Bump the npm_and_yarn group across 1 directory with 10 updates by dependabot[bot] · Pull Request #37 · RedpointGames/twofold

dependabot · 2026-10-12T11:16:01Z

Bumps the npm_and_yarn group with 10 updates in the / directory:

Package	From	To
tar	`7.5.13`	`7.5.21`
@babel/core	`7.29.0`	`7.29.6`
fast-uri	`3.1.2`	`3.1.8`
vite	`8.0.10`	`8.0.16`
sharp	`0.34.5`	`0.35.5`
js-yaml	`4.1.1`	`4.3.2`
react-server-dom-webpack	`19.2.6`	`19.2.8`
@vitest/mocker	`4.1.5`	`5.0.4`
nanoid	`3.3.11`	`3.3.20`
postcss	`8.5.12`	`8.5.29`

Updates tar from 7.5.13 to 7.5.21

Commits

0cd9cc3 7.5.21
631ae59 list: prevent unbounded recursion
ebbb720 7.5.20
2f27196 fix: fully disable and dispose of unzip when aborting parser
be440da 7.5.19
2812e93 add maxDecompressionRatio guard against explosive decompression
9ecd4d2 7.5.18
9e78bf0 refuse to let header size be less than 0
e02a4e9 pax: parse values according to known types
9cbdb31 7.5.17
Additional commits viewable in compare view

Updates @babel/core from 7.29.0 to 7.29.6

Release notes

Sourced from @babel/core's releases.

v7.29.6 (2026-05-25)

🐛 Bug Fix

babel-generator

#18014 Catchup source map position in preserveFormat (@nicolo-ribaudo)

babel-core

#18001 [7.x packport]Improve input source map handling (@JLHwung)

babel-core, babel-generator

#17998 Preserve original identifier names from input sourcemaps (#17992) (@Andarist)

Committers: 3

Huáng Jùnliàng (@JLHwung)

Mateusz Burzyński (@Andarist)

Nicolò Ribaudo (@nicolo-ribaudo)

v7.29.5 (2026-05-05)

🏠 Internal

babel-preset-env

Update @babel/* dependencies

v7.29.4 (2026-05-05)

🐛 Bug Fix

babel-plugin-transform-modules-systemjs

#17974 [7.x backport]fix(systemjs): improve module string name support (@JLHwung)

Committers: 1

Huáng Jùnliàng (@JLHwung)

v7.29.3 (2026-04-30)

👓 Spec Compliance

babel-parser

#17923 Support flow extends bound (@JLHwung)

🐛 Bug Fix

babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators

#17931 fix(decorators): replace super within all removed static elements (@JLHwung)

babel-register

#17915 Fix thread synchronization issues in @babel/register (@liuxingbaoyu)

babel-compat-data, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-preset-env

#17788 Add bugfix plugin for Safari array rest destructuring bug (@JLHwung)

💅 Polish

babel-parser

#17782 Improve trailing comma comment handling (@JLHwung)

📝 Documentation

#17847 Replace npmjs.com links with npmx.dev (@nicolo-ribaudo)

... (truncated)

Commits

04ea6b2 v7.29.6
99f498a [7.x packport]Improve input source map handling (#18001)
feba0a3 Preserve original identifier names from input sourcemaps (#17992) (#17998)
See full diff in compare view

Updates fast-uri from 3.1.2 to 3.1.8

Release notes

Sourced from fast-uri's releases.

v3.1.8

⚠️ Security Warning

This security release fixes the following medium-severity security advisory:

GHSA-hrr3-gc8f-f4qj — inconsistent host case normalization via percent-encoded octets

Users of the v3.x release line should upgrade to v3.1.8.

Full Changelog: fastify/fast-uri@v3.1.7...v3.1.8

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

GHSA-qw65-cvwx-89v3 — authority injection via an unvalidated port in serialize()

GHSA-58mr-gqgx-xq4g — host confusion via unbalanced or misplaced IP-literal brackets

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

v3.1.6

⚠️ Security Warning

This release addresses the following high-severity security advisories:

GHSA-5jgf-p345-68v8 — host confusion via skipped IDN canonicalization on scheme-relative references

GHSA-fph4-wmhf-6fwf — server-side request forgery via repeated hostname percent-decoding

GHSA-f65p-4m7j-42xc — server-side request forgery via malformed IPv6 normalization

GHSA-jqff-g426-hqxp — host confusion via percent-encoded scheme normalization

Users of the v3.x release line should upgrade to v3.1.6.

