Skip to content

Bump the production-dependencies group across 1 directory with 10 updates#596

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-df997c5ab8
Closed

Bump the production-dependencies group across 1 directory with 10 updates#596
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-df997c5ab8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 10 updates in the / directory:

Package From To
@radiantearth/stac-fields 1.5.7 1.5.9
@reduxjs/toolkit 2.11.2 2.12.0
@tanstack/react-router 1.159.10 1.170.17
dayjs 1.11.19 1.11.21
dompurify 3.4.0 3.4.11
h3-js 4.4.0 4.5.0
js-cookie 3.0.5 3.0.8
react 19.2.6 19.2.7
react-dom 19.2.6 19.2.7
react-redux 9.2.0 9.3.0

Updates @radiantearth/stac-fields from 1.5.7 to 1.5.9

Release notes

Sourced from @​radiantearth/stac-fields's releases.

v1.5.9

Full Changelog: stac-utils/stac-fields@v1.5.8...v1.5.9

v1.5.8

What's Changed

Full Changelog: stac-utils/stac-fields@v1.5.7...v1.5.8

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radiantearth/stac-fields since your current version.


Updates @reduxjs/toolkit from 2.11.2 to 2.12.0

Release notes

Sourced from @​reduxjs/toolkit's releases.

v2.12.0

This feature release adds RTK usage skills files (via TanStack Intent) exports the RTK Query hook options types for reusability, fixes issues with infinite query status flags and batching handling, and makes some small TS improvements.

Changelog

Skills Files

We've generated agent skill files that are now included in the RTK package itself in a skills folder. They cover using and migrating to modern RTK, client and server state management, and handling side effects. You can point your agent at these skills yourself, or use TanStack Intent to pick them up.

TypeScript Improvements

The types for our RTK Query hook options are now exported, which lets you stop using Parameters to extract those types for use in your own code.

The types for listener middleware matchers were tweaked to allow interface-based type guards, not just type-based definitions.

The internal IgnorePaths type was renamed to IgnoredPaths for consistency.

We now use the built-in NoInfer util that comes with TS 5.4+.

Fixes

We fixed handling of the isSuccess status flag when switching infinite query cache entries. This should prevent accidental UI flashes that were occurring due to this flag accidentally flipping.

We've added a 100ms timeout fallback to the autoBatch enhancer's requestAnimationFrame timer. We had several reports that rAF didn't work correctly when used in background tabs / opened windows, and that RTK never updated the UI. This should ensure that the updates flush correctly.

What's Changed

Full Changelog: reduxjs/redux-toolkit@v2.11.2...v2.12.0

Commits
  • 576a02f Release 2.12.0
  • de2d55e Merge pull request #5237 from aryaemami59/fix/codegen/generateEndpoints-retur...
  • ac807c3 fix(codegen): narrow generateEndpoints return type
  • 01ed3ba Merge pull request #5289 from aryaemami59/feat/toolkit/switch-to-native-NoInfer
  • 1f16db1 Merge pull request #5290 from aryaemami59/build/toolkit/exclude-test-files-fr...
  • 23783c1 build(toolkit): exclude test files from final bundle
  • 91b8b0a feat(toolkit)!: switch to native NoInfer utility type
  • 0b37f1a Merge pull request #5286 from aryaemami59/docs/toolkit/fix-typos
  • 3cd62c8 fix unforwardedActions
  • 64853cc chore: fix various typos
  • Additional commits viewable in compare view

Updates @tanstack/react-router from 1.159.10 to 1.170.17

Release notes

Sourced from @​tanstack/react-router's releases.

@​tanstack/react-router@​1.170.17

Patch Changes

  • Updated dependencies [9809a06]:
    • @​tanstack/router-core@​1.171.14

@​tanstack/react-router@​1.170.16

Patch Changes

  • #7595 52db703 - Perf improvement of useMatch and derived hooks when navigating away from previous match

  • #7575 4a93cff - useMatches can skip useRef for structural sharing during SSR

  • #7600 f046b06 - Reduce Match rerenders during navigations (PR #7596)

  • #7577 689d88e - Reduce bundle size by sharing structuralSharing selector logic

  • #7627 689c5ab - Silence AbortError in renderRouterToStream, this is normal operation

Changelog

Sourced from @​tanstack/react-router's changelog.

1.170.17

Patch Changes

  • Updated dependencies [9809a06]:
    • @​tanstack/router-core@​1.171.14

1.170.16

Patch Changes

  • #7595 52db703 - Perf improvement of useMatch and derived hooks when navigating away from previous match

  • #7575 4a93cff - useMatches can skip useRef for structural sharing during SSR

  • #7600 f046b06 - Reduce Match rerenders during navigations (PR #7596)

  • #7577 689d88e - Reduce bundle size by sharing structuralSharing selector logic

  • #7627 689c5ab - Silence AbortError in renderRouterToStream, this is normal operation

1.170.15

Patch Changes

  • Updated dependencies [776d8ef]:
    • @​tanstack/router-core@​1.171.13

1.170.14

Patch Changes

  • Updated dependencies [df1076c]:
    • @​tanstack/router-core@​1.171.12

1.170.13

Patch Changes

  • #7555 ac10815 - Fix search middleware composition so retainSearchParams does not restore search params that a downstream stripSearchParams removed.

  • Updated dependencies [ac10815]:

    • @​tanstack/router-core@​1.171.11

1.170.12

Patch Changes

... (truncated)

Commits

Updates dayjs from 1.11.19 to 1.11.21

Release notes

Sourced from dayjs's releases.

v1.11.21

1.11.21 (2026-05-26)

Bug Fixes

v1.11.20

1.11.20 (2026-03-12)

Bug Fixes

  • Update locale km.js to support meridiem (#3017) (9d2b6a1)
  • update updateLocale plugin to merge nested object properties instead of replacing (#3012) (99691c5), closes #1118
Changelog

Sourced from dayjs's changelog.

1.11.21 (2026-05-26)

Bug Fixes

1.11.20 (2026-03-12)

Bug Fixes

  • Update locale km.js to support meridiem (#3017) (9d2b6a1)
  • update updateLocale plugin to merge nested object properties instead of replacing (#3012) (99691c5), closes #1118
Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for dayjs since your current version.


Updates dompurify from 3.4.0 to 3.4.11

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.11

  • Fixed an issue with a leaky config for hooks via setConfig, thanks @​trace37labs
  • Bumped vulnerable development dependencies to arrive at plain 0 with npm audit
  • Updated the osv-scanner suppression list as no vulnerable dependencies are left for now
  • Updated up the linting tool-chain and removed now-redundant lint directives
  • Updated the documentation is several spots, README, wiki, etc.
  • Bumped several dependencies where possible

DOMPurify 3.4.10

  • Refactored codebase for clarity: extracted the public type declarations into types.ts
  • Decomposed the three largest sanitizer functions into focused helpers
  • Removed duplicated defaults and dead branches, consolidated SAFE_FOR_TEMPLATES scrubbing into single shared path
  • Improved per-node performance by hoisting the mXSS probe regexes and testing textContent before innerHTML
  • Added a deterministic micro-benchmark harness (npm run bench) with a --compare mode
  • Reduced CI cost by running the full three-engine browser suite once per PR
  • Refreshed the demos/ folder so every demo runs again, and added a SVG-via-<img> demo
  • Documented the bench and test:happydom scripts in the README
  • Completed the Attack Classes & Bypass History wiki page
  • Bumped several dependencies where possible

DOMPurify 3.4.9

  • Further improved the handling of Trusted Types config options, thanks @​offset
  • Further improved the handling of IN_PLACE sanitization, thanks @​mozfreddyb
  • Added more test coverage for IN_PLACE and Trusted Types related usage
  • Bumped several dependencies where possible
  • Updated README and wiki with more accurate documentation & attack samples

DOMPurify 3.4.8

  • Cleaned up the repository root, renamed some and removed unneeded files
  • Fixed an issue with handling of Trusted Types policies, thanks @​fulstadev
  • Fixed the node iterator for better template scrubbing, thanks @​IamLeandrooooo
  • Included formerly missing LICENSE-MPL in published npm package, thanks @​asamuzaK
  • Bumped several dependencies where possible

DOMPurify 3.4.7

  • Hardened the handling of Shadow Roots when using IN_PLACE, thanks @​GameZoneHacker
  • Removed a problem leading to permanent hook pollution, thanks @​offset
  • Refactored the test suite and expanded test coverage significantly

DOMPurify 3.4.6

  • Fixed several issues with DOM Clobbering in IN_PLACE mode, thanks @​offset & @​Bankde
  • Hardened the checks for cross-realm IN_PLACE and Shadow DOM sanitization, thanks @​offset & @​Bankde
  • Added more test coverage for IN_PLACE and general DOM Clobbering attacks
  • Bumped several dependencies where possible

DOMPurify 3.4.5

  • Fixed a bypass caused by the new HTML element selectedcontent added in 3.4.4, thanks @​KabirAcharya

Note that this is a security release for an issue introduced in 3.4.4 and should be upgraded to immediately.

... (truncated)

Commits
Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates h3-js from 4.4.0 to 4.5.0

Release notes

Sourced from h3-js's releases.

v4.5.0

[4.5.0] - 2026-07-01

Added

  • Added reverseDirectedEdge function

Changed

  • Updated the core library to v4.5.0

Fixed

  • Prevent oversized gridDisk and gridDiskDistances calls from corrupting subsequent calls.
Changelog

Sourced from h3-js's changelog.

[4.5.0] - 2026-07-01

Added

  • Added reverseDirectedEdge function

Changed

  • Updated the core library to v4.5.0

Fixed

  • Prevent oversized gridDisk and gridDiskDistances calls from corrupting subsequent calls.
Commits
  • 0528be6 Merge pull request #233 from nrabinowitz/release-4.5.0
  • 3e5ad54 Prepare for release 4.5.0
  • 9010b71 Merge pull request #232 from uber/dependabot/npm_and_yarn/babel/core-7.29.7
  • b1ae90b Bump @​babel/core from 7.26.7 to 7.29.7
  • 47767bd Merge pull request #230 from isaacbrodsky/bump-4.5.0
  • 554e13a revert almostEquals change
  • dc27574 typo
  • 2bbcbf1 Merge pull request #231 from uber/dependabot/npm_and_yarn/shell-quote-1.8.4
  • 3cceb0d Bump shell-quote from 1.8.2 to 1.8.4
  • 6b206ed adjust tests
  • Additional commits viewable in compare view

Updates js-cookie from 3.0.5 to 3.0.8

Release notes

Sourced from js-cookie's releases.

v3.0.8

  • Restore ES5 compatibility, inadvertently broken in 3.0.7 - #959
  • Lift Node version restriction, inadvertently restricted to >= 20 in 3.0.7 - #956

v3.0.7

  • Prevent cookie attribute injection: CVE-2026-46625 (eb3c40e)
  • Add Partitioned attribute to readme (b994768)
  • Publish to npm registry via trusted publisher exclusively (4dc71be)
  • Ensure consistent behaviour for get('name') + get() (1953d30)
Commits
  • d7a1096 Craft v3.0.8 release
  • 248e685 Use existing Chrome with puppeteer
  • fc04269 Remove QUnit related workaround in Grunt config
  • 265a685 Tidy up package lock file
  • 478e591 Disable Node deprecation DEP0044 for release workflow
  • 331d524 Fix node version config for E2E test job
  • 11d773d Ensure ECMAScript compatibility
  • d788646 Remove engines property from package
  • e7d9a4d Fix typo in test assertion message
  • b5fca24 Make credentials use explicit in release workflow
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for js-cookie since your current version.


Updates react from 19.2.6 to 19.2.7

Release notes

Sourced from react's releases.

19.2.7 (June 1st, 2026)

React Server Components

Changelog

Sourced from react's changelog.

19.2.7 (June 1, 2026)

React Server Components

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react since your current version.


Updates react-dom from 19.2.6 to 19.2.7

Release notes

Sourced from react-dom's releases.

19.2.7 (June 1st, 2026)

React Server Components

Changelog

Sourced from react-dom's changelog.

19.2.7 (June 1, 2026)

React Server Components

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react-dom since your current version.


Updates react-redux from 9.2.0 to 9.3.0

Release notes

Sourced from react-redux's releases.

v9.3.0

This feature release officially marks the connect API as deprecated.

That's it. That's the release. :)

Changelog

connect deprecation

Way back in 2022, I officially marked the original Redux core createStore method as deprecated in Redux 4.2.0. As I clearly stated in that release, the goal of marking createStore as deprecated was to encourage users to migrate to modern Redux Toolkit, especially for those users who don't read our docs (such as beginners following outdated tutorials or in bootcamps, etc). The change was visual-only - adding @deprecated just marks the import with a strikethrough in an IDE, and the docblock references the "use modern Redux Toolkit" docs page. No runtime errors, no behavior changes, just an indication that the function is considered obsolete and you shouldn't use it directly any more. I also exported a legacy_createStore alias - same function, no deprecation attribute.

It's 4 years later, and I'm finally doing the same thing for connect :)

Again, nothing about connect's behavior is changing, and we do not intend to remove the connect API. But it's 2026, and hooks are the correct way to use React and React-Redux today.

We do strongly encourage users to migrate from connect to the useSelector / useDispatch hooks in general. This should result in codebases that are easier to understand and ought to improve performance slightly due to the way updates are handled.

As with before, React-Redux now exports a legacy_connect alias that does not have the deprecation attribute applied.

Trusted Publishing Fixed

We had set up trusted publishing for React-Redux a couple years ago and did some releases with that enabled, but at some point I did a follow-up release that still used the previous manual workflow, and that lost the trusted publishing provenance flag. We had recent issues requesting a new release with trusted publishing enabled again, so we've fixed that with this release.

What's Changed

Full Changelog: reduxjs/react-redux@v9.2.0...v9.3.0

Commits
  • 4134f88 Release 9.3.0
  • c0fd068 Fix release workflow Node version
  • bb01aeb Merge pull request #2304 from reduxjs/feature/fix-publishing-step
  • a0b1224 Rename publish file and fix permissions
  • ed7300a Merge branch 'master' of github.com:reduxjs/react-redux
  • 8caf827 Merge pull request #2269 from reduxjs/feature/deprecate-connect
  • 9fd63fa Disable release-it actual publishes
  • 53b77d2 Docs/hooks docs fixes (#2279)
  • 11b15c8 Bump React to latest
  • 1a18e2f Update SSR hydration error assertion for 19.2
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react-redux since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the production-dependencies group across 1 directory with 10 upd…
1e61846 
…ates

Bumps the production-dependencies group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@radiantearth/stac-fields](https://github.com/stac-utils/stac-fields) | `1.5.7` | `1.5.9` |
| [@reduxjs/toolkit](https://github.com/reduxjs/redux-toolkit) | `2.11.2` | `2.12.0` |
| [@tanstack/react-router](https://github.com/TanStack/router/tree/HEAD/packages/react-router) | `1.159.10` | `1.170.17` |
| [dayjs](https://github.com/iamkun/dayjs) | `1.11.19` | `1.11.21` |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.4.0` | `3.4.11` |
| [h3-js](https://github.com/uber/h3-js) | `4.4.0` | `4.5.0` |
| [js-cookie](https://github.com/js-cookie/js-cookie) | `3.0.5` | `3.0.8` |
| [react](https://github.com/facebook/react/tree/HEAD/packages/react) | `19.2.6` | `19.2.7` |
| [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) | `19.2.6` | `19.2.7` |
| [react-redux](https://github.com/reduxjs/react-redux) | `9.2.0` | `9.3.0` |



Updates `@radiantearth/stac-fields` from 1.5.7 to 1.5.9
- [Release notes](https://github.com/stac-utils/stac-fields/releases)
- [Commits](stac-utils/stac-fields@v1.5.7...v1.5.9)

Updates `@reduxjs/toolkit` from 2.11.2 to 2.12.0
- [Release notes](https://github.com/reduxjs/redux-toolkit/releases)
- [Commits](reduxjs/redux-toolkit@v2.11.2...v2.12.0)

Updates `@tanstack/react-router` from 1.159.10 to 1.170.17
- [Release notes](https://github.com/TanStack/router/releases)
- [Changelog](https://github.com/TanStack/router/blob/main/packages/react-router/CHANGELOG.md)
- [Commits](https://github.com/TanStack/router/commits/@tanstack/react-router@1.170.17/packages/react-router)

Updates `dayjs` from 1.11.19 to 1.11.21
- [Release notes](https://github.com/iamkun/dayjs/releases)
- [Changelog](https://github.com/iamkun/dayjs/blob/dev/CHANGELOG.md)
- [Commits](iamkun/dayjs@v1.11.19...v1.11.21)

Updates `dompurify` from 3.4.0 to 3.4.11
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.0...3.4.11)

Updates `h3-js` from 4.4.0 to 4.5.0
- [Release notes](https://github.com/uber/h3-js/releases)
- [Changelog](https://github.com/uber/h3-js/blob/master/CHANGELOG.md)
- [Commits](uber/h3-js@v4.4.0...v4.5.0)

Updates `js-cookie` from 3.0.5 to 3.0.8
- [Release notes](https://github.com/js-cookie/js-cookie/releases)
- [Commits](js-cookie/js-cookie@v3.0.5...v3.0.8)

Updates `react` from 19.2.6 to 19.2.7
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react)

Updates `react-dom` from 19.2.6 to 19.2.7
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react-dom)

Updates `react-redux` from 9.2.0 to 9.3.0
- [Release notes](https://github.com/reduxjs/react-redux/releases)
- [Changelog](https://github.com/reduxjs/react-redux/blob/master/CHANGELOG.md)
- [Commits](reduxjs/react-redux@v9.2.0...v9.3.0)

---
updated-dependencies:
- dependency-name: "@radiantearth/stac-fields"
  dependency-version: 1.5.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@reduxjs/toolkit"
  dependency-version: 2.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@tanstack/react-router"
  dependency-version: 1.170.17
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: dayjs
  dependency-version: 1.11.21
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: dompurify
  dependency-version: 3.4.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: h3-js
  dependency-version: 4.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: js-cookie
  dependency-version: 3.0.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: react
  dependency-version: 19.2.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: react-dom
  dependency-version: 19.2.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: react-redux
  dependency-version: 9.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 14, 2026
@element84-infra

element84-infra commented Jul 14, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
✅ Open Source Security 0 0 0 0 0 issues
✅ Licenses 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@dependabot @github

dependabot Bot commented on behalf of github Jul 21, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Jul 21, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-df997c5ab8 branch July 21, 2026 08:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@element84-infra