Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 37 updates - #269

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-edbc9ff22a
Closed

chore(deps): bump the production-dependencies group across 1 directory with 37 updates#269
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-edbc9ff22a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 37 updates in the / directory:

Package From To
typescript 6.0.3 7.0.2
@astrojs/cloudflare 14.1.4 14.3.0
@hugeicons/core-free-icons 4.2.3 4.3.0
@sentry/browser 10.67.0 10.73.0
@tabler/icons 3.45.0 3.46.0
@tanstack/virtual-core 3.17.5 3.17.8
astro 7.1.3 7.3.1
posthog-js 1.405.3 1.426.4
tailwind-variants 3.2.2 3.3.1
@astrojs/react 6.0.1 6.0.5
@base-ui/react 1.6.0 1.8.0
@tanstack/react-virtual 3.14.7 3.14.10
lucide-react 1.25.0 1.40.0
react 19.2.7 19.2.8
react-dom 19.2.7 19.2.8
shadcn 4.13.1 4.21.0
sonner 2.0.7 2.0.8
@astrojs/starlight 0.41.3 0.42.0
sharp 0.35.3 0.35.4
@modelcontextprotocol/sdk 1.29.0 1.30.0
pg 8.22.0 8.23.0
@apidevtools/swagger-parser 12.1.0 13.0.0
@aws-sdk/client-s3 3.1091.0 3.1126.0
@fastify/busboy 3.2.0 3.2.2
@hono/mcp 0.3.1 0.3.2
@hono/node-server 2.0.11 2.1.1
@hono/zod-openapi 1.5.1 1.6.2
@libsql/client 0.17.4 0.18.0
@sentry/bun 10.67.0 10.73.0
@sentry/node 10.67.0 10.73.0
@ungap/structured-clone 1.3.3 1.4.0
add-mcp 1.13.0 2.3.0
hono 4.12.31 4.13.5
posthog-node 5.46.0 5.51.6
ws 8.21.1 8.21.3
zod 4.4.3 4.5.4
@astrojs/language-server 2.16.12 2.16.16

Updates typescript from 6.0.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

Commits
  • 1e4744d Merge branch 'main' into ts7-release
  • a5a219cmicrosoft/typescript-go#4558
  • ecfe30d Update status localization
  • 5de25b5 Hide executable name in TypeScript status
  • d7ce74a Show bundled TypeScript version for packaged servers
  • 29be66a Correct TS 7 release version to 7.0.2
  • ed2bd1b Merge branch 'main' into ts7-release
  • 8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
  • 9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
  • d4eaca5microsoft/typescript-go#4549
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.


Updates @astrojs/cloudflare from 14.1.4 to 14.3.0

Release notes

Sourced from @​astrojs/cloudflare's releases.

@​astrojs/cloudflare@​14.3.0

Minor Changes

  • #17795 15e2deb Thanks @​matthewp! - Adds concurrent rendering support for experimental.incrementalBuild, including when using @astrojs/cloudflare

    Incremental builds no longer disable caching when build.concurrency is greater than 1. Projects that set build.concurrency: 1 to keep the cache enabled can remove that workaround. Cloudflare builds also reduce serialization overhead for large prerendered pages.

  • #17887 35aa62e Thanks @​matthewp! - Adds a Cloudflare finalize() response handler for custom request handlers

    Call finalize() to apply cookies and Cloudflare CDN cache defaults to the response from an astro/fetch pipeline:

    import { astro, FetchState } from 'astro/fetch';
import { cf, finalize } from '@astrojs/cloudflare/fetch';
export default {
async fetch(request: Request, env: Env, context: ExecutionContext) {
const state = new FetchState(request);
const asset = await cf(state, env, context);
if (asset) return asset;
return finalize(state, await astro(state));

},
};

    The @astrojs/cloudflare/hono middleware applies these response headers automatically. Cloudflare custom entrypoints also fall back to static assets when no Astro route matches and use the default server entrypoint when prerendering through workerd.

Patch Changes

  • #17895 41b88ac Thanks @​astro-factory! - Fixes cold astro dev crashes by adding astro/app/manifest and @astrojs/cloudflare/cache/provider to the optimizeDeps.include list

  • Updated dependencies []:

    • @​astrojs/underscore-redirects@​1.0.4

@​astrojs/cloudflare@​14.2.6

Patch Changes

  • #17854 07b919f Thanks @​ematipico! - Added @astrojs/prism to the list of dependencies to optimise. The dev server is now faster for sites that use Prism as code highlighter.

  • #17850 1301c37 Thanks @​matthewp! - Fixes React SSR failures on the first Cloudflare dev request when JSON logging is enabled

  • Updated dependencies [f8e9458]:

    • @​astrojs/internal-helpers@​0.11.0
    • @​astrojs/underscore-redirects@​1.0.4

@​astrojs/cloudflare@​14.2.5

Patch Changes

  • #17819 633855b Thanks @​matthewp! - Updates generated and default Cloudflare compatibility_date values to match the installed runtime and requires Wrangler ^4.125.0

... (truncated)

Changelog

Sourced from @​astrojs/cloudflare's changelog.

14.3.0

Minor Changes

  • #17795 15e2deb Thanks @​matthewp! - Adds concurrent rendering support for experimental.incrementalBuild, including when using @astrojs/cloudflare

    Incremental builds no longer disable caching when build.concurrency is greater than 1. Projects that set build.concurrency: 1 to keep the cache enabled can remove that workaround. Cloudflare builds also reduce serialization overhead for large prerendered pages.

