Skip to content

chore(deps): bump the npm-minor-patch group with 14 updates - #299

Merged
forcingfx merged 1 commit into
mainfrom
dependabot/npm_and_yarn/main/npm-minor-patch-719132d642
Sep 13, 2026
Merged

chore(deps): bump the npm-minor-patch group with 14 updates#299
forcingfx merged 1 commit into
mainfrom
dependabot/npm_and_yarn/main/npm-minor-patch-719132d642

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 12, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-minor-patch group with 14 updates:

Package From To
@tanstack/react-virtual 3.14.10 3.14.11
@upstash/redis 1.38.3 1.38.4
dompurify 3.4.14 3.4.15
hono 4.13.5 4.13.7
lucide-react 1.39.0 1.43.0
marked 18.0.11 18.0.12
react-resizable-panels 4.12.3 4.12.4
@playwright/test 1.62.1 1.63.0
@types/chrome 0.2.8 0.2.9
@types/node 26.4.1 26.5.0
@types/react-dom 19.2.5 19.2.7
happy-dom 20.13.2 20.14.0
lint-staged 17.4.1 17.5.0
shadcn 4.20.0 4.21.0

Updates @tanstack/react-virtual from 3.14.10 to 3.14.11

Release notes

Sourced from @​tanstack/react-virtual's releases.

@​tanstack/react-virtual@​3.14.11

Patch Changes

  • Updated dependencies [4a0adf3]:
    • @​tanstack/virtual-core@​3.17.9
Changelog

Sourced from @​tanstack/react-virtual's changelog.

3.14.11

Patch Changes

  • Updated dependencies [4a0adf3]:
    • @​tanstack/virtual-core@​3.17.9
Commits
  • 171029d ci: Version Packages (#1269)
  • 4a0adf3 fix(virtual-core): re-issue clamped end-anchor compensation once the sizer gr...
  • See full diff in compare view

Updates @upstash/redis from 1.38.3 to 1.38.4

Release notes

Sourced from @​upstash/redis's releases.

@​upstash/redis@​1.38.4

Patch Changes

  • 7ac8182: Fix read-your-writes sending a stale upstash-sync-token

    A read issued straight after a write travelled with the token from before that write, so the server was under no obligation to serve the write and readYourWrites silently did not hold.

    HttpClient.request() snapshotted the outgoing headers with mergeHeaders(this.headers, ...) and only afterwards wrote the freshest token into this.headers, so the token learned from response N first shipped with request N+2. The assignment now happens before the merge.

    This regressed in 1.34.5. In 1.34.0–1.34.4 the request options held headers: this.headers by reference, so the late write was still picked up before fetch; 1.34.5 introduced per-request header merging, which turned that reference into a copy without moving the assignment.

Commits

Updates dompurify from 3.4.14 to 3.4.15

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.15

  • Added better clobbering hardening when XML content is involved, thanks @​gnyselcuk
  • Added several smaller hardening and edge-case improvements, thanks @​leechristensen
  • Bumped several dependencies where possible
Commits

Updates hono from 4.13.5 to 4.13.7

Release notes

Sourced from hono's releases.

v4.13.7

Security fixes

This release includes a fix for the following security issue:

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

v4.13.6

What's Changed

Full Changelog: honojs/hono@v4.13.5...v4.13.6

Commits

Updates lucide-react from 1.39.0 to 1.43.0

Release notes

Sourced from lucide-react's releases.

Version 1.43.0

What's Changed

Full Changelog: lucide-icons/lucide@1.42.0...1.43.0

Version 1.42.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.41.0...1.42.0

Version 1.41.0

What's Changed

... (truncated)

Commits

Updates marked from 18.0.11 to 18.0.12

Release notes

Sourced from marked's releases.

v18.0.12

18.0.12 (2026-09-07)

Bug Fixes

  • allow a tab before the closing sequence of an ATX heading (#4084) (4417582)
  • allow one more level of nested brackets in a link label (#4064) (37b28d8)
  • do not add a newline to an empty code block (#4073) (23b1706)
  • escape character references in autolink destinations (#4053) (8f432f0)
  • reject GFM email autolink when the domain ends in _ or - (#4063) (df57534)
  • reject invalid characters in HTML tag names (#4083) (300bb1d)
  • remove up to the fence indentation from each content line (#4074) (0244f08)
Commits
  • 24bf47c chore(release): 18.0.12 [skip ci]
  • 475ba3d chore(deps-dev): bump eslint from 10.9.1 to 10.10.0 (#4088)
  • 4417582 fix: allow a tab before the closing sequence of an ATX heading (#4084)
  • 23b1706 fix: do not add a newline to an empty code block (#4073)
  • df57534 fix: reject GFM email autolink when the domain ends in _ or - (#4063)
  • 37b28d8 fix: allow one more level of nested brackets in a link label (#4064)
  • 8f432f0 fix: escape character references in autolink destinations (#4053)
  • 44ddc31 docs: add inspect.software health badge (#4062)
  • 0244f08 fix: remove up to the fence indentation from each content line (#4074)
  • 300bb1d fix: reject invalid characters in HTML tag names (#4083)
  • Additional commits viewable in compare view

Updates react-resizable-panels from 4.12.3 to 4.12.4

Release notes

Sourced from react-resizable-panels's releases.

4.12.4

  • 743: Don't capture pointer for a detached Separator
  • 741: Separator ARIA values use proper panel indices
Changelog

Sourced from react-resizable-panels's changelog.

4.12.4

  • 743: Don't capture pointer for a detached Separator
  • 741: Separator ARIA values use proper panel indices
Commits
  • 152b1a8 4.12.3 -> 4.12.4
  • f711534 fix: skip pointer capture for detached separators (#743)
  • 2419acf fix: use group-relative panel index for Separator aria values (Fixes #740) (#...
  • See full diff in compare view

Updates @playwright/test from 1.62.1 to 1.63.0

Release notes

Sourced from @​playwright/test's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits
  • 1b025d7 chore: mark v1.63.0 (#42569)
  • 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
  • 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
  • e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
  • 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
  • 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
  • 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
  • 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
  • 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
  • bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
  • Additional commits viewable in compare view

Updates @types/chrome from 0.2.8 to 0.2.9

Commits

Updates @types/node from 26.4.1 to 26.5.0

Commits

Updates @types/react-dom from 19.2.5 to 19.2.7

Commits

Updates happy-dom from 20.13.2 to 20.14.0

Release notes

Sourced from happy-dom's releases.

v20.14.0

🎨 Features

Commits

Updates lint-staged from 17.4.1 to 17.5.0

Release notes

Sourced from lint-staged's releases.

v17.5.0

Minor Changes

  • #1847 f9063b7 - Lint-staged now refuses to run when files were staged with --intent-to-add, because Git stash doesn't support them. Previously this was an unhandled error.

Patch Changes

  • #1848 d718ccc - Lint-staged now handles color support better in non-TTY streams, and honors the FORCE_COLOR environment variable.

  • #1845 7e5ece8 - Update tinyexec@1.3.1 so that local binaries from node_modules/.bin are resolved starting from the directory of each lint-staged configuration file (in monorepo setups). This behavior was broken in lint-staged@16.3.0 where they were only resolved from the current working directory and up.

  • #1845 eb8a4e3 - Do not try to restore untracked files when using --hide-all and there is no initial commit yet.

Changelog

Sourced from lint-staged's changelog.

17.5.0

Minor Changes

  • #1847 f9063b7 - Lint-staged now refuses to run when files were staged with --intent-to-add, because Git stash doesn't support them. Previously this was an unhandled error.

Patch Changes

  • #1848 d718ccc - Lint-staged now handles color support better in non-TTY streams, and honors the FORCE_COLOR environment variable.

  • #1845 7e5ece8 - Update tinyexec@1.3.1 so that local binaries from node_modules/.bin are resolved starting from the directory of each lint-staged configuration file (in monorepo setups). This behavior was broken in lint-staged@16.3.0 where they were only resolved from the current working directory and up.

  • #1845 eb8a4e3 - Do not try to restore untracked files when using --hide-all and there is no initial commit yet.

Commits
  • dcb59f6 Merge pull request #1846 from lint-staged/changeset-release/main
  • 9c8c6dc chore(changeset): release
  • 586466f Merge pull request #1849 from lint-staged/improve-intent-to-add
  • 45eda5f refactor: improve --intent-to-add detection
  • 26372e3 Merge pull request #1848 from lint-staged/fix-color-detection
  • d718ccc fix: honor FORCE_COLOR/NO_COLOR env variables in non-TTY streams
  • be78a51 Merge pull request #1847 from lint-staged/intent-to-add
  • f9063b7 feat: refuse to run when files were staged with --intent-to-add
  • a767299 Merge pull request #1845 from lint-staged/updates
  • 61ffd25 style: add VS Code extension config
  • Additional commits viewable in compare view

Updates shadcn from 4.20.0 to 4.21.0

Release notes

Sourced from shadcn's releases.

shadcn@4.21.0

Minor Changes

Patch Changes

shadcn@4.20.1

Patch Changes

Changelog

Sourced from shadcn's changelog.

4.21.0

Minor Changes

Patch Changes

4.20.1

Patch Changes

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the npm-minor-patch group with 14 updates
44e1a21 
Bumps the npm-minor-patch group with 14 updates:

| Package | From | To |
| --- | --- | --- |
| [@tanstack/react-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual) | `3.14.10` | `3.14.11` |
| [@upstash/redis](https://github.com/upstash/redis-js) | `1.38.3` | `1.38.4` |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.4.14` | `3.4.15` |
| [hono](https://github.com/honojs/hono) | `4.13.5` | `4.13.7` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.39.0` | `1.43.0` |
| [marked](https://github.com/markedjs/marked) | `18.0.11` | `18.0.12` |
| [react-resizable-panels](https://github.com/bvaughn/react-resizable-panels) | `4.12.3` | `4.12.4` |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.62.1` | `1.63.0` |
| [@types/chrome](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/chrome) | `0.2.8` | `0.2.9` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.4.1` | `26.5.0` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.5` | `19.2.7` |
| [happy-dom](https://github.com/capricorn86/happy-dom) | `20.13.2` | `20.14.0` |
| [lint-staged](https://github.com/lint-staged/lint-staged) | `17.4.1` | `17.5.0` |
| [shadcn](https://github.com/shadcn-ui/ui/tree/HEAD/packages/shadcn) | `4.20.0` | `4.21.0` |


Updates `@tanstack/react-virtual` from 3.14.10 to 3.14.11
- [Release notes](https://github.com/TanStack/virtual/releases)
- [Changelog](https://github.com/TanStack/virtual/blob/main/packages/react-virtual/CHANGELOG.md)
- [Commits](https://github.com/TanStack/virtual/commits/@tanstack/react-virtual@3.14.11/packages/react-virtual)

Updates `@upstash/redis` from 1.38.3 to 1.38.4
- [Release notes](https://github.com/upstash/redis-js/releases)
- [Commits](https://github.com/upstash/redis-js/compare/@upstash/redis@1.38.3...@upstash/redis@1.38.4)

Updates `dompurify` from 3.4.14 to 3.4.15
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.14...3.4.15)

Updates `hono` from 4.13.5 to 4.13.7
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.5...v4.13.7)

Updates `lucide-react` from 1.39.0 to 1.43.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.43.0/packages/lucide-react)

Updates `marked` from 18.0.11 to 18.0.12
- [Release notes](https://github.com/markedjs/marked/releases)
- [Commits](markedjs/marked@v18.0.11...v18.0.12)

Updates `react-resizable-panels` from 4.12.3 to 4.12.4
- [Release notes](https://github.com/bvaughn/react-resizable-panels/releases)
- [Changelog](https://github.com/bvaughn/react-resizable-panels/blob/main/CHANGELOG.md)
- [Commits](bvaughn/react-resizable-panels@4.12.3...4.12.4)

Updates `@playwright/test` from 1.62.1 to 1.63.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.62.1...v1.63.0)

Updates `@types/chrome` from 0.2.8 to 0.2.9
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/chrome)

Updates `@types/node` from 26.4.1 to 26.5.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/react-dom` from 19.2.5 to 19.2.7
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `happy-dom` from 20.13.2 to 20.14.0
- [Release notes](https://github.com/capricorn86/happy-dom/releases)
- [Commits](capricorn86/happy-dom@v20.13.2...v20.14.0)

Updates `lint-staged` from 17.4.1 to 17.5.0
- [Release notes](https://github.com/lint-staged/lint-staged/releases)
- [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md)
- [Commits](lint-staged/lint-staged@v17.4.1...v17.5.0)

Updates `shadcn` from 4.20.0 to 4.21.0
- [Release notes](https://github.com/shadcn-ui/ui/releases)
- [Changelog](https://github.com/shadcn-ui/ui/blob/main/packages/shadcn/CHANGELOG.md)
- [Commits](https://github.com/shadcn-ui/ui/commits/shadcn@4.21.0/packages/shadcn)

---
updated-dependencies:
- dependency-name: "@tanstack/react-virtual"
  dependency-version: 3.14.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@upstash/redis"
  dependency-version: 1.38.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: dompurify
  dependency-version: 3.4.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: hono
  dependency-version: 4.13.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: lucide-react
  dependency-version: 1.43.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: marked
  dependency-version: 18.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: react-resizable-panels
  dependency-version: 4.12.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@playwright/test"
  dependency-version: 1.63.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@types/chrome"
  dependency-version: 0.2.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@types/node"
  dependency-version: 26.5.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@types/react-dom"
  dependency-version: 19.2.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: happy-dom
  dependency-version: 20.14.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: lint-staged
  dependency-version: 17.5.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: shadcn
  dependency-version: 4.21.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 12, 2026
@dependabot
dependabot Bot requested a review from forcingfx as a code owner September 12, 2026 14:54
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 12, 2026
@vercel

vercel Bot commented Sep 12, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
feedzero Ready Ready Preview Sep 12, 2026 2:54pm UTC

Request Review

@forcingfx
forcingfx merged commit 07d69a9 into main Sep 13, 2026
17 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/main/npm-minor-patch-719132d642 branch September 13, 2026 14:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@forcingfx forcingfx forcingfx approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@forcingfx