in lucide-icons/lucide#3000
• feat(icons): added square-dashed-x icon by @​EthanHazel in lucide-icons/lucide#4535
• feat(icons): add rotate-cw-clock icon by @​gkkconan in lucide-icons/lucide#3979
• fix(icons): remove path from save-off by @​HPRILLER in lucide-icons/lucide#4848
• fix(icons): changed calendar-chevrons-right by @​karsa-mistmere in lucide-icons/lucide#4865
• fix(icons): changed broccoli icon by @​jguddas in lucide-icons/lucide#4871
• feat(icons): added square-dashed-plus by @​psjdev in lucide-icons/lucide#4849

New Contributors

• @​UbaidUllah9962 made their first contribution in lucide-icons/lucide#4017
• @​sarajdhakal made their first contribution in lucide-icons/lucide#4608
• @​AlecRust made their first contribution in lucide-icons/lucide#4029
• @​gkkconan made their first contribution in lucide-icons/lucide#3979

... (truncated)

Commits

• f06ac67 chore(typchecking): More typecheck jobs for all packages (#4885)
• 94e4cb9 chore(dependencies): Update dependencies (#4806)
• 99d25bd feat(packages): extract icon build logic into @lucide/shared (#4409)
• 75b5516 chore(dev): upgrade ESLint to latest compatible stack (v10) (#4378)
• See full diff in compare view

Updates react from 19.2.8 to 19.3.0

Release notes

Sourced from react's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)
• Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@​jackpope, @​sebmarkbage, @​eps1lon, @​Dhakshin2007, @​chirokas, @​teamleaderleo, @​fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630,

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.