Bump the production group across 1 directory with 9 updates by dependabot[bot] · Pull Request #291 · cdnjs/api-server

dependabot · 2026-10-01T01:14:38Z

Bumps the production group with 9 updates in the / directory:

Package	From	To
@tanstack/react-virtual	`3.14.10`	`3.14.13`
algoliasearch	`5.57.0`	`5.59.0`
hono	`4.13.7`	`4.13.12`
pako	`3.0.1`	`3.0.2`
react	`19.2.8`	`19.3.0`
react-dom	`19.2.8`	`19.3.0`
spdx-license-ids	`3.0.23`	`3.0.24`
swagger-ui-react	`5.32.14`	`5.33.0`
zod	`4.5.2`	`4.6.5`

Updates @tanstack/react-virtual from 3.14.10 to 3.14.13

Release notes

Sourced from @tanstack/react-virtual's releases.

@tanstack/react-virtual@3.14.13

Patch Changes

#1282 b48e3b0 - Skip flushSync for the synchronous notify raised from measureElement. React calls measureElement from a ref callback, i.e. while it is committing, and flushSync cannot flush there — it warns in development instead. The commit phase already runs at discrete (sync) priority, so the update lands in the same lane and the same frame without flushSync. Notifies from every other path (ResizeObserver re-measures, scroll adjustments) still flush synchronously.

Updated dependencies [06d1b6b, 2c0a0ea]:

@tanstack/virtual-core@3.17.11

@tanstack/react-virtual@3.14.12

Patch Changes

Updated dependencies [ab3278c]:

@tanstack/virtual-core@3.17.10

@tanstack/react-virtual@3.14.11

Patch Changes

Updated dependencies [4a0adf3]:

@tanstack/virtual-core@3.17.9

Changelog

Sourced from @tanstack/react-virtual's changelog.

3.14.13

Patch Changes

#1282 b48e3b0 - Skip flushSync for the synchronous notify raised from measureElement. React calls measureElement from a ref callback, i.e. while it is committing, and flushSync cannot flush there — it warns in development instead. The commit phase already runs at discrete (sync) priority, so the update lands in the same lane and the same frame without flushSync. Notifies from every other path (ResizeObserver re-measures, scroll adjustments) still flush synchronously.

Updated dependencies [06d1b6b, 2c0a0ea]:

@tanstack/virtual-core@3.17.11

3.14.12

Patch Changes

Updated dependencies [ab3278c]:

@tanstack/virtual-core@3.17.10

3.14.11

Patch Changes

Updated dependencies [4a0adf3]:

@tanstack/virtual-core@3.17.9

Commits

78371e8 ci: Version Packages (#1279)
b48e3b0 fix(react-virtual): skip flushSync while measuring from the ref callback (#1282)
1a57cf7 test(react-virtual): wait for smooth scrolls to settle instead of a fixed 2s ...
2c0a0ea fix(virtual-core): keep a travelling smooth scroll alive through a prepend (#...
df47889 ci: Version Packages (#1277)
171029d ci: Version Packages (#1269)
4a0adf3 fix(virtual-core): re-issue clamped end-anchor compensation once the sizer gr...
See full diff in compare view

Updates algoliasearch from 5.57.0 to 5.59.0

Release notes

Sourced from algoliasearch's releases.

5.59.0

New version released!

What's Changed

BREAKING CHANGES: this minor version includes breaking changes in the A/B Testing V3 API. See below for more details.

120ed46971 chore(ci): enable yarn hardened mode and immutable installs (API-476) (#6915) by @MarioAlexandruDan

e4a6ab510a chore(ci): fail CI if a personal access token secret is referenced (#6919) by @eric-zaharia

085364de00 feat(specs): deprecates /2 abtests endpoints (#6921) by @Niamsy

32c1aaa192 chore(deps): dependencies 2026-08-24 (#6922) by @algolia-api-clients-automation-bot[bot]

28aa13de2e fix(clients): support guzzlehttp/psr7 v3 (#6945) by @eric-zaharia

b4c4109163 fix(specs): flag analytics patterns endpoints with x-beta (#6954) by @cdhawke

8317b3a8ef feat(specs): BREAKING CHANGE – remove migratedAbTestID from abtesting-v3 (#6883) by @cdhawke

86409a3b15 feat(javascript): wait and retry on 429 with Retry-After (#6965) by @MarioAlexandruDan

31395ba02e chore(deps): dependencies 2026-08-31 (#6959) by @algolia-api-clients-automation-bot[bot]

Full Changelog: algolia/algoliasearch-client-javascript@5.57.0...5.59.0

→ Browse the Algolia documentation

Changelog

Sourced from algoliasearch's changelog.