Full Changelog: fastify/fast-uri@v3.1.5...v3.1.6

v3.1.5

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

... (truncated)

Commits

ead3ab7 Bumped v3.1.8
c88b59e fix: normalize decoded reg-name case
412e40a Bumped v3.1.7
9f4c943 fix: backport port and IP-literal validation to v3.x (#216)
1eb3ce4 fix: treat unterminated bracket hosts as reg-names again (#214)
6f970b2 Bumped v3.1.6
d941579 fix: never run IDN canonicalization on bracketed IP literals
c0f0279 test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)
37f3417 Merge commit from fork
607bfbe Merge commit from fork
Additional commits viewable in compare view

Updates vite from 8.0.10 to 8.0.16

Release notes

Sourced from vite's releases.

v8.0.16

Please refer to CHANGELOG.md for details.

v8.0.15

Please refer to CHANGELOG.md for details.

v8.0.14

Please refer to CHANGELOG.md for details.

v8.0.13

Please refer to CHANGELOG.md for details.

v8.0.12

Please refer to CHANGELOG.md for details.

v8.0.11

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.0.16 (2026-06-01)

Bug Fixes

deps: reject UNC paths for launch-editor-middleware (#22571) (50b9512)

reject windows alternate paths (#22572) (dc245c7)

8.0.15 (2026-06-01)

Features

send 408 on request timeout (#22476) (c85c9ee)

update rolldown to 1.0.3 (#22538) (646dbed)

Bug Fixes

capitalize error messages and remove spurious space in parse error (#22488) (85a0eff)

deps: update all non-major dependencies (#22511) (2686d7d)

dev: fix html-proxy cache key mismatch for /@fs/ HTML paths (#21762) (47c4213)

glob: error on relative glob in virtual module when no files match (#22497) (5c8e98f)

optimizer: close the rolldown bundle when write() rejects (#22528) (e3cfb9d)

resolve: provide onWarn for viteResolvePlugin in JS plugin containers (#22509) (40985f1)

Miscellaneous Chores

deps: update rolldown-related dependencies (#22566) (3052a67)

Code Refactoring

correct logic in collectAllModules function (#22562) (6978a9c)

8.0.14 (2026-05-21)

Features

update rolldown to 1.0.2 (#22484) (96efc88)

Bug Fixes

deps: update all non-major dependencies (#22471) (98b8163)

dev: handle errors when sending messages to vite server (#22450) (e8e9a34)

html: handle trailing slash paths in transformIndexHtml (#22480) (5d94d1b)

optimizer: pass oxc jsx options to transformSync in dependency scan (#22342) (b3132da)

Miscellaneous Chores

deps: update rolldown-related dependencies (#22470) (7cb728e)

remove irrelevant commits from changelog (2c69495)

Code Refactoring

glob: do not rewrite import path for absolute base (#22310) (0ae2844)

... (truncated)

Commits

f94df87 release: v8.0.16
dc245c7 fix: reject windows alternate paths (#22572)
50b9512 fix(deps): reject UNC paths for launch-editor-middleware (#22571)
8d1b019 release: v8.0.15
2686d7d fix(deps): update all non-major dependencies (#22511)
3052a67 chore(deps): update rolldown-related dependencies (#22566)
e3cfb9d fix(optimizer): close the rolldown bundle when write() rejects (#22528)
6978a9c refactor: correct logic in collectAllModules function (#22562)
646dbed feat: update rolldown to 1.0.3 (#22538)
85a0eff fix: capitalize error messages and remove spurious space in parse error (#22488)
Additional commits viewable in compare view

Updates sharp from 0.34.5 to 0.35.5

Release notes

Sourced from sharp's releases.

v0.35.5

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4

Add upper bounds check on length of linear and GIF delay arrays.

Improve error handing when WebAssembly fallback also fails. #4593 @lazerg

TypeScript: Allow multi-frame options for JXL output. #4602 @ramin-010

TypeScript: Remove non-existent named export. #4604

Increase accepted dimensions when extending an image. #4605

Improve gain map support for extract and rotate operations. #4606

Tests: Ensure composite tests pass on big endian platforms. #4609

v0.35.5-rc.1

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4-rc.1

Add upper bounds check on length of linear and GIF delay arrays.

Improve error handing when WebAssembly fallback also fails. #4593 @lazerg

TypeScript: Allow multi-frame options for JXL output. #4602 @ramin-010

TypeScript: Remove non-existent named export. #4604

Increase accepted dimensions when extending an image. #4605

Improve gain map support for extract operation. #4606

... (truncated)

Commits

51a990f Release v0.35.5
96de105 Upgrade to sharp-libvips v1.3.4
3a61390 CI: Configure Dependabot with all package.json locations
4940c50 Improve gain map support for rotate/flip/flop ops
20654aa Prerelease v0.35.5-rc.1
ef4f934 CI: Upgrade to Ubuntu 26.04
358df95 Upgrade to libvips v8.18.7
49f4903 Improve gain map support for rotate-then-extract #4606
0e2e55e Silence a couple of compiler/static analysis warnings
cef3b8c Improve gain map support for extract operation #4606
Additional commits viewable in compare view

Updates js-yaml from 4.1.1 to 4.3.2

Changelog

Sourced from js-yaml's changelog.

4.3.2 - 2026-08-26

Changed

[backport] Hard-limit merge sequence size to 100.

Security

[backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

4.3.1 - 2026-07-31

Security

[backport] Remove quadratic complexity from !!omap duplicate key detection.

4.3.0 - 2026-06-27

Added

[backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

Restore umd builds back to es5.

Removed

[backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

[4.2.0] - 2026-06-01

Added

Added docs/safety.md with notes about processing untrusted YAML.

Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.

Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.

Added sourcemaps to dist/ builds.

Changed

Stop resolving numbers with underscores as numeric scalars, #627.

Switched dev toolchains to Vite / neostandard.

Updated demo.

Reorganized tests.

dist/ files are no longer kept in the repository.

Fixed

Fix parsing of properties on the first implicit block mapping key, #62.

Fix trailing whitespace handling when folding flow scalar lines, #307.

Reject top-level block scalars without content indentation, #280.

Ensure numbers survive round-trip, #737.

Fix test coverage for issue #221.

Fix flow scalar trailing whitespace folding, #307.

... (truncated)

Commits

79ca68d 4.3.2 released
d90b661 Backport merge limits from v5.4.1
86e91b8 4.3.1 released
c3cc4b0 Backport quadratic complexity fix for !!omap
33d05b5 4.3.0 released
663bfab Drop demo publish, to not override new v5 one.
1cb8c7b Add v4-legacy tag for publish
02f27af Restore umd builds back to es5
8be84ed Fix es5 compatibility
59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
Additional commits viewable in compare view

Updates react-server-dom-webpack from 19.2.6 to 19.2.8

Release notes

Sourced from react-server-dom-webpack's releases.

19.2.8 (July 21st, 2026)

React Server Components

Performance improvements when decoding (#37087 by @eps1lon)

19.2.7 (June 1st, 2026)

React Server Components

Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (#36566 by @unstubbable)

Changelog

Sourced from react-server-dom-webpack's changelog.

19.3.0 (September 9, 2026)

New React Features

<ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@sebmarkbage, @jackpope, @gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)

Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@jackpope, @sebmarkbage, @eps1lon, @Dhakshin2007, @chirokas, @teamleaderleo, @fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@gnoff: #37143, #37241)

Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@gnoff #37193)

Notable changes

Enable Trusted Types API integration (@rickhanlonii #35816)

Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@acdlite #37290)

Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@hoxyq, @eps1lon: #37104, #37203, #37491)

All Changes

React

Fast Refresh Fixes

Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@sophiebits #36965)

Fix Fast Refresh so edits to a memo() comparison function take effect (@sophiebits #36964)

Fix Fast Refresh crash when an edit changes the kind of a component's type (@sophiebits #36963)

Unify hot reload type resolution for Fast Refresh (@sophiebits #36962)

Fix Fast Refresh to remount correctly when an edit changes the component kind (@sophiebits #36950)

Double invoke effects in StrictMode after Fast Refresh (@eps1lon #35962)

Performance Track Fixes

Prevent crash when accessing $$typeof in Performance Tracks (@eps1lon #35679)

Handle non-string function names in Performance Tracks (@eps1lon #35659)

Use minus (-) instead of en dash for removed props in Performance Tracks (@eps1lon #35649)

Handle arrays with bigints in deep objects in Performance Tracks (@eps1lon #35648)

Don't enumerate typed array props in Performance Tracks in DEV (@UditDewan #36913)

Bail out of diffing wide objects and arrays in Performance Tracks (@eps1lon #34742)

Clear potentially large performance measures in DEV (@hoxyq #34803)

Fix missing else branch for renders with no props change in Performance Tracks (@hoxyq #34837)

Activity Fixes

Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@sophiebits #36947)

Hide portal contents when an Activity is hidden (@acdlite #35091)

Prevent metadata hoisting in hidden <Activity> trees (@ronnakamoto #34983)

Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@acdlite #35074)

Don't unhide a node if a direct parent Offscreen is still hidden (@sebmarkbage #34821)

Don't show internal <Offscreen> component in error messages (@rickhanlonii #35763)

Warn in DEV when a component appears to have been unblocked by a conditional use() (@hoxyq, @eps1lon: #37104, #37203, #37491)

Render transitions independently instead of entangling them into a single render (@acdlite #37290)

Fix hang when updating a dehydrated boundary inside a hidden tree (@gaearon #37135)

Don't reacquire Host Singletons during dev effect validation (@gnoff #37113)

Only remove properties from Host Singletons on release (@gnoff #37112)

... (truncated)

Commits

1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
6117d7c Version 19.2.7 (#36591)
02c444c [19.2.x][FlightReply] Don't drop FormData entries in decodeReplyFromBusboy ...
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react-server-dom-webpack since your current version.

Updates @vitest/mocker from 4.1.5 to 5.0.4

Release notes

Sourced from @vitest/mocker's releases.

v5.0.4

🚀 Features

experimental:

Tag cache directories with CACHEDIR.TAG - by @lifeiscontent in vitest-dev/vitest#11461 (a8ea3)

Support test.ui.theme option - by @sheremet-va in vitest-dev/vitest#11499 (1da66)

Highlight selector multiple matches in trace view - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11489 (5abba)

Print how many tests were affected and a total when running --changed - by @sheremet-va in vitest-dev/vitest#11424 (a2336)

Add an option to cache dependencies instead of statically parsing them - by @sheremet-va in vitest-dev/vitest#11515 (c0601)

Add fit and zoom controls to trace viewer - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11490 (f5dd9)

🐞 Bug Fixes

Fail the run on git and location filter errors - by @sheremet-va in vitest-dev/vitest#11430 (30d03)

Enable fsModuleCache by default - by @sheremet-va in vitest-dev/vitest#11435 (ad208)

Track project files and mocks with --changed - by @sheremet-va in vitest-dev/vitest#11432 (b0f2b)

Refactor caching, fix : in project and change the shape of results cache - by @sheremet-va in vitest-dev/vitest#11453 (9673c)

Keep full $ string values when taskTitleValueFormatTruncate is 0 - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11485 (4f7e1)

Resolve node builtins in client environments - by @sheremet-va in vitest-dev/vitest#11417 (56b31)

Fix module graph builtin externals after #11421 - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11491 and vitest-dev/vitest#11421 (008e1)

Wrap module mocks during in-source testing - by @sheremet-va in vitest-dev/vitest#11505 (36d19)

Handle line endings in snapshot - by @sheremet-va in vitest-dev/vitest#11522 (4c468)

Respect root in projects - by @sheremet-va in vitest-dev/vitest#11521 (26642)

Resolve mocks in directories with spaces - by @sheremet-va in vitest-dev/vitest#11539 (caaef)

api:

Publish the api token atomically - by @umairnawaz333 in vitest-dev/vitest#11323 (6f990)

browser:

Close the mock route interception race - by @cplieger and @sheremet-va in vitest-dev/vitest#8339 and vitest-dev/vitest#11083 (d6620)

Allow toHaveTextContent without arguments - by @nomadical in vitest-dev/vitest#11425 (8ebcf)

Apply API options without browser config - by @sheremet-va in vitest-dev/vitest#10852 (ad055)

Preserve undefined command arguments - by @sheremet-va and @AriPerkkio in vitest-dev/vitest#11497 (1576d)

Wait for setup mocks before importing a test file - by @kasperpeulen in vitest-dev/vitest#11520 (b61d1)

Avoid extra scroll outside the iframe - by @sheremet-va in vitest-dev/vitest#11523 (662e8)

Run browser instances as workers - by @sheremet-va in vitest-dev/vitest#11525 (bf04b)

Open one cdp session per tester - by @sheremet-va in vitest-dev/vitest#11542 (69e63)

Clean up unmocked and pending mocks - by @sheremet-va in vitest-dev/vitest#11537 (5c955)

coverage:

V8 browser memory leak between test files - by @AriPerkkio in vitest-dev/vitest#11466 (2297d)

allowExternal fails to include uncovered files - by @AriPerkkio in vitest-dev/vitest#11513 (4ef00)

Filenames containing brackets incorrectly showing as uncovered - by @AriPerkkio in vitest-dev/vitest#11531 (0fa80)

Istanbul coverage wrong when module transform warmups - by @AriPerkkio in vitest-dev/vitest#11529 (9f61d)

deps:

Update all non-major dependencies - by @sheremet-va in vitest-dev/vitest#11167

Bumps the npm_and_yarn group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [tar](https://github.com/isaacs/node-tar) | `7.5.13` | `7.5.21` | | [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) | `7.29.0` | `7.29.6` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.2` | `3.1.8` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.0.10` | `8.0.16` | | [sharp](https://github.com/lovell/sharp) | `0.34.5` | `0.35.5` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.1` | `4.3.2` | | [react-server-dom-webpack](https://github.com/react/react/tree/HEAD/packages/react-server-dom-webpack) | `19.2.6` | `19.2.8` | | [@vitest/mocker](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker) | `4.1.5` | `5.0.4` | | [nanoid](https://github.com/ai/nanoid) | `3.3.11` | `3.3.20` | | [postcss](https://github.com/postcss/postcss) | `8.5.12` | `8.5.29` | Updates `tar` from 7.5.13 to 7.5.21 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v7.5.13...v7.5.21) Updates `@babel/core` from 7.29.0 to 7.29.6 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.6/packages/babel-core) Updates `fast-uri` from 3.1.2 to 3.1.8 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.2...v3.1.8) Updates `vite` from 8.0.10 to 8.0.16 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.16/packages/vite) Updates `sharp` from 0.34.5 to 0.35.5 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.34.5...v0.35.5) Updates `js-yaml` from 4.1.1 to 4.3.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.1...4.3.2) Updates `react-server-dom-webpack` from 19.2.6 to 19.2.8 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-server-dom-webpack) Updates `@vitest/mocker` from 4.1.5 to 5.0.4 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.4/packages/mocker) Updates `nanoid` from 3.3.11 to 3.3.20 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@3.3.11...3.3.20) Updates `postcss` from 8.5.12 to 8.5.29 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.12...8.5.29) --- updated-dependencies: - dependency-name: tar dependency-version: 7.5.21 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@babel/core" dependency-version: 7.29.6 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.8 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 8.0.16 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: sharp dependency-version: 0.35.5 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: react-server-dom-webpack dependency-version: 19.2.8 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@vitest/mocker" dependency-version: 5.0.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: nanoid dependency-version: 3.3.20 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.29 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-10-12T11:28:41Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 12, 2026

hach-que enabled auto-merge (squash) October 12, 2026 11:25

dependabot Bot closed this Oct 12, 2026

auto-merge was automatically disabled October 12, 2026 11:28
Pull request was closed

dependabot Bot deleted the dependabot/npm_and_yarn/npm_and_yarn-d56ddbed59 branch October 12, 2026 11:28

Navigation Menu

Repository navigation

Bump the npm_and_yarn group across 1 directory with 10 updates - #37

Bump the npm_and_yarn group across 1 directory with 10 updates#37
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-d56ddbed59

dependabot Bot commented on behalf of github Oct 12, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Oct 12, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v7.29.6 (2026-05-25)

🐛 Bug Fix

Committers: 3

v7.29.5 (2026-05-05)

🏠 Internal

v7.29.4 (2026-05-05)

🐛 Bug Fix

Committers: 1

v7.29.3 (2026-04-30)

👓 Spec Compliance

🐛 Bug Fix

💅 Polish

📝 Documentation

v3.1.8

⚠️ Security Warning

v3.1.7

⚠️ Security Warning

v3.1.6

⚠️ Security Warning

v3.1.5

⚠️ Security Warning

v3.1.4

⚠️ Security Release

v8.0.16

v8.0.15

v8.0.14

v8.0.13

v8.0.12

v8.0.11

8.0.16 (2026-06-01)

Bug Fixes

8.0.15 (2026-06-01)

Features

Bug Fixes

Miscellaneous Chores

Code Refactoring

8.0.14 (2026-05-21)

Features

Bug Fixes

Miscellaneous Chores

Code Refactoring

v0.35.5

v0.35.5-rc.1

4.3.2 - 2026-08-26

Changed

Security

4.3.1 - 2026-07-31

Security

4.3.0 - 2026-06-27

Added

Fixed

Removed

[4.2.0] - 2026-06-01

Added

Changed

Fixed

19.2.8 (July 21st, 2026)

React Server Components

19.2.7 (June 1st, 2026)

React Server Components

19.3.0 (September 9, 2026)

New React Features

New React DOM Features

Notable changes

All Changes

React

v5.0.4

🚀 Features

🐞 Bug Fixes

Uh oh!

dependabot Bot commented on behalf of github Oct 12, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

dependabot Bot commented on behalf of github Oct 12, 2026 •

edited

Loading