build: bump the dependencies group across 1 directory with 8 updates

[dependabot]

Bumps the dependencies group with 8 updates in the / directory:

Package	From	To
@dicebear/styles	10.4.0	10.5.0
@posthog/types	1.403.0	1.404.1
astro-i18n-aut	0.7.3	0.8.0
posthog-js	1.416.0	1.417.1
remeda	2.39.0	2.40.0
astro	7.2.1	7.2.2
nanostores	1.4.2	1.5.0
sanitize-html	2.17.6	2.17.7

Updates @dicebear/styles from 10.4.0 to 10.5.0

Changelog

Sourced from @​dicebear/styles's changelog.

[10.5.0] - 2026-08-16

[10.5.0-rc.1] - 2026-08-15

Added

• New style: Cutouts. Faces assembled from torn craft paper. The two eyes never match on purpose, six head silhouettes place their own hair, brows and features, and every scrap casts the same soft drop shadow. The accent palettes are curated darker than every face color, so mouths and noses stay readable on any head. Hand-authored, CC0 1.0.
• New style: Line Face. A calm face drawn with a few brush strokes directly on the background, in the spirit of one-line portraits. Eight eye pairs, six noses and eight mouths, each a single clean stroke, and the mouth settles into one of three tilts per seed. Hand-authored, CC0 1.0.
• New style: Patchwork. A quilt laid from traditional blocks such as pinwheel, flying geese, rail fence and clamshells. Each avatar picks two of the 18 blocks and repeats them as diagonal twins rotated by 180 degrees, so every quilt comes out point-symmetric. All shapes share one grid, which lets neighbouring blocks meet flush at the seams. Hand-authored, CC0 1.0.

Changed

• Nine styles now expose the dark color they draw with. Adventurer, Adventurer Neutral, Croodles, Croodles Neutral, Lorelei, Notionists, Notionists Neutral, Open Peeps and Toon Head painted that color into the artwork, where no render option could reach it. Each style names the new group after the job the color does there:

  • ink carries the whole drawing, outlines and filled masses alike. Seven styles use it: Adventurer, Adventurer Neutral, Croodles, Croodles Neutral, Notionists, Notionists Neutral and Open Peeps.
  • outline is only the head and ear contour, which is why Lorelei uses that name. Every feature there already had a group of its own.
  • stroke is a real SVG stroke rather than a filled path. Toon Head is the only style drawn that way.

  Five of the nine gained more than that one group. Adventurer and Adventurer Neutral split the face into eyes, sclera, lips, teeth, tongue, throat, uvula and glasses, and Adventurer adds earrings on top. Croodles gained facialHair for the beard and moustache. Notionists had no color groups at all before and now carries ink and paper, where the paper is the body the ink sits on rather than the canvas behind the figure. Notionists Neutral gains the same two next to the background it already had.

  Existing avatars keep their look. Every group defaults to the value the artwork already used, no palette changed, and no variant, probability or seed behaves differently. The SVG is not byte-identical to the previous release, because a literal black now resolves to [#000000](https://github.com/dicebear/styles/issues/000000) and separating the groups

... (truncated)

Commits

• ce7a25b v10.5.0
• 7119ac9 ci: report definitions the svgo pass would still shrink
• 6f9791b chore: raise the definition schema to 1.4.0
• f9da34e docs: fix and restructure the color group changelog entry
• 7b26357 v10.5.0-rc.1
• 5726af3 refactor: fold the Croodles linework into one ink group
• 7065a2b feat: expose the linework color of nine styles
• f6a8dfb feat: add the line-face, cutouts and patchwork styles
• See full diff in compare view

Updates @posthog/types from 1.403.0 to 1.404.1

Release notes

Sourced from @​posthog/types's releases.

@​posthog/types@​1.404.1

1.404.1

Patch Changes

• #4503 eb05237 Thanks @​pauldambra! - fix(dead-clicks): treat visibility and focus changes as liveness signals, not dead-click evidence

  The dead-click detector treated a visibilitychange as evidence a click was dead: it measured Math.abs(clickTimestamp - lastVisibilityChange) and, once that exceeded the threshold, timed the click out as dead. Because it only recorded the tab becoming visible, any click in a session where the tab had ever been backgrounded (median gap ~1 minute) was flagged.

