Skip to content

chore(deps): bump the minor-and-patch group with 13 updates - #500

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-5e19003607
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-5e19003607

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 21, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 13 updates:

Package From To
@mux/mux-player-react 3.13.3 3.13.4
@sentry/nextjs 10.74.0 10.75.0
@tanstack/react-query 5.102.8 5.103.1
google-auth-library 11.0.2 11.1.0
kysely 0.29.5 0.29.6
lucide-react 1.46.0 1.47.0
mapbox-gl 3.30.0 3.31.0
pg-boss 12.32.0 12.33.1
posthog-js 1.433.1 1.434.0
posthog-node 5.52.2 5.52.4
@types/nodemailer 8.0.1 8.0.2
jsdom 30.0.1 30.1.0
prettier 3.9.6 3.9.8

Updates @mux/mux-player-react from 3.13.3 to 3.13.4

Release notes

Sourced from @​mux/mux-player-react's releases.

@​mux/mux-player-react: v3.13.4

3.13.4 (2026-09-15)

Miscellaneous Chores

  • @​mux/mux-player-react: Synchronize player versions

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​mux/mux-player bumped from 3.13.3 to 3.13.4
      • @​mux/playback-core bumped from 0.35.3 to 0.35.4
Changelog

Sourced from @​mux/mux-player-react's changelog.

3.13.4 (2026-09-15)

Miscellaneous Chores

  • @​mux/mux-player-react: Synchronize player versions

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​mux/mux-player bumped from 3.13.3 to 3.13.4
      • @​mux/playback-core bumped from 0.35.3 to 0.35.4
Commits

Updates @sentry/nextjs from 10.74.0 to 10.75.0

Release notes

Sourced from @​sentry/nextjs's releases.

10.75.0

Important Changes

  • feat(v10/effect): Capture errors through the Effect v4 ErrorReporter API (#24445)

    On Effect v4, Sentry.effectLayer now registers a Sentry ErrorReporter. Failures that pass through Effect.withErrorReporting, ErrorReporter.report or the built-in HTTP and RPC reporting boundaries are captured automatically, with ErrorReporter.ignore, ErrorReporter.severity and ErrorReporter.attributes annotations respected. Nothing changes on Effect v3.

Other Changes

  • feat(v10/core): Accept a CollectBehavior shorthand for dataCollection.httpHeaders (#24339)
  • fix(v10/browser): Release the XHR virtualError once the request completed (#24307)
  • fix(v10/browser-utils): Skip nullish LCP entries in vendored web-vitals (#24349)
  • fix(v10/bundler-plugins): Stamp debug IDs onto emitted source maps when disable-upload is set (#24332)
  • fix(v10/core): Don't instrument the SDK's own envelope requests (#24276)
  • fix(v10/nextjs): Only include emitted chunk directories in Turbopack sourcemap upload (#24295)
  • fix(v10/nitro): Import from nitro/h3 instead of h3 directly (#24444)
  • fix(v10/node-core): Don't recurse in logAndExitProcess on a broken stdio pipe (#24353)
  • fix(v10/nuxt): Detect Nitro version via the app's Nuxt dependency chain (#24025)
  • fix(v10/replay): Don't rewrite already-emitted nodes when syncing mirror attributes (#23588)

Bundle size 📦

Path Size
@​sentry/browser 27.18 KB
@​sentry/browser - with treeshaking flags 25.66 KB
@​sentry/browser (incl. Tracing) 45.6 KB
@​sentry/browser (incl. Tracing + Span Streaming) 47.34 KB
@​sentry/browser (incl. Tracing, Profiling) 50.24 KB
@​sentry/browser (incl. Tracing, Replay) 83.99 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags 73.84 KB
@​sentry/browser (incl. Tracing, Replay with Canvas) 88.6 KB
@​sentry/browser (incl. Tracing, Replay, Feedback) 100.94 KB
@​sentry/browser (incl. Feedback) 43.94 KB
@​sentry/browser (incl. sendFeedback) 31.87 KB
@​sentry/browser (incl. FeedbackAsync) 36.88 KB
@​sentry/browser (incl. Metrics) 28.25 KB
@​sentry/browser (incl. Logs) 28.47 KB
@​sentry/browser (incl. Metrics & Logs) 29.15 KB
@​sentry/react 28.93 KB
@​sentry/react (incl. Tracing) 47.81 KB
@​sentry/vue 32.47 KB
@​sentry/vue (incl. Tracing) 47.55 KB
@​sentry/svelte 27.21 KB
CDN Bundle 29.53 KB
CDN Bundle (incl. Tracing) 47.52 KB
CDN Bundle (incl. Logs, Metrics) 31.07 KB
CDN Bundle (incl. Tracing, Logs, Metrics) 48.81 KB
CDN Bundle (incl. Replay, Logs, Metrics) 69.49 KB
CDN Bundle (incl. Tracing, Replay) 84.22 KB

