Skip to content

Bump the production group across 1 directory with 7 updates - #308

Merged
MattIPv4 merged 1 commit into
masterfrom
dependabot/npm_and_yarn/production-cf78a0e088
Nov 2, 2026
Merged

Bump the production group across 1 directory with 7 updates#308
MattIPv4 merged 1 commit into
masterfrom
dependabot/npm_and_yarn/production-cf78a0e088

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown
Contributor

Bumps the production group with 7 updates in the / directory:

Package From To
@sentry/cloudflare 11.1.0 11.10.0
algoliasearch 5.59.0 5.61.0
hono 4.13.12 4.13.14
pako 3.0.2 3.0.3
react 19.3.0 19.3.1
react-dom 19.3.0 19.3.1
zod 4.6.6 4.6.7

Updates @sentry/cloudflare from 11.1.0 to 11.10.0

Release notes

Sourced from @​sentry/cloudflare's releases.

11.10.0

Important Changes

  • feat: Add a managed tunnel that the SDK derives from the DSN (#25199, #25200, #25783)

    Set tunnel: true in your browser Sentry.init call to send events through your own server. This helps when ad blockers block requests to Sentry. The browser derives the tunnel path from the DSN, so older and newer builds of your client and server always agree on the path.

    To serve the tunnel, add serveTunnelIntegration() to your server SDK. Astro, Nuxt, Nitro, React Router, Remix 3, SolidStart, SvelteKit and TanStack Start then answer tunnel requests automatically:

    // browser
Sentry.init({ dsn, tunnel: true });
// server
Sentry.init({ dsn, integrations: [Sentry.serveTunnelIntegration()] });

    If the browser uses a different DSN than the server, set serveTunnelIntegration({ allowedDsns: [browserDsn] }). For other setups, the server SDKs export handleTunnelRequestIfMatched, handleTunnelRequest, isTunnelRequest and getTunnelPath:

    app.use((req, res, next) => Sentry.handleTunnelRequestIfMatched(req, res) ?? next());

    The request option of handleTunnelRequest is deprecated and will be removed in v12.

  • feat: Make span origins spec compliant (#25602)

    Some span origins changed their names to follow the trace origin spec:

    • auto.amqplib.* is now auto.queue.amqplib.*, and auto.kafkajs.* is now auto.queue.kafkajs.*.
    • auto.vercelai.channel is now auto.ai.vercelai.
    • auto.firebase.firestore is now auto.db.firebase.firestore, and auto.firebase.functions is now auto.function.firebase.
    • auto.aws.aws_sdk is now auto.{rpc,db,queue,ai}.aws_sdk, with the category from the span op.
    • auto.aws_lambda is now auto.function.aws_serverless.
    • auto.mcp.notification is now auto.function.mcp_server.notification.
    • auto.db.cloudflare.durable_object.sql is now auto.db.cloudflare.durable_object_sql.
    • auto.http.browser.{lcp,cls,inp} is now auto.ui.browser.{lcp,cls,inp}.

    If you have ignoreSpans rules, queries or alerts on the old origins, change them to use the new origins.

  • feat(bun): Add incoming request options and request sessions to bunServerIntegration (#25580)

    bunServerIntegration now accepts the same options as denoServeIntegration: ignoreRequestBody, ignoreIncomingRequests, ignoreStaticAssets, spans, onSpanCreated, onSpanEnd, sessions and sessionFlushingDelayMS. The callbacks receive the web Request.

    Bun.serve now records a request session for each incoming request. Sessions are sent only when a release is set. To turn them off, set bunServerIntegration({ sessions: false }).

    ignoreStaticAssets defaults to true, so Bun.serve no longer creates spans for GET requests to common static assets such as favicon.ico, robots.txt or *.js files. To keep these spans, set bunServerIntegration({ ignoreStaticAssets: false }). Bun.serve spans also follow the client's tracing configuration by default, so the integration does not start spans when tracing is disabled. Errors thrown for OPTIONS and HEAD requests are now captured.

  • feat(bun): Inject debug IDs and upload source maps in sentryBunPlugin (#25670)

    sentryBunPlugin from @sentry/bun/plugin now accepts the same options as sentryEsbuildPlugin (org, project, authToken, release, sourcemaps, ...). When Bun.build writes source maps to outdir, the plugin injects the debug ID that Bun writes into each bundle, injects the release, and uploads the source maps at the end of the build. You no longer need to run sentry sourcemap inject and sentry sourcemap upload after the build.

... (truncated)

Changelog

Sourced from @​sentry/cloudflare's changelog.

11.10.0

Important Changes

  • feat: Add a managed tunnel that the SDK derives from the DSN (#25199, #25200, #25783)

    Set tunnel: true in your browser Sentry.init call to send events through your own server. This helps when ad blockers block requests to Sentry. The browser derives the tunnel path from the DSN, so older and newer builds of your client and server always agree on the path.

    To serve the tunnel, add serveTunnelIntegration() to your server SDK. Astro, Nuxt, Nitro, React Router, Remix 3, SolidStart, SvelteKit and TanStack Start then answer tunnel requests automatically:

    // browser
Sentry.init({ dsn, tunnel: true });
// server
Sentry.init({ dsn, integrations: [Sentry.serveTunnelIntegration()] });

    If the browser uses a different DSN than the server, set serveTunnelIntegration({ allowedDsns: [browserDsn] }). For other setups, the server SDKs export handleTunnelRequestIfMatched, handleTunnelRequest, isTunnelRequest and getTunnelPath:

    app.use((req, res, next) => Sentry.handleTunnelRequestIfMatched(req, res) ?? next());

    The request option of handleTunnelRequest is deprecated and will be removed in v12.

  • feat: Make span origins spec compliant (#25602)

    Some span origins changed their names to follow the trace origin spec:

    • auto.amqplib.* is now auto.queue.amqplib.*, and auto.kafkajs.* is now auto.queue.kafkajs.*.
    • auto.vercelai.channel is now auto.ai.vercelai.
    • auto.firebase.firestore is now auto.db.firebase.firestore, and auto.firebase.functions is now auto.function.firebase.
    • auto.aws.aws_sdk is now auto.{rpc,db,queue,ai}.aws_sdk, with the category from the span op.
    • auto.aws_lambda is now auto.function.aws_serverless.
    • auto.mcp.notification is now auto.function.mcp_server.notification.
    • auto.db.cloudflare.durable_object.sql is now auto.db.cloudflare.durable_object_sql.
    • auto.http.browser.{lcp,cls,inp} is now auto.ui.browser.{lcp,cls,inp}.

    If you have ignoreSpans rules, queries or alerts on the old origins, change them to use the new origins.

  • feat(bun): Add incoming request options and request sessions to bunServerIntegration (#25580)

    bunServerIntegration now accepts the same options as denoServeIntegration: ignoreRequestBody, ignoreIncomingRequests, ignoreStaticAssets, spans, onSpanCreated, onSpanEnd, sessions and sessionFlushingDelayMS. The callbacks receive the web Request.

    Bun.serve now records a request session for each incoming request. Sessions are sent only when a release is set. To turn them off, set bunServerIntegration({ sessions: false }).

    ignoreStaticAssets defaults to true, so Bun.serve no longer creates spans for GET requests to common static assets such as favicon.ico, robots.txt or *.js files. To keep these spans, set bunServerIntegration({ ignoreStaticAssets: false }). Bun.serve spans also follow the client's tracing configuration by default, so the integration does not start spans when tracing is disabled. Errors thrown for OPTIONS and HEAD requests are now captured.

  • feat(bun): Inject debug IDs and upload source maps in sentryBunPlugin (#25670)

... (truncated)

Commits
  • 9e33660 release: 11.10.0
  • a51d938 Merge pull request #25832 from getsentry/prepare-release/11.10.0
  • 612654c meta(changelog): Update changelog for 11.10.0
  • 0455361 Merge pull request #25833 from getsentry/ab/merge-master-into-develop
  • 0e2b465 chore: Merge master into develop
  • 90a71e7 feat(server-utils): Instrument together-ai 1.x (#25823)
  • c6ac34c test(cloudflare): Bump agents and MCP SDK in cloudflare-mcp-agent e2e app (#2...
  • 6efffd8 test(remix): Cover prefetched navigations in the Remix 3 E2E app (#25829)
  • e17a480 fix(remix): Drop Remix 3 release candidates from the peer range (#25808)
  • cad66c7 test: Wire the managed tunnel by hand in Node, Cloudflare and Next.js (#25785)
  • Additional commits viewable in compare view

Updates algoliasearch from 5.59.0 to 5.61.0

Release notes

Sourced from algoliasearch's releases.

5.61.0

New version released!

What's Changed

Full Changelog: algolia/algoliasearch-client-javascript@5.60.0...5.61.0

→ Browse the Algolia documentation

5.60.0

New version released!

What's Changed

BREAKING CHANGES: this minor version includes breaking changes (A/B Testing V3 API, Agent Studio API). See below for more details.

Full Changelog: algolia/algoliasearch-client-javascript@5.59.0...5.60.0

→ Browse the Algolia documentation

Changelog

Sourced from algoliasearch's changelog.

5.61.0

5.60.0

BREAKING CHANGES: this minor version includes breaking changes (A/B Testing V3 API, Agent Studio API). See below for more details.

Commits
  • 10b58b5 chore: release 5.61.0
  • f2925e8 feat(specs): add user metrics to abtesting-v3 timeseries enum (generated)
  • 61bc3e1 clients(php): cache host state only on change (generated)
  • 0ff1bb1 fix(javascript): mask API key in ApiError stack trace (generated)
  • 4e5362f chore(deps): dependencies 2026-10-12 (generated)
  • 47de7e5 fix(specs): remove obsolete index-key copy note (generated)
  • 642e71a chore: release 5.60.0
  • 3bb30cf fix(specs): update allowed value for externalProvider source ordering field (...
  • e429720 fix(specs): correct links to Algolia docs (generated)
  • 5621191 fix(specs): sync agent-studio OpenAPI from conversational-ai (generated)
  • Additional commits viewable in compare view

Updates hono from 4.13.12 to 4.13.14

Release notes

Sourced from hono's releases.

v4.13.14

What's Changed

Full Changelog: honojs/hono@v4.13.13...v4.13.14

v4.13.13

Mount Middleware

app.mount() is now available as the Mount Middleware, hono/mount. It is just a handler, so you register it with app.all():

import { Router as IttyRouter } from 'itty-router'
import { Hono } from 'hono'
import { mount } from 'hono/mount'
const ittyRouter = IttyRouter()
ittyRouter.get('/hello', () => new Response('Hello from itty-router'))
const app = new Hono()
app.all('/itty-router/*', mount(ittyRouter.handle))

app.mount() still works in v4 but is deprecated and will be removed in v5. Migrating is a one-line change:

- app.mount('/itty-router', ittyRouter.handle)
+ app.all('/itty-router/*', mount(ittyRouter.handle))

What's Changed

  • test(client): simulate network error for undefined route in parseResponse test in honojs/hono#5439
  • docs(request): fix jsdoc comments for some getters in honojs/hono#5445
  • fix(jsx): allow JSXNode function component results in honojs/hono#5476

... (truncated)

Commits
  • bac5c4a 4.13.14
  • eb78eca fix(utils/url): preserve encoded duplicate query order (#5495)
  • 06a45bc feat(bearer-auth): allow MessageFunction to return a Response (#5269)
  • 5ca49b0 fix(css): Fix multiline CSS handling in style replacement (#5405)
  • e9c0107 fix(hono-base): disallow getPath when strict is false (#5563)
  • 08807ce fix(trie-router): keep first value for duplicate path params (#5422) (#5423)
  • e77c7c8 fix(helper/route): match regex params in basePath() the same way as the route...
  • d54720d fix(serve-static): respect q-values in Accept-Encoding for precompressed file...
  • ae401f0 fix(css): keep the descendant combinator before a pseudo-class when minifying...
  • 2013fed fix(css): keep "//" inside an unquoted url() when minifying (#5450)
  • Additional commits viewable in compare view

Updates pako from 3.0.2 to 3.0.3

Changelog

Sourced from pako's changelog.

3.0.3 - 2026-10-26

Added

  • Export Z_Strategy type for compression strategy options, #326.

Changed

  • Speed up CRC32 with slicing-by-8, #320.

Fixed

  • Restore compression strategy constant exports, #326.
  • Enforce the 65536-character limit when collecting gzip header names and comments.
Commits

Updates react from 19.3.0 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

Commits

Updates react-dom from 19.3.0 to 19.3.1

Release notes

Sourced from react-dom's releases.

19.3.1 (October 14th, 2026)

React Server Components

Commits

Updates zod from 4.6.6 to 4.6.7

Release notes

Sourced from zod's releases.

v4.6.7

Commits:

  • b500a2ee95134f81d74da7911d7378dd2853d042 4.6.7
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the production group across 1 directory with 7 updates
e4dca48 
Bumps the production group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@sentry/cloudflare](https://github.com/getsentry/sentry-javascript) | `11.1.0` | `11.10.0` |
| [algoliasearch](https://github.com/algolia/algoliasearch-client-javascript) | `5.59.0` | `5.61.0` |
| [hono](https://github.com/honojs/hono) | `4.13.12` | `4.13.14` |
| [pako](https://github.com/nodeca/pako) | `3.0.2` | `3.0.3` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.3.0` | `19.3.1` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.3.0` | `19.3.1` |
| [zod](https://github.com/colinhacks/zod) | `4.6.6` | `4.6.7` |



Updates `@sentry/cloudflare` from 11.1.0 to 11.10.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@11.1.0...11.10.0)

Updates `algoliasearch` from 5.59.0 to 5.61.0
- [Release notes](https://github.com/algolia/algoliasearch-client-javascript/releases)
- [Changelog](https://github.com/algolia/algoliasearch-client-javascript/blob/main/CHANGELOG.md)
- [Commits](algolia/algoliasearch-client-javascript@5.59.0...5.61.0)

Updates `hono` from 4.13.12 to 4.13.14
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.12...v4.13.14)

Updates `pako` from 3.0.2 to 3.0.3
- [Changelog](https://github.com/nodeca/pako/blob/master/CHANGELOG.md)
- [Commits](nodeca/pako@3.0.2...3.0.3)

Updates `react` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react)

Updates `react-dom` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom)

Updates `zod` from 4.6.6 to 4.6.7
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.6.6...v4.6.7)

---
updated-dependencies:
- dependency-name: "@sentry/cloudflare"
  dependency-version: 11.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: algoliasearch
  dependency-version: 5.61.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: hono
  dependency-version: 4.13.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: pako
  dependency-version: 3.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: react
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: react-dom
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: zod
  dependency-version: 4.6.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 2, 2026
@MattIPv4
MattIPv4 merged commit 2149aab into master Nov 2, 2026
8 checks passed
@MattIPv4
MattIPv4 deleted the dependabot/npm_and_yarn/production-cf78a0e088 branch November 2, 2026 02:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@MattIPv4 MattIPv4 MattIPv4 approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@MattIPv4