  A visibility or focus change near a click is the opposite — a sign the click did something (it woke/focused the tab, opened a new tab, or opened a new window/popup) — so these signals now only ever suppress a dead click, never cause one:

  • Visibility changes are recorded in both directions (a click that opens a new tab sends the current tab to hidden), and a window focus/blur observer is added, since a click that opens a new window/popup may leave the tab visible and only surface as the current window losing focus.
  • A click within a wake-up/interaction window (1s, wide enough for a real "tab back, then click" gesture) of any such change is suppressed.
  • The visibility signal no longer feeds the dead-marking path at all. $dead_click_visibility_changed_timeout stays in the payload (always false) for shape compatibility, and a new $dead_click_focus_changed_delay_ms is emitted for observability.
  • Visibility/focus changes are now recorded onto each queued candidate the instant they fire (like scroll), instead of being read from a single shared timestamp when the click is checked ~1s later. A click that hides or blurs the tab (opening a new tab/window) suspends that check while the tab is backgrounded; by the time it resumes the tab has usually returned, and the shared timestamp would have been overwritten by that later transition — losing the click-correlated one and wrongly flagging the click dead. Stamping the candidate as the event fires makes delayed hide→show and blur→focus sequences suppress correctly. (2026-08-14)

@​posthog/types@​1.404.0

1.404.0

Minor Changes

• #4485 8bc63c3 Thanks @​dustinbyrne! - Default external dependency loading to versioned asset paths with automatic fallback to legacy paths, and add a strict_script_versioning: 'fallback' mode. (2026-08-13)

@​posthog/types@​1.403.1

1.403.1

Patch Changes

• #4443 b2c6830 Thanks @​arnohillen! - Harden the session replay stylesheet inlining budget (inlineStylesheetBudgetRules):
  • The default budget (10,000 rules) moves from the recorder chunk into posthog-js session recording options, so npm-pinned or cached bundles keep their configured override (including 0 to disable) and direct rrweb.record() consumers keep unbounded inlining unless they opt in.
  • Deferred inlining is bounded inside a sheet: a resumable cursor stringifies 200 rules per idle slice and emits a sheet's _cssText atomically, so monolithic sheets no longer produce one long task and partial CSS never reaches the wire.
  • Deferred sheets are flushed synchronously when recording stops and on pagehide; residual failure modes are counted via $sdk_debug_replay_deferred_stylesheets_failed / _abandoned.
  • CSSOM-only styles (insertRule output, adoptedStyleSheets) no longer charge the budget, since deferring <link> sheets buys those pages nothing.
  • Telemetry fixes: full-snapshot duration wraps the whole synchronous task, deferred counts are cumulative per session, new gauges cover non-deferrable rules and idle stringification cost, and duration samples straddling tab suspension are discarded ($sdk_debug_replay_discarded_duration_samples). (2026-08-13)

Changelog

Sourced from @​posthog/types's changelog.

1.404.1

Patch Changes

• #4503 eb05237 Thanks @​pauldambra! - fix(dead-clicks): treat visibility and focus changes as liveness signals, not dead-click evidence

  The dead-click detector treated a visibilitychange as evidence a click was dead: it measured Math.abs(clickTimestamp - lastVisibilityChange) and, once that exceeded the threshold, timed the click out as dead. Because it only recorded the tab becoming visible, any click in a session where the tab had ever been backgrounded (median gap ~1 minute) was flagged.

  A visibility or focus change near a click is the opposite — a sign the click did something (it woke/focused the tab, opened a new tab, or opened a new window/popup) — so these signals now only ever suppress a dead click, never cause one:

  • Visibility changes are recorded in both directions (a click that opens a new tab sends the current tab to hidden), and a window focus/blur observer is added, since a click that opens a new window/popup may leave the tab visible and only surface as the current window losing focus.
  • A click within a wake-up/interaction window (1s, wide enough for a real "tab back, then click" gesture) of any such change is suppressed.
  • The visibility signal no longer feeds the dead-marking path at all. $dead_click_visibility_changed_timeout stays in the payload (always false) for shape compatibility, and a new $dead_click_focus_changed_delay_ms is emitted for observability.
  • Visibility/focus changes are now recorded onto each queued candidate the instant they fire (like scroll), instead of being read from a single shared timestamp when the click is checked ~1s later. A click that hides or blurs the tab (opening a new tab/window) suspends that check while the tab is backgrounded; by the time it resumes the tab has usually returned, and the shared timestamp would have been overwritten by that later transition — losing the click-correlated one and wrongly flagging the click dead. Stamping the candidate as the event fires makes delayed hide→show and blur→focus sequences suppress correctly. (2026-08-14)

1.404.0

Minor Changes

• #4485 8bc63c3 Thanks @​dustinbyrne! - Default external dependency loading to versioned asset paths with automatic fallback to legacy paths, and add a strict_script_versioning: 'fallback' mode. (2026-08-13)

1.403.1

Patch Changes

• #4443 b2c6830 Thanks @​arnohillen! - Harden the session replay stylesheet inlining budget (inlineStylesheetBudgetRules):
  • The default budget (10,000 rules) moves from the recorder chunk into posthog-js session recording options, so npm-pinned or cached bundles keep their configured override (including 0 to disable) and direct rrweb.record() consumers keep unbounded inlining unless they opt in.
  • Deferred inlining is bounded inside a sheet: a resumable cursor stringifies 200 rules per idle slice and emits a sheet's _cssText atomically, so monolithic sheets no longer produce one long task and partial CSS never reaches the wire.
  • Deferred sheets are flushed synchronously when recording stops and on pagehide; residual failure modes are counted via $sdk_debug_replay_deferred_stylesheets_failed / _abandoned.
  • CSSOM-only styles (insertRule output, adoptedStyleSheets) no longer charge the budget, since deferring <link> sheets buys those pages nothing.
  • Telemetry fixes: full-snapshot duration wraps the whole synchronous task, deferred counts are cumulative per session, new gauges cover non-deferrable rules and idle stringification cost, and duration samples straddling tab suspension are discarded ($sdk_debug_replay_discarded_duration_samples). (2026-08-13)

Commits

• 6872a1c chore: update versions and lockfile [version bump]
• 0a0206f fix: normalize SDK timestamps to UTC (#4521)
• eb05237 fix(dead-clicks): treat visibility and focus changes as liveness signals, not...
• 9b41d8a chore: update versions and lockfile [version bump]
• 8bc63c3 feat(browser): default script versioning to fallback (#4485)
• 5c5d26c chore: update versions and lockfile [version bump]
• b2c6830 fix(replay): close the stylesheet budget review findings shipped in #4320 (#4...
• See full diff in compare view

Updates astro-i18n-aut from 0.7.3 to 0.8.0

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for astro-i18n-aut since your current version.

Updates posthog-js from 1.416.0 to 1.417.1

Release notes

Sourced from posthog-js's releases.

posthog-js@1.417.1

1.417.1

Patch Changes

• #4521 0a0206f Thanks @​marandaneto! - Normalize capture timestamp overrides to equivalent UTC ISO strings in the browser and Node.js SDKs and shared core. (2026-08-14)

• #4523 6230b5b Thanks @​marandaneto! - Prevent swallowed rrweb observer initialization errors from breaking session replay teardown and subsequent recorder restarts. (2026-08-14)

• #4503 eb05237 Thanks @​pauldambra! - fix(dead-clicks): treat visibility and focus changes as liveness signals, not dead-click evidence

  The dead-click detector treated a visibilitychange as evidence a click was dead: it measured Math.abs(clickTimestamp - lastVisibilityChange) and, once that exceeded the threshold, timed the click out as dead. Because it only recorded the tab becoming visible, any click in a session where the tab had ever been backgrounded (median gap ~1 minute) was flagged.