... (truncated)

Changelog

Sourced from @​sentry/nextjs's changelog.

10.75.0

Important Changes

  • feat(v10/effect): Capture errors through the Effect v4 ErrorReporter API (#24445)

    On Effect v4, Sentry.effectLayer now registers a Sentry ErrorReporter. Failures that pass through Effect.withErrorReporting, ErrorReporter.report or the built-in HTTP and RPC reporting boundaries are captured automatically, with ErrorReporter.ignore, ErrorReporter.severity and ErrorReporter.attributes annotations respected. Nothing changes on Effect v3.

Other Changes

  • feat(v10/core): Accept a CollectBehavior shorthand for dataCollection.httpHeaders (#24339)
  • fix(v10/browser): Release the XHR virtualError once the request completed (#24307)
  • fix(v10/browser-utils): Skip nullish LCP entries in vendored web-vitals (#24349)
  • fix(v10/bundler-plugins): Stamp debug IDs onto emitted source maps when disable-upload is set (#24332)
  • fix(v10/core): Don't instrument the SDK's own envelope requests (#24276)
  • fix(v10/nextjs): Only include emitted chunk directories in Turbopack sourcemap upload (#24295)
  • fix(v10/nitro): Import from nitro/h3 instead of h3 directly (#24444)
  • fix(v10/node-core): Don't recurse in logAndExitProcess on a broken stdio pipe (#24353)
  • fix(v10/nuxt): Detect Nitro version via the app's Nuxt dependency chain (#24025)
  • fix(v10/replay): Don't rewrite already-emitted nodes when syncing mirror attributes (#23588)
Commits
  • 9ffb58c release: 10.75.0
  • 664c906 meta(changelog): Update changelog for 10.75.0 (#24446)
  • e3e7acc fix(v10/nitro): Import from nitro/h3 instead of h3 directly (#24444)
  • 4bb51d1 feat(v10/effect): Capture errors through the Effect v4 ErrorReporter API (#24...
  • 738f17e fix(v10/core): Don't instrument the SDK's own envelope requests (#24276)
  • f63c56a fix(v10/node-core): Don't recurse in logAndExitProcess on a broken stdio pipe...
  • 0e24355 fix(v10/browser-utils): Skip nullish LCP entries in vendored web-vitals (#24349)
  • ac3ea13 fix(v10/nuxt): Detect Nitro version via the app's Nuxt dependency chain (#24025)
  • 9235d43 fix(v10/nextjs): Only include emitted chunk directories in Turbopack sourcema...
  • e2deda0 feat(v10/core): Accept CollectBehavior shorthand for `dataCollection.httpHe...
  • Additional commits viewable in compare view

Updates @tanstack/react-query from 5.102.8 to 5.103.1

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.103.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.103.1
    • @​tanstack/react-query@​5.103.1

@​tanstack/react-query-next-experimental@​5.103.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.103.1

@​tanstack/react-query-persist-client@​5.103.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-persist-client-core@​5.103.1
    • @​tanstack/react-query@​5.103.1

@​tanstack/react-query@​5.103.1

Patch Changes

@​tanstack/react-query-devtools@​5.103.0

Patch Changes

  • #11501 9567367 - Declare dependencies used by the published devtools source and type declarations so they resolve with strict package managers. Keep runtime dependencies bundled in the compiled devtools.

    Declare the React types used by React Query Devtools as a peer dependency, compatible with React 18 and 19.

  • Updated dependencies [9567367]:

    • @​tanstack/query-devtools@​5.103.0
    • @​tanstack/react-query@​5.103.0

@​tanstack/react-query-next-experimental@​5.103.0

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.103.0

@​tanstack/react-query-persist-client@​5.103.0

Patch Changes

  • Updated dependencies [4c7cdbb]:
    • @​tanstack/query-persist-client-core@​5.103.0
    • @​tanstack/react-query@​5.103.0

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.103.1

Patch Changes

5.103.0

Patch Changes

Commits
  • c08f576 ci: Version Packages (#11511)
  • 19ccf27 ci: Version Packages (#11339)
  • 2da46cd chore(*): use eslint description syntax for grandfathered 'no-restricted-synt...
  • 58ad3e2 fix: isolate TypeScript test output (#11503)
  • d63afc7 Simplifed query methods/internal tests new lint (#11347)
  • 23fbdc3 test({react,preact,solid,angular}-query): remove 'fromGenericOptionsQueryFn' ...
  • 50680b9 test({react,preact,solid,svelte}-query,angular-query-experimental): rename 'm...
  • 0b326b6 test({react,preact}-query/useMutation): add tests for 'MutationFunctionContex...
  • a1119e5 ref(hydration): remove outdated dehydratedAt fallback (#11436)
  • 1a51bb8 docs(*): clarify 'Promise.all' only waits for all mutateAsync calls when they...
  • Additional commits viewable in compare view

Updates google-auth-library from 11.0.2 to 11.1.0

Release notes

Sourced from google-auth-library's releases.

google-auth-library: v11.1.0

11.1.0 (2026-09-15)

Features

Changelog

Sourced from google-auth-library's changelog.

11.1.0 (2026-09-15)

Features

Commits

Updates kysely from 0.29.5 to 0.29.6

Release notes

Sourced from kysely's releases.

0.29.6

Hey 👋

A small batch of bug fixes. Please report any issues. 🤞😰🤞

🚀 Features

🐞 Bugfixes

PostgreSQL 🐘 / SQLite 📘

📖 Documentation

📦 CICD & Tooling

⚠️ Breaking Changes

🐤 New Contributors

What's Changed

Full Changelog: kysely-org/kysely@v0.29.5...v0.29.6

Commits
  • 2fefd4c 0.29.6
  • 2feb1f3 chore: bumps dependencies. (#2045)
  • b596221 fix: allow immutable columns in doUpdateSet's where. (#2043)
  • b9674df chore(CONTRIBUTING): llm contribution farming accounts.
  • 90fe25c chore(deps): bump github/codeql-action/upload-sarif from 4.37.6 to 4.37.7 in ...
  • 6582fb6 chore(deps-dev): bump tsx from 4.23.11 to 4.23.12 (#1984)
  • b497657 chore(deps-dev): bump shiki from 4.4.2 to 4.4.3 (#1982)
  • 44c4782 chore(deps): bump step-security/harden-runner from 2.20.1 to 2.21.0 (#1987)
  • 20e5d15 chore(deps-dev): bump mysql2 from 3.23.2 to 3.23.3 (#1983)
  • 93cb9ad Update link to Migrator API docs (#1991)
  • Additional commits viewable in compare view

Updates lucide-react from 1.46.0 to 1.47.0

Release notes

Sourced from lucide-react's releases.

Version 1.47.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.46.0...1.47.0

Commits

Updates mapbox-gl from 3.30.0 to 3.31.0

Release notes

Sourced from mapbox-gl's releases.

v3.31.0

Features and improvements ✨

  • Significantly improve GeoJSON memory footprint.
  • Reduce landmark model memory usage.
  • Remove the experimental flag from raster-allow-draping.
  • Add support for emissive MRT in custom layers.

Bug fixes 🐞

  • Fix transformRequest headers/credentials being dropped when loading GL model (GLTF) resources.
  • Fix removeSource throwing under globe projection. (h/t @​mhayk)

v3.31.0-rc.1

Features and improvements ✨

  • Significantly improve GeoJSON memory footprint.
  • Reduce landmark model memory usage.
  • Remove the experimental flag from raster-allow-draping.
  • Add support for emissive MRT in custom layers.

Bug fixes 🐞

  • Fix removeSource throwing under globe projection. (h/t @​mhayk)
Changelog

Sourced from mapbox-gl's changelog.

3.31.0

Features and improvements ✨

  • Significantly improve GeoJSON memory footprint.
  • Reduce landmark model memory usage.
  • Remove the experimental flag from raster-allow-draping.
  • Add support for emissive MRT in custom layers.

Bug fixes 🐞

  • Fix transformRequest headers/credentials being dropped when loading GL model (GLTF) resources.
  • Fix removeSource throwing under globe projection. (h/t @​mhayk)
Commits
  • ae6c3e2 v3.31.0. Bump versions
  • 537ef03 Skip HD tiles and flatten when no provider is visible
  • 9709f42 [DRIVE3D-3870] Fix carpet view-depth bias in tunnels
  • 958340f GL JS v3.31.0-rc.1
  • a06fa9c Bump @​mapbox/mapbox-gl-supported from 4.0.0 to 4.1.0 (internal-18833)
  • 75c9a7e Bump the eslint-dependencies group with 4 updates (internal-18830)
  • 4bf6135 Bump postcss-cli from 11.0.1 to 12.0.0 (internal-18834)
  • 135cb5e Fix crash when a landmarks don't have height data on a node
  • ab89e66 Update changelog
  • 83159a4 Bump cssnano from 9.0.1 to 9.0.2 (internal-18836)
  • Additional commits viewable in compare view

Updates pg-boss from 12.32.0 to 12.33.1

Release notes

Sourced from pg-boss's releases.

12.33.1

Schema version: 42 — unchanged from 12.33.0, so no migration runs on upgrade.

Three fixes to the timers behind pg-boss's background passes, the first of which was skipping an interval of work on a healthy deployment.

Interval passes keep their cadence

Each background pass — cron, queue monitoring, maintenance, flow resolution, BAM, index rebuilds — is claimed by one instance per interval. That claim was being refused whenever a tick's statement reached the server a few milliseconds faster than the previous tick's had, and the next pass then came a whole interval late. On an idle Linux box at a 45-second cron interval, 4 of every 19 ticks.

What it cost:

  • Scheduled jobs, on deployments that increased cronMonitorIntervalSeconds above the default of 30 seconds. Each scheduling pass sends the occurrences of the preceding 60 seconds, so at the default of 30 seconds a skipped pass leaves a gap the window still covers and nothing is lost. Set above 30, two intervals outgrow that window, and occurrences falling in the gap were missed.
  • Queue monitoring. superviseIntervalSeconds and monitorIntervalSeconds both default to 60, which gave that claim the same shape and lost about a quarter of its passes: gaps in queue_stats, and job expiry, heartbeat failure and deletion each deferred an interval.

Each timer now schedules its next attempt from the moment its claim stamped the row rather than on a fixed grid, so the gap between two passes can only come out long, never short. Nothing runs early — the claim still refuses anything short of the full interval.

Thanks to @​toruiwasa for #905, which found and diagnosed this.

TestClock runs a pass on every tick

A real clock never lands on exactly the interval; a fake one lands there every time, and the claim refused it. A test that ticked one cronMonitorIntervalSeconds got no cron pass, and a pass ran on every other tick.

A tick now produces a pass. A suite written against 12.33.0 that ticks twice to get one pass now gets two, so counts and timings asserted around that shift by an interval — tick once per expected pass.


Full Changelog: timgit/pg-boss@12.33.0...12.33.1

12.33.0

Schema version: 42 (a migration runs on upgrade — see Upgrading).

  • Time is now an injectable dependency on both sides of the connection, so a test can drive a queue to its next poll, retry, expiration or schedule without waiting for it.

Highlights

TestClock: tests that do not wait

pg-boss by its definition is very concerned about watching the clock. A worker's next poll, a job's startAfter, a retry delay, a handler's expiration, a schedule's next minute. Until now the only way to test any of it was to sleep for real, so suites were slow where they were not flaky.

TestClock puts that clock in the test's hands. Pass one as the new clock constructor option and time moves only when the test says so:

import { PgBoss, TestClock } from 'pg-boss'
const clock = new TestClock('2026-01-01T00:00:00Z')
const boss = new PgBoss({ connectionString, clock, __test__enableSpies: true })
await boss.start()
await boss.work('q', async () => {})
const id = await boss.send('q', {}, { startAfter: 60 })
</tr></table>

... (truncated)

Commits
  • 5bb7a00 Merge pull request #906 from timgit/claim-timer-anchor
  • f24616a versioning for release
  • 57b0b09 fix(clock): accept a claim at exactly the interval, for TestClock
  • 2376d14 fix: anchor the interval claims to the claim instead of a fixed grid
  • f4233b2 add crdb migration test to ci
  • d63ae11 Merge pull request #904 from timgit/clock-followups
  • 5d4faf8 fix(clock): undo the session opt-in whatever happens to the release
  • 569fd86 fix(clock): seed the clock row in the batch that installs the override
  • 4cb89e5 fix(pglite): wait out every reapply a leader change starts
  • 57ebc6b updates from review
  • Additional commits viewable in compare view

Updates posthog-js from 1.433.1 to 1.434.0

Release notes

Sourced from posthog-js's releases.

posthog-js@1.434.0

1.434.0

Minor Changes

  • #5014 5e86154 Thanks @​pauldambra! - Rename the metrics.network default attributes to the OTel HTTP client semantic conventions: http.request.method, server.address, server.port, url.scheme, url.template, http.response.status_code and error.type replace method, host, path and status_class. (2026-09-17)

Patch Changes

  • Updated dependencies [5e86154]:
    • @​posthog/types@​1.412.2

posthog-js@1.433.10

1.433.10

Patch Changes

  • #4960 c8e53fa Thanks @​posthog! - Log a console warning when session replay stops capturing canvas frames (browser without OffscreenCanvas, a CSP that blocks blob: workers, or a failing canvasCapture.maskRegionsFn), and stop changing WebGL and WebGPU canvas settings when canvas capture fails to start (2026-09-17)

  • #4977 0257a29 Thanks @​lucasheriques! - Share survey choice and question shuffling between web and React Native through surveys core. Use Fisher-Yates for web questions, preserve Other-last choice ordering, and avoid mutating configured choices. (2026-09-17)

  • Updated dependencies [0257a29]:

    • @​posthog/core@​1.54.4

posthog-js@1.433.9

1.433.9

Patch Changes

  • #5007 c3043f4 Thanks @​marandaneto! - Add a session diagnostic when stale replay configuration cannot be refreshed, without changing recording behavior. (2026-09-17)

posthog-js@1.433.8

1.433.8

Patch Changes

  • #4709 c1d1faf Thanks @​posthog! - Prefer synchronous compression for events captured with send_instantly, including the initial $pageview, to avoid delaying request dispatch on asynchronous compression. (2026-09-17)

posthog-js@1.433.7

1.433.7

Patch Changes

  • #4979 c767b98 Thanks @​darkopia! - fix(surveys): keep URL prefill working when localStorage is unavailable, such as on a page with an opaque origin or in private browsing (2026-09-16)
  • Updated dependencies [2828b6b]:

... (truncated)

Commits
  • 90c7afb chore: update versions and lockfile [version bump]
  • 5e86154 feat(metrics): use OTel attribute names for network request durations (#5014)
  • 3fb8954 chore: update versions and lockfile [version bump]
  • be40430 chore(mcp): enable model capture and conversation correlation by default (#4924)
  • d5123fc chore: update versions and lockfile [version bump]
  • 614e508 fix(react-native): compose source maps after Babel transforms (#5006)
  • 63944c7 chore: update versions and lockfile [version bump]
  • c8e53fa fix(replay): make canvas capture failures self-diagnosable (#4960)
  • 0257a29 refactor(surveys): share shuffling across web and React Native (#4977)
  • 63f55dc chore: update versions and lockfile [version bump]
  • Additional commits viewable in compare view

Updates posthog-node from 5.52.2 to 5.52.4

Release notes

Sourced from posthog-node's releases.

posthog-node@5.52.4

5.52.4

Patch Changes

  • #4885 39a8980 Thanks @​decknamec! - Server-side feature flags now resolve in posthog-node and posthog-edge even when a proxy rewrites the request's User-Agent. Flags restricted to the client runtime now resolve to undefined in these SDKs, where a rewritten User-Agent previously let them through. (2026-09-15)
  • Updated dependencies [39a8980]:
    • @​posthog/core@​1.54.2

posthog-node@5.52.3

5.52.3

Patch Changes

  • #4941 07c1045 Thanks @​marandaneto! - Capture causes and AggregateError members with relationship metadata and individual stacks, limiting output to 50 entries and 1,000 member inspections. (2026-09-15)
  • Updated dependencies [07c1045]:
    • @​posthog/core@​1.54.1
Changelog

Sourced from posthog-node's changelog.

5.52.4

Patch Changes

  • #4885 39a8980 Thanks @​decknamec! - Server-side feature flags now resolve in posthog-node and posthog-edge even when a proxy rewrites the request's User-Agent. Flags restricted to the client runtime now resolve to undefined in these SDKs, where a rewritten User-Agent previously let them through. (2026-09-15)
  • Updated dependencies [39a8980]:
    • @​posthog/core@​1.54.2

5.52.3

Patch Changes

  • #4941 07c1045 Thanks @​marandaneto! - Capture causes and AggregateError members with relationship metadata and individual stacks, limiting output to 50 entries and 1,000 member inspections. (2026-09-15)
  • Updated dependencies [07c1045]:
    • @​posthog/core@​1.54.1
Commits
  • bba9db4 chore: update versions and lockfile [version bump]
  • 39a8980 fix(core): declare the evaluation runtime on /flags requests (#4885)
  • 8aecf43 chore: update versions and lockfile [version bump]
  • 07c1045 fix(error-tracking): link causes and aggregate members in one event (#4941)
  • See full diff in compare view

Updates @types/nodemailer from 8.0.1 to 8.0.2

Commits

Updates jsdom from 30.0.1 to 30.1.0

Release notes

Sourced from jsdom's releases.

v30.1.0

jsdom is feeling the AGI!

This release is dedicated to @​scttcper, who unleashed @​codex upon jsdom and found tons of performance improvements. Along the way, he found and fixed many correctness issues as well.

We really appreciate his thoughtful PRs, which did a great job following the project's contribution guidelines, and were clearly human-curated, with their PR descriptions edited to be brief and respectful of the maintainers' time.

Thanks to @​scttcper, as well as all the other contributors of this release (most of whom were AI-assisted).

  • Added named access to elements on document, such as document.myForm for <form name="myForm">. (@​vojtisprime11)
  • Added QuotaExceededError, including its use for storage quota errors and oversized crypto.getRandomValues() requests.
  • Added support for the relaxed DOM naming rules when creating elements, attributes, and document types.
  • Improved performance of DOM construction, tree mutations, range operations, and live collection access, especially on large documents. (@​scttcper, @​erezrokah)
  • Improved performance of getComputedStyle(), style changes, and CSS serialization. (@​scttcper, @​jhult)
  • Improved performance of event dispatch, form control and label lookups, and updates to <select> elements and radio button groups. (@​scttcper)
  • Reduced memory use when creating and working with DOM nodes, attributes, event listeners, and mutation observers. (@​scttcper)
  • Changed window.close() to preserve access to the document and its DOM through retained references.
  • Fixed element.querySelectorAll() returning no matches when the first part of the selector matches the element itself, which regressed in v30.0.0. (@​asamuzaK)
  • Fixed case sensitivity in CSS attribute selectors, including selectors matching data-state="", title="", and other case-sensitive values. (@​asamuzaK)
  • Fixed document.querySelector() failing to find a matching element when an earlier element has the same ID but does not match the rest of the selector. (@​vojtisprime11)
  • Fixed :focus matching in shadow trees. (@​asamuzaK)
  • Fixed DOM insertion and replacement, including valid document.replaceChildren() calls, invalid document element and doctype placements, and mutations during element.replaceWith().
  • Fixed the ordering of script execution, custom element callbacks, iframe loading, and mutation observer notifications during DOM insertion, including in shadow trees.
  • Fixed queued events and navigation continuing after window.close() or iframe removal, and prevented new scripts, resource loads, timers, and animation frames from starting in destroyed documents. (@​scttcper)
  • Fixed parent documents waiting indefinitely for loading to finish when a child iframe removes itself during loading.
  • Fixed request cancellation across redirects, during pending requestInterceptor() callbacks, and when reusing an XMLHttpRequest after aborting it.
  • Fixed resource loading and JSDOM.fromURL() potentially hanging when response handling throws and response stream cleanup does not finish.
  • Fixed successful cached resource loads being treated as aborted.
  • Fixed getComputedStyle() and document.styleSheets using the wrong stylesheet order after inserting or updating <style> elements.
  • Fixed getComputedStyle() ignoring nested @import and @media rules in imported stylesheets, and returning stale results after imports finish loading.
  • Fixed style invalidation, stylesheet removal, and frame source updates in shadow trees.
  • Fixed repeated getComputedStyle() calls changing case-sensitive background URLs, and inconsistent resolution of border shorthands containing system colors. (@​scttcper)
  • Fixed computed border widths, including borderless elements incorrectly reporting 16px, which regressed in v30.0.0. (@​Alberto-BaseNet)
  • Fixed getComputedStyle() to resolve 'font-weight' keywords to numeric values. (@​tianrking)
  • Fixed getComputedStyle() to convert lengths to pixels inside CSS math functions containing percentages, and to resolve percentages in 'font-size' math functions. (@​soroushm)
  • Fixed serialization of min() and max() containing nested calc(), which regressed in v30.0.0. (@​asamuzaK)
  • Fixed CSS values mixing lengths or percentages with math functions, such as 'grid-template-columns' values containing both 100px and calc(). (@​rome-xi)
  • Fixed parsing of 'background' and 'border' shorthands with adjacent components, such as url(a.png)no-repeat, including a crash when parsing inline styles. Also fixed handling of invalid shorthand assignments and escaped or unusual characters in CSS declarations. (@​asamuzaK)
  • Fixed parsing of unitless zero values in 'flex' shorthands, such as 35 1 0, and rejection of negative 'flex-basis' lengths and percentages. (@​asamuzaK)
  • Fixed shorthand style assignments producing extra mutation records and custom element callbacks for intermediate values. (@​scttcper)
  • Fixed Range and Selection handling of CDATA sections, including boundary offsets and range cloning, extraction, deletion, insertion, and stringification. (@​scttcper)
  • Fixed text.normalize() incorrectly removing the text node or merging its siblings. (@​scttcper)
  • Fixed cloning and importing CDATA sections and processing instructions whose contents have been modified, and serialization of CDATA sections adopted into HTML documents.
  • Fixed stale named-property collections on window, and incorrect named access from empty or namespaced id="" and name="" values. (@​scttcper)
  • Fixed elements in documents created with DOMParser or document.implementation.createHTMLDocument() appearing as named properties on window and being retained in memory. (@​Iaotle)
  • Fixed memory leaks from mutation observers retaining observed nodes, abort signals retaining removed event listeners, and storage event tracking retaining closed windows. (@​scttcper)
  • Fixed storage even...

    Description has been truncated

Bumps the minor-and-patch group with 13 updates:

| Package | From | To |
| --- | --- | --- |
| [@mux/mux-player-react](https://github.com/muxinc/elements/tree/HEAD/packages/mux-player-react) | `3.13.3` | `3.13.4` |
| [@sentry/nextjs](https://github.com/getsentry/sentry-javascript) | `10.74.0` | `10.75.0` |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.102.8` | `5.103.1` |
| [google-auth-library](https://github.com/googleapis/google-cloud-node/tree/HEAD/core/packages/google-auth-library-nodejs) | `11.0.2` | `11.1.0` |
| [kysely](https://github.com/kysely-org/kysely) | `0.29.5` | `0.29.6` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.46.0` | `1.47.0` |
| [mapbox-gl](https://github.com/mapbox/mapbox-gl-js) | `3.30.0` | `3.31.0` |
| [pg-boss](https://github.com/timgit/pg-boss) | `12.32.0` | `12.33.1` |
| [posthog-js](https://github.com/PostHog/posthog-js) | `1.433.1` | `1.434.0` |
| [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.52.2` | `5.52.4` |
| [@types/nodemailer](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/nodemailer) | `8.0.1` | `8.0.2` |
| [jsdom](https://github.com/jsdom/jsdom) | `30.0.1` | `30.1.0` |
| [prettier](https://github.com/prettier/prettier) | `3.9.6` | `3.9.8` |


Updates `@mux/mux-player-react` from 3.13.3 to 3.13.4
- [Release notes](https://github.com/muxinc/elements/releases)
- [Changelog](https://github.com/muxinc/elements/blob/main/packages/mux-player-react/CHANGELOG.md)
- [Commits](https://github.com/muxinc/elements/commits/@mux/mux-player-react@3.13.4/packages/mux-player-react)

Updates `@sentry/nextjs` from 10.74.0 to 10.75.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.75.0/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.74.0...10.75.0)

Updates `@tanstack/react-query` from 5.102.8 to 5.103.1
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.103.1/packages/react-query)

Updates `google-auth-library` from 11.0.2 to 11.1.0
- [Release notes](https://github.com/googleapis/google-cloud-node/releases)
- [Changelog](https://github.com/googleapis/google-cloud-node/blob/main/core/packages/google-auth-library-nodejs/CHANGELOG.md)
- [Commits](https://github.com/googleapis/google-cloud-node/commits/google-auth-library-v11.1.0/core/packages/google-auth-library-nodejs)

Updates `kysely` from 0.29.5 to 0.29.6
- [Release notes](https://github.com/kysely-org/kysely/releases)
- [Commits](kysely-org/kysely@v0.29.5...v0.29.6)

Updates `lucide-react` from 1.46.0 to 1.47.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.47.0/packages/lucide-react)

Updates `mapbox-gl` from 3.30.0 to 3.31.0
- [Release notes](https://github.com/mapbox/mapbox-gl-js/releases)
- [Changelog](https://github.com/mapbox/mapbox-gl-js/blob/main/CHANGELOG.md)
- [Commits](mapbox/mapbox-gl-js@v3.30.0...v3.31.0)

Updates `pg-boss` from 12.32.0 to 12.33.1
- [Release notes](https://github.com/timgit/pg-boss/releases)
- [Commits](timgit/pg-boss@12.32.0...12.33.1)

Updates `posthog-js` from 1.433.1 to 1.434.0
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.433.1...posthog-js@1.434.0)

Updates `posthog-node` from 5.52.2 to 5.52.4
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.52.4/packages/node)

Updates `@types/nodemailer` from 8.0.1 to 8.0.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/nodemailer)

Updates `jsdom` from 30.0.1 to 30.1.0
- [Release notes](https://github.com/jsdom/jsdom/releases)
- [Commits](jsdom/jsdom@v30.0.1...v30.1.0)

Updates `prettier` from 3.9.6 to 3.9.8
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.9.6...3.9.8)

---
updated-dependencies:
- dependency-name: "@mux/mux-player-react"
  dependency-version: 3.13.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@sentry/nextjs"
  dependency-version: 10.75.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.103.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: google-auth-library
  dependency-version: 11.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: kysely
  dependency-version: 0.29.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: lucide-react
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: mapbox-gl
  dependency-version: 3.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: pg-boss
  dependency-version: 12.33.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: posthog-js
  dependency-version: 1.434.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: posthog-node
  dependency-version: 5.52.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@types/nodemailer"
  dependency-version: 8.0.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: jsdom
  dependency-version: 30.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: prettier
  dependency-version: 3.9.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 21, 2026
joaquimds added a commit that referenced this pull request Sep 22, 2026
…ride

Combines the four green Dependabot PRs into one lockfile:
- minor-and-patch group (13 updates, #500)
- sanity 6.13.2 -> 6.15.0 (#501)
- trpc 11.18.0 -> 11.19.0 (#502)
- vitest 5.0.1, @vitejs/plugin-react 5.2.0 -> 6.1.1 (#503)

Replaces the @sanity/runtime-cli-scoped adm-zip override with a global
^0.6.1 override so @module-federation/dts-plugin also picks up the fix
for GHSA-7q85-xj36-vmfc (high). npm audit drops from 14 findings to 6.

The remaining 6 are transitive via minio (query-string, stream-json)
and @react-email/preview-server (esbuild); the patched releases are
ESM-only or major bumps that would break the CommonJS consumers, so
they wait on upstream.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@joaquimds

Copy link
Copy Markdown
Member

Superseded by #507 (combined dependency sweep).

@joaquimds joaquimds closed this Sep 22, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 22, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/minor-and-patch-5e19003607 branch September 22, 2026 14:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant