Skip to content

chore(deps): bump the minor-and-patch group across 1 directory with 27 updates - #466

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-46ca2a7567
Closed

chore(deps): bump the minor-and-patch group across 1 directory with 27 updates#466
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-46ca2a7567

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 10, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 27 updates in the / directory:

Package From To
wrangler 4.127.0 4.129.0
@sentry/cloudflare 10.71.0 10.73.0
hono 4.13.5 4.13.7
jose 6.2.10 6.2.12
zod 4.4.3 4.5.4
@cloudflare/workers-types 5.20260827.1 5.20260907.1
@types/node 26.4.0 26.4.1
tsx 4.23.12 4.23.13
next 16.3.3 16.3.4
@types/react-dom 19.2.5 19.2.7
eslint 10.9.1 10.10.0
eslint-config-next 16.3.3 16.3.4
dompurify 3.4.14 3.4.15
lucide-react 1.34.0 1.41.0
react-router-dom 7.18.2 7.18.3
autoprefixer 10.5.4 10.5.5
postcss 8.5.26 8.5.28
@tauri-apps/plugin-deep-link 2.4.9 2.4.10
@tauri-apps/plugin-dialog 2.7.2 2.7.3
@tauri-apps/plugin-updater 2.10.1 2.11.0
@tanstack/react-router 1.170.32 1.170.33
@xyflow/react 12.11.5 12.11.6
i18next 26.4.0 26.4.2
react-hook-form 7.86.0 7.87.0
react-i18next 17.0.12 17.0.13
@aws-sdk/client-s3 3.1120.0 3.1127.0
bullmq 6.3.1 6.3.4

Updates wrangler from 4.127.0 to 4.129.0

Release notes

Sourced from wrangler's releases.

wrangler@4.129.0

Minor Changes

  • #15460 93d72a5 Thanks @​QnJ1c2kNCg! - Support gzip compression for JSON Pipelines sinks

    Pipelines is in open beta. wrangler pipelines sinks create and the interactive setup flow now pass the selected JSON compression to the Pipelines API. JSON sinks accept uncompressed or gzip, while Parquet retains its existing compression options and zstd default.

  • #15358 d2d8eea Thanks @​pombosilva! - Add a --json flag to the wrangler workflows commands

    Every wrangler workflows command now accepts --json, which emits the raw API payload instead of the human-readable rendering. The formatted output remains the default, so existing usage is unaffected:

    wrangler workflows instances list my-workflow --json

    The JSON output carries raw values rather than a serialisation of the formatted view: ISO timestamps instead of locale-formatted dates, plain status strings instead of emojified labels, and no presentation-only derived fields.

Patch Changes

  • #15469 d40a634 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    @​cloudflare/workers-types ^5.20260831.1 ^5.20260902.1
    workerd 1.20260831.1 1.20260902.1

  • #15481 7c1b2a6 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    @​cloudflare/workers-types ^5.20260902.1 ^5.20260903.1
    workerd 1.20260902.1 1.20260903.1

  • #15472 f6fb347 Thanks @​emily-shen! - Tolerate missing permissions during wrangler delete cleanup checks

    wrangler delete now warns and continues when it cannot inspect Worker dependencies or clean up legacy Workers Sites KV namespaces because of missing permissions. The Worker delete request itself still fails normally if the token cannot delete the Worker.

  • #15472 f6fb347 Thanks @​emily-shen! - Tolerate missing resource permissions during resource provisioning

    When Wrangler cannot check whether a bound resource exists because the API returns a 403, it now skips automatic provisioning for that resource type and continues the deploy. The deploy may still fail later if the resource is missing.

  • #15476 dc24057 Thanks @​christhorwarth! - Fix remote development with static assets for API tokens using granular Worker permissions

    Wrangler now creates Workers.dev preview sessions through the Worker-scoped endpoint and derives the preview hostname from the session response. This avoids requiring account-level Workers subdomain access.

  • Updated dependencies [00a9f2f, 1dba24a, d40a634, 7c1b2a6]:

... (truncated)

Commits

Updates @sentry/cloudflare from 10.71.0 to 10.73.0

Release notes

Sourced from @​sentry/cloudflare's releases.

10.73.0

Important Changes

  • feat(v10/nextjs): Add @sentry/nextjs/config entry point (#23766)

    withSentryConfig is now available from @sentry/nextjs/config, the path it moves to in v11. Importing it from @sentry/nextjs still works on v10 but logs a warning once, so you can change your next.config file today and upgrade to v11 without touching it again.

    // next.config.mjs
- import { withSentryConfig } from '@sentry/nextjs';
+ import { withSentryConfig } from '@sentry/nextjs/config';

Other Changes

  • feat(v10/node): Deprecate shouldHandleError on setupExpressErrorHandler and setupFasitfyErrorHandler (#23734)
  • fix(v10/cloudflare): Instrument Durable Object handlers installed as read-only properties (#23769)
  • test(v10/nextjs): Drop nextjs-16-cf-workers canary variant (#23775)

Bundle size 📦

Path Size
@​sentry/browser 27.1 KB
@​sentry/browser - with treeshaking flags 25.58 KB
@​sentry/browser (incl. Tracing) 45.54 KB
@​sentry/browser (incl. Tracing + Span Streaming) 47.28 KB
@​sentry/browser (incl. Tracing, Profiling) 50.17 KB
@​sentry/browser (incl. Tracing, Replay) 83.87 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags 73.74 KB
@​sentry/browser (incl. Tracing, Replay with Canvas) 88.49 KB
@​sentry/browser (incl. Tracing, Replay, Feedback) 100.83 KB
@​sentry/browser (incl. Feedback) 43.87 KB
@​sentry/browser (incl. sendFeedback) 31.78 KB
@​sentry/browser (incl. FeedbackAsync) 36.79 KB
@​sentry/browser (incl. Metrics) 28.16 KB
@​sentry/browser (incl. Logs) 28.38 KB
@​sentry/browser (incl. Metrics & Logs) 29.06 KB
@​sentry/react 28.86 KB
@​sentry/react (incl. Tracing) 47.74 KB
@​sentry/vue 32.4 KB
@​sentry/vue (incl. Tracing) 47.46 KB
@​sentry/svelte 27.12 KB
CDN Bundle 29.43 KB

... (truncated)

Changelog

Sourced from @​sentry/cloudflare's changelog.

10.73.0

Important Changes

  • feat(v10/nextjs): Add @sentry/nextjs/config entry point (#23766)

    withSentryConfig is now available from @sentry/nextjs/config, the path it moves to in v11. Importing it from @sentry/nextjs still works on v10 but logs a warning once, so you can change your next.config file today and upgrade to v11 without touching it again.

    // next.config.mjs
- import { withSentryConfig } from '@sentry/nextjs';
+ import { withSentryConfig } from '@sentry/nextjs/config';

Other Changes

  • feat(v10/node): Deprecate shouldHandleError on setupExpressErrorHandler and setupFasitfyErrorHandler (#23734)
  • fix(v10/cloudflare): Instrument Durable Object handlers installed as read-only properties (#23769)
  • test(v10/nextjs): Drop nextjs-16-cf-workers canary variant (#23775)

10.72.0

Important Changes

  • AI integrations no longer report errors that propagate to the caller (#23638, #23639, #23640)

    Across all AI integrations (OpenAI, Anthropic, Google GenAI, LangChain, and LangGraph), the SDK no longer sends an event to Sentry for errors that the AI framework propagates to your code. Previously the instrumentation reported these as unhandled (handled: false) before your own error handling ran, so an error your code caught still showed up in Sentry as an unhandled crash. The span is still marked as errored and the error still propagates, so reporting is left to your application: if your code does not handle the error, it reaches Sentry's global error handlers and is captured as unhandled, just like any other uncaught error. Errors that a provider surfaces as data on an otherwise successful response (such as Anthropic error-shaped responses or Google GenAI blocked content) are still captured, since your code never sees them propagate.

  • feat(v10/cloudflare): Add rpcTracePropagationBindings (#23737, #23738)

    The new rpcTracePropagationBindings option names the env bindings that outgoing RPC calls propagate trace context to. Strings match a binding name exactly, regular expressions match by pattern, and the default empty array propagates to nothing. RPC has no headers to carry trace context, so the SDK appends it as a trailing argument that only a Sentry-instrumented receiver removes again. List only the bindings whose receiver you know runs Sentry. Setting the option takes precedence over enableRpcTracePropagation, which is now deprecated. When you build with the Sentry Cloudflare Vite plugin, the bindings that resolve to this worker (its own Durable Objects and self service bindings) are derived from your wrangler config and added for you.

Other Changes

  • fix(v10/astro): support astro v7 route patterns properly (#23657)
  • fix(v10/bundler-plugins): Preserve full file path in component annotation source maps (#23595)
  • fix(v10/core): Store child span timeout handle in _childSpanTimeoutID (#23673)
  • fix(v10/node): Only end the process session when it is still ok (#23731)
  • fix(v10/react-router): Use react-router's own instrumentation types instead of a mirrored copy (#23589)
  • fix(v10/replay): Suppress Worker destroyed error on session expiry (#23654)
  • fix(v10/server-utils): Keep orchestrion registration out of tree-shaking (#23591)
  • fix(v10/server-utils): Stop shipping orchestrion bundler plugins as production dependencies (#23667)
  • fix(v10/server-utils): Support openai v7 in auto-instrumentation (#23713)
  • fix(v10/sveltekit): Detect native tracing in flattened SvelteKit 3 config (#23656)

... (truncated)

Commits
  • f109d92 release: 10.73.0
  • 1a3e04e meta(changelog): Update changelog for 10.73.0 (#23778)
  • da8d769 test(v10/nextjs): Drop nextjs-16-cf-workers canary variant (#23775)
  • bea4d38 feat(v10/node): Deprecate shouldHandleError on setupExpressErrorHandler a...
  • 605caaf feat(v10/nextjs): Add @sentry/nextjs/config entry point (#23766)
  • da17307 fix(v10/cloudflare): Instrument Durable Object handlers installed as read-onl...
  • 2c4ca38 Merge branch 'release/10.72.0' into v10
  • 0d23628 release: 10.72.0
  • ac2094d meta(changelog): Update changelog for 10.72.0 (#23743)
  • f325434 feat(v10/cloudflare): Derive rpcTracePropagationBindings from the wrangler co...
  • Additional commits viewable in compare view

Updates hono from 4.13.5 to 4.13.7

Release notes

Sourced from hono's releases.

v4.13.7

Security fixes

This release includes a fix for the following security issue:

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

v4.13.6

What's Changed

Full Changelog: honojs/hono@v4.13.5...v4.13.6

Commits

Updates jose from 6.2.10 to 6.2.12

Release notes

Sourced from jose's releases.

v6.2.12

Documentation

  • clarify and shorten public API guidance (be62530)

Refactor

  • simplify JWS and JWE operation cores (92e9640)

Performance

  • avoid copying AES-GCM output (6925d43)
  • deduplicate pending jwks key imports (bf5138b)
  • encode single-signature JWS input once (7bc9a33)
  • normalize General JWE shared headers once (78637bd)
  • normalize jwks selection metadata once (fd3ae3f)
  • use native encoding for larger ASCII strings (b23a6f3)

v6.2.11

Documentation

  • render subpath indexes as tables (94589ee)
  • shorten API index descriptions (681482f)

Refactor

  • model JWE key management modes (e01dda6)
  • types: reduce declaration repetition (55b970f)
Changelog

Sourced from jose's changelog.

6.2.12 (2026-09-05)

Documentation

  • clarify and shorten public API guidance (be62530)

Refactor

  • simplify JWS and JWE operation cores (92e9640)

Performance

  • avoid copying AES-GCM output (6925d43)
  • deduplicate pending jwks key imports (bf5138b)
  • encode single-signature JWS input once (7bc9a33)
  • normalize General JWE shared headers once (78637bd)
  • normalize jwks selection metadata once (fd3ae3f)
  • use native encoding for larger ASCII strings (b23a6f3)

6.2.11 (2026-09-04)

Documentation

  • render subpath indexes as tables (94589ee)
  • shorten API index descriptions (681482f)

Refactor

  • model JWE key management modes (e01dda6)
  • types: reduce declaration repetition (55b970f)
Commits
  • 505a55b chore(release): 6.2.12
  • 7bc9a33 perf: encode single-signature JWS input once
  • 78637bd perf: normalize General JWE shared headers once
  • bf5138b perf: deduplicate pending jwks key imports
  • b23a6f3 perf: use native encoding for larger ASCII strings
  • fd3ae3f perf: normalize jwks selection metadata once
  • 6925d43 perf: avoid copying AES-GCM output
  • be62530 docs: clarify and shorten public API guidance
  • 1b41312 build: preserve README when generation fails
  • 0b51829 build: check tree-shaking for every public binding
  • Additional commits viewable in compare view

Updates zod from 4.4.3 to 4.5.4

Release notes

Sourced from zod's releases.

v4.5.4

Commits:

  • 84e416fbf4740527bbc8f319634f4e1b065bb42c fix(v4): stop the cycle walk from firing a default factory (#6500)
  • e8e206fa33ac5fe7ce20a2beb12d57b1cb3df653 4.5.4

v4.5.3

Commits:

  • e6b6ab347675cd2bd54b1bdbed16f98c59be82a9 docs(blog): widen the z.compile example to a 20-property schema
  • 87d6464418582bb96fc665a01f852ca6da324ad0 fix(docs): drop the OG description when the title wraps past two lines
  • 99fce394a026823e602b9c30d8d5d9f5f1932ce7 bench(v4): z.compile() against zod-compiler (#6499)
  • e3a695b6bf3f0d591ea682816e3cdaea04b0f967 docs(v4): record the email regex and container output-shape findings under Open
  • 7e24a24288183ce02554f1ded7775d0650a7b7e6 docs(blog): drop the reading time and put a GitHub link in the navbar
  • eab51ff3592b2d11d863f4ee4d5452f31a3de1b6 fix(v4): emit record numeric keys as strings in toJSONSchema (#6497)

v4.5.2

Commits:

  • a354314ac04fdd5484aa62dd5c3a4b553211a0e4 fix(docs): keep blog posts out of the docs collection (#6484)
  • d378c42aff6869f0929058a7923cd775880f5c4c ci: drop canary publishing from the release workflow (#6487)
  • 212b941791e7faae078e17645eb612824fd8f79a fix(v4): let a prototype method getter answer a bare call so vi.spyOn works (#6488)
  • e7576f542a7bc7ef3cc5eeec237714fd0e6b6e98 docs(blog): let the page show through the navbar in dark mode (#6489)
  • fedb06fafe33a66ce0b5c236ad2557e0a5a170fe fix(docs): match the blog TOC hover bar to the 2px active indicator
  • 6c932fcb2eea6eb671710ea058ca9fdc382ada89 chore: bump devcontainer image to Node 24 (#6470)
  • 6635d9dd367a664109de83c021995821f48efa29 docs(blog): soften the "method memoization" attribution
  • 019ae299cc75daa132bf1acf59086a520abf6b85 fix(docs): drop ISR on the docs route so the home page hydrates
  • 652bb438aa4c626c1cd7948c6849c4691239fca7 chore(docs): drop the scroll log from the route-change scroller
  • 571c8e8a3d73b4305f4abfdd6977773cc12f2bf5 fix(docs): render blog tabs with the stock fumadocs tab card
  • 9a193aa24b4efa3b315b91d4c56c8bc385b8513f 4.5.2

v4.5.1

Commits:

  • 2e862dbf89da2835e5206a8fd3d3be61afe3cf7f ci: gate the GitHub release and JSR publish on the version being live on npm
  • 8e03380510db36fa6fda979fc78a375fdea8021c 4.5.1

v4.5.0

Zod 4.5 is now available.

npm install zod@latest

At a glance:

... (truncated)

Commits
  • e8e206f 4.5.4
  • 84e416f fix(v4): stop the cycle walk from firing a default factory (#6500)
  • 1a16102 4.5.3
  • eab51ff fix(v4): emit record numeric keys as strings in toJSONSchema (#6497)
  • 7e24a24 docs(blog): drop the reading time and put a GitHub link in the navbar
  • e3a695b docs(v4): record the email regex and container output-shape findings under Open
  • 99fce39 bench(v4): z.compile() against zod-compiler (#6499)
  • 87d6464 fix(docs): drop the OG description when the title wraps past two lines
  • e6b6ab3 docs(blog): widen the z.compile example to a 20-property schema
  • 9a193aa 4.5.2
  • Additional commits viewable in compare view

Updates @cloudflare/workers-types from 5.20260827.1 to 5.20260907.1

Commits

Updates @types/node from 26.4.0 to 26.4.1

Commits

Updates tsx from 4.23.12 to 4.23.13

Release notes

Sourced from tsx's releases.

v4.23.13

4.23.13 (2026-08-30)

Bug Fixes

  • cache: bound shared transform cache memory (#835) (28e1f12)

This release is also available on:

Commits

Updates next from 16.3.3 to 16.3.4

Release notes

Sourced from next's releases.

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

  • testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
  • Fix build error when aliasing typescript to @​typescript/typescript6 (#97997)
  • Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

Huge thanks to @​eps1lon, @​mischnic, and @​timneutkens for helping!

Commits
  • 299180d v16.3.4
  • 12e173d [16.3.x] Re-enable AVIF image optimization and require sharp 0.35.4 (#97949)
  • 5d9022e [backport] Fix unset crossOrigin in Turbopack manifests (#97930)
  • d8f4560 [16.3.x] Fix build error when aliasing typescript to @​typescript/typescript6 ...
  • 656aebf [16.3] testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
  • f37c1d6 [16.3.x] ci: remove pull_request_stats workflow (#97975)
  • See full diff in compare view

Updates @types/react-dom from 19.2.5 to 19.2.7

Commits

Updates eslint from 10.9.1 to 10.10.0

Release notes

Sourced from eslint's releases.

v10.10.0

Features

  • 264b434 feat: add d and v flags to no-unexpected-multiline (#21305) (Gihyeon Jeong / 정기현)
  • c6cc6c5 feat: check Object.prototype property names in new-cap (#21269) (crimsonjay0)
  • 5661fa6 feat: no-extra-bind false negatives with class fields and static blocks (#21260) (synthex-byte)

Bug Fixes

  • bb47dc6 fix: update dependency file-entry-cache to v11 (#20801) (Milos Djermanovic)
  • 427ac0a fix: use format strings in debug calls (#21247) (Francesco Trotta)
  • 9d81532 fix: support __proto__ in /* exported */ comments (#21261) (sethamus)
  • 87e0a08 fix: prefer-object-has-own autofix breaks when Object is shadowed (#21282) (김채영)
  • 8e2cb14 fix: new-cap false positive for UTC calls with properties: false (#21275) (Pixel)
  • 9f4a364 fix: Ignore static imports in no-unreachable (#21276) (Taha Kotil)

Documentation

  • 2417cad docs: Update README (GitHub Actions Bot)
  • 9cecb8a docs: document \c control letter escapes in no-control-regex (#21286) (한국)
  • 8724829 docs: update compat table links (#21263) (fnx)
  • 5634542 docs: Clarify eqeqeq suggestion behavior (#21256) (Müslüm Yılmaz)

Chores

  • b3d876b chore: disable npm audit in ecosystem tests (#21306) (Francesco Trotta)
  • 1696682 ci: restore EMFILE test on Node.js 26 (#21297) (Marry (Subin Yang))
  • 2c7f5d6 chore: update github/codeql-action action to v4.37.9 (#21296) (renovate[bot])
  • 3c753f1 chore: update eslint (#21289) (renovate[bot])
  • 1c73469 chore: update ecosystem plugins (#21280) (ESLint Bot)
  • 08a02be test: add error locations to no-extra-boolean-cast (#21266) (lumir)
  • 77bb1db chore: update github/codeql-action action to v4.37.8 (#21270) (renovate[bot])
  • 007e81a ci: skip EMFILE test on Node.js 26 (#21265) (lumir)
  • 0430280 chore: improve ecosystem tests compatibility on Windows (#21178) (crimsonjay0)
Commits
  • 3f20a57...

    Description has been truncated

@dependabot
chore(deps): bump the minor-and-patch group across 1 directory with 2…
e1727ea 
…7 updates

Bumps the minor-and-patch group with 27 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.127.0` | `4.129.0` |
| [@sentry/cloudflare](https://github.com/getsentry/sentry-javascript) | `10.71.0` | `10.73.0` |
| [hono](https://github.com/honojs/hono) | `4.13.5` | `4.13.7` |
| [jose](https://github.com/panva/jose) | `6.2.10` | `6.2.12` |
| [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.5.4` |
| [@cloudflare/workers-types](https://github.com/cloudflare/workerd) | `5.20260827.1` | `5.20260907.1` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.4.0` | `26.4.1` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.12` | `4.23.13` |
| [next](https://github.com/vercel/next.js) | `16.3.3` | `16.3.4` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.5` | `19.2.7` |
| [eslint](https://github.com/eslint/eslint) | `10.9.1` | `10.10.0` |
| [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.3.3` | `16.3.4` |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.4.14` | `3.4.15` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.34.0` | `1.41.0` |
| [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `7.18.2` | `7.18.3` |
| [autoprefixer](https://github.com/postcss/autoprefixer) | `10.5.4` | `10.5.5` |
| [postcss](https://github.com/postcss/postcss) | `8.5.26` | `8.5.28` |
| [@tauri-apps/plugin-deep-link](https://github.com/tauri-apps/plugins-workspace) | `2.4.9` | `2.4.10` |
| [@tauri-apps/plugin-dialog](https://github.com/tauri-apps/plugins-workspace) | `2.7.2` | `2.7.3` |
| [@tauri-apps/plugin-updater](https://github.com/tauri-apps/plugins-workspace) | `2.10.1` | `2.11.0` |
| [@tanstack/react-router](https://github.com/TanStack/router/tree/HEAD/packages/react-router) | `1.170.32` | `1.170.33` |
| [@xyflow/react](https://github.com/xyflow/xyflow/tree/HEAD/packages/react) | `12.11.5` | `12.11.6` |
| [i18next](https://github.com/i18next/i18next) | `26.4.0` | `26.4.2` |
| [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.86.0` | `7.87.0` |
| [react-i18next](https://github.com/i18next/react-i18next) | `17.0.12` | `17.0.13` |
| [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1120.0` | `3.1127.0` |
| [bullmq](https://github.com/taskforcesh/bullmq) | `6.3.1` | `6.3.4` |



Updates `wrangler` from 4.127.0 to 4.129.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.129.0/packages/wrangler)

Updates `@sentry/cloudflare` from 10.71.0 to 10.73.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.73.0/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.71.0...10.73.0)

Updates `hono` from 4.13.5 to 4.13.7
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.5...v4.13.7)

Updates `jose` from 6.2.10 to 6.2.12
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v6.2.10...v6.2.12)

Updates `zod` from 4.4.3 to 4.5.4
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.4.3...v4.5.4)

Updates `@cloudflare/workers-types` from 5.20260827.1 to 5.20260907.1
- [Release notes](https://github.com/cloudflare/workerd/releases)
- [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md)
- [Commits](https://github.com/cloudflare/workerd/commits)

Updates `@types/node` from 26.4.0 to 26.4.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `tsx` from 4.23.12 to 4.23.13
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.23.12...v4.23.13)

Updates `next` from 16.3.3 to 16.3.4
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.3.3...v16.3.4)

Updates `@types/react-dom` from 19.2.5 to 19.2.7
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `eslint` from 10.9.1 to 10.10.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.9.1...v10.10.0)

Updates `eslint-config-next` from 16.3.3 to 16.3.4
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.4/packages/eslint-config-next)

Updates `dompurify` from 3.4.14 to 3.4.15
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.14...3.4.15)

Updates `lucide-react` from 1.34.0 to 1.41.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.41.0/packages/lucide-react)

Updates `react-router-dom` from 7.18.2 to 7.18.3
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/react-router-dom@7.18.3/packages/react-router-dom/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.18.3/packages/react-router-dom)

Updates `autoprefixer` from 10.5.4 to 10.5.5
- [Release notes](https://github.com/postcss/autoprefixer/releases)
- [Changelog](https://github.com/postcss/autoprefixer/blob/main/CHANGELOG.md)
- [Commits](postcss/autoprefixer@10.5.4...10.5.5)

Updates `postcss` from 8.5.26 to 8.5.28
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.26...8.5.28)

Updates `@tauri-apps/plugin-deep-link` from 2.4.9 to 2.4.10
- [Release notes](https://github.com/tauri-apps/plugins-workspace/releases)
- [Commits](tauri-apps/plugins-workspace@deep-link-v2.4.9...deep-link-v2.4.10)

Updates `@tauri-apps/plugin-dialog` from 2.7.2 to 2.7.3
- [Release notes](https://github.com/tauri-apps/plugins-workspace/releases)
- [Commits](tauri-apps/plugins-workspace@dialog-v2.7.2...dialog-v2.7.3)

Updates `@tauri-apps/plugin-updater` from 2.10.1 to 2.11.0
- [Release notes](https://github.com/tauri-apps/plugins-workspace/releases)
- [Commits](tauri-apps/plugins-workspace@updater-v2.10.1...updater-v2.11.0)

Updates `@tanstack/react-router` from 1.170.32 to 1.170.33
- [Release notes](https://github.com/TanStack/router/releases)
- [Changelog](https://github.com/TanStack/router/blob/main/packages/react-router/CHANGELOG.md)
- [Commits](https://github.com/TanStack/router/commits/@tanstack/react-router@1.170.33/packages/react-router)

Updates `@xyflow/react` from 12.11.5 to 12.11.6
- [Release notes](https://github.com/xyflow/xyflow/releases)
- [Changelog](https://github.com/xyflow/xyflow/blob/main/packages/react/CHANGELOG.md)
- [Commits](https://github.com/xyflow/xyflow/commits/@xyflow/react@12.11.6/packages/react)

Updates `i18next` from 26.4.0 to 26.4.2
- [Release notes](https://github.com/i18next/i18next/releases)
- [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/i18next@v26.4.0...v26.4.2)

Updates `react-hook-form` from 7.86.0 to 7.87.0
- [Release notes](https://github.com/react-hook-form/react-hook-form/releases)
- [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md)
- [Commits](react-hook-form/react-hook-form@v7.86.0...v7.87.0)

Updates `react-i18next` from 17.0.12 to 17.0.13
- [Changelog](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/react-i18next@v17.0.12...v17.0.13)

Updates `@aws-sdk/client-s3` from 3.1120.0 to 3.1127.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1127.0/clients/client-s3)

Updates `bullmq` from 6.3.1 to 6.3.4
- [Release notes](https://github.com/taskforcesh/bullmq/releases)
- [Commits](taskforcesh/bullmq@v6.3.1...v6.3.4)

---
updated-dependencies:
- dependency-name: wrangler
  dependency-version: 4.129.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@sentry/cloudflare"
  dependency-version: 10.73.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: hono
  dependency-version: 4.13.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: jose
  dependency-version: 6.2.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: zod
  dependency-version: 4.5.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@cloudflare/workers-types"
  dependency-version: 5.20260907.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@types/node"
  dependency-version: 26.4.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: tsx
  dependency-version: 4.23.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: next
  dependency-version: 16.3.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@types/react-dom"
  dependency-version: 19.2.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: eslint
  dependency-version: 10.10.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: eslint-config-next
  dependency-version: 16.3.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: dompurify
  dependency-version: 3.4.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: lucide-react
  dependency-version: 1.41.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: react-router-dom
  dependency-version: 7.18.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: autoprefixer
  dependency-version: 10.5.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: postcss
  dependency-version: 8.5.28
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@tauri-apps/plugin-deep-link"
  dependency-version: 2.4.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@tauri-apps/plugin-dialog"
  dependency-version: 2.7.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@tauri-apps/plugin-updater"
  dependency-version: 2.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@tanstack/react-router"
  dependency-version: 1.170.33
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@xyflow/react"
  dependency-version: 12.11.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: i18next
  dependency-version: 26.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: react-hook-form
  dependency-version: 7.87.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: react-i18next
  dependency-version: 17.0.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/client-s3"
  dependency-version: 3.1127.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: bullmq
  dependency-version: 6.3.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 10, 2026
@khuepm khuepm mentioned this pull request Sep 10, 2026
Merged
@khuepm

khuepm commented Sep 10, 2026

Copy link
Copy Markdown
Owner

Verified and absorbed into #467 (branch chore/deps-batch-2026-09), together with #465 and #464 — the three share one lockfile, so they cannot be verified apart.

One defect this PR could not have known about. It raises apps/{docs,landing,studio} to @types/react-dom ^19.2.7, but pnpm.overrides holds that package as an exact pin at 19.2.5. pnpm overrides apply to direct dependencies too, so the pin wins: every lockfile importer still recorded specifier: 19.2.5, i.e. three manifests claiming a version that was not installed. pnpm drift:check fails on it — the second time that gate has caught this class after the vite 7-vs-8 incident it was built for. #467 raises the pin in both places pnpm reads and corrects the registry row in docs/{en,vi}/security/dependency-overrides.md, whose EN copy was itself stale at 19.2.4.

Everything else in the group is clean. bullmq 6.3.1→6.3.4 got the extra scrutiny B40 asks for: verify:worker-bundle (5.40 MB, none of the 5 Docker-only markers), verify:worker-startup under workerd, build:node, and an actual Node import of @lumibase/runtime/docker to prove no top-level throw.

Full results: check:all clean, typecheck 18/18, build 11/11, lint 6/6, tests 14/14 (cms 2689 passed / 101 skipped).

Also logged as backlog B62: the four @tauri-apps/plugin-* bumps in this PR cannot affect anything. apps/shell has no JS/TS source, nothing in apps/ or packages/ imports @tauri-apps/plugin, and the plugins are used only from Rust — the versions that matter live in Cargo.lock (dialog 2.7.1, deep-link 2.4.9, updater 2.10.1), not package.json.

Closing in favour of #467.

This was referenced Sep 10, 2026
Closed
Closed
@khuepm

khuepm commented Sep 10, 2026

Copy link
Copy Markdown
Owner

Superseded by #467, verified rather than assumed (the B36 lesson): git diff of every package.json line this PR adds or removes against #467 comes back empty, and #467 is green on all 15 checks. Dependabot branches are deleted on close, so recording here that nothing unique remained.

@khuepm khuepm closed this Sep 10, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 10, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/minor-and-patch-46ca2a7567 branch September 10, 2026 22:13
khuepm added a commit that referenced this pull request Sep 13, 2026
@khuepm
Merge pull request #467 from khuepm/chore/deps-batch-2026-09
fdac8f6 
chore(deps): batch #466 + #465 + #464; hold TypeScript 7
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@khuepm