  A visibility or focus change near a click is the opposite — a sign the click did something (it woke/focused the tab, opened a new tab, or opened a new window/popup) — so these signals now only ever suppress a dead click, never cause one:

  • Visibility changes are recorded in both directions (a click that opens a new tab sends the current tab to hidden), and a window focus/blur observer is added, since a click that opens a new window/popup may leave the tab visible and only surface as the current window losing focus.
  • A click within a wake-up/interaction window (1s, wide enough for a real "tab back, then click" gesture) of any such change is suppressed.
  • The visibility signal no longer feeds the dead-marking path at all. $dead_click_visibility_changed_timeout stays in the payload (always false) for shape compatibility, and a new $dead_click_focus_changed_delay_ms is emitted for observability.
  • Visibility/focus changes are now recorded onto each queued candidate the instant they fire (like scroll), instead of being read from a single shared timestamp when the click is checked ~1s later. A click that hides or blurs the tab (opening a new tab/window) suspends that check while the tab is backgrounded; by the time it resumes the tab has usually returned, and the shared timestamp would have been overwritten by that later transition — losing the click-correlated one and wrongly flagging the click dead. Stamping the candidate as the event fires makes delayed hide→show and blur→focus sequences suppress correctly. (2026-08-14)

• Updated dependencies [0a0206f, eb05237]:

  • @​posthog/core@​1.48.1
  • @​posthog/types@​1.404.1

posthog-js@1.417.0

1.417.0

Minor Changes

• #4485 8bc63c3 Thanks @​dustinbyrne! - Default external dependency loading to versioned asset paths with automatic fallback to legacy paths, and add a strict_script_versioning: 'fallback' mode. (2026-08-13)

Patch Changes

• Updated dependencies [8bc63c3]:
  • @​posthog/types@​1.404.0

posthog-js@1.416.1

1.416.1

Patch Changes

• #4443 b2c6830 Thanks @​arnohillen! - Harden the session replay stylesheet inlining budget (inlineStylesheetBudgetRules):
  • The default budget (10,000 rules) moves from the recorder chunk into posthog-js session recording options, so npm-pinned or cached bundles keep their configured override (including 0 to disable) and direct rrweb.record() consumers keep unbounded inlining unless they opt in.
  • Deferred inlining is bounded inside a sheet: a resumable cursor stringifies 200 rules per idle slice and emits a sheet's _cssText atomically, so monolithic sheets no longer produce one long task and partial CSS never reaches the wire.
  • Deferred sheets are flushed synchronously when recording stops and on pagehide; residual failure modes are counted via $sdk_debug_replay_deferred_stylesheets_failed / _abandoned.
  • CSSOM-only styles (insertRule output, adoptedStyleSheets) no longer charge the budget, since deferring <link> sheets buys those pages nothing.
  • Telemetry fixes: full-snapshot duration wraps the whole synchronous task, deferred counts are cumulative per session, new gauges cover non-deferrable rules and idle stringification cost, and duration samples straddling tab suspension are discarded ($sdk_debug_replay_discarded_duration_samples). (2026-08-13)

... (truncated)

Commits

• 6872a1c chore: update versions and lockfile [version bump]
• aba7d55 fix: perf(react-native): useFeatureFlags / useFeatureFlag re-read the full fl...
• 0a0206f fix: normalize SDK timestamps to UTC (#4521)
• eb05237 fix(dead-clicks): treat visibility and focus changes as liveness signals, not...
• 6230b5b fix(replay): recover from observer initialization failures (#4523)
• a4a25fe ci: upgrade React Native plugin in PostHog after releases (#4518)
• e4d64b6 ci: Remove auto-merge from PostHog upgrade workflow (#4519)
• 65c4809 chore: update versions and lockfile [version bump]
• 1030636 fix(rollup): inject chunk ids in-memory in renderChunk for SRI compatibility ...
• 9b41d8a chore: update versions and lockfile [version bump]
• Additional commits viewable in compare view