  • #17887 35aa62e Thanks @​matthewp! - Adds a Cloudflare finalize() response handler for custom request handlers

    Call finalize() to apply cookies and Cloudflare CDN cache defaults to the response from an astro/fetch pipeline:

    import { astro, FetchState } from 'astro/fetch';
import { cf, finalize } from '@astrojs/cloudflare/fetch';
export default {
async fetch(request: Request, env: Env, context: ExecutionContext) {
const state = new FetchState(request);
const asset = await cf(state, env, context);
if (asset) return asset;
return finalize(state, await astro(state));

},
};

    The @astrojs/cloudflare/hono middleware applies these response headers automatically. Cloudflare custom entrypoints also fall back to static assets when no Astro route matches and use the default server entrypoint when prerendering through workerd.

Patch Changes

  • #17895 41b88ac Thanks @​astro-factory! - Fixes cold astro dev crashes by adding astro/app/manifest and @astrojs/cloudflare/cache/provider to the optimizeDeps.include list

  • Updated dependencies []:

    • @​astrojs/underscore-redirects@​1.0.4

14.2.6

Patch Changes

  • #17854 07b919f Thanks @​ematipico! - Added @astrojs/prism to the list of dependencies to optimise. The dev server is now faster for sites that use Prism as code highlighter.

  • #17850 1301c37 Thanks @​matthewp! - Fixes React SSR failures on the first Cloudflare dev request when JSON logging is enabled

  • Updated dependencies [f8e9458]:

    • @​astrojs/internal-helpers@​0.11.0
    • @​astrojs/underscore-redirects@​1.0.4

14.2.5

... (truncated)

Commits

Updates @hugeicons/core-free-icons from 4.2.3 to 4.3.0

Updates @sentry/browser from 10.67.0 to 10.73.0

Release notes

Sourced from @​sentry/browser's releases.

10.73.0

Important Changes

  • feat(v10/nextjs): Add @sentry/nextjs/config entry point (#23766)

    withSentryConfig is now available from @sentry/nextjs/config, the path it moves to in v11. Importing it from @sentry/nextjs still works on v10 but logs a warning once, so you can change your next.config file today and upgrade to v11 without touching it again.

    // next.config.mjs
- import { withSentryConfig } from '@sentry/nextjs';
+ import { withSentryConfig } from '@sentry/nextjs/config';

Other Changes

  • feat(v10/node): Deprecate shouldHandleError on setupExpressErrorHandler and setupFasitfyErrorHandler (#23734)
  • fix(v10/cloudflare): Instrument Durable Object handlers installed as read-only properties (#23769)
  • test(v10/nextjs): Drop nextjs-16-cf-workers canary variant (#23775)

Bundle size 📦

Path Size
@​sentry/browser 27.1 KB
@​sentry/browser - with treeshaking flags 25.58 KB
@​sentry/browser (incl. Tracing) 45.54 KB
@​sentry/browser (incl. Tracing + Span Streaming) 47.28 KB
@​sentry/browser (incl. Tracing, Profiling) 50.17 KB
@​sentry/browser (incl. Tracing, Replay) 83.87 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags 73.74 KB
@​sentry/browser (incl. Tracing, Replay with Canvas) 88.49 KB
@​sentry/browser (incl. Tracing, Replay, Feedback) 100.83 KB
@​sentry/browser (incl. Feedback) 43.87 KB
@​sentry/browser (incl. sendFeedback) 31.78 KB
@​sentry/browser (incl. FeedbackAsync) 36.79 KB
@​sentry/browser (incl. Metrics) 28.16 KB
@​sentry/browser (incl. Logs) 28.38 KB
@​sentry/browser (incl. Metrics & Logs) 29.06 KB
@​sentry/react 28.86 KB
@​sentry/react (incl. Tracing) 47.74 KB
@​sentry/vue 32.4 KB
@​sentry/vue (incl. Tracing) 47.46 KB
@​sentry/svelte 27.12 KB
CDN Bundle 29.43 KB

... (truncated)

Changelog

Sourced from @​sentry/browser's changelog.

10.73.0

Important Changes

  • feat(v10/nextjs): Add @sentry/nextjs/config entry point (#23766)

    withSentryConfig is now available from @sentry/nextjs/config, the path it moves to in v11. Importing it from @sentry/nextjs still works on v10 but logs a warning once, so you can change your next.config file today and upgrade to v11 without touching it again.

    // next.config.mjs
- import { withSentryConfig } from '@sentry/nextjs';
+ import { withSentryConfig } from '@sentry/nextjs/config';

Other Changes

  • feat(v10/node): Deprecate shouldHandleError on setupExpressErrorHandler and setupFasitfyErrorHandler (#23734)
  • fix(v10/cloudflare): Instrument Durable Object handlers installed as read-only properties (#23769)
  • test(v10/nextjs): Drop nextjs-16-cf-workers canary variant (#23775)

10.72.0

Important Changes

  • AI integrations no longer report errors that propagate to the caller (#23638, #23639, #23640)

    Across all AI integrations (OpenAI, Anthropic, Google GenAI, LangChain, and LangGraph), the SDK no longer sends an event to Sentry for errors that the AI framework propagates to your code. Previously the instrumentation reported these as unhandled (handled: false) before your own error handling ran, so an error your code caught still showed up in Sentry as an unhandled crash. The span is still marked as errored and the error still propagates, so reporting is left to your application: if your code does not handle the error, it reaches Sentry's global error handlers and is captured as unhandled, just like any other uncaught error. Errors that a provider surfaces as data on an otherwise successful response (such as Anthropic error-shaped responses or Google GenAI blocked content) are still captured, since your code never sees them propagate.

  • feat(v10/cloudflare): Add rpcTracePropagationBindings (#23737, #23738)

    The new rpcTracePropagationBindings option names the env bindings that outgoing RPC calls propagate trace context to. Strings match a binding name exactly, regular expressions match by pattern, and the default empty array propagates to nothing. RPC has no headers to carry trace context, so the SDK appends it as a trailing argument that only a Sentry-instrumented receiver removes again. List only the bindings whose receiver you know runs Sentry. Setting the option takes precedence over enableRpcTracePropagation, which is now deprecated. When you build with the Sentry Cloudflare Vite plugin, the bindings that resolve to this worker (its own Durable Objects and self service bindings) are derived from your wrangler config and added for you.

Other Changes

  • fix(v10/astro): support astro v7 route patterns properly (#23657)
  • fix(v10/bundler-plugins): Preserve full file path in component annotation source maps (#23595)
  • fix(v10/core): Store child span timeout handle in _childSpanTimeoutID (#23673)
  • fix(v10/node): Only end the process session when it is still ok (#23731)
  • fix(v10/react-router): Use react-router's own instrumentation types instead of a mirrored copy (#23589)
  • fix(v10/replay): Suppress Worker destroyed error on session expiry (#23654)
  • fix(v10/server-utils): Keep orchestrion registration out of tree-shaking (#23591)
  • fix(v10/server-utils): Stop shipping orchestrion bundler plugins as production dependencies (#23667)
  • fix(v10/server-utils): Support openai v7 in auto-instrumentation (#23713)
  • fix(v10/sveltekit): Detect native tracing in flattened SvelteKit 3 config (#23656)

... (truncated)

Commits
  • f109d92 release: 10.73.0
  • 1a3e04e meta(changelog): Update changelog for 10.73.0 (#23778)
  • da8d769 test(v10/nextjs): Drop nextjs-16-cf-workers canary variant (#23775)
  • bea4d38 feat(v10/node): Deprecate shouldHandleError on setupExpressErrorHandler a...
  • 605caaf feat(v10/nextjs): Add @sentry/nextjs/config entry point (#23766)
  • da17307 fix(v10/cloudflare): Instrument Durable Object handlers installed as read-onl...
  • 2c4ca38 Merge branch 'release/10.72.0' into v10
  • 0d23628 release: 10.72.0
  • ac2094d meta(changelog): Update changelog for 10.72.0 (#23743)
  • f325434 feat(v10/cloudflare): Derive rpcTracePropagationBindings from the wrangler co...
  • Additional commits viewable in compare view

Updates @tabler/icons from 3.45.0 to 3.46.0

Release notes

Sourced from @​tabler/icons's releases.

Release 3.46.0

18 new icons:

  • outline/play-bug
  • outline/play-bugs
  • outline/remote-control
  • outline/rocking-chair
  • outline/run-sprint
  • outline/sparkles-2-off
  • outline/tabs
  • outline/tags-chevron-down
  • outline/tags-chevron-left
  • outline/tags-chevron-right
  • outline/tags-chevron-up
  • outline/thinking-high
  • outline/thinking-low
  • outline/thinking-medium
  • outline/treasure-chest
  • outline/twig
  • outline/vault
  • outline/yarn

Fixed icons: outline/credits, outline/currency-tether, outline/device-3d-camera, outline/device-screen, outline/home-lock, outline/map-lock, outline/notdef, outline/queue-pop-in, outline/server-bolt, outline/server, outline/sparkles-2, outline/transform-point-bottom-left, outline/transform-point-bottom-right, outline/transform-point-top-left, outline/transform-point-top-right

Commits
  • 8ac7d81 Release 3.46.0
  • 2727ba9 Enhance release process in package.json: add GitHub authentication check and ...
  • 4ff4802 Add npm login check before release-it initialization in package.json
  • 74a7690 Merge branch 'main' of https://github.com/tabler/tabler-icons
  • f828849 Update dependencies in package.json and pnpm-lock.yaml: remove @​release-it-pl...
  • 1a39582 Fix rect width/height swap in optimize script (#1570)
  • 54bac86 Secure PR validation: run fork code without privileges (#1569)
  • eaaf32d Update Turbo package to version 2.10.7 and adjust schema reference in turbo.json
  • 2cfcde7 Remove unused AI tag generation script and related package dependency from pr...
  • be0e5a8 Refactor SVG paths for several icons to improve structure and consistency: `o...
  • Additional commits viewable in compare view

Updates @tanstack/virtual-core from 3.17.5 to 3.17.8

Release notes

Sourced from @​tanstack/virtual-core's releases.

@​tanstack/virtual-core@​3.17.8

Patch Changes

  • #1256 a0a411e - Cancel the pending isScrolling reset when a scroll observer is torn down, and reset isScrolling and scrollDirection in cleanup() so they don't stay stuck after the scroll element changes or is removed.

  • #1246 d2cf98b - Ignore connected measurement nodes whose indexes are outside the current item count.

@​tanstack/virtual-core@​3.17.7

Patch Changes

  • #1239 a5417b4 - Fix a one-frame viewport jump when above-viewport rows resize while scrolling up (#1227). resizeItem writes scrollTop synchronously inside the ResizeObserver callback to compensate for the size change, but then notified asynchronously — so the browser could paint a frame with the new scrollTop and the old item transforms, making the content jerk by the resize delta and snap back. When a compensation actually moves the scroll position, resizeItem now notifies synchronously so the transform commit lands in the same paint as the scroll write. Resizes that don't move the scroll position (below-fold measurements, iOS-deferred adjustments) keep the cheaper async notify.

@​tanstack/virtual-core@​3.17.6

Patch Changes

  • #1236 7ae32b5 - Stop the default scroll-adjustment heuristic from drifting the viewport when a viewport-spanning item grows. Previously any item whose top sat above the fold (itemStart < scrollOffset) had its size delta compensated on every re-measure — including a streaming chat message that spans the fold and grows at its bottom, dragging scrollTop downward token by token (#1218). Re-measurements now only compensate items that are entirely above the fold (itemStart + itemSize <= scrollOffset); growth below the anchor point leaves the scroll position untouched. First measurements (estimate→actual) still compensate any above-fold item, and a custom shouldAdjustScrollPositionOnItemSizeChange still overrides the default.
Changelog

Sourced from @​tanstack/virtual-core's changelog.

3.17.8

Patch Changes

  • #1256 a0a411e - Cancel the pending isScrolling reset when a scroll observer is torn down, and reset isScrolling and scrollDirection in cleanup() so they don't stay stuck after the scroll element changes or is removed.

  • #1246 d2cf98b - Ignore connected measurement nodes whose indexes are outside the current item count.

3.17.7

Patch Changes

  • #1239 a5417b4 - Fix a one-frame viewport jump when above-viewport rows resize while scrolling up (#1227). resizeItem writes scrollTop synchronously inside the ResizeObserver callback to compensate for the size change, but then notified asynchronously — so the browser could paint a frame with the new scrollTop and the old item transforms, making the content jerk by the resize delta and snap back. When a compensation actually moves the scroll position, resizeItem now notifies synchronously so the transform commit lands in the same paint as the scroll write. Resizes that don't move the scroll position (below-fold measurements, iOS-deferred adjustments) keep the cheaper async notify.

3.17.6

Patch Changes

  • #1236 7ae32b5 - Stop the default scroll-adjustment heuristic from drifting the viewport when a viewport-spanning item grows. Previously any item whose top sat above the fold (itemStart < scrollOffset) had its size delta compensated on every re-measure — including a streaming chat message that spans the fold and grows at its bottom, dragging scrollTop downward token by token (#1218). Re-measurements now only compensate items that are entirely above the fold (itemStart + itemSize <= scrollOffset); growth below the anchor point leaves the scroll position untouched. First measurements (estimate→actual) still compensate any above-fold item, and a custom shouldAdjustScrollPositionOnItemSizeChange still overrides the default.
Commits
  • e9874f0 ci: Version Packages (#1247)
  • a0a411e fix(virtual-core): cancel the isScrolling debounce on scroll-observer cleanup...
  • d2cf98b fix(virtual-core): ignore stale connected measurements (#1246)
  • deca524 ci: Version Packages (#1240)
  • a5417b4 fix(virtual-core): notify synchronously after above-viewport resize compensat...
  • 32b2f2b ci: Version Packages (#1238)
  • ef6e92a docs(virtual-core): clarify shouldAdjustScrollPositionOnItemSizeChange usage ...
  • 7ae32b5 fix(virtual-core): stop viewport-spanning item growth from drifting scroll (#...
  • See full diff in compare view

Updates astro from 7.1.3 to 7.3.1

Release notes

Sourced from astro's releases.

astro@7.3.1

Patch Changes

astro@7.3.0

Minor Changes

  • #17767 ce7c91f Thanks @​astro-factory! - Adds --ignore-lock flag to astro preview, allowing multiple preview servers to run simultaneously on different ports. This is useful for E2E testing workflows (e.g., Playwright) that need to run several preview servers at once.

  • #17818 c0b6581 Thanks @​florian-lefebvre! - Adds a logger parameter to image services hooks

    Custom image services now receive Astro's runtime logger as an extra argument. Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

    import type { LocalImageService } from 'astro';
const service: LocalImageService = {
// ...
async transform(inputBuffer, transform, imageConfig, logger) {
logger.warn(Could not optimize &quot;${transform.src}&quot;. Passing it through unchanged.);
return { data: inputBuffer, format: 'png' };
},
};

    Astro's built-in Sharp service now uses this logger for the warnings it emits when it encounters an unexpected or unsupported source format.

  • #17818 c0b6581 Thanks @​florian-lefebvre! - Adds logger to the context object passed to cache providers

    Custom cache providers now receive Astro's runtime logger on the context passed to onRequest(). Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

    import type { CacheProvider } from 'astro';
const provider: CacheProvider = {
name: 'my-cache',
async onRequest({ request, url, logger }, next) {
logger.warn(Skipping cache for ${url.pathname} because the response sets a cookie.);
return next();
},
// ...
};

    Astro's built-in memoryCache() provider now uses this logger for the warnings it emits when it skips caching a response that sets cookies, and when a background revalidation fails.

Patch Changes

  • #17818 c0b6581 Thanks @​florian-lefebvre! - Updates Astro's remaining internal warnings and errors to be written through the configured logger instead of directly to the console, when possible

... (truncated)

Changelog

Sourced from astro's changelog.

7.3.1

Patch Changes

7.3.0

Minor Changes

  • #17767 ce7c91f Thanks @​astro-factory! - Adds --ignore-lock flag to astro preview, allowing multiple preview servers to run simultaneously on different ports. This is useful for E2E testing workflows (e.g., Playwright) that need to run several preview servers at once.

  • #17818 c0b6581 Thanks @​florian-lefebvre! - Adds a logger parameter to image services hooks

    Custom image services now receive Astro's runtime logger as an extra argument. Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

    import type { LocalImageService } from 'astro';
const service: LocalImageService = {
// ...
async transform(inputBuffer, transform, imageConfig, logger) {
logger.warn(Could not optimize &quot;${transform.src}&quot;. Passing it through unchanged.);
return { data: inputBuffer, format: 'png' };
},
};

    Astro's built-in Sharp service now uses this logger for the warnings it emits when it encounters an unexpected or unsupported source format.

  • #17818 c0b6581 Thanks @​florian-lefebvre! - Adds logger to the context object passed to cache providers

    Custom cache providers now receive Astro's runtime logger on the context passed to onRequest(). Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

    import type { CacheProvider } from 'astro';
const provider: CacheProvider = {
name: 'my-cache',
async onRequest({ request, url, logger }, next) {
logger.warn(Skipping cache for ${url.pathname} because the response sets a cookie.);
return next();
},
// ...
};

    Astro's built-in memoryCache() provider now uses this logger for the warnings it emits when it skips caching a response that sets cookies, and when a background revalidation fails.

Patch Changes

... (truncated)

Commits

Updates posthog-js from 1.405.3 to 1.426.4

Release notes

Sourced from posthog-js's releases.

posthog-js@1.426.4

1.426.4

Patch Changes

  • #4764 fa2924d Thanks @​marandaneto! - Preserve previously persisted feature flags as an offline fallback when bootstrap flags are provided. (2026-09-04)

posthog-js@1.426.3

1.426.3

Patch Changes

  • #4761 ebf7318 Thanks @​marandaneto! - Prevent session replay network capture from replacing a downstream fetch wrapper's response with an instrumentation error when the response has no headers. (2026-09-04)

posthog-js@1.426.2

1.426.2

Patch Changes

  • #4763 7b30da7 Thanks @​marandaneto! - Ship the package ESM entrypoint with an .mjs extension so Node recognizes its module format, while retaining the existing .js bundle for backwards compatibility. (2026-09-03)

  • #4759 c475070 Thanks @​marandaneto! - Preserve explicitly false feature flag values supplied through bootstrap configuration. (2026-09-03)

  • #4767 9d683ca Thanks @​marandaneto! - Preserve the anonymous distinct ID used for feature flag persistence when identify() queues a reload behind an in-flight flags request. (2026-09-03)

  • #4766 ed4ba23 Thanks @​marandaneto! - Limit persisted initial URLs by their encoded cookie size to prevent long URLs and referrers from exceeding browser cookie limits. (2026-09-03)

  • #4762 fbf10d4 Thanks @​marandaneto! - Merge event-specific $groups with groups registered on the browser client. (2026-09-03)

  • #4732 f00e24d Thanks @​posthog! - Polyfill Array.prototype.findLast in the web vitals attribution bundles so they keep capturing on browsers older than Chrome 97 and Safari 15.4 (2026-09-03)

  • Updated dependencies [c475070, f00e24d]:

    • @​posthog/core@​1.50.4
    • @​posthog/browser-common@​0.7.2

posthog-js@1.426.1

1.426.1

Patch Changes

  • #4765 d8508b6 Thanks @​marandaneto! - Initialize the Segment enrichment integration when Segment is configured through set_config, so Segment events include PostHog properties such as active feature flags. (2026-09-03)

... (truncated)

Commits
  • f166ee8 chore: update versions and lockfile [version bump]
  • fa2924d fix(browser): preserve persisted flags when bootstrap requests fail (#4764)
  • a7a3729 chore: update versions and lockfile [version bump]
  • ebf7318 fix(replay): preserve fetch responses without headers (#4761)
  • 09c6b93 fix(nextjs-config): delete server sourcemaps after upload (#4768)
  • a9ed673 chore: update versions and lockfile [version bump]
  • ed4ba23 fix(browser): keep initial person cookies below browser limits (#4766)
  • 9d683ca fix(browser): preserve anonymous ID during flag reloads (#4767)
  • fbf10d4 fix(browser): merge event-specific groups with registered groups (#4762)
  • 7b30da7 fix(browser): ship ESM entrypoint as .mjs (#4763)
  • Additional commits viewable in compare view

Updates tailwind-variants from 3.2.2 to 3.3.1

Release notes

Sourced from tailwind-variants's releases.

v3.3.1

   🐞 Bug Fixes

    View changes on GitHub

v3.3.0

No significant changes

    View changes on GitHub
Changelog

Sourced from tailwind-variants's changelog.

3.3.1 (2026-08-03)

Bug Fixes

3.3.0 (2026-07-26)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for tailwind-variants since your current version.


Updates @astrojs/react from 6.0.1 to 6.0.5

Release notes

Sourced from @​astrojs/react's releases.

@​astrojs/react@​6.0.5

Patch Changes

  • Updated dependencies [f8e9458]:
    • @​astrojs/internal-helpers@​0.11.0

@​astrojs/react@​6Description has been truncated

@dependabot
chore(deps): bump the production-dependencies group across 1 director…
9a1edb6 
…y with 37 updates

Bumps the production-dependencies group with 37 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [typescript](https://github.com/microsoft/TypeScript) | `6.0.3` | `7.0.2` |
| [@astrojs/cloudflare](https://github.com/withastro/astro/tree/HEAD/packages/integrations/cloudflare) | `14.1.4` | `14.3.0` |
| @hugeicons/core-free-icons | `4.2.3` | `4.3.0` |
| [@sentry/browser](https://github.com/getsentry/sentry-javascript) | `10.67.0` | `10.73.0` |
| [@tabler/icons](https://github.com/tabler/tabler-icons) | `3.45.0` | `3.46.0` |
| [@tanstack/virtual-core](https://github.com/TanStack/virtual/tree/HEAD/packages/virtual-core) | `3.17.5` | `3.17.8` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.1.3` | `7.3.1` |
| [posthog-js](https://github.com/PostHog/posthog-js) | `1.405.3` | `1.426.4` |
| [tailwind-variants](https://github.com/heroui-inc/tailwind-variants) | `3.2.2` | `3.3.1` |
| [@astrojs/react](https://github.com/withastro/astro/tree/HEAD/packages/integrations/react) | `6.0.1` | `6.0.5` |
| [@base-ui/react](https://github.com/mui/base-ui/tree/HEAD/packages/react) | `1.6.0` | `1.8.0` |
| [@tanstack/react-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual) | `3.14.7` | `3.14.10` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.25.0` | `1.40.0` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.7` | `19.2.8` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.7` | `19.2.8` |
| [shadcn](https://github.com/shadcn-ui/ui/tree/HEAD/packages/shadcn) | `4.13.1` | `4.21.0` |
| [sonner](https://github.com/emilkowalski/sonner) | `2.0.7` | `2.0.8` |
| [@astrojs/starlight](https://github.com/withastro/starlight/tree/HEAD/packages/starlight) | `0.41.3` | `0.42.0` |
| [sharp](https://github.com/lovell/sharp) | `0.35.3` | `0.35.4` |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.29.0` | `1.30.0` |
| [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.22.0` | `8.23.0` |
| [@apidevtools/swagger-parser](https://github.com/APIDevTools/swagger-parser) | `12.1.0` | `13.0.0` |
| [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1091.0` | `3.1126.0` |
| [@fastify/busboy](https://github.com/fastify/busboy) | `3.2.0` | `3.2.2` |
| [@hono/mcp](https://github.com/honojs/middleware/tree/HEAD/packages/mcp) | `0.3.1` | `0.3.2` |
| [@hono/node-server](https://github.com/honojs/node-server) | `2.0.11` | `2.1.1` |
| [@hono/zod-openapi](https://github.com/honojs/middleware/tree/HEAD/packages/zod-openapi) | `1.5.1` | `1.6.2` |
| [@libsql/client](https://github.com/tursodatabase/libsql-client-ts/tree/HEAD/packages/libsql-client) | `0.17.4` | `0.18.0` |
| [@sentry/bun](https://github.com/getsentry/sentry-javascript) | `10.67.0` | `10.73.0` |
| [@sentry/node](https://github.com/getsentry/sentry-javascript) | `10.67.0` | `10.73.0` |
| [@ungap/structured-clone](https://github.com/ungap/structured-clone) | `1.3.3` | `1.4.0` |
| [add-mcp](https://github.com/neon-solutions/add-mcp) | `1.13.0` | `2.3.0` |
| [hono](https://github.com/honojs/hono) | `4.12.31` | `4.13.5` |
| [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.46.0` | `5.51.6` |
| [ws](https://github.com/websockets/ws) | `8.21.1` | `8.21.3` |
| [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.5.4` |
| [@astrojs/language-server](https://github.com/withastro/astro/tree/HEAD/packages/language-tools/language-server) | `2.16.12` | `2.16.16` |



Updates `typescript` from 6.0.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](microsoft/TypeScript@v6.0.3...v7.0.2)

Updates `@astrojs/cloudflare` from 14.1.4 to 14.3.0
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/cloudflare/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/cloudflare@14.3.0/packages/integrations/cloudflare)

Updates `@hugeicons/core-free-icons` from 4.2.3 to 4.3.0

Updates `@sentry/browser` from 10.67.0 to 10.73.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.73.0/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.67.0...10.73.0)

Updates `@tabler/icons` from 3.45.0 to 3.46.0
- [Release notes](https://github.com/tabler/tabler-icons/releases)
- [Commits](tabler/tabler-icons@v3.45.0...v3.46.0)

Updates `@tanstack/virtual-core` from 3.17.5 to 3.17.8
- [Release notes](https://github.com/TanStack/virtual/releases)
- [Changelog](https://github.com/TanStack/virtual/blob/main/packages/virtual-core/CHANGELOG.md)
- [Commits](https://github.com/TanStack/virtual/commits/@tanstack/virtual-core@3.17.8/packages/virtual-core)

Updates `astro` from 7.1.3 to 7.3.1
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.3.1/packages/astro)

Updates `posthog-js` from 1.405.3 to 1.426.4
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.405.3...posthog-js@1.426.4)

Updates `tailwind-variants` from 3.2.2 to 3.3.1
- [Release notes](https://github.com/heroui-inc/tailwind-variants/releases)
- [Changelog](https://github.com/heroui-inc/tailwind-variants/blob/main/CHANGELOG.md)
- [Commits](heroui-inc/tailwind-variants@v3.2.2...v3.3.1)

Updates `@astrojs/react` from 6.0.1 to 6.0.5
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/react/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/react@6.0.5/packages/integrations/react)

Updates `@base-ui/react` from 1.6.0 to 1.8.0
- [Release notes](https://github.com/mui/base-ui/releases)
- [Changelog](https://github.com/mui/base-ui/blob/master/CHANGELOG.md)
- [Commits](https://github.com/mui/base-ui/commits/v1.8.0/packages/react)

Updates `@tanstack/react-virtual` from 3.14.7 to 3.14.10
- [Release notes](https://github.com/TanStack/virtual/releases)
- [Changelog](https://github.com/TanStack/virtual/blob/main/packages/react-virtual/CHANGELOG.md)
- [Commits](https://github.com/TanStack/virtual/commits/@tanstack/react-virtual@3.14.10/packages/react-virtual)

Updates `lucide-react` from 1.25.0 to 1.40.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.40.0/packages/lucide-react)

Updates `react` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react)

Updates `react-dom` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom)

Updates `shadcn` from 4.13.1 to 4.21.0
- [Release notes](https://github.com/shadcn-ui/ui/releases)
- [Changelog](https://github.com/shadcn-ui/ui/blob/main/packages/shadcn/CHANGELOG.md)
- [Commits](https://github.com/shadcn-ui/ui/commits/shadcn@4.21.0/packages/shadcn)

Updates `sonner` from 2.0.7 to 2.0.8
- [Release notes](https://github.com/emilkowalski/sonner/releases)
- [Commits](emilkowalski/sonner@v2.0.7...v2.0.8)

Updates `@astrojs/starlight` from 0.41.3 to 0.42.0
- [Release notes](https://github.com/withastro/starlight/releases)
- [Changelog](https://github.com/withastro/starlight/blob/main/packages/starlight/CHANGELOG.md)
- [Commits](https://github.com/withastro/starlight/commits/@astrojs/starlight@0.42.0/packages/starlight)

Updates `sharp` from 0.35.3 to 0.35.4
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.35.3...v0.35.4)

Updates `@modelcontextprotocol/sdk` from 1.29.0 to 1.30.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0)

Updates `pg` from 8.22.0 to 8.23.0
- [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md)
- [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.0/packages/pg)

Updates `@apidevtools/swagger-parser` from 12.1.0 to 13.0.0
- [Release notes](https://github.com/APIDevTools/swagger-parser/releases)
- [Changelog](https://github.com/APIDevTools/swagger-parser/blob/main/CHANGELOG.md)
- [Commits](APIDevTools/swagger-parser@v12.1.0...v13.0.0)

Updates `@aws-sdk/client-s3` from 3.1091.0 to 3.1126.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1126.0/clients/client-s3)

Updates `@fastify/busboy` from 3.2.0 to 3.2.2
- [Release notes](https://github.com/fastify/busboy/releases)
- [Commits](fastify/busboy@v3.2.0...v3.2.2)

Updates `@hono/mcp` from 0.3.1 to 0.3.2
- [Release notes](https://github.com/honojs/middleware/releases)
- [Changelog](https://github.com/honojs/middleware/blob/main/packages/mcp/CHANGELOG.md)
- [Commits](https://github.com/honojs/middleware/commits/@hono/mcp@0.3.2/packages/mcp)

Updates `@hono/node-server` from 2.0.11 to 2.1.1
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v2.0.11...v2.1.1)

Updates `@hono/zod-openapi` from 1.5.1 to 1.6.2
- [Release notes](https://github.com/honojs/middleware/releases)
- [Changelog](https://github.com/honojs/middleware/blob/main/packages/zod-openapi/CHANGELOG.md)
- [Commits](https://github.com/honojs/middleware/commits/@hono/zod-openapi@1.6.2/packages/zod-openapi)

Updates `@libsql/client` from 0.17.4 to 0.18.0
- [Release notes](https://github.com/tursodatabase/libsql-client-ts/releases)
- [Changelog](https://github.com/tursodatabase/libsql-client-ts/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tursodatabase/libsql-client-ts/commits/v0.18.0/packages/libsql-client)

Updates `@sentry/bun` from 10.67.0 to 10.73.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.73.0/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.67.0...10.73.0)

Updates `@sentry/node` from 10.67.0 to 10.73.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.73.0/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.67.0...10.73.0)

Updates `@ungap/structured-clone` from 1.3.3 to 1.4.0
- [Commits](ungap/structured-clone@v1.3.3...v1.4.0)

Updates `add-mcp` from 1.13.0 to 2.3.0
- [Release notes](https://github.com/neon-solutions/add-mcp/releases)
- [Changelog](https://github.com/neon-solutions/add-mcp/blob/main/CHANGELOG.md)
- [Commits](neon-solutions/add-mcp@v1.13.0...v2.3.0)

Updates `hono` from 4.12.31 to 4.13.5
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.31...v4.13.5)

Updates `posthog-node` from 5.46.0 to 5.51.6
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.51.6/packages/node)

Updates `ws` from 8.21.1 to 8.21.3
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.21.1...8.21.3)

Updates `zod` from 4.4.3 to 4.5.4
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.4.3...v4.5.4)

Updates `@astrojs/language-server` from 2.16.12 to 2.16.16
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/language-tools/language-server/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/language-server@2.16.16/packages/language-tools/language-server)

---
updated-dependencies:
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: "@astrojs/cloudflare"
  dependency-version: 14.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@hugeicons/core-free-icons"
  dependency-version: 4.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@sentry/browser"
  dependency-version: 10.73.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@tabler/icons"
  dependency-version: 3.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@tanstack/virtual-core"
  dependency-version: 3.17.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: astro
  dependency-version: 7.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: posthog-js
  dependency-version: 1.426.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: tailwind-variants
  dependency-version: 3.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@astrojs/react"
  dependency-version: 6.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@base-ui/react"
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@tanstack/react-virtual"
  dependency-version: 3.14.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: lucide-react
  dependency-version: 1.40.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: react
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: react-dom
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: shadcn
  dependency-version: 4.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: sonner
  dependency-version: 2.0.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@astrojs/starlight"
  dependency-version: 0.42.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: sharp
  dependency-version: 0.35.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: pg
  dependency-version: 8.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@apidevtools/swagger-parser"
  dependency-version: 13.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: "@aws-sdk/client-s3"
  dependency-version: 3.1126.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@fastify/busboy"
  dependency-version: 3.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@hono/mcp"
  dependency-version: 0.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@hono/node-server"
  dependency-version: 2.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@hono/zod-openapi"
  dependency-version: 1.6.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@libsql/client"
  dependency-version: 0.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@sentry/bun"
  dependency-version: 10.73.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@sentry/node"
  dependency-version: 10.73.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@ungap/structured-clone"
  dependency-version: 1.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: add-mcp
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: hono
  dependency-version: 4.13.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: posthog-node
  dependency-version: 5.51.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: ws
  dependency-version: 8.21.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: zod
  dependency-version: 4.5.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@astrojs/language-server"
  dependency-version: 2.16.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 7, 2026
@greptile-apps

greptile-apps Bot commented Sep 7, 2026

Copy link
Copy Markdown
Contributor

PR author is in the excluded authors list.

@socket-security

socket-security Bot commented Sep 7, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updated@​tanstack/​react-virtual@​3.14.7 ⏵ 3.14.10100 +110068 +195 -2100
Updated@​base-ui/​react@​1.6.0 ⏵ 1.8.07210089 +193100
Updated@​tanstack/​virtual-core@​3.17.5 ⏵ 3.17.899 +110073 +195 -2100
Updated@​types/​pg@​8.20.0 ⏵ 8.23.1100 +110073 +192100
Updated@​types/​react-dom@​19.2.3 ⏵ 19.2.710010075 +192100
Updatedposthog-node@​5.46.0 ⏵ 5.51.692 +2010079 +1100100
Updated@​types/​react@​19.2.17 ⏵ 19.2.18100 +110079 +190100
Updated@​astrojs/​language-server@​2.16.12 ⏵ 2.16.169810080 +196 +1100
Updatedlucide-react@​1.25.0 ⏵ 1.40.010010098 +196 +180
Updatedposthog-js@​1.405.3 ⏵ 1.426.49910081 +1100100
Updated@​astrojs/​react@​6.0.1 ⏵ 6.0.5991008296 +1100
Updatedsonner@​2.0.7 ⏵ 2.0.810010083 +185100
Updated@​apidevtools/​swagger-parser@​12.1.0 ⏵ 13.0.09910010084 -5100
Updatedreact@​19.2.7 ⏵ 19.2.81001008497100
Updated@​astrojs/​cloudflare@​14.1.4 ⏵ 14.3.0100 +110084 +198 +1100
Updated@​astrojs/​starlight@​0.41.3 ⏵ 0.42.09810085 +197 +2100
Updated@​hono/​mcp@​0.3.1 ⏵ 0.3.29810095 +187 -4100
Updatedastro@​7.1.3 ⏵ 7.3.198 +110088 +198 +1100
Updatedpg@​8.22.0 ⏵ 8.23.099 +1100100 +188100
Updated@​ungap/​structured-clone@​1.3.3 ⏵ 1.4.0100 +110099 +189100
Updated@​sentry/​bun@​10.67.0 ⏵ 10.73.09910090 +196100
Updated@​libsql/​client@​0.17.4 ⏵ 0.18.0100 +1100100 +190 +6100
Updated@​tabler/​icons@​3.45.0 ⏵ 3.46.0100100100 +191100
Updated@​sentry/​browser@​10.67.0 ⏵ 10.73.098 +1910091 +196100
Updatedshadcn@​4.13.1 ⏵ 4.21.09810091 +198 +1100
Updatedtailwind-variants@​3.2.2 ⏵ 3.3.1100 +1100100 +191 +7100
Updated@​fastify/​busboy@​3.2.0 ⏵ 3.2.2100 +110010092100
Updatedreact-dom@​19.2.7 ⏵ 19.2.81001009298100
Addedws@​8.21.39910010092100
Updated@​hugeicons/​core-free-icons@​4.2.3 ⏵ 4.3.092 -710010094100
Updatedsharp@​0.35.3 ⏵ 0.35.497 +1100100 +193100
See 7 more rows in the dashboard

View full report

@socket-security

socket-security Bot commented Sep 7, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm @sentry/node-core is 60.0% likely obfuscated

Confidence: 0.60

Location: Package overview

From: pnpm-lock.yaml → npm/@sentry/node@10.73.0 → npm/@sentry/node-core@10.73.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@sentry/node-core@10.73.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@dependabot @github

dependabot Bot commented on behalf of github Sep 14, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 14, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-edbc9ff22a branch September 14, 2026 09:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants