Skip to content

Bump the production group with 9 updates - #304

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/production-e4842f6324
Closed

Bump the production group with 9 updates#304
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/production-e4842f6324

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production group with 9 updates:

Package From To
@sentry/cloudflare 11.1.0 11.10.0
@tanstack/react-virtual 3.14.13 3.14.23
algoliasearch 5.59.0 5.60.0
hono 4.13.12 4.13.14
pako 3.0.2 3.0.3
react 19.3.0 19.3.1
react-dom 19.3.0 19.3.1
swagger-ui-react 5.33.0 5.34.0
zod 4.6.6 4.6.7

Updates @sentry/cloudflare from 11.1.0 to 11.10.0

Release notes

Sourced from @​sentry/cloudflare's releases.

11.10.0

Important Changes

  • feat: Add a managed tunnel that the SDK derives from the DSN (#25199, #25200, #25783)

    Set tunnel: true in your browser Sentry.init call to send events through your own server. This helps when ad blockers block requests to Sentry. The browser derives the tunnel path from the DSN, so older and newer builds of your client and server always agree on the path.

    To serve the tunnel, add serveTunnelIntegration() to your server SDK. Astro, Nuxt, Nitro, React Router, Remix 3, SolidStart, SvelteKit and TanStack Start then answer tunnel requests automatically:

    // browser
Sentry.init({ dsn, tunnel: true });
// server
Sentry.init({ dsn, integrations: [Sentry.serveTunnelIntegration()] });

    If the browser uses a different DSN than the server, set serveTunnelIntegration({ allowedDsns: [browserDsn] }). For other setups, the server SDKs export handleTunnelRequestIfMatched, handleTunnelRequest, isTunnelRequest and getTunnelPath:

    app.use((req, res, next) => Sentry.handleTunnelRequestIfMatched(req, res) ?? next());

    The request option of handleTunnelRequest is deprecated and will be removed in v12.

  • feat: Make span origins spec compliant (#25602)

    Some span origins changed their names to follow the trace origin spec:

    • auto.amqplib.* is now auto.queue.amqplib.*, and auto.kafkajs.* is now auto.queue.kafkajs.*.
    • auto.vercelai.channel is now auto.ai.vercelai.
    • auto.firebase.firestore is now auto.db.firebase.firestore, and auto.firebase.functions is now auto.function.firebase.
    • auto.aws.aws_sdk is now auto.{rpc,db,queue,ai}.aws_sdk, with the category from the span op.
    • auto.aws_lambda is now auto.function.aws_serverless.
    • auto.mcp.notification is now auto.function.mcp_server.notification.
    • auto.db.cloudflare.durable_object.sql is now auto.db.cloudflare.durable_object_sql.
    • auto.http.browser.{lcp,cls,inp} is now auto.ui.browser.{lcp,cls,inp}.

    If you have ignoreSpans rules, queries or alerts on the old origins, change them to use the new origins.

  • feat(bun): Add incoming request options and request sessions to bunServerIntegration (#25580)

    bunServerIntegration now accepts the same options as denoServeIntegration: ignoreRequestBody, ignoreIncomingRequests, ignoreStaticAssets, spans, onSpanCreated, onSpanEnd, sessions and sessionFlushingDelayMS. The callbacks receive the web Request.

    Bun.serve now records a request session for each incoming request. Sessions are sent only when a release is set. To turn them off, set bunServerIntegration({ sessions: false }).

    ignoreStaticAssets defaults to true, so Bun.serve no longer creates spans for GET requests to common static assets such as favicon.ico, robots.txt or *.js files. To keep these spans, set bunServerIntegration({ ignoreStaticAssets: false }). Bun.serve spans also follow the client's tracing configuration by default, so the integration does not start spans when tracing is disabled. Errors thrown for OPTIONS and HEAD requests are now captured.

  • feat(bun): Inject debug IDs and upload source maps in sentryBunPlugin (#25670)

    sentryBunPlugin from @sentry/bun/plugin now accepts the same options as sentryEsbuildPlugin (org, project, authToken, release, sourcemaps, ...). When Bun.build writes source maps to outdir, the plugin injects the debug ID that Bun writes into each bundle, injects the release, and uploads the source maps at the end of the build. You no longer need to run sentry sourcemap inject and sentry sourcemap upload after the build.

... (truncated)

Changelog

Sourced from @​sentry/cloudflare's changelog.

11.10.0

Important Changes

  • feat: Add a managed tunnel that the SDK derives from the DSN (#25199, #25200, #25783)

    Set tunnel: true in your browser Sentry.init call to send events through your own server. This helps when ad blockers block requests to Sentry. The browser derives the tunnel path from the DSN, so older and newer builds of your client and server always agree on the path.

    To serve the tunnel, add serveTunnelIntegration() to your server SDK. Astro, Nuxt, Nitro, React Router, Remix 3, SolidStart, SvelteKit and TanStack Start then answer tunnel requests automatically:

    // browser
Sentry.init({ dsn, tunnel: true });
// server
Sentry.init({ dsn, integrations: [Sentry.serveTunnelIntegration()] });

    If the browser uses a different DSN than the server, set serveTunnelIntegration({ allowedDsns: [browserDsn] }). For other setups, the server SDKs export handleTunnelRequestIfMatched, handleTunnelRequest, isTunnelRequest and getTunnelPath:

    app.use((req, res, next) => Sentry.handleTunnelRequestIfMatched(req, res) ?? next());

    The request option of handleTunnelRequest is deprecated and will be removed in v12.

  • feat: Make span origins spec compliant (#25602)

    Some span origins changed their names to follow the trace origin spec:

    • auto.amqplib.* is now auto.queue.amqplib.*, and auto.kafkajs.* is now auto.queue.kafkajs.*.
    • auto.vercelai.channel is now auto.ai.vercelai.
    • auto.firebase.firestore is now auto.db.firebase.firestore, and auto.firebase.functions is now auto.function.firebase.
    • auto.aws.aws_sdk is now auto.{rpc,db,queue,ai}.aws_sdk, with the category from the span op.
    • auto.aws_lambda is now auto.function.aws_serverless.
    • auto.mcp.notification is now auto.function.mcp_server.notification.
    • auto.db.cloudflare.durable_object.sql is now auto.db.cloudflare.durable_object_sql.
    • auto.http.browser.{lcp,cls,inp} is now auto.ui.browser.{lcp,cls,inp}.

    If you have ignoreSpans rules, queries or alerts on the old origins, change them to use the new origins.

  • feat(bun): Add incoming request options and request sessions to bunServerIntegration (#25580)

    bunServerIntegration now accepts the same options as denoServeIntegration: ignoreRequestBody, ignoreIncomingRequests, ignoreStaticAssets, spans, onSpanCreated, onSpanEnd, sessions and sessionFlushingDelayMS. The callbacks receive the web Request.

    Bun.serve now records a request session for each incoming request. Sessions are sent only when a release is set. To turn them off, set bunServerIntegration({ sessions: false }).

    ignoreStaticAssets defaults to true, so Bun.serve no longer creates spans for GET requests to common static assets such as favicon.ico, robots.txt or *.js files. To keep these spans, set bunServerIntegration({ ignoreStaticAssets: false }). Bun.serve spans also follow the client's tracing configuration by default, so the integration does not start spans when tracing is disabled. Errors thrown for OPTIONS and HEAD requests are now captured.

  • feat(bun): Inject debug IDs and upload source maps in sentryBunPlugin (#25670)

... (truncated)

Commits
  • 9e33660 release: 11.10.0
  • a51d938 Merge pull request #25832 from getsentry/prepare-release/11.10.0
  • 612654c meta(changelog): Update changelog for 11.10.0
  • 0455361 Merge pull request #25833 from getsentry/ab/merge-master-into-develop
  • 0e2b465 chore: Merge master into develop
  • 90a71e7 feat(server-utils): Instrument together-ai 1.x (#25823)
  • c6ac34c test(cloudflare): Bump agents and MCP SDK in cloudflare-mcp-agent e2e app (#2...
  • 6efffd8 test(remix): Cover prefetched navigations in the Remix 3 E2E app (#25829)
  • e17a480 fix(remix): Drop Remix 3 release candidates from the peer range (#25808)
  • cad66c7 test: Wire the managed tunnel by hand in Node, Cloudflare and Next.js (#25785)
  • Additional commits viewable in compare view

Updates @tanstack/react-virtual from 3.14.13 to 3.14.23

Release notes

Sourced from @​tanstack/react-virtual's releases.

@​tanstack/react-virtual@​3.14.23

Patch Changes

  • Updated dependencies [2343004]:
    • @​tanstack/virtual-core@​3.19.8

@​tanstack/react-virtual@​3.14.22

Patch Changes

@​tanstack/react-virtual@​3.14.21

Patch Changes

  • Updated dependencies [05bb4d3]:
    • @​tanstack/virtual-core@​3.19.6

@​tanstack/react-virtual@​3.14.20

Patch Changes

@​tanstack/react-virtual@​3.14.19

Patch Changes

  • Updated dependencies [269e8ed]:
    • @​tanstack/virtual-core@​3.19.4

@​tanstack/react-virtual@​3.14.18

Patch Changes

  • Updated dependencies [f211d3a]:
    • @​tanstack/virtual-core@​3.19.3

@​tanstack/react-virtual@​3.14.17

Patch Changes

@​tanstack/react-virtual@​3.14.16

Patch Changes

@​tanstack/react-virtual@​3.14.15

Patch Changes

... (truncated)

Changelog

Sourced from @​tanstack/react-virtual's changelog.

3.14.23

Patch Changes

  • Updated dependencies [2343004]:
    • @​tanstack/virtual-core@​3.19.8

3.14.22

Patch Changes

3.14.21

Patch Changes

  • Updated dependencies [05bb4d3]:
    • @​tanstack/virtual-core@​3.19.6

3.14.20

Patch Changes

3.14.19

Patch Changes

  • Updated dependencies [269e8ed]:
    • @​tanstack/virtual-core@​3.19.4

3.14.18

Patch Changes

  • Updated dependencies [f211d3a]:
    • @​tanstack/virtual-core@​3.19.3

3.14.17

Patch Changes

3.14.16

... (truncated)

Commits

Updates algoliasearch from 5.59.0 to 5.60.0

Release notes

Sourced from algoliasearch's releases.

5.60.0

New version released!

What's Changed

BREAKING CHANGES: this minor version includes breaking changes (A/B Testing V3 API, Agent Studio API). See below for more details.

Full Changelog: algolia/algoliasearch-client-javascript@5.59.0...5.60.0

→ Browse the Algolia documentation

Changelog

Sourced from algoliasearch's changelog.

5.60.0

BREAKING CHANGES: this minor version includes breaking changes (A/B Testing V3 API, Agent Studio API). See below for more details.

Commits
  • 642e71a chore: release 5.60.0
  • 3bb30cf fix(specs): update allowed value for externalProvider source ordering field (...
  • e429720 fix(specs): correct links to Algolia docs (generated)
  • 5621191 fix(specs): sync agent-studio OpenAPI from conversational-ai (generated)
  • c821b7f chore(deps): dependencies 2026-09-21 (generated)
  • cf62a27 fix(specs): sync agent-studio OpenAPI from conversational-ai (generated)
  • 8c1e3c9 refactor(specs): extract source object from behaviour object (generated)
  • b99375c feat(specs): add resultCard to renderingContent widgets (generated)
  • e44ad25 feat(specs): add externalProvider source for CompAPI client (generated)
  • 3c43383 fix(specs): BREAKING CHANGE - make AB test pValue optional (generated)
  • Additional commits viewable in compare view

Updates hono from 4.13.12 to 4.13.14

Release notes

Sourced from hono's releases.

v4.13.14

What's Changed

Full Changelog: honojs/hono@v4.13.13...v4.13.14

v4.13.13

Mount Middleware

app.mount() is now available as the Mount Middleware, hono/mount. It is just a handler, so you register it with app.all():

import { Router as IttyRouter } from 'itty-router'
import { Hono } from 'hono'
import { mount } from 'hono/mount'
const ittyRouter = IttyRouter()
ittyRouter.get('/hello', () => new Response('Hello from itty-router'))
const app = new Hono()
app.all('/itty-router/*', mount(ittyRouter.handle))

app.mount() still works in v4 but is deprecated and will be removed in v5. Migrating is a one-line change:

- app.mount('/itty-router', ittyRouter.handle)
+ app.all('/itty-router/*', mount(ittyRouter.handle))

What's Changed

  • test(client): simulate network error for undefined route in parseResponse test in honojs/hono#5439
  • docs(request): fix jsdoc comments for some getters in honojs/hono#5445
  • fix(jsx): allow JSXNode function component results in honojs/hono#5476

... (truncated)

Commits
  • bac5c4a 4.13.14
  • eb78eca fix(utils/url): preserve encoded duplicate query order (#5495)
  • 06a45bc feat(bearer-auth): allow MessageFunction to return a Response (#5269)
  • 5ca49b0 fix(css): Fix multiline CSS handling in style replacement (#5405)
  • e9c0107 fix(hono-base): disallow getPath when strict is false (#5563)
  • 08807ce fix(trie-router): keep first value for duplicate path params (#5422) (#5423)
  • e77c7c8 fix(helper/route): match regex params in basePath() the same way as the route...
  • d54720d fix(serve-static): respect q-values in Accept-Encoding for precompressed file...
  • ae401f0 fix(css): keep the descendant combinator before a pseudo-class when minifying...
  • 2013fed fix(css): keep "//" inside an unquoted url() when minifying (#5450)
  • Additional commits viewable in compare view

Updates pako from 3.0.2 to 3.0.3

Changelog

Sourced from pako's changelog.

3.0.3 - 2026-10-26

Added

  • Export Z_Strategy type for compression strategy options, #326.

Changed

  • Speed up CRC32 with slicing-by-8, #320.

Fixed

  • Restore compression strategy constant exports, #326.
  • Enforce the 65536-character limit when collecting gzip header names and comments.
Commits

Updates react from 19.3.0 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

Commits

Updates react-dom from 19.3.0 to 19.3.1

Release notes

Sourced from react-dom's releases.

19.3.1 (October 14th, 2026)

React Server Components

Commits

Updates swagger-ui-react from 5.33.0 to 5.34.0

Release notes

Sourced from swagger-ui-react's releases.

v5.34.0

5.34.0 (2026-10-19)

Features

v5.33.3

5.33.3 (2026-10-15)

Bug Fixes

v5.33.2

5.33.2 (2026-10-12)

Bug Fixes

  • deps: bump dompurify from 3.4.13 to 3.4.16 (#11076) (3beee55)
  • json-schema-5: move early return after useCallback in models (#11082) (7f26236)

v5.33.1

5.33.1 (2026-10-01)

Bug Fixes

  • handle virtualization with path item references (#11069) (38f0ef0)
Commits
  • a3d333d chore(release): cut the 5.34.0 release
  • fa20f4d feat(filter): support searching operations by path (#11095)
  • 2f91b75 feat(oas32): add support for additionalOperations (#11090)
  • 38ca10e chore(release): cut the 5.33.3 release
  • f170383 fix(deps): bump swagger-client to v3.38.3 (#11096)
  • e89a91f chore(release): cut the 5.33.2 release
  • 7f26236 fix(json-schema-5): move early return after useCallback in models (#11082)
  • cfd955e chore(deps): bump postcss-selector-parser from 7.1.5 to 7.1.6 (#11083)
  • 553cf09 chore(deps-dev): bump joi from 17.13.7 to 17.13.8 (#11087)
  • d19e961 chore(deps): bump source-map-js from 1.2.1 to 1.2.2 (#11085)
  • Additional commits viewable in compare view

Updates zod from 4.6.6 to 4.6.7

Release notes

Sourced from zod's releases.

v4.6.7

Commits:

  • b500a2ee95134f81d74da7911d7378dd2853d042 4.6.7
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the production group with 9 updates
985c733 
Bumps the production group with 9 updates:

| Package | From | To |
| --- | --- | --- |
| [@sentry/cloudflare](https://github.com/getsentry/sentry-javascript) | `11.1.0` | `11.10.0` |
| [@tanstack/react-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual) | `3.14.13` | `3.14.23` |
| [algoliasearch](https://github.com/algolia/algoliasearch-client-javascript) | `5.59.0` | `5.60.0` |
| [hono](https://github.com/honojs/hono) | `4.13.12` | `4.13.14` |
| [pako](https://github.com/nodeca/pako) | `3.0.2` | `3.0.3` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.3.0` | `19.3.1` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.3.0` | `19.3.1` |
| [swagger-ui-react](https://github.com/swagger-api/swagger-ui) | `5.33.0` | `5.34.0` |
| [zod](https://github.com/colinhacks/zod) | `4.6.6` | `4.6.7` |


Updates `@sentry/cloudflare` from 11.1.0 to 11.10.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@11.1.0...11.10.0)

Updates `@tanstack/react-virtual` from 3.14.13 to 3.14.23
- [Release notes](https://github.com/TanStack/virtual/releases)
- [Changelog](https://github.com/TanStack/virtual/blob/main/packages/react-virtual/CHANGELOG.md)
- [Commits](https://github.com/TanStack/virtual/commits/@tanstack/react-virtual@3.14.23/packages/react-virtual)

Updates `algoliasearch` from 5.59.0 to 5.60.0
- [Release notes](https://github.com/algolia/algoliasearch-client-javascript/releases)
- [Changelog](https://github.com/algolia/algoliasearch-client-javascript/blob/main/CHANGELOG.md)
- [Commits](algolia/algoliasearch-client-javascript@5.59.0...5.60.0)

Updates `hono` from 4.13.12 to 4.13.14
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.12...v4.13.14)

Updates `pako` from 3.0.2 to 3.0.3
- [Changelog](https://github.com/nodeca/pako/blob/master/CHANGELOG.md)
- [Commits](nodeca/pako@3.0.2...3.0.3)

Updates `react` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react)

Updates `react-dom` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom)

Updates `swagger-ui-react` from 5.33.0 to 5.34.0
- [Release notes](https://github.com/swagger-api/swagger-ui/releases)
- [Commits](swagger-api/swagger-ui@v5.33.0...v5.34.0)

Updates `zod` from 4.6.6 to 4.6.7
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.6.6...v4.6.7)

---
updated-dependencies:
- dependency-name: "@sentry/cloudflare"
  dependency-version: 11.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: "@tanstack/react-virtual"
  dependency-version: 3.14.23
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: algoliasearch
  dependency-version: 5.60.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: hono
  dependency-version: 4.13.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: pako
  dependency-version: 3.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: react
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: react-dom
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: swagger-ui-react
  dependency-version: 5.34.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: zod
  dependency-version: 4.6.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 1, 2026
@MattIPv4

MattIPv4 commented Nov 2, 2026

Copy link
Copy Markdown
Member

@dependabot rebase

@dependabot @github

dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Nov 2, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/production-e4842f6324 branch November 2, 2026 02:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@MattIPv4