chore(deps): bump the npm-minor-patch group across 1 directory with 15 updates by dependabot[bot] · Pull Request #1067 · FlowwStar/FlowStar

dependabot · 2026-10-22T05:16:37Z

Bumps the npm-minor-patch group with 15 updates in the / directory:

Package	From	To
@base-ui/react	`1.8.0`	`1.9.0`
@tanstack/react-virtual	`3.14.13`	`3.14.21`
@walletconnect/sign-client	`2.25.0`	`2.26.0`
lucide-react	`1.52.0`	`1.59.0`
next	`16.3.8`	`16.4.2`
react	`19.3.0`	`19.3.1`
react-dom	`19.3.0`	`19.3.1`
@axe-core/playwright	`4.10.2`	`4.14.0`
@next/eslint-plugin-next	`16.3.8`	`16.4.2`
@playwright/test	`1.63.0`	`1.64.1`
@testing-library/user-event	`14.6.7`	`14.6.8`
eslint	`10.12.0`	`10.13.0`
postcss	`8.5.28`	`8.5.31`
prettier	`3.9.9`	`3.9.10`
shadcn	`4.21.1`	`4.22.1`

Updates @base-ui/react from 1.8.0 to 1.9.0

Release notes

Sourced from @base-ui/react's releases.

v1.9.0

General changes

Export CssVariables and DataAttributes types (#5243) by @superhooman

Fix stale focused field state (#5345) by @atomiks

Fix animation waits retaining detached elements (#5719) by @flaviendelangle

Keep item registration in sync when items change under Strict Mode (#5862) by @atomiks

Avoid re-rendering inactive triggers on open and close (#5865) by @atomiks

Accordion

Fix <Accordion.Trigger>'s data-value and data-index attributes (#5705) by @cpruijsen

Apply the native disabled attribute to <Accordion.Trigger> when using native buttons (#5607) by @atomiks

Expand hiddenUntilFound panels synchronously on beforematch (#5514) by @aarongarciah

Alert Dialog

Don't associate a programmatically opened popup with a trigger that did not open it (#5641) by @michaldudak

Autocomplete

Fix autoHighlight for asynchronous results (#5818) by @atomiks

Pass the originating event to onItemHighlighted. Pointer events may be MouseEvent or PointerEvent; typing reports the reason none (#5838) by @atomiks

Decouple automatic unmounting from actionsRef. Call eventDetails.preventUnmountOnClose() in onOpenChange to opt out of automatic unmounting (#5734) by @michaldudak

Checkbox

Prefer aria-label over associated labels (#5787) by @atomiks

Collapsible

Apply the native disabled attribute to <Collapsible.Trigger> when using native buttons (#5607) by @atomiks

Finish closing when the render function removes the panel (#5890) by @michaldudak

Restore animations when a removed panel reopens (#5891) by @michaldudak

Expand hiddenUntilFound panels synchronously on beforematch (#5514) by @aarongarciah

Combobox

Fix stale chip focus after returning to the input (#5879) by @mdm317

Fix autoHighlight for asynchronous results (#5818) by @atomiks

Decouple automatic unmounting from actionsRef. Call eventDetails.preventUnmountOnClose() in onOpenChange to opt out of automatic unmounting (#5734) by @michaldudak

Fix label focus in Shadow DOM (#5871) by @lyzno1

Pass the originating event to onItemHighlighted. Pointer events may be MouseEvent or PointerEvent; typing reports the reason none (#5838) by @atomiks

Reset typeahead state when closing without moving focus (#5816) by @mdm317

Accept readonly arrays for multiple values (#5710) by @MonstraG

Share item indicator implementation (#5728) by @flaviendelangle

Improve mount performance of large lists (#5819) by @atomiks

Combine item store subscriptions (#5863) by @atomiks

Dialog

... (truncated)

Changelog

Sourced from @base-ui/react's changelog.

v1.9.0

Oct 9, 2026

General changes

Export CssVariables and DataAttributes types (#5243) by @superhooman

Fix stale focused field state (#5345) by @atomiks

Fix animation waits retaining detached elements (#5719) by @flaviendelangle

Keep item registration in sync when items change under Strict Mode (#5862) by @atomiks

Avoid re-rendering inactive triggers on open and close (#5865) by @atomiks

Accordion

Fix <Accordion.Trigger>'s data-value and data-index attributes (#5705) by @cpruijsen

Apply the native disabled attribute to <Accordion.Trigger> when using native buttons (#5607) by @atomiks

Expand hiddenUntilFound panels synchronously on beforematch (#5514) by @aarongarciah

Alert Dialog

Don't associate a programmatically opened popup with a trigger that did not open it (#5641) by @michaldudak

Autocomplete

Fix autoHighlight for asynchronous results (#5818) by @atomiks

Pass the originating event to onItemHighlighted. Pointer events may be MouseEvent or PointerEvent; typing reports the reason none (#5838) by @atomiks

Decouple automatic unmounting from actionsRef. Call eventDetails.preventUnmountOnClose() in onOpenChange to opt out of automatic unmounting (#5734) by @michaldudak

Checkbox

Prefer aria-label over associated labels (#5787) by @atomiks

Collapsible

Apply the native disabled attribute to <Collapsible.Trigger> when using native buttons (#5607) by @atomiks

Finish closing when the render function removes the panel (#5890) by @michaldudak

Restore animations when a removed panel reopens (#5891) by @michaldudak

Expand hiddenUntilFound panels synchronously on beforematch (#5514) by @aarongarciah

Combobox

Fix stale chip focus after returning to the input (#5879) by @mdm317

Fix autoHighlight for asynchronous results (#5818) by @atomiks

Decouple automatic unmounting from actionsRef. Call eventDetails.preventUnmountOnClose() in onOpenChange to opt out of automatic unmounting (#5734) by @michaldudak

Fix label focus in Shadow DOM (#5871) by @lyzno1

Pass the originating event to onItemHighlighted. Pointer events may be MouseEvent or PointerEvent; typing reports the reason none (#5838) by @atomiks

Reset typeahead state when closing without moving focus (#5816) by @mdm317

Accept readonly arrays for multiple values (#5710) by @MonstraG

... (truncated)

Commits

ad7ecda [release] v1.9.0 (#5906)
3296de3 [drawer] Avoid retaining unmounted drawers in DrawerProvider (#5921)
69c33b4 [drawer] Fix deferred touch swipes leaving the popup (#5922)
51b70db [menu] Strip internal filter components from public types (#5923)
8d8b98c [menu] Ignore filter input edits while the menu animates out (#5911)
aeba3eb [combobox][menu][select] Revert highlightItem imperative action (#5910)
ec6bf32 [field][select][combobox][slider] Fall back to the owner document when lookin...
1f112a5 [popups] Avoid re-rendering inactive triggers on open and close (#5865)
bc53db6 [fieldset] Await render in Legend disabled-state test (#5909)
147092e [test] Strengthen tests, add test lint rules and share copied suites (#5892)
Additional commits viewable in compare view

Updates @tanstack/react-virtual from 3.14.13 to 3.14.21

Release notes

Sourced from @tanstack/react-virtual's releases.

@tanstack/react-virtual@3.14.21

Patch Changes

Updated dependencies [05bb4d3]:

@tanstack/virtual-core@3.19.6

@tanstack/react-virtual@3.14.20

Patch Changes

Updated dependencies [56b2a63, d2c7911, 9c762fe, 6789f7a, 77cb05e, 4a1a4fd, 3c61b6e, 9c762fe]:

@tanstack/virtual-core@3.19.5

@tanstack/react-virtual@3.14.19

Patch Changes

Updated dependencies [269e8ed]:

@tanstack/virtual-core@3.19.4

@tanstack/react-virtual@3.14.18

Patch Changes

Updated dependencies [f211d3a]:

@tanstack/virtual-core@3.19.3

@tanstack/react-virtual@3.14.17

Patch Changes

Updated dependencies [3800fb3, cb510cb]:

@tanstack/virtual-core@3.19.2

@tanstack/react-virtual@3.14.16

Patch Changes

Updated dependencies [7aa34f6, e7a0a92]:

@tanstack/virtual-core@3.19.1

@tanstack/react-virtual@3.14.15

Patch Changes

Updated dependencies [28a2174, 92c697f]:

@tanstack/virtual-core@3.19.0

@tanstack/react-virtual@3.14.14

Patch Changes

#1301 ce57b78 - fix(react-virtual): position directDomUpdates rows that mount without the owner re-rendering

Rows were only positioned by the owner's layout effect or the next onChange. A row mounted by a child that re-renders on its own (local state, context, a resolved Suspense boundary) skipped both when it was fixed-size, and stayed unpositioned until the range changed. Rows are now positioned as they register through measureElement, and containerRef positions the rows that mounted together with the container.

Updated dependencies [43675bc, 9df47a3, c644f10, 2a631f4]:

... (truncated)

Changelog

Sourced from @tanstack/react-virtual's changelog.

3.14.21

Patch Changes

Updated dependencies [05bb4d3]:

@tanstack/virtual-core@3.19.6

3.14.20

Patch Changes

Updated dependencies [56b2a63, d2c7911, 9c762fe, 6789f7a, 77cb05e, 4a1a4fd, 3c61b6e, 9c762fe]:

@tanstack/virtual-core@3.19.5

3.14.19

Patch Changes

Updated dependencies [269e8ed]:

@tanstack/virtual-core@3.19.4

3.14.18

Patch Changes

Updated dependencies [f211d3a]:

@tanstack/virtual-core@3.19.3

3.14.17

Patch Changes

Updated dependencies [3800fb3, cb510cb]:

@tanstack/virtual-core@3.19.2

3.14.16

Patch Changes

Updated dependencies [7aa34f6, e7a0a92]:

@tanstack/virtual-core@3.19.1

3.14.15

Patch Changes

Updated dependencies [28a2174, 92c697f]:

@tanstack/virtual-core@3.19.0

3.14.14

... (truncated)

Commits

28ff2ca ci: Version Packages (#1333)
4296ac2 ci: Version Packages (#1323)
9c762fe fix(virtual-core): finish the iOS scroll-correction plan and simplify the scr...
4a1a4fd fix(virtual-core): defer iOS scroll corrections only for touch-driven scrolls...
4f9636e ci: Version Packages (#1322)
676a098 ci: Version Packages (#1317)
7c20899 ci: Version Packages (#1315)
cb510cb refactor(virtual-core): describe an in-flight scroll command by one phase (#1...
46f73fb ci: Version Packages (#1312)
6732e00 test(virtual-core): pin the iOS deferral and index-scroll orderings measured ...
Additional commits viewable in compare view

Updates @walletconnect/sign-client from 2.25.0 to 2.26.0

Release notes

Sourced from @walletconnect/sign-client's releases.

@walletconnect/sign-client@2.26.0

Patch Changes

Updated dependencies [c247899, 22c6e93]:

@walletconnect/utils@2.26.0

@walletconnect/types@2.26.0

@walletconnect/core@2.26.0

Changelog

Sourced from @walletconnect/sign-client's changelog.

2.26.0

Patch Changes

Updated dependencies [c247899, 22c6e93]:

@walletconnect/utils@2.26.0

@walletconnect/types@2.26.0

@walletconnect/core@2.26.0

Commits

bd830b5 chore: update versions and lerna.json
See full diff in compare view

Updates lucide-react from 1.52.0 to 1.59.0

Release notes

Sourced from lucide-react's releases.

Version 1.59.0

What's Changed

feat(docs): Adds search field to docs pages by @ericfennis in lucide-icons/lucide#5012

fix(icons): changed chess-queen icon by @karsa-mistmere in lucide-icons/lucide#4613

Full Changelog: lucide-icons/lucide@1.58.0...1.59.0

Version 1.58.0

What's Changed

feat(docs): add third-party package lucide-jte by @sgruendel in lucide-icons/lucide#5000

chore(integration-tests): Add Svelte integration tests for @ucide/svelte by @ericfennis in lucide-icons/lucide#5005

chore(deps-dev): bump the angular-deps group across 1 directory with 10 updates by @dependabot[bot] in lucide-icons/lucide#5004

fix(site): Fix homepage animation by @ericfennis in lucide-icons/lucide#5015

feat(ci): auto-generate PR titles from added file paths by @ericfennis with @Copilot in lucide-icons/lucide#4790

fix(icons): changed barrel icon by @karsa-mistmere in lucide-icons/lucide#4639

ci(dev): fix "Generate PR Title" job by using REST API for changed files by @ericfennis with @Copilot in lucide-icons/lucide#5017

feat(icons): added certificate icon by @rrod497 in lucide-icons/lucide#4327

fix(icons): update music icons by @jamiemlaw in lucide-icons/lucide#4072

New Contributors

@sgruendel made their first contribution in lucide-icons/lucide#5000

Full Changelog: lucide-icons/lucide@1.57.0...1.58.0

Version 1.57.0

What's Changed

feat(icons): added folder-user and folder-user icons by @rrod497 in lucide-icons/lucide#4603

feat(icons): added calendar-chevrons-left icon by @karsa-mistmere in lucide-icons/lucide#5001

feat(icons): added users-collaboration icon by @rrod497 in lucide-icons/lucide#4922

feat(icons): added Belarusian ruble icon by @js-best in lucide-icons/lucide#4984

feat(icons): added circle-fading-play icon by @tatianatsiguleva in lucide-icons/lucide#4990

feat(icons): add cpu-ai icon by @signalgridco in lucide-icons/lucide#4992

feat(icons): added guitar-electric icon by @rrod497 in lucide-icons/lucide#4917

feat(icons): added graph-star icon by @Nitero in lucide-icons/lucide#4983

chore(deps-dev): bump the svelte-deps group with 2 updates by @dependabot[bot] in lucide-icons/lucide#4996

chore(deps-dev): bump preact from 11.0.0 to 11.0.1 in the preact-deps group by @dependabot[bot] in lucide-icons/lucide#4999

chore(deps-dev): bump @vitejs/plugin-react from 6.1.1 to 6.1.2 in the react-deps group by @dependabot[bot] in lucide-icons/lucide#4995

feat(icons): added perfume icon by @rrod497 in lucide-icons/lucide#4426

New Contributors

@js-best made their first contribution in lucide-icons/lucide#4984

@tatianatsiguleva made their first contribution in lucide-icons/lucide#4990

@signalgridco made their first contribution in lucide-icons/lucide#4992

@Nitero made their first contribution in lucide-icons/lucide#4983

Full Changelog: lucide-icons/lucide@1.56.0...1.57.0

Version 1.56.0

What's Changed

... (truncated)

Commits

3f1255e chore(deps-dev): bump @vitejs/plugin-react (#4995)
949bc6d test(lucide-react): add tests for DynamicIcon fallback and ref forwarding (#4...
See full diff in compare view

Updates next from 16.3.8 to 16.4.2

Release notes

Sourced from next's releases.

v16.4.2

What's Changed

[lts-active] turbo-tasks snapshot consistency fixes (#99644, #99732, #99649) by @lukesandberg in vercel/next.js#100002

[lts-active] Turbopack: backport Pages Router dev module graph chaining (#98823, #99910, #100091) by @sokra in vercel/next.js#100008

[lts-active] fix(next-code-frame): snap visible window to char boundaries by @lukesandberg in vercel/next.js#100212

[lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependency edges by @lukesandberg in vercel/next.js#100209

[lts-active] Turbopack: Ignore realpath errors during module resolution, matching node's behavior by @lukesandberg in vercel/next.js#100217

[lts-active] Backport docs fixes since v16.4.0 by @icyJoseph in vercel/next.js#100246

[lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions by @lukesandberg in vercel/next.js#100211

[lts-active] Backport additional documentation fixes since v16.4.0 by @aurorascharff in vercel/next.js#100262

Full Changelog: vercel/next.js@v16.4.1...v16.4.2

v16.4.1

This release contains security fixes for the following advisories:

Critical:

Unauthenticated Remote Code Execution in use cache functions returning typed arrays

Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

Denial of Service in App Router using Server Actions

v16.4.0

Check out the 16.4 announcement post to get an overview of the changes.

Core Changes

Show compiler plugin warning in more situations: #75682

fix(scripts): correct typo in rm.mjs error message: #87015

docs: improve clarity and punctuation in README: #86096

Fix debug build paths Pages Router support entries: #93529

bundle-analyzer: record historical snapshots on each analyze run: #93520

fix: detect proxy.ts correctly with compound pageExtensions: #93246

feat(turbopack): support false values for resolveAlias config: #93331

Misc Changes

docs: correction to dynamicParams migration: #96624

docs: proxy event argument: #96435

docs: remove experimental note from runtime prefetching: #96615

Preserve per-segment prefetching after dynamic navigation: #96583

Rename static generation stream option to waitForAllReady: #96564

Remove obsolete static generation plumbing: #96563

[turbopack] Drop dead writes to exports: #96381

[turbopack] Ignore writes to exports after a module.exports = {} writes: #96380

[turbopack] Add test for sideEffects with optimizePackageImports: #96549

[turbopack] Strip leading BOM before parsing CSS: #96678

Upgrade React from cbb046ab-20260731 to 7dfc7ccd-20260803: #96550

... (truncated)

Commits

2864b17 v16.4.2
a42cb59 Revert "[lts-active] Keep requests through middleware in a single OpenTelemet...
f0760ec [lts-active] Backport additional documentation fixes since v16.4.0 (#100262)
845007a [lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions (#100211)
6a79d8a [lts-active] Backport docs fixes since v16.4.0 (#100246)
a75a782 [lts-active] Keep requests through middleware in a single OpenTelemetry trace...
8ad8524 [lts-active] Turbopack: Ignore realpath errors during module resolution, matc...
29d030e [lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependenc...
3e50b82 [lts-active] fix(next-code-frame): snap visible window to char boundaries (#1...
9458fb9 [lts-active] Turbopack: backport Pages Router dev module graph chaining (#988...
Additional commits viewable in compare view

Updates react from 19.3.0 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

Improve transport protocol (#37845 by @unstubbable and @eps1lon)

Commits

61aa00d [19.3.x][Flight] Improve transport protocol (#37845)
See full diff in compare view

Updates react-dom from 19.3.0 to 19.3.1

Release notes

Sourced from react-dom's releases.

19.3.1 (October 14th, 2026)

React Server Components

Improve transport protocol (#37845 by @unstubbable and @eps1lon)

Commits

61aa00d [19.3.x][Flight] Improve transport protocol (#37845)
See full diff in compare view

Updates @axe-core/playwright from 4.10.2 to 4.14.0

Release notes

Sourced from @axe-core/playwright's releases.

Release 4.14.0

What's Changed

docs(webdriverjs): update chrome options in example by @G-Rath in dequelabs/axe-core-npm#1401

chore: merge master into develop by @attest-team-ci in dequelabs/axe-core-npm#1417

ci: create the release tag when publishing to production by @Garbee in dequelabs/axe-core-npm#1418

chore: bump brace-expansion by @dependabot[bot] in dequelabs/axe-core-npm#1419

chore: bump tar and lerna by @dependabot[bot] in dequelabs/axe-core-npm#1420

chore: migrate from npm workspaces to pnpm by @Garbee in dequelabs/axe-core-npm#1421

chore(deps): upgrade dependencies and audit engine floors in CI by @Garbee in dequelabs/axe-core-npm#1430

chore: bump chromedriver from 152.0.0 to 152.0.1 in the browser-drivers group by @dependabot[bot] in dequelabs/axe-core-npm#1435

chore: bump the webdriverio group with 6 updates by @dependabot[bot] in dequelabs/axe-core-npm#1434

chore: bump eslint from 10.8.1 to 10.9.0 by @dependabot[bot] in dequelabs/axe-core-npm#1437

fix: exempt axe-core from the pnpm release-age cooldown by @Garbee in dequelabs/axe-core-npm#1441

feat: Update axe-core to v4.14.0 by @attest-team-ci in dequelabs/axe-core-npm#1456

chore: bump postcss-selector-parser from 7.1.5 to 7.1.6 by @dependabot[bot] in dequelabs/axe-core-npm#1457

chore: bump puppeteer from 25.8.0 to 25.12.0 in the puppeteer group by @dependabot[bot] in dequelabs/axe-core-npm#1451

chore: bump proxy-addr from 2.0.7 to 2.0.8 by @dependabot[bot] in dequelabs/axe-core-npm#1458

chore: bump nx from 23.1.1 to 23.2.1 by @dependabot[bot] in dequelabs/axe-core-npm#1459

chore: bump adm-zip from 0.6.0 to 0.6.1 by @dependabot[bot] in dequelabs/axe-core-npm#1443

chore: bump the webdriverio group across 1 directory with 7 updates by @dependabot[bot] in dequelabs/axe-core-npm#1449

ci: provide pnpm via action-setup in release workflows by @Garbee in dequelabs/axe-core-npm#1461

chore: RC v4.14.0 by @attest-team-ci in dequelabs/axe-core-npm#1463

fix(cli): restore bin paths and lint published package tarballs (#1467) by @Garbee in dequelabs/axe-core-npm#1468

chore: release v4.14.0 by @axe-core in dequelabs/axe-core-npm#1479

New Contributors

@G-Rath made their first contribution in dequelabs/axe-core-npm#1401

Full Changelog: dequelabs/axe-core-npm@v4.13.0...v4.14.0

Release 4.13.0

What's Changed

ci: use pat instead of github token by @Garbee in dequelabs/axe-core-npm#1334

chore: bump nyc from 17.1.0 to 18.0.0 by @dependabot[bot] in dequelabs/axe-core-npm#1311

chore: increase timeout for axe-core update by @Garbee in dequelabs/axe-core-npm#1354

chore: pin node by @Garbee in dequelabs/axe-core-npm#1355

test: fix webdriverio esmTest.mjs by @straker in dequelabs/axe-core-npm#1356

chore: disable dependabot rebase strategy by @Garbee in dequelabs/axe-core-npm#1344

chore: bump actions/checkout from 6 to 6.0.2 in the gha-low-risk group by @dependabot[bot] in dequelabs/axe-core-npm#1357

ci: increase timeout for axe-core update by @Garbee in dequelabs/axe-core-npm#1360

chore: exclude test/release from npm workspaces by @Garbee in dequelabs/axe-core-npm#1361

chore: bump axios from 1.14.0 to 1.17.0 by @dependabot[bot] in dequelabs/axe-core-npm#1358

chore: merge master into develop by @michael-siek in dequelabs/axe-core-npm#1362

chore: declare @eslint/js and group eslint deps for dependabot by @Garbee in dequelabs/axe-core-npm#1348

chore: bump actions/checkout from 6.0.2 to 6.0.3 in the gha-low-risk group by @dependabot[bot] in dequelabs/axe-core-npm#1363

chore: group browser-driver and jest deps for dependabot by @Garbee in dequelabs/axe-core-npm#1365

chore: bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in dequelabs/axe-core-npm#1301

chore: bump handlebars from 4.7.8 to 4.7.9 by @dependabot[bot] in dequelabs/axe-core-npm#1305

chore: bump fast-xml-parser from 5.5.1 to 5.8.0 by @dependabot[bot] in dequelabs/axe-core-npm#1325

chore: bump lodash from 4.17.21 to 4.18.1 by @dependabot[bot] in dequelabs/axe-core-npm#1337

... (truncated)

Changelog

Sourced from @axe-core/playwright's changelog.

4.14.0 (2026-10-06)

Bug Fixes

exempt axe-core from the pnpm release-age cooldown (#1441) (0bcb185), closes #1346 #1346 #1442 #1346

Features

Update axe-core to v4.14.0 (#1456) (dccfe7a)

4.13.0 (2026-08-10)

Features

Update axe-core to v4.12.1 (#1378) (4263054)

update axe-core to v4.13.0 (#1413) (399c5d7), closes #1412

4.12.1 (2026-06-22)

Features

Update axe-core to v4.12.1 (#1378) (4263054)

4.11.3 (2026-04-29)

Bug Fixes

Update axe-core to v4.11.4 (#1330) (eed87f5)

Description has been truncated

…5 updates Bumps the npm-minor-patch group with 15 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@base-ui/react](https://github.com/mui/base-ui/tree/HEAD/packages/react) | `1.8.0` | `1.9.0` | | [@tanstack/react-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual) | `3.14.13` | `3.14.21` | | [@walletconnect/sign-client](https://github.com/WalletConnect/walletconnect-monorepo/tree/HEAD/packages/sign-client) | `2.25.0` | `2.26.0` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.52.0` | `1.59.0` | | [next](https://github.com/vercel/next.js) | `16.3.8` | `16.4.2` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.3.0` | `19.3.1` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.3.0` | `19.3.1` | | [@axe-core/playwright](https://github.com/dequelabs/axe-core-npm) | `4.10.2` | `4.14.0` | | [@next/eslint-plugin-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-plugin-next) | `16.3.8` | `16.4.2` | | [@playwright/test](https://github.com/microsoft/playwright) | `1.63.0` | `1.64.1` | | [@testing-library/user-event](https://github.com/testing-library/user-event) | `14.6.7` | `14.6.8` | | [eslint](https://github.com/eslint/eslint) | `10.12.0` | `10.13.0` | | [postcss](https://github.com/postcss/postcss) | `8.5.28` | `8.5.31` | | [prettier](https://github.com/prettier/prettier) | `3.9.9` | `3.9.10` | | [shadcn](https://github.com/shadcn-ui/ui/tree/HEAD/packages/shadcn) | `4.21.1` | `4.22.1` | Updates `@base-ui/react` from 1.8.0 to 1.9.0 - [Release notes](https://github.com/mui/base-ui/releases) - [Changelog](https://github.com/mui/base-ui/blob/master/CHANGELOG.md) - [Commits](https://github.com/mui/base-ui/commits/v1.9.0/packages/react) Updates `@tanstack/react-virtual` from 3.14.13 to 3.14.21 - [Release notes](https://github.com/TanStack/virtual/releases) - [Changelog](https://github.com/TanStack/virtual/blob/main/packages/react-virtual/CHANGELOG.md) - [Commits](https://github.com/TanStack/virtual/commits/@tanstack/react-virtual@3.14.21/packages/react-virtual) Updates `@walletconnect/sign-client` from 2.25.0 to 2.26.0 - [Release notes](https://github.com/WalletConnect/walletconnect-monorepo/releases) - [Changelog](https://github.com/WalletConnect/walletconnect-monorepo/blob/v2.0/packages/sign-client/CHANGELOG.md) - [Commits](https://github.com/WalletConnect/walletconnect-monorepo/commits/@walletconnect/sign-client@2.26.0/packages/sign-client) Updates `lucide-react` from 1.52.0 to 1.59.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.59.0/packages/lucide-react) Updates `next` from 16.3.8 to 16.4.2 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.3.8...v16.4.2) Updates `react` from 19.3.0 to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react) Updates `react-dom` from 19.3.0 to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom) Updates `@axe-core/playwright` from 4.10.2 to 4.14.0 - [Release notes](https://github.com/dequelabs/axe-core-npm/releases) - [Changelog](https://github.com/dequelabs/axe-core-npm/blob/develop/CHANGELOG.md) - [Commits](dequelabs/axe-core-npm@v4.10.2...v4.14.0) Updates `@next/eslint-plugin-next` from 16.3.8 to 16.4.2 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.4.2/packages/eslint-plugin-next) Updates `@playwright/test` from 1.63.0 to 1.64.1 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.63.0...v1.64.1) Updates `@testing-library/user-event` from 14.6.7 to 14.6.8 - [Release notes](https://github.com/testing-library/user-event/releases) - [Changelog](https://github.com/testing-library/user-event/blob/main/CHANGELOG.md) - [Commits](testing-library/user-event@v14.6.7...v14.6.8) Updates `eslint` from 10.12.0 to 10.13.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.12.0...v10.13.0) Updates `postcss` from 8.5.28 to 8.5.31 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.28...8.5.31) Updates `prettier` from 3.9.9 to 3.9.10 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.9.9...3.9.10) Updates `shadcn` from 4.21.1 to 4.22.1 - [Release notes](https://github.com/shadcn-ui/ui/releases) - [Changelog](https://github.com/shadcn-ui/ui/blob/main/packages/shadcn/CHANGELOG.md) - [Commits](https://github.com/shadcn-ui/ui/commits/shadcn@4.22.1/packages/shadcn) --- updated-dependencies: - dependency-name: "@base-ui/react" dependency-version: 1.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@tanstack/react-virtual" dependency-version: 3.14.21 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: "@walletconnect/sign-client" dependency-version: 2.26.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: lucide-react dependency-version: 1.59.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: next dependency-version: 16.4.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: react dependency-version: 19.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: react-dom dependency-version: 19.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: "@axe-core/playwright" dependency-version: 4.14.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@next/eslint-plugin-next" dependency-version: 16.4.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@playwright/test" dependency-version: 1.64.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@testing-library/user-event" dependency-version: 14.6.8 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: eslint dependency-version: 10.13.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: postcss dependency-version: 8.5.31 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: prettier dependency-version: 3.9.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: shadcn dependency-version: 4.22.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-10-22T05:16:40Z

Labels

The following labels could not be found: dependencies, npm. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

github-actions · 2026-10-22T05:17:25Z

🛡️ Frontend Security Scan

npm audit

# npm audit report

fflate  0.7.0 - 0.7.4
Severity: moderate
fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives - https://github.com/advisories/GHSA-px8p-9vwx-vf98
fix available via `npm audit fix --force`
Will install @vercel/og@1.0.1, which is a breaking change
node_modules/fflate
  satori  >=0.33.0
  Depends on vulnerable versions of fflate
  node_modules/satori
    @vercel/og  >=1.0.2
    Depends on vulnerable versions of satori
    node_modules/@vercel/og

3 moderate severity vulnerabilities

To address all issues (including breaking changes), run:
  npm audit fix --force
# npm audit report

@vitest/mocker  <=4.1.11
Severity: moderate
Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock - https://github.com/advisories/GHSA-82fw-gwwq-j7x9
Vitest: Code injection via unauthenticated manual mock registration - https://github.com/advisories/GHSA-qxg6-89mg-rqv8
Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix - https://github.com/advisories/GHSA-xp26-3454-mjgp
fix available via `npm audit fix`
node_modules/@vitest/mocker
node_modules/vitest/node_modules/@vitest/mocker
  storybook  9.0.0 - 10.1.0-beta.6
  Depends on vulnerable versions of @vitest/mocker
  node_modules/storybook
  vitest  2.1.0-beta.1 - 4.1.11
  Depends on vulnerable versions of @vitest/coverage-v8
  Depends on vulnerable versions of @vitest/mocker
  node_modules/vitest
    @vitest/coverage-v8  2.1.0-beta.1 - 4.1.11
    Depends on vulnerable versions of vitest
    node_modules/@vitest/coverage-v8

braces  *
Severity: high
braces vulnerable to stack-exhaustion denial of service through deeply nested patterns - https://github.com/advisories/GHSA-vfj7-8cjw-p6xm
No fix available
node_modules/braces
  chokidar  2.0.0 - 3.6.0
  Depends on vulnerable versions of braces
  node_modules/chokidar
    fork-ts-checker-webpack-plugin  0.4.7 - 4.0.0-beta.5 || 6.0.0-alpha.1 - 9.0.3
    Depends on vulnerable versions of chokidar
    node_modules/fork-ts-checker-webpack-plugin
      @storybook/builder-webpack5  <=11.0.0-alpha.4
      Depends on vulnerable versions of fork-ts-checker-webpack-plugin
      Depends on vulnerable versions of webpack-dev-middleware
      node_modules/@storybook/builder-webpack5
        @storybook/nextjs  *
        Depends on vulnerable versions of @storybook/builder-webpack5
        Depends on vulnerable versions of @storybook/preset-react-webpack
        Depends on vulnerable versions of node-polyfill-webpack-plugin
        node_modules/@storybook/nextjs
  micromatch  >=0.2.0
  Depends on vulnerable versions of braces
  node_modules/micromatch
    @storybook/react-docgen-typescript-plugin  *
    Depends on vulnerable versions of micromatch
    node_modules/@storybook/react-docgen-typescript-plugin
      @storybook/preset-react-webpack  *
      Depends on vulnerable versions of @storybook/react-docgen-typescript-plugin
      node_modules/@storybook/preset-react-webpack
    fast-glob  *
    Depends on vulnerable versions of micromatch
    node_modules/@shadcn/registry/node_modules/fast-glob
    node_modules/@ts-morph/common/node_modules/fast-glob
    node_modules/fast-glob
    node_modules/shadcn/node_modules/fast-glob
      @next/eslint-plugin-next  >=14.3.0-canary.0
      Depends on vulnerable versions of fast-glob
      node_modules/@next/eslint-plugin-next
      @shadcn/registry  <=0.0.0-rc-20261007105214 || >=0.1.0
      Depends on vulnerable versions of fast-glob
      node_modules/@shadcn/registry
        shadcn  <=0.0.0-rc-20261007105214 || >=2.0.0
        Depends on vulnerable versions of @shadcn/registry
        Depends on vulnerable versions of fast-glob
        Depends on vulnerable versions of ts-morph
        node_modules/shadcn
      @ts-morph/common  0.2.0 - 0.24.0 || 0.26.0 - 0.27.0
      Depends on vulnerable versions of fast-glob
      node_modules/@ts-morph/common
        ts-morph  6.0.1 - 23.0.0 || 25.0.0 - 26.0.0
        Depends on vulnerable versions of @ts-morph/common
        node_modules/ts-morph

elliptic  *
Elliptic Uses a Cryptographic Primitive with a Risky Implementation - https://github.com/advisories/GHSA-848j-6mx2-7j84
No fix available
node_modules/elliptic
  browserify-sign  >=2.4.0
  Depends on vulnerable versions of elliptic
  node_modules/browserify-sign
    crypto-browserify  >=3.4.0
    Depends on vulnerable versions of browserify-sign
    Depends on vulnerable versions of create-ecdh
    node_modules/crypto-browserify
      node-polyfill-webpack-plugin  <=4.0.0
      Depends on vulnerable versions of crypto-browserify
      node_modules/node-polyfill-webpack-plugin
  create-ecdh  *
  Depends on vulnerable versions of elliptic
  node_modules/create-ecdh

fflate  0.7.0 - 0.7.4
Severity: moderate
fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives - https://github.com/advisories/GHSA-px8p-9vwx-vf98
fix available via `npm audit fix --force`
Will install @vercel/og@1.0.1, which is a breaking change
node_modules/fflate
  satori  >=0.33.0
  Depends on vulnerable versions of fflate
  node_modules/satori
    @vercel/og  >=1.0.2
    Depends on vulnerable versions of satori
    node_modules/@vercel/og


vite  7.0.0 - 7.3.6
Severity: high
launch-editor: escapeCmdArgs() omits % escaping on Windows - https://github.com/advisories/GHSA-698v-4r3x-3vcv
launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors - https://github.com/advisories/GHSA-r825-w8mm-5pxw
launch-editor: `fs.existsSync()` existence check can be bypassed on Windows - https://github.com/advisories/GHSA-587h-7wmj-h5pm
Vite: Cross origin script execution through Vite custom middleware - https://github.com/advisories/GHSA-9jrq-w75r-8gcw
Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine - https://github.com/advisories/GHSA-rq7h-c2jc-7f22
fix available via `npm audit fix`
node_modules/vite

webpack-dev-middleware  <7.4.5
Severity: high
webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath - https://github.com/advisories/GHSA-g84c-rxfj-3j2c
No fix available
node_modules/webpack-dev-middleware

28 vulnerabilities (5 low, 6 moderate, 16 high, 1 critical)

To address issues that do not require attention, run:
  npm audit fix

To address all issues possible (including breaking changes), run:
  npm audit fix --force

Some issues need review, and may require choosing
a different dependency.

ESLint

(no output)

Hardcoded secrets check

(no output)

github-actions · 2026-10-22T05:17:35Z

🔐 Contract Security Scan

cargo audit

(no output)

Soroban pattern check

(no output)

dependabot Bot had a problem deploying to staging October 22, 2026 05:16 Failure

Navigation Menu

Repository navigation

chore(deps): bump the npm-minor-patch group across 1 directory with 15 updates - #1067

chore(deps): bump the npm-minor-patch group across 1 directory with 15 updates#1067
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-badb441050

dependabot Bot commented on behalf of github Oct 22, 2026

Uh oh!

dependabot Bot commented on behalf of github Oct 22, 2026

Uh oh!

github-actions Bot commented Oct 22, 2026

Uh oh!

github-actions Bot commented Oct 22, 2026

Uh oh!

This branch had an error being deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 22, 2026

v1.9.0

General changes

Accordion

Alert Dialog

Autocomplete

Checkbox

Collapsible

Combobox

Dialog

v1.9.0

General changes

Accordion

Alert Dialog

Autocomplete

Checkbox

Collapsible

Combobox

@​tanstack/react-virtual@​3.14.21

Patch Changes

@​tanstack/react-virtual@​3.14.20

Patch Changes

@​tanstack/react-virtual@​3.14.19

Patch Changes

@​tanstack/react-virtual@​3.14.18

Patch Changes

@​tanstack/react-virtual@​3.14.17

Patch Changes

@​tanstack/react-virtual@​3.14.16

Patch Changes

@​tanstack/react-virtual@​3.14.15

Patch Changes

@​tanstack/react-virtual@​3.14.14

Patch Changes

3.14.21

Patch Changes

3.14.20

Patch Changes

3.14.19

Patch Changes

3.14.18

Patch Changes

3.14.17

Patch Changes

3.14.16

Patch Changes

3.14.15

Patch Changes

3.14.14

@​walletconnect/sign-client@​2.26.0

Patch Changes

2.26.0

Patch Changes

Version 1.59.0

What's Changed

Version 1.58.0

What's Changed

New Contributors

Version 1.57.0

What's Changed

New Contributors

Version 1.56.0

What's Changed

v16.4.2

What's Changed

v16.4.1

v16.4.0

Core Changes

Misc Changes

19.3.1 (October 14th, 2026)

React Server Components

19.3.1 (October 14th, 2026)

React Server Components

Release 4.14.0

What's Changed

New Contributors

Release 4.13.0

What's Changed

4.14.0 (2026-10-06)

`@tanstack/react-virtual@3`.14.21

`@tanstack/react-virtual@3`.14.20

`@tanstack/react-virtual@3`.14.19

`@tanstack/react-virtual@3`.14.18

`@tanstack/react-virtual@3`.14.17

`@tanstack/react-virtual@3`.14.16

`@tanstack/react-virtual@3`.14.15

`@tanstack/react-virtual@3`.14.14

`@walletconnect/sign-client@2`.26.0