Updates remeda from 2.39.0 to 2.40.0

Release notes

Sourced from remeda's releases.

v2.40.0

2.40.0 (2026-08-14)

Bug Fixes

• deps: bump versions + manual fixes (#1416) (035ae14)

Affected utils:

Runtime

• ceil
• evolve
• floor
• isDeepEqual
• isShallowEqual
• mergeDeep
• round
• swapIndices

Typing

• last

Commits

• 035ae14 fix(deps): bump versions + manual fixes (#1416)
• d24feab chore(deps): bump fast-uri from 3.1.3 to 3.1.4 (#1395)
• 2b5e35d chore(deps): bump astro from 7.0.6 to 7.1.0 (#1392)
• cb64f68 chore(deps): bump svgo from 4.0.1 to 4.0.2 (#1393)
• cae862c chore(deps-dev): bump dompurify from 3.4.11 to 3.4.12 (#1394)
• 465991f chore(canary): allow breaking unrelated peer dependencies (#1390)
• 3b87a5f docs: astro 7 (#1389)
• 3b72f9f chore(deps): bump vite from 7.3.3 to 7.3.6 (#1387)
• a468136 chore(deps): bump @​astrojs/react from 5.0.7 to 6.0.1 (#1386)
• 1a5a34a chore(deps): bump the minor group across 1 directory with 7 updates (#1383)
• Additional commits viewable in compare view

Updates astro from 7.2.1 to 7.2.2

Release notes

Sourced from astro's releases.

astro@7.2.2

Patch Changes

• #17611 9bc3207 Thanks @​thelazylamaGit! - Fixes component styles rendered from content entries remaining stale until a second save when an adapter uses Astro's fallback development environment

• #17634 2267eee Thanks @​astrobot-houston! - Fixes incremental builds dropping optimized images for cached pages when using a collectStaticImages prerenderer (e.g. @astrojs/cloudflare with compile-time image optimization)

• #17650 4cdf128 Thanks @​astrobot-houston! - Fixes intermittent ImageNotFound errors during build on projects with many images. The build now limits concurrent image file reads to avoid exhausting OS file descriptors (EMFILE) and retries transient I/O errors with backoff. Non-transient errors are no longer silently swallowed.

• #17683 2378221 Thanks @​astrobot-houston! - Fixes prerenderConflictBehavior not applying to content collection duplicate ID warnings in the glob() and file() loaders. Setting it to 'error' now throws during content sync, and 'ignore' suppresses the warning.

• #17659 90c6ea4 Thanks @​astrobot-houston! - Fixes the Fonts API breaking experimental.incrementalBuild caching by embedding a build-local, randomly-assigned server port in generated code used for the dependency hash

• #17630 fd1d9ee Thanks @​ericclemmons! - Fixes incremental builds becoming prohibitively slow for sites with many pages or content entries that share a large dependency graph.

• #17690 93beecc Thanks @​NgoQuocViet2001! - Prevents files in directories whose names start with pages from being treated as page routes

• #17671 09f0dc7 Thanks @​tarikermis! - Fixes astro dev refusing to start after a Docker container restart when an unrelated process reuses the PID from a persisted lock file. Astro now checks the process command across platforms, so stale lock files are cleaned up and --force does not signal the unrelated process.

Changelog

Sourced from astro's changelog.

7.2.2

Patch Changes

• #17611 9bc3207 Thanks @​thelazylamaGit! - Fixes component styles rendered from content entries remaining stale until a second save when an adapter uses Astro's fallback development environment

• #17634 2267eee Thanks @​astrobot-houston! - Fixes incremental builds dropping optimized images for cached pages when using a collectStaticImages prerenderer (e.g. @astrojs/cloudflare with compile-time image optimization)

• #17650 4cdf128 Thanks @​astrobot-houston! - Fixes intermittent ImageNotFound errors during build on projects with many images. The build now limits concurrent image file reads to avoid exhausting OS file descriptors (EMFILE) and retries transient I/O errors with backoff. Non-transient errors are no longer silently swallowed.

• #17683 2378221 Thanks @​astrobot-houston! - Fixes prerenderConflictBehavior not applying to content collection duplicate ID warnings in the glob() and file() loaders. Setting it to 'error' now throws during content sync, and 'ignore' suppresses the warning.

• #17659 90c6ea4 Thanks @​astrobot-houston! - Fixes the Fonts API breaking experimental.incrementalBuild caching by embedding a build-local, randomly-assigned server port in generated code used for the dependency hash

• #17630 fd1d9ee Thanks @​ericclemmons! - Fixes incremental builds becoming prohibitively slow for sites with many pages or content entries that share a large dependency graph.

• #17690 93beecc Thanks @​NgoQuocViet2001! - Prevents files in directories whose names start with pages from being treated as page routes

• #17671 09f0dc7 Thanks @​tarikermis! - Fixes astro dev refusing to start after a Docker container restart when an unrelated process reuses the PID from a persisted lock file. Astro now checks the process command across platforms, so stale lock files are cleaned up and --force does not signal the unrelated process.

Commits

• 14f8f87 [ci] release (#17673)
• 93beecc Fix page directory boundary detection (#17690)
• 2378221 fix(content): apply prerenderConflictBehavior to content collection duplicate...
• fd1d9ee fix(build): Optimize incremental builds with shared content graph hashing (#1...
• 8df416a test: skip type check tests in ecosystem-ci (#17587)
• 09f0dc7 Detect stale dev server lock files after PID reuse (#17671)
• 2267eee fix: preserve restored image transforms when merging adapter-collected images...
• 4cdf128 fix(assets): prevent EMFILE errors on large image builds with concurrency lim...
• 90c6ea4 fix(fonts): strip volatile server address from incremental build hash (#17659)
• 9bc3207 fix(dev): apply the dev CSS plugin to the fallback Astro environment (#17611)
• See full diff in compare view

Updates nanostores from 1.4.2 to 1.5.0

Release notes

Sourced from nanostores's releases.

1.5.0

• Added eq and eqKey for custom value comparison (by @​psd-coder).
• Fixed calling other listeners if one of them throws (by @​psd-coder).
• Fixed listenKeys deep paths on whole store set (by @​ankit1324).

Changelog

Sourced from nanostores's changelog.

1.5.0

• Added eq and eqKey for custom value comparison (by @​psd-coder).
• Fixed calling other listeners if one of them throws (by @​psd-coder).
• Fixed listenKeys deep paths on whole store set (by @​ankit1324).

Commits

• afce852 Release 1.5.0 version
• 0856df7 Simplify docs
• 579eae9 fix(listen-keys): compare deep paths on whole-store set (#419)
• fd78b3d Update size limit
• a40a72f Add eq and eqKey for custom value comparison (#418)
• 6ae02fa Be sure that docs and size limit config are synced
• 6e8b976 Simplify rethrowing logic to reduce size
• 5088aab fix: keep listeners running when one of them throws (#417)
• a8246ba Update dependencies
• a8c254c Improve docs
• See full diff in compare view

Updates sanitize-html from 2.17.6 to 2.17.7

Changelog

Sourced from sanitize-html's changelog.

2.17.7 (2026-08-13)

Security

• Fixed an XSS / URL scheme policy bypass affecting configurations that allow the SVG animation elements (animate, animateColor, animateMotion, animateTransform or set) together with attributeName and one of the animation value attributes. The default configuration was not affected, as these elements are not in the default allowedTags. apostrophecms was not affected. Thanks to koyokr for responsibly disclosing the vulnerability (GHSA-g8qq-57p8-ggw5).

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	posthog-js@​1.417.1
	astro-i18n-aut@​0.8.0
	remeda@​2.40.0
	astro@​7.2.2
	nanostores@​1.5.0
	sanitize-html@​2.17.7
	@​dicebear/​styles@​10.5.0
	@​posthog/​types@​1.404.1

View full report