Skip to content

chore(deps): bump the minor-patch group across 1 directory with 27 updates - #577

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-patch-2e93f053f5
Open

chore(deps): bump the minor-patch group across 1 directory with 27 updates#577
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-patch-2e93f053f5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 13, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-patch group with 27 updates in the / directory:

Package From To
@biomejs/biome 2.4.16 2.5.7
@swc/core 1.15.40 1.15.47
browserslist 4.28.2 4.28.8
classnames 2.3.2 2.5.1
core-js 3.21.1 3.50.0
html-to-react 1.5.0 1.7.0
lerna-audit 1.2.0 1.3.3
lodash 4.17.21 4.18.1
@types/lodash 4.17.24 4.17.25
react 19.1.0 19.2.8
@types/react 19.2.17 19.2.18
react-dom 19.1.0 19.2.8
@types/react-dom 19.2.3 19.2.4
react-redux 9.2.0 9.3.0
sass 1.100.0 1.102.0
syncpack 15.3.2 15.3.3
ts-jest 29.4.11 29.4.12
tsdown 0.22.1 0.22.14
@types/lodash 4.17.24 4.17.25
markdown-it-front-matter 0.1.2 0.2.4
@vitejs/plugin-react 6.0.2 6.0.5
vite 8.0.16 8.2.1
use-sync-external-store 1.5.0 1.6.0
@types/use-sync-external-store 0.0.6 1.5.0
react-test-renderer 19.2.7 19.2.8
pureimage 0.1.6 0.4.20
uglify-js 3.15.1 3.19.3
@playwright/test 1.60.0 1.62.1

Updates @biomejs/biome from 2.4.16 to 2.5.7

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.7

2.5.7

Patch Changes

  • #10822 c171b3b Thanks @​pkallos! - Added the option ignoreIfStatements to useNullishCoalescing. Biome now flags if statements that only assign to a nullish variable (such as if (!a) { a = b }) and can rewrite them to ??=. When enabled, Biome ignores those if statements.

  • #11136 e63354c Thanks @​AkashNaickar! - Added a new nursery rule noExtendNative, which reports extending the prototype of a built-in object.

  • #10094 e007143 Thanks @​THEjacob1000! - Added the nursery rule noTailwindArbitraryValue. Biome now reports Tailwind CSS arbitrary values such as w-[400px], including in HTML/JSX class attributes, configured utility functions, and tagged templates.

  • #11184 135f476 Thanks @​subotac! - Fixed #11176: noUnknownPseudoClass now recognizes Vue's :deep() pseudo-class inside .vue style blocks.

  • #8239 a519f9d Thanks @​cormacrelf! - Fixed #8233, where Biome CLI in stdin mode didn't work correctly when handling files in projects with nested configurations. For example, with the following structure, --stdin-file-path=subdirectory/... would not use the nested configuration in subdirectory/biome.json:

    ├── biome.json
└── subdirectory
    ├── biome.json
    └── lib.js

    biome format --write --stdin-file-path=subdirectory/lib.js < subdirectory/lib.js

    Now, the nested configuration is correctly picked up and applied.

    In addition, Biome now shows a warning if --stdin-file-path is provided but that path is ignored and therefore not formatted or fixed.

  • #11138 8c2c6bd Thanks @​ematipico! - Fixed noUnnecessaryConditions: Biome now chooses the same function overload as TypeScript when an argument is a callback, so conditions that were previously missed are reported.

    The following code is now invalid, because a parameter typed () => void accepts an async callback and schedule therefore returns string:

    declare function schedule(handler: () => void): string;
declare function schedule(handler: () => Promise<void>): string | undefined;
schedule(async () => {}) ?? "fallback";

    The following code is also now invalid, because map(() => 42) returns 42:

    

    • 






... (truncated)





Changelog

Sourced from @​biomejs/biome's changelog.




2.5.7


Patch Changes


    

  • 

    #10822 c171b3b Thanks @​pkallos! - Added the option ignoreIfStatements to useNullishCoalescing. Biome now flags if statements that only assign to a nullish variable (such as if (!a) { a = b }) and can rewrite them to ??=. When enabled, Biome ignores those if statements.
    

    • 

  • 

    #11136 e63354c Thanks @​AkashNaickar! - Added a new nursery rule noExtendNative, which reports extending the prototype of a built-in object.
    

    • 

  • 

    #10094 e007143 Thanks @​THEjacob1000! - Added the nursery rule noTailwindArbitraryValue. Biome now reports Tailwind CSS arbitrary values such as w-[400px], including in HTML/JSX class attributes, configured utility functions, and tagged templates.
    

    • 

  • 

    #11184 135f476 Thanks @​subotac! - Fixed #11176: noUnknownPseudoClass now recognizes Vue's :deep() pseudo-class inside .vue style blocks.
    

    • 

  • 

    #8239 a519f9d Thanks @​cormacrelf! - Fixed #8233, where Biome CLI in
stdin mode didn't work correctly when handling files in projects with nested
configurations. For example, with the following structure,
--stdin-file-path=subdirectory/... would not use the nested configuration in
subdirectory/biome.json:
    

    ├── biome.json
└── subdirectory
    ├── biome.json
    └── lib.js

    

    biome format --write --stdin-file-path=subdirectory/lib.js < subdirectory/lib.js
    

    Now, the nested configuration is correctly picked up and applied.
    

    In addition, Biome now shows a warning if --stdin-file-path is provided but
that path is ignored and therefore not formatted or fixed.
    

    • 

  • 

    #11138 8c2c6bd Thanks @​ematipico! - Fixed noUnnecessaryConditions: Biome now chooses the same function overload as TypeScript when an argument is a callback, so conditions that were previously missed are reported.
    

    The following code is now invalid, because a parameter typed () => void accepts an async callback and schedule therefore returns string:
    

    declare function schedule(handler: () => void): string;
declare function schedule(handler: () => Promise<void>): string | undefined;
schedule(async () => {}) ?? "fallback";
    

    The following code is also now invalid, because map(() => 42) returns 42:
    

    type Mapper<T> = () => T;
declare function map<T>(mapper: Mapper<T>): T;
    

    • 






... (truncated)





Commits






Updates @swc/core from 1.15.40 to 1.15.47



Changelog

Sourced from @​swc/core's changelog.




[1.15.47] - 2026-07-29


Bug Fixes


    

  • 

    (es) Preserve numeric property key identity (#12050) (46900a3)
    

    • 

  • 

    (es/ast) Support hashing non-finite numbers (#12043) (f4b85a6)
    

    • 

  • 

    (es/codegen) Emit non-finite numeric literals (#12047) (883abc4)
    

    • 

  • 

    (es/decorators) Avoid class state leakage for nested undecorated classes (#12076) (4c9d277)
    

    • 

  • 

    (es/minifier) Apply ToInt32 when folding bitwise NOT (#12058) (550e2f7)
    

    • 

  • 

    (es/minifier) Avoid inexact number radix folding (#12057) (506a0ea)
    

    • 

  • 

    (es/minifier) Preserve invalid Array lengths (#12056) (3ce9e16)
    

    • 

  • 

    (es/minifier) Preserve non-canonical arguments access (#12052) (850230b)
    

    • 

  • 

    (es/minifier) Apply ToUint16 in fromCharCode (#12055) (9ae7b92)
    

    • 

  • 

    (es/minifier) Index strings by UTF-16 code unit (#12054) (bc263d2)
    

    • 

  • 

    (es/minifier) Use numeric literals for non-finite values (#12048) (b830786)
    

    • 

  • 

    (es/minifier) Preserve top-level declarations referenced only by direct eval (#12029) (ad0e3b4)
    

    • 

  • 

    (es/optimization) Preserve JSON numeric values (#12051) (667af8c)
    

    • 

  • 

    (es/transforms) Use numeric literals for non-finite enum values (#12049) (1e3ed5c)
    

    • 

  • 

    (es/typescript) Evaluate cooked enum templates (#12059) (49d0b0f)
    

    • 






... (truncated)





Commits

    

  • 0febbba chore: Publish 1.15.47 with swc_core v75.0.0
    • 

  • 68abe42 chore: Publish 1.15.47-nightly-20260729.1 with swc_core v75.0.0
    • 

  • 9383162 chore: Publish 1.15.46 with swc_core v74.0.1
    • 

  • 035084a chore: Publish 1.15.46-nightly-20260719.1 with swc_core v74.0.1
    • 

  • 42d599f chore: Publish 1.15.45-nightly-20260719.1 with swc_core v74.0.1
    • 

  • 715eab8 chore: Publish 1.15.44-nightly-20260718.1 with swc_core v74.0.0
    • 

  • d6833cc refactor(es/lexer): remove smartstring dependency (#12013)
    • 

  • 5761a2b refactor: remove direct rkyv dependencies (#12010)
    • 

  • f36e4b6 refactor(es/helpers): Generate inline helpers from canonical ESM sources (#12...
    • 

  • 2f47530 fix(es/module): Rewrite SystemJS transform (#11996)
    • 

  • Additional commits viewable in compare view
    • 







Updates browserslist from 4.28.2 to 4.28.8



Release notes

Sourced from browserslist's releases.




4.28.8


    

  • Fixed including kaios in baseline queries (by @​Jaybhade).
    • 



4.28.7



4.28.6



4.28.5



4.28.4


    

  • Fixed SyntaxError regression of 4.28.3.
    • 



4.28.3


    

  • Fixed baseline query case-insensitivity (by @​swwind).
    • 








Changelog

Sourced from browserslist's changelog.




4.28.8


    

  • Fixed including kaios in baseline queries (by @​Jaybhade).
    • 



4.28.7



4.28.6



4.28.5



4.28.4


    

  • Fixed SyntaxError regression of 4.28.3.
    • 



4.28.3


    

  • Fixed baseline query case-insensitivity (by @​swwind).
    • 








Commits

    

  • f2f2e6c Release 4.28.8 version
    • 

  • d0787c8 Update dependencies
    • 

  • fcf8fa9 Merge pull request #939 from Jaybhade/fix/baseline-kaios-without-downstream
    • 

  • 57ecd64 fix: support "including kaios" without downstream
    • 

  • 093a0f6 Update EM banner
    • 

  • b637868 Release 4.28.7 version
    • 

  • 313f465 Update dependencies
    • 

  • c935c5a Fix regexp performance
    • 

  • d7e9e65 Rewrite structure parsing to make it always fast
    • 

  • ec4a55e Fix import order
    • 

  • Additional commits viewable in compare view
    • 






Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.






Updates classnames from 2.3.2 to 2.5.1



Changelog

Sourced from classnames's changelog.




v2.5.1 / 2023-12-29


    

  • Remove workspaces field from package (#350)
    • 



v2.5.0 / 2023-12-27


    

  • Restore ability to pass a TypeScript interface (#341)
    • 

  • Add exports field to package (#342)
    • 



v2.4.0 / 2023-12-26


    

  • Use string concatenation to increase performance thanks Jon Koops (#336)
    • 



v2.3.3 / 2023-12-21








Commits






Updates core-js from 3.21.1 to 3.50.0



Release notes

Sourced from core-js's releases.




3.50.0 - 2026.08.05


    

  • Changes v3.49.0...v3.50.0 (138 commits)
    • 

  • Joint iteration proposal:

      

    • Built-ins:

        

      • Iterator.zip
        • 

      • Iterator.zipKeyed
        • 

      

      • 

    • Moved to stable ES, May 2026 TC39 meeting
      • 

    • Added es. namespace modules, /es/ and /stable/ namespace entries
      • 

    

    • 

  • Iterator chunking proposal:

      

    • Built-ins:

        

      • Iterator.prototype.chunks
        • 

      • Iterator.prototype.windows
        • 

      

      • 

    • Throw a TypeError instead of RangeError on non-integer number chunkSize / windowSize, following [tc39/proposal-iterator-chunking/#30](tc39/proposal-iterator-chunking#30)
      • 

    • Moved to stage 3, May 2026 TC39 meeting
      • 

    • Added /actual/ namespace entries, unconditional forced replacement changed to feature detection
      • 

    

    • 

  • Added Iterator includes stage 3 proposal:

      

    • Added built-in:

        

      • Iterator.prototype.includes
        • 

      

      • 

    

    • 

  • Added Iterator join stage 3 proposal:

      

    • Added built-in:

        

      • Iterator.prototype.join
        • 

      

      • 

    

    • 

  • Added Await dictionary of Promises stage 3 proposal:

      

    • Added built-ins:

        

      • Promise.allKeyed
        • 

      • Promise.allSettledKeyed
        • 

      

      • 

    

    • 

  • Throw a RangeError on finite unsafe integer limit in Iterator.prototype.{ drop, take }, following [tc39/ecma262/#3776](tc39/ecma262#3776)
    • 

  • Use PromiseResolve semantics in Promise.try, following [tc39/ecma262/#3883](tc39/ecma262#3883)
    • 

  • Added detection of missed Webkit ~ Safari < 26.2 Iterator.prototype.flatMap bug case, #1538
    • 

  • Deno 2.9+ replaces Object.prototype.__proto__ instead of removing it, so the feature detection updated
    • 

  • Fixed JSON.stringify polyfill with an array replacer - keys order now follows the replacer, inherited and non-enumerable properties are no longer ignored, #1539
    • 

  • Make URL / URLSearchParams parsing a little more correct (char sets, percent coding, etc)
    • 

  • Ensure opaque paths always roundtrip in URL polyfill (still without adding to feature detection), whatwg/url#844
    • 

  • Fix URL#toJSON when URL#toString is reassigned after core-js is imported
    • 

  • Fixed possible crash on some keys in Symbol.for
    • 

  • Some get-iterator / get-iterator-method fixes
    • 

  • Fixed String.prototype.{ match, search } polyfills conversion order
    • 

  • Added missed MAX_SAFE_INTEGER excess check in Array.from and { Map, Object }.groupBy polyfills
    • 

  • Improved the way of inner iterators cleaning in iterator helpers
    • 

  • Improved accuracy of Math.{ asinh, cbrt, log1p } polyfills with big and small values
    • 

  • Improved performance of Uint8Array base64 methods
    • 

  • Improved performance of escape
    • 

  • Slight performance improvement for engines with native Array.prototype.fill on ArrayBuffer constructor and %TypedArray%.prototype.fill
    • 

  • Clarify supported Node versions in package.json of some missed packages (just to satisfy publint)
    • 

  • Compat data improvements:


    • 






... (truncated)





Changelog

Sourced from core-js's changelog.




3.50.0 - 2026.08.05


    

  • Changes v3.49.0...v3.50.0 (138 commits)
    • 

  • Joint iteration proposal:

      

    • Built-ins:

        

      • Iterator.zip
        • 

      • Iterator.zipKeyed
        • 

      

      • 

    • Moved to stable ES, May 2026 TC39 meeting
      • 

    • Added es. namespace modules, /es/ and /stable/ namespace entries
      • 

    

    • 

  • Iterator chunking proposal:

      

    • Built-ins:

        

      • Iterator.prototype.chunks
        • 

      • Iterator.prototype.windows
        • 

      

      • 

    • Throw a TypeError instead of RangeError on non-integer number chunkSize / windowSize, following [tc39/proposal-iterator-chunking/#30](tc39/proposal-iterator-chunking#30)
      • 

    • Moved to stage 3, May 2026 TC39 meeting
      • 

    • Added /actual/ namespace entries, unconditional forced replacement changed to feature detection
      • 

    

    • 

  • Added Iterator includes stage 3 proposal:

      

    • Added built-in:

        

      • Iterator.prototype.includes
        • 

      

      • 

    

    • 

  • Added Iterator join stage 3 proposal:

      

    • Added built-in:

        

      • Iterator.prototype.join
        • 

      

      • 

    

    • 

  • Added Await dictionary of Promises stage 3 proposal:

      

    • Added built-ins:

        

      • Promise.allKeyed
        • 

      • Promise.allSettledKeyed
        • 

      

      • 

    

    • 

  • Throw a RangeError on finite unsafe integer limit in Iterator.prototype.{ drop, take }, following [tc39/ecma262/#3776](tc39/ecma262#3776)
    • 

  • Use PromiseResolve semantics in Promise.try, following [tc39/ecma262/#3883](tc39/ecma262#3883)
    • 

  • Added detection of missed Webkit ~ Safari < 26.2 Iterator.prototype.flatMap bug case, #1538
    • 

  • Deno 2.9+ replaces Object.prototype.__proto__ instead of removing it, so the feature detection updated
    • 

  • Fixed JSON.stringify polyfill with an array replacer - keys order now follows the replacer, inherited and non-enumerable properties are no longer ignored, #1539
    • 

  • Make URL / URLSearchParams parsing a little more correct (char sets, percent coding, etc)
    • 

  • Ensure opaque paths always roundtrip in URL polyfill (still without adding to feature detection), whatwg/url#844
    • 

  • Fix URL#toJSON when URL#toString is reassigned after core-js is imported
    • 

  • Fixed possible crash on some keys in Symbol.for
    • 

  • Some get-iterator / get-iterator-method fixes
    • 

  • Fixed String.prototype.{ match, search } polyfills conversion order
    • 

  • Added missed MAX_SAFE_INTEGER excess check in Array.from and { Map, Object }.groupBy polyfills
    • 

  • Improved the way of inner iterators cleaning in iterator helpers
    • 

  • Improved accuracy of Math.{ asinh, cbrt, log1p } polyfills with big and small values
    • 

  • Improved performance of Uint8Array base64 methods
    • 

  • Improved performance of escape
    • 

  • Slight performance improvement for engines with native Array.prototype.fill on ArrayBuffer constructor and %TypedArray%.prototype.fill
    • 

  • Clarify supported Node versions in package.json of some missed packages (just to satisfy publint)
    • 

  • Compat data improvements:


    • 






... (truncated)





Commits

    

  • 486e8d6 v3.50.0
    • 

  • 6a78c6a Cache URL#toString (#1533)
    • 

  • 5d4f138 fix: correct Iterator zip entry exports
    • 

  • 7e8e1cc rename method for consistency
    • 

  • 2507115 fix JSON.stringify polyfill with an array replacerJSON.stringify polyfill...
    • 

  • 4036342 make URL / URLSearchParams parsing a little more correct (char sets, perc...
    • 

  • 37375ba fix order of detection
    • 

  • 276de47 add detection of missed Webkit ~ Safari < 26.2 Iterator.prototype.flatMap b...
    • 

  • 6e4a942 use PromiseResolve semantics in Promise.try
    • 

  • ff52b9f backport await dictionary stage 3 proposal
    • 

  • Additional commits viewable in compare view
    • 






Maintainer changes

This version was pushed to npm by zloirock, a new releaser for core-js since your current version.





Install script changes

This version adds postinstall script that runs during installation. Review the package contents before updating.






Updates html-to-react from 1.5.0 to 1.7.0



Changelog

Sourced from html-to-react's changelog.




v1.7.0


    

  • Don't process attributes for custom elements #151 (bilobom)
    • 



v1.6.0



v1.5.1








Commits






Updates lerna-audit from 1.2.0 to 1.3.3



Release notes

Sourced from lerna-audit's releases.




v1.3.3


    

  • Fix: No longer compatible with latest version of @​npmcli/arborist (#25)
    • 



v1.3.2


    

  • Fix: Avoid truncated logs by using spawnSync to inherit stdio streams (#16)
    • 



Thx to @​curvedriver for creating this fix! 🎉


v1.3.1


    

  • Bugfix: package.json - EOF newline removed (#15)
    • 



Many thanks to @​wiese for proposing the PR and @​brandonb927 for reviewing/testing.


v1.3.0


Changes are documented in the Changelog







Changelog

Sourced from lerna-audit's changelog.




1.3.3


    

  • Fix: No longer compatible with latest version of @​npmcli/arborist (#25)
    • 



1.3.2


    

  • Fix: Avoid truncated logs by using spawnSync to inherit stdio streams (#16)
    • 



1.3.1


    

  • Bugfix: package.json - EOF newline removed (#15)
    • 



1.3.0


    

  • Enhancement: Added optional parameter --no-fix to skip an automatic fix after an audit (#13)
    • 








Commits

    

  • 9e85444 1.3.3
    • 

  • 7701eff CHANGELOG.md
    • 

  • 088c2f3 Consider source json file formatting (indentation / eof) when writing audited...
    • 

  • c8d3a90 Removed arborist
    • 

  • d0575df moved lib files into dedicated folder
    • 

  • c9cc320 Merge pull request #30 from tnobody/dependabot/npm_and_yarn/path-parse-1.0.7
    • 

  • bc222f1 Merge pull request #29 from tnobody/dependabot/npm_and_yarn/npmcli/git-2.1.0
    • 

  • ed72feb Merge pull request #28 from tnobody/dependabot/npm_and_yarn/tar-6.1.5
    • 

  • 307bed8 Bump path-parse from 1.0.6 to 1.0.7
    • 

  • c40d6a4 Bump @​npmcli/git from 2.0.6 to 2.1.0
    • 

  • Additional commits viewable in compare view
    • 







Updates lodash from 4.17.21 to 4.18.1



Release notes

Sourced from lodash's releases.




4.18.1


Bugs


Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167


These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.


There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:



4.18.0


v4.18.0


Full Changelog: lodash/lodash@4.17.23...4.18.0


Security


_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.


_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".


Docs


    

  • Add security notice for _.template in threat model and API docs (#6099)
    • 

  • Document lower > upper behavior in _.random (#6115)
    • 

  • Fix quotes in _.compact jsdoc (#6090)
    • 



lodash.* modular packages


Diff


We have also regenerated and published a select number of the lodash.* modular packages.


These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:








Commits

    

  • cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
    • 

  • 75535f5 chore: prune stale advisory refs (#6170)
    • 

  • 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
    • 

  • 59be2de release(minor): bump to 4.18.0 (#6161)
    • 

  • af63457 fix: broken tests for _.template 879aaa9
    • 

  • 1073a76 fix: linting issues
    • 

  • 879aaa9 fix: validate imports keys in _.template
    • 

  • fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
    • 

  • 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
    • 

  • b819080 ci: add dist sync validation workflow (#6137)
    • 

  • Additional commits viewable in compare view
    • 







Updates @types/lodash from 4.17.24 to 4.17.25



Commits






Updates react from 19.1.0 to 19.2.8



Release notes

Sourced from react's releases.




19.2.8 (July 21st, 2026)


React Server Components



19.2.7 (June 1st, 2026)


React Server Components



19.2.6 (May 6th, 2026)


React Server Components



19.2.5 (April 8th, 2026)


React Server Components



19.2.4 (January 26th, 2026)


React Server Components



19.2.3 (December 11th, 2025)


React Server Components



19.2.2 (December 11th, 2025)


React Server Components



19.2.1 (December 3rd, 2025)


React Server Components


    

  • Bring React Server Component fixes to Se...

    Description has been truncated

    

  
  



      


          

          
  
  

    
  
    
    

  

  

  



                    

          
        





  





    



      

  
        

  

      

  
  

  
          

  

    

      


  

        
          @dependabot
  




      

        
          chore(deps): bump the minor-patch group across 1 directory with 27 up…
        

          
                        
      


      

        

    
    
    

  

    


      


      

        

          

    
    
    

  

  

    
  



        

      


      

        
          742f6b7
        
      

    

  

    

      
…dates

Bumps the minor-patch group with 27 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.4.16` | `2.5.7` |
| [@swc/core](https://github.com/swc-project/swc/tree/HEAD/packages/core) | `1.15.40` | `1.15.47` |
| [browserslist](https://github.com/browserslist/browserslist) | `4.28.2` | `4.28.8` |
| [classnames](https://github.com/JedWatson/classnames) | `2.3.2` | `2.5.1` |
| [core-js](https://github.com/zloirock/core-js/tree/HEAD/packages/core-js) | `3.21.1` | `3.50.0` |
| [html-to-react](https://github.com/aknuds1/html-to-react) | `1.5.0` | `1.7.0` |
| [lerna-audit](https://github.com/tnobody/lerna-audit) | `1.2.0` | `1.3.3` |
| [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.18.1` |
| [@types/lodash](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/lodash) | `4.17.24` | `4.17.25` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.1.0` | `19.2.8` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.17` | `19.2.18` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.1.0` | `19.2.8` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.3` | `19.2.4` |
| [react-redux](https://github.com/reduxjs/react-redux) | `9.2.0` | `9.3.0` |
| [sass](https://github.com/sass/dart-sass) | `1.100.0` | `1.102.0` |
| [syncpack](https://github.com/JamieMason/syncpack) | `15.3.2` | `15.3.3` |
| [ts-jest](https://github.com/kulshekhar/ts-jest) | `29.4.11` | `29.4.12` |
| [tsdown](https://github.com/rolldown/tsdown) | `0.22.1` | `0.22.14` |
| [@types/lodash](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/lodash) | `4.17.24` | `4.17.25` |
| [markdown-it-front-matter](https://github.com/ParkSB/markdown-it-front-matter) | `0.1.2` | `0.2.4` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.2` | `6.0.5` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.0.16` | `8.2.1` |
| [use-sync-external-store](https://github.com/facebook/react/tree/HEAD/packages/use-sync-external-store) | `1.5.0` | `1.6.0` |
| [@types/use-sync-external-store](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/use-sync-external-store) | `0.0.6` | `1.5.0` |
| [react-test-renderer](https://github.com/react/react/tree/HEAD/packages/react-test-renderer) | `19.2.7` | `19.2.8` |
| [pureimage](https://github.com/joshmarinacci/node-pureimage) | `0.1.6` | `0.4.20` |
| [uglify-js](https://github.com/mishoo/UglifyJS) | `3.15.1` | `3.19.3` |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.60.0` | `1.62.1` |



Updates `@biomejs/biome` from 2.4.16 to 2.5.7
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.7/packages/@biomejs/biome)

Updates `@swc/core` from 1.15.40 to 1.15.47
- [Release notes](https://github.com/swc-project/swc/releases)
- [Changelog](https://github.com/swc-project/swc/blob/main/CHANGELOG.md)
- [Commits](https://github.com/swc-project/swc/commits/v1.15.47/packages/core)

Updates `browserslist` from 4.28.2 to 4.28.8
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](browserslist/browserslist@4.28.2...4.28.8)

Updates `classnames` from 2.3.2 to 2.5.1
- [Changelog](https://github.com/JedWatson/classnames/blob/main/HISTORY.md)
- [Commits](JedWatson/classnames@v2.3.2...v2.5.1)

Updates `core-js` from 3.21.1 to 3.50.0
- [Release notes](https://github.com/zloirock/core-js/releases)
- [Changelog](https://github.com/zloirock/core-js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/zloirock/core-js/commits/v3.50.0/packages/core-js)

Updates `html-to-react` from 1.5.0 to 1.7.0
- [Changelog](https://github.com/aknuds1/html-to-react/blob/master/CHANGELOG.md)
- [Commits](aknuds1/html-to-react@1.5.0...v1.7.0)

Updates `lerna-audit` from 1.2.0 to 1.3.3
- [Release notes](https://github.com/tnobody/lerna-audit/releases)
- [Changelog](https://github.com/tnobody/lerna-audit/blob/main/CHANGELOG.md)
- [Commits](tnobody/lerna-audit@v1.2.0...v1.3.3)

Updates `lodash` from 4.17.21 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.18.1)

Updates `@types/lodash` from 4.17.24 to 4.17.25
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/lodash)

Updates `react` from 19.1.0 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react)

Updates `@types/react` from 19.2.17 to 19.2.18
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `react-dom` from 19.1.0 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom)

Updates `@types/react-dom` from 19.2.3 to 19.2.4
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `react-redux` from 9.2.0 to 9.3.0
- [Release notes](https://github.com/reduxjs/react-redux/releases)
- [Changelog](https://github.com/reduxjs/react-redux/blob/master/CHANGELOG.md)
- [Commits](reduxjs/react-redux@v9.2.0...v9.3.0)

Updates `sass` from 1.100.0 to 1.102.0
- [Release notes](https://github.com/sass/dart-sass/releases)
- [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md)
- [Commits](sass/dart-sass@1.100.0...1.102.0)

Updates `syncpack` from 15.3.2 to 15.3.3
- [Release notes](https://github.com/JamieMason/syncpack/releases)
- [Changelog](https://github.com/JamieMason/syncpack/blob/main/CHANGELOG.md)
- [Commits](JamieMason/syncpack@15.3.2...15.3.3)

Updates `ts-jest` from 29.4.11 to 29.4.12
- [Release notes](https://github.com/kulshekhar/ts-jest/releases)
- [Changelog](https://github.com/kulshekhar/ts-jest/blob/main/CHANGELOG.md)
- [Commits](kulshekhar/ts-jest@v29.4.11...v29.4.12)

Updates `tsdown` from 0.22.1 to 0.22.14
- [Release notes](https://github.com/rolldown/tsdown/releases)
- [Commits](rolldown/tsdown@v0.22.1...v0.22.14)

Updates `@types/lodash` from 4.17.24 to 4.17.25
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/lodash)

Updates `markdown-it-front-matter` from 0.1.2 to 0.2.4
- [Commits](https://github.com/ParkSB/markdown-it-front-matter/commits/v0.2.4)

Updates `@vitejs/plugin-react` from 6.0.2 to 6.0.5
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.0.5/packages/plugin-react)

Updates `vite` from 8.0.16 to 8.2.1
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.2.1/packages/vite)

Updates `use-sync-external-store` from 1.5.0 to 1.6.0
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/HEAD/packages/use-sync-external-store)

Updates `@types/use-sync-external-store` from 0.0.6 to 1.5.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/use-sync-external-store)

Updates `@types/react` from 19.2.17 to 19.2.18
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `@types/react-dom` from 19.2.3 to 19.2.4
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `@types/use-sync-external-store` from 0.0.6 to 1.5.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/use-sync-external-store)

Updates `react-test-renderer` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-test-renderer)

Updates `pureimage` from 0.1.6 to 0.4.20
- [Release notes](https://github.com/joshmarinacci/node-pureimage/releases)
- [Changelog](https://github.com/joshmarinacci/node-pureimage/blob/master/changes.md)
- [Commits](https://github.com/joshmarinacci/node-pureimage/commits)

Updates `uglify-js` from 3.15.1 to 3.19.3
- [Release notes](https://github.com/mishoo/UglifyJS/releases)
- [Commits](mishoo/UglifyJS@v3.15.1...v3.19.3)

Updates `@playwright/test` from 1.60.0 to 1.62.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.60.0...v1.62.1)

---
updated-dependencies:
- dependency-name: "@biomejs/biome"
  dependency-version: 2.5.7
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: "@swc/core"
  dependency-version: 1.15.47
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-patch
- dependency-name: browserslist
  dependency-version: 4.28.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-patch
- dependency-name: classnames
  dependency-version: 2.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: core-js
  dependency-version: 3.50.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: html-to-react
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: lerna-audit
  dependency-version: 1.3.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: "@types/lodash"
  dependency-version: 4.17.25
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-patch
- dependency-name: react
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: "@types/react"
  dependency-version: 19.2.18
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-patch
- dependency-name: react-dom
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: "@types/react-dom"
  dependency-version: 19.2.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-patch
- dependency-name: react-redux
  dependency-version: 9.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: sass
  dependency-version: 1.102.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: syncpack
  dependency-version: 15.3.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-patch
- dependency-name: ts-jest
  dependency-version: 29.4.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-patch
- dependency-name: tsdown
  dependency-version: 0.22.14
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-patch
- dependency-name: "@types/lodash"
  dependency-version: 4.17.25
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-patch
- dependency-name: markdown-it-front-matter
  dependency-version: 0.2.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.0.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-patch
- dependency-name: vite
  dependency-version: 8.2.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: use-sync-external-store
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: "@types/use-sync-external-store"
  dependency-version: 1.5.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: minor-patch
- dependency-name: "@types/react"
  dependency-version: 19.2.18
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-patch
- dependency-name: "@types/react-dom"
  dependency-version: 19.2.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-patch
- dependency-name: "@types/use-sync-external-store"
  dependency-version: 1.5.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: minor-patch
- dependency-name: react-test-renderer
  dependency-version: 19.2.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-patch
- dependency-name: pureimage
  dependency-version: 0.4.20
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: uglify-js
  dependency-version: 3.19.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: "@playwright/test"
  dependency-version: 1.62.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

    







  








      

  
            


    

    

      
    

    


      


          @dependabot
dependabot
Bot



          added
  the 

  security

  Pull requests that address a security vulnerability
 label


      Aug 13, 2026

    

  












  
  

    

      

  










  








  
      

  
    Sign up for free
    to join this conversation on GitHub.
    Already have an account?
    Sign in to comment


  










      

  

    
    

    

  

    Reviewers
  


    

    No reviews







    

  


      
  

    Assignees
  



        


      

        


  
      @msimmer
  
    msimmer
    

      








      


  


  

    Labels
  



    

      

    security

  Pull requests that address a security vulnerability








      

  

    

        

    Projects
  


        




    None yet




  



      


  

    
  

    Milestone
  


      No milestone





    
      
          


  

    

      
        

          
  

    Development
  



            


Successfully merging this pull request may close these issues.





  
  



      
    

  




      

    

  
        

  

    

      1 participant
    

    

        
          @msimmer