5.59.0

BREAKING CHANGES: this minor version includes breaking changes in the A/B Testing V3 API. See below for more details.

120ed46971 chore(ci): enable yarn hardened mode and immutable installs (API-476) (#6915) by @MarioAlexandruDan

e4a6ab510a chore(ci): fail CI if a personal access token secret is referenced (#6919) by @eric-zaharia

085364de00 feat(specs): deprecates /2 abtests endpoints (#6921) by @Niamsy

32c1aaa192 chore(deps): dependencies 2026-08-24 (#6922) by @algolia-api-clients-automation-bot[bot]

28aa13de2e fix(clients): support guzzlehttp/psr7 v3 (#6945) by @eric-zaharia

b4c4109163 fix(specs): flag analytics patterns endpoints with x-beta (#6954) by @cdhawke

8317b3a8ef feat(specs): BREAKING CHANGE – remove migratedAbTestID from abtesting-v3 (#6883) by @cdhawke

86409a3b15 feat(javascript): wait and retry on 429 with Retry-After (#6965) by @MarioAlexandruDan

31395ba02e chore(deps): dependencies 2026-08-31 (#6959) by @algolia-api-clients-automation-bot[bot]

5.58.0

120ed46971 chore(ci): enable yarn hardened mode and immutable installs (API-476) (#6915) by @MarioAlexandruDan

e4a6ab510a chore(ci): fail CI if a personal access token secret is referenced (#6919) by @eric-zaharia

085364de00 feat(specs): deprecates /2 abtests endpoints (#6921) by @Niamsy

32c1aaa192 chore(deps): dependencies 2026-08-24 (#6922) by @algolia-api-clients-automation-bot[bot]

Commits

6f5c9b0 chore: release 5.59.0
77e38c8 chore(deps): dependencies 2026-08-31 (generated)
ea3e99b feat(javascript): wait and retry on 429 with Retry-After (generated)
1ff88f0 feat(specs): remove migratedAbTestID from abtesting-v3 (generated)
217d5b6 fix(specs): flag analytics patterns endpoints with x-beta (generated)
c68ea4d fix(php): support guzzlehttp/psr7 v3 (generated)
ed4b4cb chore(deps): dependencies 2026-08-24 (generated)
f963a1d feat(specs): deprecates /2 abtests endpoints (generated)
ff559ad chore(ci): fail CI if a personal access token secret is referenced (generated)
2e6f8f4 chore(ci): enable yarn hardened mode and immutable installs (API-476) (genera...
See full diff in compare view

Updates hono from 4.13.7 to 4.13.12

Release notes

Sourced from hono's releases.

v4.13.12

What's Changed

fix(build): keep internal types private in bundled d.ts and avoid a self-referencing JSX.IntrinsicElements in honojs/hono#5485

test(build): type-check the bundled declarations from a consumer project in honojs/hono#5486

fix(etag): correctly match mixed-case header name in retainedHeader option in honojs/hono#5475

fix(jsx): add px to numeric gridGap, gridRowGap and gridColumnGap in honojs/hono#5487

fix(combine): return a Response from a short-circuiting middleware in some() in honojs/hono#5391

chore(deps): upgrade vite-plus to 1.0.0 in honojs/hono#5464

Full Changelog: honojs/hono@v4.13.11...v4.13.12

v4.13.11

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: hono/serve-static and the adapters built on it (hono/bun, hono/deno, hono/cloudflare-workers, @hono/bun, @hono/deno, @hono/cloudflare-workers). Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-5r4p-p66f-jhc7

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in @hono/node-server v2.1.3.

v4.13.10

Adapters are now separate packages

The runtime adapters are now published as their own packages: @hono/bun, @hono/deno, @hono/cloudflare-workers, @hono/aws-lambda, @hono/lambda-edge, @hono/netlify, @hono/vercel, and @hono/service-worker. @hono/deno is also on JSR.

hono/<adapter> still works in v4 but is deprecated and will be removed in v5. Migrating is an import change:
- import { serveStatic } from 'hono/bun'
+ import { serveStatic } from '@hono/bun'
hono/cloudflare-pages is deprecated without a replacement package; Cloudflare recommends Workers with static assets.

What's Changed

chore: migrate the package manager from bun to pnpm in honojs/hono#5433

chore(package.json): invoke package scripts through pnpm instead of bun in honojs/hono#5434

chore: replace prettier with oxfmt in honojs/hono#5435

chore(deps): upgrade vitest to 5.0.1 in honojs/hono#5437

chore: let oxfmt sort imports instead of eslint in honojs/hono#5442

chore: replace eslint with oxlint in honojs/hono#5443

chore: introduce Vite+ in honojs/hono#5444

fix(types): allow returning a Blob as a response body in honojs/hono#5446

chore: convert build scripts into plugins in honojs/hono#5448

chore: stop editorconfig-checker from checking Markdown indent size in honojs/hono#5455

ci: remove empty step left in cr.yml by the pnpm migration in honojs/hono#5456

chore(deps): upgrade vite-plus to 1.0.0-rc.1 in honojs/hono#5459

feat(adapters): add @hono/bun as a workspace package in honojs/hono#5447

... (truncated)

Commits

6abd35b 4.13.12
95eb860 chore(deps): upgrade vite-plus to 1.0.0 (#5464)
afb2068 fix(combine): return a Response from a short-circuiting middleware in some() ...
e5bb206 fix(jsx): add px to numeric gridGap, gridRowGap and gridColumnGap (#5487)
c3053cc fix(etag): correctly match mixed-case header name in retainedHeader option (#...
c437d75 test(build): type-check the bundled declarations from a consumer project (#5486)
be1f749 fix(build): keep internal types private in bundled d.ts and avoid a self-refe...
37ce069 4.13.11
1e1207c test(serve-static): fix the test (#5479)
8b05c77 Merge commit from fork
Additional commits viewable in compare view

Updates pako from 3.0.1 to 3.0.2

Changelog

Sourced from pako's changelog.

3.0.2 - 2026-09-12

Fixed

Port missed upstream zlib fix for block type selection with Z_FIXED, avoiding fixed blocks when stored blocks would be smaller, #316.

Read gzip header time as an unsigned 32-bit value, fixing negative timestamps from 2038 onward, #311.

Commits

32be8f8 3.0.2 released
0e2ae06 Pick zlib's Z_FIXED fix in block type selection (#316)
938123e Read gzip header time as unsigned 32-bit (#311)
See full diff in compare view

Updates react from 19.2.8 to 19.3.0

Release notes

Sourced from react's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

<ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@sebmarkbage, @jackpope, @gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)

Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@jackpope, @sebmarkbage, @eps1lon, @Dhakshin2007, @chirokas, @teamleaderleo, @fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@gnoff: #37143, #37241)

Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@gnoff #37193)

Notable changes

Enable Trusted Types API integration (@rickhanlonii #35816)

Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@acdlite #37290)

Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@hoxyq, @eps1lon: #37104, #37203, #37491)

All Changes

React

Fast Refresh Fixes

Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@sophiebits #36965)

Fix Fast Refresh so edits to a memo() comparison function take effect (@sophiebits #36964)

Fix Fast Refresh crash when an edit changes the kind of a component's type (@sophiebits #36963)

Unify hot reload type resolution for Fast Refresh (@sophiebits #36962)

Fix Fast Refresh to remount correctly when an edit changes the component kind (@sophiebits #36950)

Double invoke effects in StrictMode after Fast Refresh (@eps1lon #35962)

Performance Track Fixes

Prevent crash when accessing $$typeof in Performance Tracks (@eps1lon #35679)

Handle non-string function names in Performance Tracks (@eps1lon #35659)

Use minus (-) instead of en dash for removed props in Performance Tracks (@eps1lon #35649)

Handle arrays with bigints in deep objects in Performance Tracks (@eps1lon #35648)

Don't enumerate typed array props in Performance Tracks in DEV (@UditDewan #36913)

Bail out of diffing wide objects and arrays in Performance Tracks (@eps1lon #34742)

Clear potentially large performance measures in DEV (@hoxyq #34803)

Fix missing else branch for renders with no props change in Performance Tracks (@hoxyq #34837)

Activity Fixes

Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@sophiebits #36947)

Hide portal contents when an Activity is hidden (@acdlite #35091)

Prevent metadata hoisting in hidden <Activity> trees (@ronnakamoto #34983)

Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@acdlite #35074)

Don't unhide a node if a direct parent Offscreen is still hidden (@sebmarkbage #34821)

Don't show internal <Offscreen> component in error messages (@rickhanlonii #35763)

Warn in DEV when a component appears to have been unblocked by a conditional use() (@hoxyq, @eps1lon: #37104, #37203, #37491)

Render transitions independently instead of entangling them into a single render (@acdlite #37290)

... (truncated)

Changelog

Sourced from react's changelog.

19.3.0 (September 9, 2026)

New React Features

<ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@sebmarkbage, @jackpope, @gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)

Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@jackpope, @sebmarkbage, @eps1lon, @Dhakshin2007, @chirokas, @teamleaderleo, @fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@gnoff: #37143, #37241)

Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@gnoff #37193)

Notable changes

Enable Trusted Types API integration (@rickhanlonii #35816)

Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@acdlite #37290)

Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@hoxyq, @eps1lon: #37104, #37203, #37491)

All Changes

React

Fast Refresh Fixes

Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@sophiebits #36965)

Fix Fast Refresh so edits to a memo() comparison function take effect (@sophiebits #36964)

Fix Fast Refresh crash when an edit changes the kind of a component's type (@sophiebits #36963)

Unify hot reload type resolution for Fast Refresh (@sophiebits #36962)

Fix Fast Refresh to remount correctly when an edit changes the component kind (@sophiebits #36950)

Double invoke effects in StrictMode after Fast Refresh (@eps1lon #35962)

Performance Track Fixes

Prevent crash when accessing $$typeof in Performance Tracks (@eps1lon #35679)

Handle non-string function names in Performance Tracks (@eps1lon #35659)

Use minus (-) instead of en dash for removed props in Performance Tracks (@eps1lon #35649)

Handle arrays with bigints in deep objects in Performance Tracks (@eps1lon #35648)

Don't enumerate typed array props in Performance Tracks in DEV (@UditDewan #36913)

Bail out of diffing wide objects and arrays in Performance Tracks (@eps1lon #34742)

Clear potentially large performance measures in DEV (@hoxyq #34803)

Fix missing else branch for renders with no props change in Performance Tracks (@hoxyq #34837)

Activity Fixes

Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@sophiebits #36947)

Hide portal contents when an Activity is hidden (@acdlite #35091)

Prevent metadata hoisting in hidden <Activity> trees (@ronnakamoto #34983)

Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@acdlite #35074)

Don't unhide a node if a direct parent Offscreen is still hidden (@sebmarkbage #34821)

Don't show internal <Offscreen> component in error messages (@rickhanlonii #35763)

Warn in DEV when a component appears to have been unblocked by a conditional use() (@hoxyq, @eps1lon: #37104, #37203, #37491)

Render transitions independently instead of entangling them into a single render (@acdlite #37290)

Fix hang when updating a dehydrated boundary inside a hidden tree (@gaearon #37135)

Don't reacquire Host Singletons during dev effect validation (@gnoff #37113)

Only remove properties from Host Singletons on release (@gnoff #37112)

... (truncated)

Commits

2dc7da7 [test] Bump Jest to 30.4 (#37382)
4f93894 docs: remove stale parentType param from validateChildKeys JSDoc (#36928)
dbc3750 Update required references to GitHub repo (#36752)
900ae09 [flow] Bump flow to v0.317.0 (#36701)
fbb1370 [flow] Bump flow to v0.307.1 (#36199)
56922cf [react-native-renderer] Delete Paper (legacy) renderer (#36285)
74568e8 [Flight] Transport AggregateErrors.errors (#36156)
e66ef64 [tests] remove withoutStack from assertConsole helpers (#35498)
db71391 [Fiber] Instrument the lazy initializer thenable in all cases (#35521)
3e1abcc [tests] Require exact error messages in assertConsole helpers (

MattIPv4 · 2026-10-03T22:45:18Z

@dependabot rebase

Bumps the production group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@tanstack/react-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual) | `3.14.10` | `3.14.13` | | [algoliasearch](https://github.com/algolia/algoliasearch-client-javascript) | `5.57.0` | `5.59.0` | | [hono](https://github.com/honojs/hono) | `4.13.7` | `4.13.12` | | [pako](https://github.com/nodeca/pako) | `3.0.1` | `3.0.2` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.8` | `19.3.0` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.8` | `19.3.0` | | [spdx-license-ids](https://github.com/jslicense/spdx-license-ids) | `3.0.23` | `3.0.24` | | [swagger-ui-react](https://github.com/swagger-api/swagger-ui) | `5.32.14` | `5.33.0` | | [zod](https://github.com/colinhacks/zod) | `4.5.2` | `4.6.5` | Updates `@tanstack/react-virtual` from 3.14.10 to 3.14.13 - [Release notes](https://github.com/TanStack/virtual/releases) - [Changelog](https://github.com/TanStack/virtual/blob/main/packages/react-virtual/CHANGELOG.md) - [Commits](https://github.com/TanStack/virtual/commits/@tanstack/[email protected]/packages/react-virtual) Updates `algoliasearch` from 5.57.0 to 5.59.0 - [Release notes](https://github.com/algolia/algoliasearch-client-javascript/releases) - [Changelog](https://github.com/algolia/algoliasearch-client-javascript/blob/main/CHANGELOG.md) - [Commits](algolia/algoliasearch-client-javascript@5.57.0...5.59.0) Updates `hono` from 4.13.7 to 4.13.12 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.13.7...v4.13.12) Updates `pako` from 3.0.1 to 3.0.2 - [Changelog](https://github.com/nodeca/pako/blob/master/CHANGELOG.md) - [Commits](nodeca/pako@3.0.1...3.0.2) Updates `react` from 19.2.8 to 19.3.0 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.0/packages/react) Updates `react-dom` from 19.2.8 to 19.3.0 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.0/packages/react-dom) Updates `spdx-license-ids` from 3.0.23 to 3.0.24 - [Commits](jslicense/spdx-license-ids@v3.0.23...v3.0.24) Updates `swagger-ui-react` from 5.32.14 to 5.33.0 - [Release notes](https://github.com/swagger-api/swagger-ui/releases) - [Commits](swagger-api/swagger-ui@v5.32.14...v5.33.0) Updates `zod` from 4.5.2 to 4.6.5 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.5.2...v4.6.5) --- updated-dependencies: - dependency-name: "@tanstack/react-virtual" dependency-version: 3.14.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production - dependency-name: algoliasearch dependency-version: 5.59.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: hono dependency-version: 4.13.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production - dependency-name: pako dependency-version: 3.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production - dependency-name: react dependency-version: 19.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: react-dom dependency-version: 19.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: spdx-license-ids dependency-version: 3.0.24 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production - dependency-name: swagger-ui-react dependency-version: 5.33.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: zod dependency-version: 4.6.5 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 1, 2026

dependabot Bot changed the title ~~Bump the production group with 9 updates~~ Bump the production group across 1 directory with 9 updates Oct 3, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/production-67bd05a1ea branch from 0dc417e to b6b81a4 Compare October 3, 2026 21:05

dependabot Bot changed the title ~~Bump the production group across 1 directory with 9 updates~~ bump the production group across 1 directory with 9 updates Oct 3, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/production-67bd05a1ea branch from b6b81a4 to a2b3e9a Compare October 3, 2026 21:54

dependabot Bot changed the title ~~bump the production group across 1 directory with 9 updates~~ Bump the production group across 1 directory with 9 updates Oct 3, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/production-67bd05a1ea branch 2 times, most recently from 7704473 to 71539a5 Compare October 3, 2026 22:36

dependabot Bot force-pushed the dependabot/npm_and_yarn/production-67bd05a1ea branch from 71539a5 to 2170d40 Compare October 3, 2026 22:46

MattIPv4 approved these changes Oct 3, 2026

View reviewed changes

MattIPv4 merged commit afa6ce7 into master Oct 3, 2026
8 checks passed

MattIPv4 deleted the dependabot/npm_and_yarn/production-67bd05a1ea branch October 3, 2026 22:53

Navigation Menu

Uh oh!

Bump the production group across 1 directory with 9 updates - #291

Bump the production group across 1 directory with 9 updates#291
MattIPv4 merged 1 commit into
masterfrom
dependabot/npm_and_yarn/production-67bd05a1ea

dependabot Bot commented on behalf of github Oct 1, 2026 •

edited

Loading

Uh oh!

MattIPv4 commented Oct 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

@​tanstack/react-virtual@​3.14.13

Patch Changes

@​tanstack/react-virtual@​3.14.12

Patch Changes

@​tanstack/react-virtual@​3.14.11

Patch Changes

3.14.13

Patch Changes

3.14.12

Patch Changes

3.14.11

Patch Changes

5.59.0

New version released!

What's Changed

5.59.0

5.58.0

v4.13.12

What's Changed

v4.13.11

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

v4.13.10

Adapters are now separate packages

What's Changed

3.0.2 - 2026-09-12

Fixed

19.3.0 (September 9, 2026)

New React Features

New React DOM Features

Notable changes

All Changes

React

19.3.0 (September 9, 2026)

New React Features

New React DOM Features

Notable changes

All Changes

React

Uh oh!

MattIPv4 commented Oct 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Oct 1, 2026 •

edited

Loading

`@tanstack/react-virtual@3`.14.13

`@tanstack/react-virtual@3`.14.12

`@tanstack/react-virtual@3`.14.11

`serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths