Skip to content
This repository was archived by the owner on Sep 4, 2026. It is now read-only.

chore(deps): bump the production-dependencies group with 12 updates - #147

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-aae93d7763
Closed

chore(deps): bump the production-dependencies group with 12 updates#147
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-aae93d7763

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 4, 2026

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 12 updates:

Package From To
@fontsource-variable/cascadia-mono 5.2.2 5.3.0
@fontsource-variable/geist 5.2.9 5.3.0
@fontsource-variable/geist-mono 5.2.8 5.3.0
@fontsource-variable/inter 5.2.8 5.3.0
@fontsource-variable/material-symbols-rounded 5.2.45 5.3.4
argon2 0.44.0 0.45.1
better-sqlite3 12.10.0 12.11.1
express-rate-limit 8.5.2 8.7.0
helmet 8.1.0 8.3.0
react 19.2.6 19.2.8
react-dom 19.2.6 19.2.8
react-router-dom 7.15.1 7.18.3

Updates @fontsource-variable/cascadia-mono from 5.2.2 to 5.3.0

Commits

Updates @fontsource-variable/geist from 5.2.9 to 5.3.0

Commits

Updates @fontsource-variable/geist-mono from 5.2.8 to 5.3.0

Commits

Updates @fontsource-variable/inter from 5.2.8 to 5.3.0

Commits

Updates @fontsource-variable/material-symbols-rounded from 5.2.45 to 5.3.4

Commits

Updates argon2 from 0.44.0 to 0.45.1

Release notes

Sourced from argon2's releases.

v0.45.1

Fixes an issue with v0.45.0 where TypeScript generated types for the hash function as returning Promise<any>

Full Changelog: ranisalt/node-argon2@v0.45.0...v0.45.1

v0.45.0

What's Changed

Drops support for Node 18 and 20 (probably still works, but isn't tested)

New Contributors

Full Changelog: ranisalt/node-argon2@v0.44.0...v0.45.0

Commits
  • 786de71 fix: hash function generated types
  • e2fe33f fix: update Node.js version to latest in publish job
  • e27980f fix: revert sync to default in freebsd test
  • 3d0a0b4 fix: change npm publish to npm stage publish in release workflow
  • c61513f chore: update actions versions
  • 2bc0733 fix: revert sync to default in freebsd build
  • b012379 chore: update dependencies and devDependencies
  • d2edf4e fix(tests): add unicode flag to regex assertions in option tests
  • 0eb1db1 Apply npm fixes to package.json
  • a09b94e Fix compilation on solaris (#538)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for argon2 since your current version.


Updates better-sqlite3 from 12.10.0 to 12.11.1

Release notes

Sourced from better-sqlite3's releases.

v12.11.1

What's Changed

Full Changelog: WiseLibs/better-sqlite3@v12.11.0...v12.11.1

v12.11.0

⚠️CAUTION: NOT A VIABLE RELEASE

Use v12.11.1 instead.

What's Changed

Full Changelog: WiseLibs/better-sqlite3@v12.10.1...v12.11.0

v12.10.1

What's Changed

Full Changelog: WiseLibs/better-sqlite3@v12.10.0...v12.10.1

Commits

Updates express-rate-limit from 8.5.2 to 8.7.0

Release notes

Sourced from express-rate-limit's releases.

v8.7.0

You can view the changelog here.

v8.6.2

You can view the changelog here.

v8.6.1

You can view the changelog here.

v8.6.0

You can view the changelog here.

Commits
  • 48db09e 8.7.0
  • dce5871 v8.7.0 changelog
  • 2f08044 Add inspect.software health badge (#673)
  • a29757c feat: add retryAfter option (#661)
  • 146e88b chore: rename license
  • 5cfb8e8 ci: drop top-level id-token: write from the workflow token (#676)
  • 062bbdd fix: re-wrap license.md so GitHub recognizes it as MIT (#675)
  • 514772d chore(deps-dev): bump mintlify in the development-dependencies group (#674)
  • 4f06c8a chore(deps-dev): bump the development-dependencies group with 2 updates (#671)
  • 83356a5 chore(deps): bump ip-address from 10.4.0 to 10.5.0 (#672)
  • Additional commits viewable in compare view

Updates helmet from 8.1.0 to 8.3.0

Changelog

Sourced from helmet's changelog.

8.3.0 - 2026-07-11

Changed

  • Content-Security-Policy: improved performance by ~7% when there are no dynamic directives
  • Content-Security-Policy: improved error handling for invalid directive names

Fixed

  • Content-Security-Policy: useDefaults: false with no directives is no longer valid, both at runtime and the type level
  • Content-Security-Policy: dynamically-computed directive values would throw, not call next, when invalid
  • Content-Security-Policy: dynamically-computed directive value entries would throw, not call next, when function threw

8.2.0 - 2026-05-21

  • Cross-Origin-Opener-Policy: support noopener-allow-popups. See #522
  • Improve error message when passing duplicate options
Commits
  • 75f1a98 8.3.0
  • f03f70d Update changelog for 8.3.0 release
  • a307fce Fix capitalization in CSP package changelog
  • 5347b43 Format default CSP in README for readability
  • 9afc570 CSP: fix middleware-specific README missing link
  • 266c95c Minor speedups to project setups test
  • 7a4196c CSP: update package-specific changelog
  • 02716b4 CSP: improve performance when there are no dynamic directives
  • 3f511ed CSP: move utility functions to separate file
  • 80338af CSP: disabling defaults with no directives is now an error
  • Additional commits viewable in compare view

Updates react from 19.2.6 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

19.2.7 (June 1st, 2026)

React Server Components

Changelog

Sourced from react's changelog.

19.2.7 (June 1, 2026)

React Server Components

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react since your current version.


Updates react-dom from 19.2.6 to 19.2.8

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

19.2.7 (June 1st, 2026)

React Server Components

Changelog

Sourced from react-dom's changelog.

19.2.7 (June 1, 2026)

React Server Components

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react-dom since your current version.


Updates react-router-dom from 7.15.1 to 7.18.3

Changelog

Sourced from react-router-dom's changelog.

v7.18.3

Patch Changes

v7.18.2

Patch Changes

v7.18.1

Patch Changes

v7.18.0

Patch Changes

v7.17.0

Patch Changes

v7.16.0

Patch Changes

  • Remove stale/invalid unpkg field from package.json. This was removed from other packages with the release of v7 but missed in the react-router-dom re-export package (#15075)
  • Updated dependencies:
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the production-dependencies group with 12 updates
b520bf2 
Bumps the production-dependencies group with 12 updates:

| Package | From | To |
| --- | --- | --- |
| [@fontsource-variable/cascadia-mono](https://github.com/fontsource/font-files/tree/HEAD/fonts/variable/cascadia-mono) | `5.2.2` | `5.3.0` |
| [@fontsource-variable/geist](https://github.com/fontsource/font-files/tree/HEAD/fonts/variable/geist) | `5.2.9` | `5.3.0` |
| [@fontsource-variable/geist-mono](https://github.com/fontsource/font-files/tree/HEAD/fonts/variable/geist-mono) | `5.2.8` | `5.3.0` |
| [@fontsource-variable/inter](https://github.com/fontsource/font-files/tree/HEAD/fonts/variable/inter) | `5.2.8` | `5.3.0` |
| [@fontsource-variable/material-symbols-rounded](https://github.com/fontsource/font-files/tree/HEAD/fonts/variable/material-symbols-rounded) | `5.2.45` | `5.3.4` |
| [argon2](https://github.com/ranisalt/node-argon2) | `0.44.0` | `0.45.1` |
| [better-sqlite3](https://github.com/WiseLibs/better-sqlite3) | `12.10.0` | `12.11.1` |
| [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `8.5.2` | `8.7.0` |
| [helmet](https://github.com/helmetjs/helmet) | `8.1.0` | `8.3.0` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.6` | `19.2.8` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.6` | `19.2.8` |
| [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `7.15.1` | `7.18.3` |


Updates `@fontsource-variable/cascadia-mono` from 5.2.2 to 5.3.0
- [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md)
- [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/variable/cascadia-mono)

Updates `@fontsource-variable/geist` from 5.2.9 to 5.3.0
- [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md)
- [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/variable/geist)

Updates `@fontsource-variable/geist-mono` from 5.2.8 to 5.3.0
- [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md)
- [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/variable/geist-mono)

Updates `@fontsource-variable/inter` from 5.2.8 to 5.3.0
- [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md)
- [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/variable/inter)

Updates `@fontsource-variable/material-symbols-rounded` from 5.2.45 to 5.3.4
- [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/variable/material-symbols-rounded)

Updates `argon2` from 0.44.0 to 0.45.1
- [Release notes](https://github.com/ranisalt/node-argon2/releases)
- [Commits](ranisalt/node-argon2@v0.44.0...v0.45.1)

Updates `better-sqlite3` from 12.10.0 to 12.11.1
- [Release notes](https://github.com/WiseLibs/better-sqlite3/releases)
- [Commits](WiseLibs/better-sqlite3@v12.10.0...v12.11.1)

Updates `express-rate-limit` from 8.5.2 to 8.7.0
- [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases)
- [Commits](express-rate-limit/express-rate-limit@v8.5.2...v8.7.0)

Updates `helmet` from 8.1.0 to 8.3.0
- [Changelog](https://github.com/helmetjs/helmet/blob/main/CHANGELOG.md)
- [Commits](helmetjs/helmet@v8.1.0...v8.3.0)

Updates `react` from 19.2.6 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react)

Updates `react-dom` from 19.2.6 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom)

Updates `react-router-dom` from 7.15.1 to 7.18.3
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/react-router-dom@7.18.3/packages/react-router-dom/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.18.3/packages/react-router-dom)

---
updated-dependencies:
- dependency-name: "@fontsource-variable/cascadia-mono"
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@fontsource-variable/geist"
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@fontsource-variable/geist-mono"
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@fontsource-variable/inter"
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@fontsource-variable/material-symbols-rounded"
  dependency-version: 5.3.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: argon2
  dependency-version: 0.45.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: better-sqlite3
  dependency-version: 12.11.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: express-rate-limit
  dependency-version: 8.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: helmet
  dependency-version: 8.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: react
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: react-dom
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: react-router-dom
  dependency-version: 7.18.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 4, 2026
@socket-security

socket-security Bot commented Sep 4, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedreact-router-dom@​7.15.1 ⏵ 7.18.31001006596100
Updated@​fontsource-variable/​cascadia-mono@​5.2.2 ⏵ 5.3.074 +11008388 +690
Updated@​types/​react-dom@​19.2.3 ⏵ 19.2.5100 +110075 +189 -3100
Updated@​types/​react@​19.2.15 ⏵ 19.2.181001007990100
Updated@​fontsource-variable/​material-symbols-rounded@​5.2.45 ⏵ 5.3.499 +12100819790
Updated@​fontsource-variable/​geist@​5.2.9 ⏵ 5.3.0100 +210082 +186 -190
Updated@​fontsource-variable/​geist-mono@​5.2.8 ⏵ 5.3.0100 +41008385 +190
Updated@​fontsource-variable/​inter@​5.2.8 ⏵ 5.3.010010084 +183 -290
Updatedreact@​19.2.6 ⏵ 19.2.81001008497100
Updatedhelmet@​8.1.0 ⏵ 8.3.0100100100 +185100
Updatedargon2@​0.44.0 ⏵ 0.45.1100100100 +191 +5100
Updatedbetter-sqlite3@​12.10.0 ⏵ 12.11.110010010092 -1100
Updatedreact-dom@​19.2.6 ⏵ 19.2.81001009298100
Updatedexpress-rate-limit@​8.5.2 ⏵ 8.7.09910010095100

View full report

@socket-security

socket-security Bot commented Sep 4, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm better-sqlite3 is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package.json → npm/better-sqlite3@12.11.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/better-sqlite3@12.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@iShark5060 iShark5060 closed this Sep 4, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 4, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-aae93d7763 branch September 4, 2026 01:44
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@iShark5060