Skip to content

chore(deps): bump the dependencies-minor-patch group with 4 updates#353

Merged
quiet-node merged 2 commits into
mainfrom
dependabot/npm_and_yarn/dependencies-minor-patch-ce847ab5ef
Jul 21, 2026
Merged

chore(deps): bump the dependencies-minor-patch group with 4 updates#353
quiet-node merged 2 commits into
mainfrom
dependabot/npm_and_yarn/dependencies-minor-patch-ce847ab5ef

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 21, 2026

Copy link
Copy Markdown
Contributor

Bumps the dependencies-minor-patch group with 4 updates: @lexical/react, katex, lexical and @eslint-react/eslint-plugin.

Updates @lexical/react from 0.47.0 to 0.48.0

Release notes

Sourced from @​lexical/react's releases.

v0.48.0 is a maintenance release focused on bug fixes across Markdown, tables, lists, links, and selection. It's headlined by a fix for a v0.46.0 regression that broke native text drag-and-drop (#8842) and a couple of notable security hardening fixes. It also adds a handful of new features, including an MdastHtmlExtension with examples for authoring custom Markdown constructs (collapsibles, kbd, alerts, footnotes), a customizable Yjs shared-type root name for collaborative editing, and new table row manipulation helpers.

New APIs & Features

Notable Fixes

Drag & drop (fix for v0.46.0 regression)

  • Don't cancel dragover for text drags, so native drops work again (#8842)

Security

  • LinkNode.sanitizeUrl() now fails closed on unparseable URLs, preventing a potential XSS vector (#8846)
  • Fixed a serialize-javascript dependency vulnerability (#8803)

Markdown & code

  • Roundtrip overlapping inline formats correctly through mdast/Markdown (#8825)
  • Force re-tokenization after an async language load so highlighting appears once the grammar is ready (#8830)

Tables

  • Auto-scroll while drag-selecting cells past the visible edge (#8822)
  • Enable table copy in read-only mode (#8845)

Lists & character limit

  • Backspace at the start of a list item now outdents or converts to a paragraph (#8829)
  • Merge adjacent OverflowNodes in useCharacterLimit (#8831)
  • Count block separators when wrapping character-limit overflow (#8840)

Links & selection

  • Disable link opening for disabled autolinks (#8839)
  • Skip scrollIntoViewIfNeeded when the selection rect is above the editor, fixing a Safari RTL caret jump (#8848)

What's Changed

... (truncated)

Changelog

Sourced from @​lexical/react's changelog.

v0.48.0 (2026-07-16)

  • lexical-reactlexical-table Bug Fix Enable table copy in read-only mode (#8845) mayrang
  • lexical-extensionlexical-mdastdev-mdast-editor-example Feature Add MdastHtmlExtension and Markdown custom-construct examples (collapsible, kbd, alerts, footnotes) (#8826) Bob Ippolito
  • Fix fail closed in LinkNode.sanitizeUrl() on unparseable URLs (XSS) (#8846) xiezhenjia-meta
  • lexical Chore Fix serialize-javascript package dependency vulnerability (#8803) vijay ojha
  • lexical-react Bug Fix Count block separators in character limit overflow wrapping (#8840) mayrang
  • lexical-yjslexical-react Feature Customizable Yjs shared-type root name (#8841) mayrang
  • lexical-list Bug Fix Backspace at start of list item outdents or converts to paragraph (#8829) mayrang
  • lexical-table Feature Add moveTableRow function Add missing export for unmergeCellNode (#8833)
  • lexical-link Bug Fix disable link opening for disabled autolink in (#8839) Olivier Chevallier
  • lexical-rich-textlexical-plain-text Bug Fix dont cancel dragover for text drags so native drops work again (#8842) Bob Ippolito
  • Open playground links in a new tab (#8837) Sherry
  • lexical-react Bug Fix Merge adjacent OverflowNodes in useCharacterLimit (#8831) mayrang
  • lexical-code-shiki Bug Fix force re-tokenize after async language load (#8830) Olivier Chevallier
  • lexical-tablelexical-playground Bug Fix Auto-scroll while drag-selecting cells past the visible edge (#8822) Oleksandr Trukhnii
  • lexical-mdastlexical-markdown Bug Fix Roundtrip overlapping inline formats (#8825) Bob Ippolito
  • v0.47.0 (#8821) Bob Ippolito
  • v0.47.0 Lexical GitHub Actions Bot
Commits
  • 284b749 v0.48.0
  • 91aa5cd [lexical-react][lexical-table] Bug Fix: Enable table copy in read-only mode (...
  • 4242f42 [lexical-react] Bug Fix: Count block separators in character limit overflow w...
  • b1e5698 [lexical-yjs][lexical-react] Feature: Customizable Yjs shared-type root name ...
  • eef6c49 [lexical-react] Bug Fix: Merge adjacent OverflowNodes in useCharacterLimit (#...
  • e4b7cc3 v0.47.0 (#8821)
  • See full diff in compare view

Updates katex from 0.17.0 to 0.18.1

Release notes

Sourced from katex's releases.

v0.18.1

0.18.1 (2026-07-19)

Bug Fixes

v0.18.0

0.18.0 (2026-07-17)

Features

BREAKING CHANGES

  • users who apply custom styles or have allowlists targeting KaTeX's internal classes must update their selectors.
Changelog

Sourced from katex's changelog.

0.18.1 (2026-07-19)

Bug Fixes

0.18.0 (2026-07-17)

Features

BREAKING CHANGES

  • users who apply custom styles or have allowlists targeting KaTeX's internal classes must update their selectors.
Commits
  • cdf479f chore(release): 0.18.1 [ci skip]
  • 87a2b30 fix(htmlData): allow escaped commas in \htmlData (#4236)
  • 2318066 chore(deps): bump codecov/codecov-action from 6 to 7 (#4227)
  • 3b5b6a0 chore(deps): bump actions/checkout from 6 to 7 (#4232)
  • 4e9d31a chore(deps): update dependency js-yaml to v4.2.0 [security] (#4244)
  • b7ca8f0 chore(deps): update dependency webpack-dev-server to v5.2.5 [security] (#4242)
  • bf1a59f chore: use pixel diff as fallback for byte-to-byte (#4245)
  • 4d9d0ae chore(release): 0.18.0 [ci skip]
  • 6f5c44f feat: prefix css classes (#4229)
  • 2c6143a refactor: remove direct hasOwnProperty call (#4230)
  • Additional commits viewable in compare view
Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates lexical from 0.47.0 to 0.48.0

Release notes

Sourced from lexical's releases.

v0.48.0 is a maintenance release focused on bug fixes across Markdown, tables, lists, links, and selection. It's headlined by a fix for a v0.46.0 regression that broke native text drag-and-drop (#8842) and a couple of notable security hardening fixes. It also adds a handful of new features, including an MdastHtmlExtension with examples for authoring custom Markdown constructs (collapsibles, kbd, alerts, footnotes), a customizable Yjs shared-type root name for collaborative editing, and new table row manipulation helpers.

New APIs & Features

Notable Fixes

Drag & drop (fix for v0.46.0 regression)

  • Don't cancel dragover for text drags, so native drops work again (#8842)

Security

  • LinkNode.sanitizeUrl() now fails closed on unparseable URLs, preventing a potential XSS vector (#8846)
  • Fixed a serialize-javascript dependency vulnerability (#8803)

Markdown & code

  • Roundtrip overlapping inline formats correctly through mdast/Markdown (#8825)
  • Force re-tokenization after an async language load so highlighting appears once the grammar is ready (#8830)

Tables

  • Auto-scroll while drag-selecting cells past the visible edge (#8822)
  • Enable table copy in read-only mode (#8845)

Lists & character limit

  • Backspace at the start of a list item now outdents or converts to a paragraph (#8829)
  • Merge adjacent OverflowNodes in useCharacterLimit (#8831)
  • Count block separators when wrapping character-limit overflow (#8840)

Links & selection

  • Disable link opening for disabled autolinks (#8839)
  • Skip scrollIntoViewIfNeeded when the selection rect is above the editor, fixing a Safari RTL caret jump (#8848)

What's Changed

... (truncated)

Changelog

Sourced from lexical's changelog.

v0.48.0 (2026-07-16)

  • lexical-reactlexical-table Bug Fix Enable table copy in read-only mode (#8845) mayrang
  • lexical-extensionlexical-mdastdev-mdast-editor-example Feature Add MdastHtmlExtension and Markdown custom-construct examples (collapsible, kbd, alerts, footnotes) (#8826) Bob Ippolito
  • Fix fail closed in LinkNode.sanitizeUrl() on unparseable URLs (XSS) (#8846) xiezhenjia-meta
  • lexical Chore Fix serialize-javascript package dependency vulnerability (#8803) vijay ojha
  • lexical-react Bug Fix Count block separators in character limit overflow wrapping (#8840) mayrang
  • lexical-yjslexical-react Feature Customizable Yjs shared-type root name (#8841) mayrang
  • lexical-list Bug Fix Backspace at start of list item outdents or converts to paragraph (#8829) mayrang
  • lexical-table Feature Add moveTableRow function Add missing export for unmergeCellNode (#8833)
  • lexical-link Bug Fix disable link opening for disabled autolink in (#8839) Olivier Chevallier
  • lexical-rich-textlexical-plain-text Bug Fix dont cancel dragover for text drags so native drops work again (#8842) Bob Ippolito
  • Open playground links in a new tab (#8837) Sherry
  • lexical-react Bug Fix Merge adjacent OverflowNodes in useCharacterLimit (#8831) mayrang
  • lexical-code-shiki Bug Fix force re-tokenize after async language load (#8830) Olivier Chevallier
  • lexical-tablelexical-playground Bug Fix Auto-scroll while drag-selecting cells past the visible edge (#8822) Oleksandr Trukhnii
  • lexical-mdastlexical-markdown Bug Fix Roundtrip overlapping inline formats (#8825) Bob Ippolito
  • v0.47.0 (#8821) Bob Ippolito
  • v0.47.0 Lexical GitHub Actions Bot
Commits

Updates @eslint-react/eslint-plugin from 5.14.8 to 5.17.3

Release notes

Sourced from @​eslint-react/eslint-plugin's releases.

v5.17.3 (2026-07-20)

What's Changed

🏗️ Internal

  • @eslint-react/ast: reworked the Extract API — replaced getRootIdentifier with the position-based getIdentifierAt, renamed getStaticPropertyName to getPropertyName (with a min/max effort option), and added findProperty for finding properties in nested object expressions; added Check.isConditional for matching conditional expressions and control flow statements. (#1918)
  • Bumped eslint-plugin-jsdoc to 63.1.0, expect-type to 1.4.0, @preact/preset-vite to 2.10.6, and pnpm to 11.15.0.

Full Changelog: Rel1cx/eslint-react@v5.17.2...v5.17.3

Attestation

https://github.com/Rel1cx/eslint-react/attestations/36106563

v5.17.2 (2026-07-19)

What's Changed

📝 Documentation

  • @eslint-react/kit: added a README with quick start and API overview.

🏗️ Internal

  • @eslint-react/core: migrated JsxDetectionHint and related JSX detection helpers from @eslint-react/jsx. (#1913)
  • @eslint-react/jsx: consolidated helpers into focused attribute, children, element, and text modules. (#1914)
  • @eslint-react/var: renamed computeObjectType to resolveObjectType.
  • @local/testkit: extracted shared test helpers into a new local package. (#1915)
  • Bumped tsdown to 0.22.9, eslint-plugin-jsdoc to 63.0.14, and pnpm to 11.13.1.

Full Changelog: Rel1cx/eslint-react@v5.17.1...v5.17.2

Attestation

https://github.com/Rel1cx/eslint-react/attestations/36041651

v5.17.1 (2026-07-17)

What's Changed

🏗️ Internal

  • react-jsx/no-key-after-spread: reworked the attribute scan to a pipeline style using dropWhile and not from @local/eff, Check.is from @eslint-react/ast, and the new isAttribute helper from @eslint-react/jsx. (#1912)
  • @eslint-react/jsx: added isAttribute for matching JSX attributes by name.
  • @local/eff: added dropWhile and takeWhile.
  • Bumped tsdown to 0.22.8, tsl-dx to 0.13.3, import-integrity-lint to 1.1.4, fumadocs to 16.11.5, and fumadocs-mdx to 15.2.0.

... (truncated)

Changelog

Sourced from @​eslint-react/eslint-plugin's changelog.

v5.17.3 (2026-07-20)

🏗️ Internal

  • @eslint-react/ast: reworked the Extract API — replaced getRootIdentifier with the position-based getIdentifierAt, renamed getStaticPropertyName to getPropertyName (with a min/max effort option), and added findProperty for finding properties in nested object expressions; added Check.isConditional for matching conditional expressions and control flow statements. (#1918)
  • Bumped eslint-plugin-jsdoc to 63.1.0, expect-type to 1.4.0, @preact/preset-vite to 2.10.6, and pnpm to 11.15.0.

Full Changelog: Rel1cx/eslint-react@v5.17.2...v5.17.3

v5.17.2 (2026-07-19)

📝 Documentation

  • @eslint-react/kit: added a README with quick start and API overview.

🏗️ Internal

  • @eslint-react/core: migrated JsxDetectionHint and related JSX detection helpers from @eslint-react/jsx. (#1913)
  • @eslint-react/jsx: consolidated helpers into focused attribute, children, element, and text modules. (#1914)
  • @eslint-react/var: renamed computeObjectType to resolveObjectType.
  • @local/testkit: extracted shared test helpers into a new local package. (#1915)
  • Bumped tsdown to 0.22.9, eslint-plugin-jsdoc to 63.0.14, and pnpm to 11.13.1.

Full Changelog: Rel1cx/eslint-react@v5.17.1...v5.17.2

v5.17.1 (2026-07-17)

🏗️ Internal

  • react-jsx/no-key-after-spread: reworked the attribute scan to a pipeline style using dropWhile and not from @local/eff, Check.is from @eslint-react/ast, and the new isAttribute helper from @eslint-react/jsx. (#1912)
  • @eslint-react/jsx: added isAttribute for matching JSX attributes by name.
  • @local/eff: added dropWhile and takeWhile.
  • Bumped tsdown to 0.22.8, tsl-dx to 0.13.3, import-integrity-lint to 1.1.4, fumadocs to 16.11.5, and fumadocs-mdx to 15.2.0.

Full Changelog: Rel1cx/eslint-react@v5.17.0...v5.17.1

v5.17.0 (2026-07-17)

🐞 Fixes

  • react-jsx/no-leaked-dollar: the intentional-$ exemption (e.g. <div>${price}</div>) is no longer defeated by surrounding whitespace or empty siblings — a lone $ before a single expression is now allowed whenever all other siblings are non-substantive. (#1911)
  • react-jsx/no-leaked-semicolon: consecutive leaked semicolons (e.g. ;;) at the start of a JSX text node are now detected. (#1911)

📝 Documentation

  • react-x/no-unnecessary-use-prefix: reorganized the rule examples.

🏗️ Internal

  • react-jsx: extracted the shared find-create-element-children-prop and remove-jsx-attribute rule helpers, removed dead Literal visitors from no-comment-textnodes and no-leaked-semicolon, simplified the no-key-after-spread attribute scan, and hoisted no-useless-fragment detection and fix helpers to module level. (#1911)

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the dependencies-minor-patch group with 4 updates: [@lexical/react](https://github.com/facebook/lexical/tree/HEAD/packages/lexical-react), [katex](https://github.com/KaTeX/KaTeX), [lexical](https://github.com/facebook/lexical/tree/HEAD/packages/lexical) and [@eslint-react/eslint-plugin](https://github.com/Rel1cx/eslint-react/tree/HEAD/plugins/eslint-plugin).


Updates `@lexical/react` from 0.47.0 to 0.48.0
- [Release notes](https://github.com/facebook/lexical/releases)
- [Changelog](https://github.com/facebook/lexical/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/lexical/commits/v0.48.0/packages/lexical-react)

Updates `katex` from 0.17.0 to 0.18.1
- [Release notes](https://github.com/KaTeX/KaTeX/releases)
- [Changelog](https://github.com/KaTeX/KaTeX/blob/main/CHANGELOG.md)
- [Commits](KaTeX/KaTeX@v0.17.0...v0.18.1)

Updates `lexical` from 0.47.0 to 0.48.0
- [Release notes](https://github.com/facebook/lexical/releases)
- [Changelog](https://github.com/facebook/lexical/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/lexical/commits/v0.48.0/packages/lexical)

Updates `@eslint-react/eslint-plugin` from 5.14.8 to 5.17.3
- [Release notes](https://github.com/Rel1cx/eslint-react/releases)
- [Changelog](https://github.com/Rel1cx/eslint-react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/Rel1cx/eslint-react/commits/v5.17.3/plugins/eslint-plugin)

---
updated-dependencies:
- dependency-name: "@lexical/react"
  dependency-version: 0.48.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies-minor-patch
- dependency-name: katex
  dependency-version: 0.18.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies-minor-patch
- dependency-name: lexical
  dependency-version: 0.48.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies-minor-patch
- dependency-name: "@eslint-react/eslint-plugin"
  dependency-version: 5.17.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 21, 2026
Signed-off-by: Logan Nguyen <lg.131.dev@gmail.com>
@quiet-node

Copy link
Copy Markdown
Owner

Pushed a manual bun.lock regen on top of this branch: Dependabot edits package.json but can't touch bun.lock, and CI installs with --frozen-lockfile, so every npm Dependabot PR here needs this follow-up commit.

Also adjusted the katex bump: the PR proposed katex ^0.18.1, but rehype-katex, micromark-extension-math, and mermaid all declare katex ^0.16.x and only resolve up to 0.16.44. Taking ^0.18.1 at the top level would leave two katex versions installed (0.18.1 for the CSS import, 0.16.44 for what the renderers actually emit markup against), which is worth avoiding. Pinned katex to ^0.16.44 instead so it dedupes to a single resolved version across the app and its markdown renderers. Worth noting main currently has the same latent dual-version katex install with its ^0.17.0 pin (0.17.0 top-level vs 0.16.44 nested); this PR doesn't fix that separately, just avoids making it worse.

lexical/@lexical/react 0.48.0 and @eslint-react/eslint-plugin 5.17.3 required no source or lint-config changes; all existing gates pass unchanged.

Verified locally: format check, lint, typecheck, vitest with 100% coverage, and the frontend build all pass on the regenerated lockfile.

@quiet-node
quiet-node merged commit 4d93c0e into main Jul 21, 2026
6 checks passed
@quiet-node
quiet-node deleted the dependabot/npm_and_yarn/dependencies-minor-patch-ce847ab5ef branch July 21, 2026 20:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant