chore(deps): Bump the production-dependencies group across 1 directory with 8 updates by dependabot[bot] · Pull Request #175 · madfam-org/selva-office

dependabot · 2026-05-15T19:31:45Z

Bumps the production-dependencies group with 8 updates in the / directory:

Package	From	To
turbo	`2.9.9`	`2.9.14`
@playwright/test	`1.59.1`	`1.60.0`
posthog-js	`1.372.8`	`1.373.5`
react	`19.2.5`	`19.2.6`
react-dom	`19.2.5`	`19.2.6`
@types/node	`25.6.0`	`25.8.0`
tsx	`4.21.0`	`4.22.0`
ws	`8.20.0`	`8.20.1`

Updates turbo from 2.9.9 to 2.9.14

Release notes

Sourced from turbo's releases.

Turborepo v2.9.14

[!NOTE] This release contains important security fixes.

High:

GHSA-5xc8-49mv-x4mm: Turborepo VSCode Extension command injection

Low:

GHSA-hcf7-66rw-9f5r: Login callback CSRF/session fixation

GHSA-3qcw-2rhx-2726: Unexpected local code execution during Yarn Berry detection

What's Changed

Changelog

release(turborepo): 2.9.12 by @github-actions[bot] in vercel/turborepo#12774

fix: Restore docs mobile menu by @anthonyshew in vercel/turborepo#12782

ci: Use pull_request for PR title linting by @anthonyshew in vercel/turborepo#12787

ci: Scope GitHub Actions caches by branch by @anthonyshew in vercel/turborepo#12788

test: Validate lockfiles without dependency downloads by @anthonyshew in vercel/turborepo#12789

Removed unneeded import form hash creation script in docs by @dancrumb in vercel/turborepo#12799

fix: Validate auth callback state by @anthonyshew in vercel/turborepo#12802

fix: Harden VS Code extension command execution by @anthonyshew in vercel/turborepo#12800

fix: Avoid project-local Yarn during detection by @anthonyshew in vercel/turborepo#12801

chore: Release 2.9.13 by @anthonyshew in vercel/turborepo#12803

New Contributors

@dancrumb made their first contribution in vercel/turborepo#12799

Full Changelog: vercel/turborepo@v2.9.12...v2.9.14

Turborepo v2.9.13-canary.1

What's Changed

Changelog

release(turborepo): 2.9.11-canary.7 by @github-actions[bot] in vercel/turborepo#12768

fix: Allow $TURBO_EXTENDS$ in LSP diagnostics by @anthonyshew in vercel/turborepo#12770

release(turborepo): 2.9.11 by @github-actions[bot] in vercel/turborepo#12771

fix: Allow transit nodes in LSP diagnostics by @anthonyshew in vercel/turborepo#12773

release(turborepo): 2.9.12 by @github-actions[bot] in vercel/turborepo#12774

fix: Restore docs mobile menu by @anthonyshew in vercel/turborepo#12782

ci: Use pull_request for PR title linting by @anthonyshew in vercel/turborepo#12787

ci: Scope GitHub Actions caches by branch by @anthonyshew in vercel/turborepo#12788

test: Validate lockfiles without dependency downloads by @anthonyshew in vercel/turborepo#12789

Removed unneeded import form hash creation script in docs by @dancrumb in vercel/turborepo#12799

fix: Validate auth callback state by @anthonyshew in vercel/turborepo#12802

fix: Harden VS Code extension command execution by @anthonyshew in vercel/turborepo#12800

fix: Avoid project-local Yarn during detection by @anthonyshew in vercel/turborepo#12801

... (truncated)

Commits

fc62fe0 publish 2.9.14 to registry
fb8c9ae chore: Release 2.9.13 (#12803)
e8e629d fix: Avoid project-local Yarn during detection (#12801)
91c90cb fix: Harden VS Code extension command execution (#12800)
84f4508 fix: Validate auth callback state (#12802)
1779ad7 Removed unneeded import form hash creation script in docs (#12799)
71f8c90 test: Validate lockfiles without dependency downloads (#12789)
5fcb960 ci: Scope GitHub Actions caches by branch (#12788)
4cf9fab ci: Use pull_request for PR title linting (#12787)
859c629 fix: Restore docs mobile menu (#12782)
Additional commits viewable in compare view

Updates @playwright/test from 1.59.1 to 1.60.0

Release notes

Sourced from @playwright/test's releases.

v1.60.0

🌐 HAR recording on Tracing

tracing.startHar() / tracing.stopHar() expose HAR recording as a first-class tracing API, with the same content, mode and urlFilter options as recordHar. The returned Disposable makes it easy to scope a recording with await using:
await using har = await context.tracing.startHar('trace.har');
const page = await context.newPage();
await page.goto('https://playwright.dev');
// HAR is finalized when `har` goes out of scope.
🪝 Drop API

New locator.drop() simulates an external drag-and-drop of files or clipboard-like data onto an element. Playwright dispatches dragenter, dragover, and drop with a synthetic [DataTransfer] in the page context — works cross-browser and is great for testing upload zones:
await page.locator('#dropzone').drop({
  files: { name: 'note.txt', mimeType: 'text/plain', buffer: Buffer.from('hello') },
});
await page.locator('#dropzone').drop({
data: {
'text/plain': 'hello world',
'text/uri-list': 'https://example.com',
},
});
🎯 Aria snapshots

expect(page).toMatchAriaSnapshot() now works on a Page, in addition to a Locator — equivalent to asserting against page.locator('body').

New boxes option on locator.ariaSnapshot() / page.ariaSnapshot() appends each element's bounding box as [box=x,y,width,height], useful for AI consumption.

🛑 test.abort()

New test.abort() aborts the currently running test from a fixture, hook, or route handler with an optional message. Use it when you have detected an unrecoverable misuse and want to fail the test right away:
test('does not publish to the shared page', async ({ page }) => {
  await page.route('**/publish', route => {
    test.abort('Tests must not publish to the shared page. Use the `clone` option.');
    return route.abort();
  });
  // ...
});
New APIs

Browser, Context and Page

... (truncated)

Commits

87bb9dd cherry-pick(#40747): fix(yauzl): vendor yauzl with destroy-lifecycle fix
9a9c51c cherry-pick(#40733): chore(electron): revert #40184 (move Electron API to a s...
4b3b628 cherry-pick(#40736): Revert "feat(electron): add timeout option to electronAp...
f869f96 chore: bump version to v1.60.0 (#40714)
7eb6918 cherry-pick(#40710): docs: release notes v1.60
118d2aa cherry-pick(#40693): chore(python): formdata path type
54012f5 chore(deps): bump ip-address and express-rate-limit (#40680)
9fa531d fix(screencast): unblock frame ack when an async client disconnects (#40674)
3649db5 chore(mcp): bump default extension protocol to v2 (#40678)
bb6c009 chore(extension): mark 0.2.1 (#40679)
Additional commits viewable in compare view

Updates posthog-js from 1.372.8 to 1.373.5

Release notes

Sourced from posthog-js's releases.

posthog-js@1.373.5

1.373.5

Patch Changes

#3613 221973e Thanks @lucasheriques! - Surveys: submit open text questions with Cmd/Ctrl+Enter. The textarea still inserts a newline on plain Enter (native behaviour), matching the convention used by Slack, GitHub, Discord, and ChatGPT for multi-line inputs. Single-line "Other:" inputs continue to submit on plain Enter as before. (2026-05-15)

Updated dependencies []:

@posthog/types@1.373.5

@posthog/core@1.29.2

posthog-js@1.373.4

1.373.4

Patch Changes

#3602 4b895bf Thanks @marandaneto! - Validate gzip request bodies at the browser send boundary and fall back to JSON if the outgoing body is not gzip data. (2026-05-12)

Updated dependencies [4b895bf]:

@posthog/core@1.29.1

@posthog/types@1.373.4

posthog-js@1.373.3

1.373.3

Patch Changes

Updated dependencies [ad60818]:

@posthog/core@1.29.0

@posthog/types@1.373.3

posthog-js@1.373.2

1.373.2

Patch Changes

#3568 223d925 Thanks @marandaneto! - Validate native gzip output before sending requests and fall back when CompressionStream returns malformed data. (2026-05-11)

Updated dependencies [223d925]:

@posthog/core@1.28.7

@posthog/types@1.373.2

posthog-js@1.373.1

1.373.1

Patch Changes

#3566 7d027bc Thanks @dustinbyrne! - Prevent browser log capture from throwing when console arguments contain unreadable properties. (2026-05-11)

Updated dependencies []:

... (truncated)

Commits

0a7143b chore: update versions and lockfile [version bump]
221973e feat(surveys): submit open text questions with Cmd/Ctrl+Enter (#3613)
c9f6c79 chore: update versions and lockfile [version bump]
77ee9df fix: set default next pages export to client version, matching the default ex...
6407531 chore: update versions and lockfile [version bump]
afb0ae8 fix: send absolute current URLs for Next pageviews (#3608)
50480eb chore: update versions and lockfile [version bump]
4b895bf fix: validate gzip body before browser send (#3602)
db56be8 ci: add notice for edits to auto-generated files (#3603)
417765c chore: update versions and lockfile [version bump]
Additional commits viewable in compare view

Updates react from 19.2.5 to 19.2.6

Release notes

Sourced from react's releases.

19.2.6 (May 6th, 2026)

React Server Components

Type hardening and performance improvements (#36425 by @eps1lon and @unstubbable)

Commits

eaf3e95 Version 19.2.6
See full diff in compare view

Updates react-dom from 19.2.5 to 19.2.6

Release notes

Sourced from react-dom's releases.

19.2.6 (May 6th, 2026)

React Server Components

Type hardening and performance improvements (#36425 by @eps1lon and @unstubbable)

Commits

eaf3e95 Version 19.2.6
See full diff in compare view

Updates @types/node from 25.6.0 to 25.8.0

Commits

See full diff in compare view

Updates tsx from 4.21.0 to 4.22.0

Release notes

Sourced from tsx's releases.

v4.22.0

4.22.0 (2026-05-14)

Features

upgrade esbuild to 0.28 (#789) (b29f6ee)

This release is also available on:

npm package (@latest dist-tag)

v4.21.1

4.21.1 (2026-05-14)

Bug Fixes

support Node 20.11/21.2 import.meta paths (acf3d8f)

support Node.js 24.15.0 (c1d2d45)

support Node.js 26.1.0 and 25.9.0 (1d7e528)

This release is also available on:

npm package (@latest dist-tag)

Commits

b29f6ee feat: upgrade esbuild to 0.28 (#789)
0dd17e9 test: cover registerHooks loader composition
acf3d8f fix: support Node 20.11/21.2 import.meta paths
4bbef80 test: cover configDir paths without baseUrl
dddc5ce test: cover sync-hook watch reruns and cleanup retries
09e8f8c test: assert CLI runs without warnings
1d7e528 fix: support Node.js 26.1.0 and 25.9.0
c1d2d45 fix: support Node.js 24.15.0
d04672d test: update node version feature gates
abd863f build: bundle get-tsconfig v5
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for tsx since your current version.

Updates ws from 8.20.0 to 8.20.1

Release notes

Sourced from ws's releases.

8.20.1

Bug fixes

Fixed an uninitialized memory disclosure issue in websocket.close() (c0327ec1).

Providing a TypedArray (e.g. Float32Array) as the reason argument for websocket.close(), rather than the supported string or Buffer types, caused uninitialized memory to be disclosed to the remote peer.
import { deepStrictEqual } from 'node:assert';
import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer(
{ port: 0, skipUTF8Validation: true },
function () {
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port}, {
skipUTF8Validation: true
});
ws.on('close', function (code, reason) {
  deepStrictEqual(reason, Buffer.alloc(80));
});

}
);
wss.on('connection', function (ws) {
ws.close(1000, new Float32Array(20));
});
The issue was privately reported by Nikita Skovoroda.

Commits

5d9b316 [dist] 8.20.1
c0327ec [security] Fix uninitialized memory disclosure in websocket.close()
ce2a3d6 [ci] Test on node 26
58e45b8 [ci] Do not test on node 25
5f26c24 [ci] Run the lint step on node 24
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…y with 8 updates Bumps the production-dependencies group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [turbo](https://github.com/vercel/turborepo) | `2.9.9` | `2.9.14` | | [@playwright/test](https://github.com/microsoft/playwright) | `1.59.1` | `1.60.0` | | [posthog-js](https://github.com/PostHog/posthog-js) | `1.372.8` | `1.373.5` | | [react](https://github.com/facebook/react/tree/HEAD/packages/react) | `19.2.5` | `19.2.6` | | [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) | `19.2.5` | `19.2.6` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.6.0` | `25.8.0` | | [tsx](https://github.com/privatenumber/tsx) | `4.21.0` | `4.22.0` | | [ws](https://github.com/websockets/ws) | `8.20.0` | `8.20.1` | Updates `turbo` from 2.9.9 to 2.9.14 - [Release notes](https://github.com/vercel/turborepo/releases) - [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md) - [Commits](vercel/turborepo@v2.9.9...v2.9.14) Updates `@playwright/test` from 1.59.1 to 1.60.0 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.59.1...v1.60.0) Updates `posthog-js` from 1.372.8 to 1.373.5 - [Release notes](https://github.com/PostHog/posthog-js/releases) - [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md) - [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.372.8...posthog-js@1.373.5) Updates `react` from 19.2.5 to 19.2.6 - [Release notes](https://github.com/facebook/react/releases) - [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/react/commits/v19.2.6/packages/react) Updates `react-dom` from 19.2.5 to 19.2.6 - [Release notes](https://github.com/facebook/react/releases) - [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/react/commits/v19.2.6/packages/react-dom) Updates `@types/node` from 25.6.0 to 25.8.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `tsx` from 4.21.0 to 4.22.0 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.21.0...v4.22.0) Updates `ws` from 8.20.0 to 8.20.1 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.20.0...8.20.1) --- updated-dependencies: - dependency-name: turbo dependency-version: 2.9.14 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: "@playwright/test" dependency-version: 1.60.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: posthog-js dependency-version: 1.373.5 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: react dependency-version: 19.2.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: react-dom dependency-version: 19.2.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: "@types/node" dependency-version: 25.8.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: tsx dependency-version: 4.22.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: ws dependency-version: 8.20.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 15, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): Bump the production-dependencies group across 1 directory with 8 updates#175

chore(deps): Bump the production-dependencies group across 1 directory with 8 updates#175
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-3ac2d8b09d

dependabot Bot commented on behalf of github May 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github May 15, 2026

Turborepo v2.9.14

High:

Low:

What's Changed

Changelog

New Contributors

Turborepo v2.9.13-canary.1

What's Changed

Changelog

v1.60.0

🌐 HAR recording on Tracing

🪝 Drop API

🎯 Aria snapshots

🛑 test.abort()

New APIs

Browser, Context and Page

posthog-js@1.373.5

1.373.5

Patch Changes

posthog-js@1.373.4

1.373.4

Patch Changes

posthog-js@1.373.3

1.373.3

Patch Changes

posthog-js@1.373.2

1.373.2

Patch Changes

posthog-js@1.373.1

1.373.1

Patch Changes

19.2.6 (May 6th, 2026)

React Server Components

19.2.6 (May 6th, 2026)

React Server Components

v4.22.0

4.22.0 (2026-05-14)

Features

v4.21.1

4.21.1 (2026-05-14)

Bug Fixes

8.20.1

Bug fixes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants