Skip to content

build(deps): bump the production-dependencies group across 1 directory with 14 updates#234

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-dcb4a489b2
Open

build(deps): bump the production-dependencies group across 1 directory with 14 updates#234
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-dcb4a489b2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 20, 2026

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 14 updates in the / directory:

Package From To
@floating-ui/dom 1.7.6 1.8.0
@napi-rs/simple-git 1.0.0 1.1.0
globby 16.2.1 16.2.2
lightningcss 1.32.0 1.33.0
preact 10.29.4 10.29.7
pretty-bytes 7.1.0 7.1.1
satori 0.26.0 0.28.1
toml 4.1.2 5.0.0
ws 8.21.0 8.21.1
@types/hast 3.0.4 3.0.5
@types/node 26.1.0 26.1.1
prettier 3.9.4 3.9.5
tsx 4.23.0 4.23.1
typescript 6.0.3 7.0.2

Updates @floating-ui/dom from 1.7.6 to 1.8.0

Release notes

Sourced from @​floating-ui/dom's releases.

@​floating-ui/dom@​1.8.0

Minor Changes

  • feat: add 'layoutViewport' string option to rootBoundary. Unlike the visual 'viewport' boundary, it remains stable while pinch-zooming or when a mobile software keyboard is open, and unlike a manually passed Rect of the documentElement's client size, it accounts for space reserved by scrollbar-gutter: stable.

Patch Changes

  • fix: remove redundant passive options from scroll listeners
  • fix: support explicit undefined for optional properties with exactOptionalPropertyTypes
  • fix(autoUpdate): update immediately instead of waiting for the 1s layoutShift refresh throttle when the reference moved during an observer refresh
  • fix(getClippingRect): correct clipping-ancestor filtering for fixed-position elements
  • perf(dom): reduce bundle size and skip redundant per-call work in positioning utilities
  • fix(getViewportRect): account for scrollbar-gutter: stable both-edges reserved space
  • fix(getViewportRect): don't overflow past a left-side document scrollbar
  • fix(platform): don't throw in getClientRects when a virtual element without a getClientRects method is used with the inline() middleware
  • fix(autoUpdate): refresh layout shift observer on root resize
  • Update dependencies: @floating-ui/core@1.8.0, @floating-ui/utils@0.2.12
Changelog

Sourced from @​floating-ui/dom's changelog.

1.8.0

Minor Changes

  • feat: add 'layoutViewport' string option to rootBoundary. Unlike the visual 'viewport' boundary, it remains stable while pinch-zooming or when a mobile software keyboard is open, and unlike a manually passed Rect of the documentElement's client size, it accounts for space reserved by scrollbar-gutter: stable.

Patch Changes

  • fix: remove redundant passive options from scroll listeners
  • fix: support explicit undefined for optional properties with exactOptionalPropertyTypes
  • fix(autoUpdate): update immediately instead of waiting for the 1s layoutShift refresh throttle when the reference moved during an observer refresh
  • fix(getClippingRect): correct clipping-ancestor filtering for fixed-position elements
  • perf(dom): reduce bundle size and skip redundant per-call work in positioning utilities
  • fix(getViewportRect): account for scrollbar-gutter: stable both-edges reserved space
  • fix(getViewportRect): don't overflow past a left-side document scrollbar
  • fix(platform): don't throw in getClientRects when a virtual element without a getClientRects method is used with the inline() middleware
  • fix(autoUpdate): refresh layout shift observer on root resize
  • Update dependencies: @floating-ui/core@1.8.0, @floating-ui/utils@0.2.12
Commits
  • 12d9473 chore: version packages (#3480)
  • ad0a73f fix(getViewportRect): account for scrollbar-gutter: stable both-edges reser...
  • 9887c96 fix(types): restore bivariant parameters for optional callbacks
  • 28bc9c1 fix(autoUpdate): avoid duplicate update on window resize
  • 5976f20 test(dom): run unit tests in vitest browser mode
  • 705a03c fix(platform): support virtual elements without getClientRects in inline() (#...
  • 3785f3b feat: add layoutViewport string option to rootBoundary (#3486)
  • 0d0e88e fix(inline): no-op on empty client rects and detect RTL disjoined line rects ...
  • 73c1f76 fix(types): support exactOptionalPropertyTypes (#3456)
  • cd58dd2 fix(getClippingRect): correct clipping-ancestor filtering for fixed-position ...
  • Additional commits viewable in compare view

Updates @napi-rs/simple-git from 1.0.0 to 1.1.0

Release notes

Sourced from @​napi-rs/simple-git's releases.

v1.1.0

What's Changed

Full Changelog: Brooooooklyn/simple-git@v1.0.0...v1.1.0

Commits
  • 3b8e55c 1.1.0
  • e580290 fix(deps): update void to v0.10.6 (#153)
  • 659d5ca feat: add created (first-add commit) to FileModification (#152)
  • 3ca64c5 chore(deps): update dorny/paths-filter action to v4 (#150)
  • 9b5a48b fix(deps): update dependency void to v0.10.5 (#151)
  • 723f6b3 chore: move renovate.json
  • 4ca5860 chore: fix yarn and renovate config
  • 638b632 fix(deps): update dependency @​void/react to v0.10.5 (#148)
  • 8300a3f fix(deps): update dependency @​void/md to v0.10.5 (#147)
  • 6881589 feat: simple-git.napi.rs website (landing + docs + Cloudflare deploy) (#146)
  • See full diff in compare view

Updates globby from 16.2.1 to 16.2.2

Release notes

Sourced from globby's releases.

v16.2.2

  • Fix: Do not enumerate ignored directories with gitignore option 8bf8f54

sindresorhus/globby@v16.2.1...v16.2.2

Commits

Updates lightningcss from 1.32.0 to 1.33.0

Release notes

Sourced from lightningcss's releases.

v1.33.0

Added

Fixed

Commits

Updates preact from 10.29.4 to 10.29.7

Release notes

Sourced from preact's releases.

10.29.7

Maintenance

10.29.6

We had to revert preactjs/preact#5055 due to an incompatibility with useSignalEffect

10.29.5

Fixes

Commits

Updates pretty-bytes from 7.1.0 to 7.1.1

Release notes

Sourced from pretty-bytes's releases.

v7.1.1

  • Fix numbers less than 1 having excessive precision af55eb9

sindresorhus/pretty-bytes@v7.1.0...v7.1.1

Commits

Updates satori from 0.26.0 to 0.28.1

Release notes

Sourced from satori's releases.

0.28.1

0.28.1 (2026-07-20)

Bug Fixes

  • render text matching Object.prototype property names as glyphs (#761) (504b4c9)

0.28.0

0.28.0 (2026-07-14)

Features

0.27.0

0.27.0 (2026-04-29)

Bug Fixes

  • Fixed error when rendering React Fragments inside <svg>
Commits
  • 504b4c9 fix: render text matching Object.prototype property names as glyphs (#761)
  • b5c1f64 feat: trigger npm publish after OIDC fix (#771)
  • 8119856 docs: fix flexWrap default from 'wrap' to 'nowrap' (#767)
  • 2120646 ci: publish via npm trusted publishing (OIDC) (#770)
  • 2d3af44 fix: SSRF guard for server-side image fetches + pluggable fetcher (#769)
  • 9feec94 fix: text matching Object.prototype property names rendered as image (#768)
  • 91ade3b ci: declare minimum permissions on PR title workflow (#756)
  • ab49faf chore: migrate workspace to pnpm 10 (#762)
  • 8a0619f chore: remove pull_request_target (#755)
  • a2e0dce fix bug with fragments in svg
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for satori since your current version.


Updates toml from 4.1.2 to 5.0.0

Changelog

Sourced from toml's changelog.

5.0.0 - July 14 2026

  • Breaking: Integers outside JavaScript's safe range (beyond ±Number.MAX_SAFE_INTEGER) now throw a parse error instead of silently returning a rounded value (#28). Opt in to lossless handling of the full 64-bit range with toml.parse(input, { bigint: true }), which returns all integer values as BigInt.
  • Breaking: Integers outside TOML's 64-bit signed integer range now throw a parse error in either mode, as required by the spec. Previously they were silently rounded.

4.3.0 - July 13 2026

  • Add opt-in Temporal support via toml.parse(input, { useTemporal: true }), mapping offset date-times to Temporal.ZonedDateTime and local date-times/dates/times to Temporal.PlainDateTime/PlainDate/PlainTime. An implementation can be supplied via the temporal option on runtimes without a Temporal global. (#69)

4.2.0 - July 13 2026

  • Address security advisory GHSA-82x6-q7mm-w9cf (CVE pending), in which deeply nested arrays or inline tables could overflow the call stack and crash the process with an uncatchable RangeError. Nesting is now bounded (default 500 levels), and input past the limit throws a normal parse error. The limit is configurable via toml.parse(input, { maxDepth }).
Commits
  • ccd8b10 5.0.0
  • 00ac4a6 Update changelog
  • 121e5fa Merge pull request #74 from BinaryMuse/mkt/big-ints
  • 2b6bcb7 Add opt-in BigInt support, throw when parsing out of bounds values
  • 38fb4e6 4.3.0
  • 5222a64 feat: Add opt-in Temporal support for date/time values (#73)
  • 95f79b3 4.2.0
  • b71c439 Merge pull request #72 from BinaryMuse/fix/nesting-depth-dos
  • a2d6dbb Update changelog
  • 967b8b0 fix: bound nesting depth to prevent stack-overflow DoS
  • Additional commits viewable in compare view

Updates ws from 8.21.0 to 8.21.1

Release notes

Sourced from ws's releases.

8.21.1

Bug fixes

  • Empty fragments are now counted toward the limit (a2f4e7c0).
  • The default values of the maxBufferedChunks and maxFragments options have been reduced (f197ac65).
Commits
  • ae1de54 [dist] 8.21.1
  • 8e9511b [ci] Trust Coveralls Homebrew tap
  • f197ac6 [fix] Lower default values of maxBufferedChunks and maxFragments
  • 8df8265 [ci] Update actions/checkout action to v7
  • a2f4e7c [fix] Count empty fragments toward the limit (#2329)
  • e79f912 [pkg] Approve install scripts for bufferutil and utf-8-validate
  • 4ea355d [doc] Document 32-bit signed integer coercion for option values
  • 2120f4c [example] Remove uuid dependency
  • 4c534a6 [security] Add latest vulnerability to SECURITY.md
  • See full diff in compare view

Updates @types/hast from 3.0.4 to 3.0.5

Commits

Updates @types/node from 26.1.0 to 26.1.1

Commits

Updates prettier from 3.9.4 to 3.9.5

Release notes

Sourced from prettier's releases.

3.9.5

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.5

diff

Markdown: Cap ordered list mark at 999,999,999 (#19351 by @​tats-u)

CommonMark parsers only support ordered list item numbers up to 999,999,999.

With this change, Prettier now caps the ordered list item number at 999,999,999 to ensure that the output is correctly parsed as an ordered list by CommonMark parsers. Numbers larger than 999,999,999 are not parsed as list item numbers and are left unchanged in the output:

<!-- Input -->
999999998. text
999999998. text
999999998. text
999999998. text
1234567890123456789012) text
<!-- Prettier 3.9.4 -->
999999998. text
999999999. text
1000000000. text
1000000001. text
1234567890123456789012) text
<!-- Prettier 3.9.5 -->
999999998. text
999999999. text
999999999. text
999999999. text
1234567890123456789012) text

Markdown: Avoid corrupting empty link with title (#19487 by @​andersk)

Do not remove <> from an inline link or image with an empty URL and a title, as this removal would change its interpretation.

<!-- Input -->
[link](https://github.com/prettier/prettier/blob/main/<> "title")
<!-- Prettier 3.9.4 -->
[link](https://github.com/prettier/prettier/blob/main/ "title")
<!-- Prettier 3.9.5 -->
</tr></table>

... (truncated)

Commits

Updates tsx from 4.23.0 to 4.23.1

Release notes

Sourced from tsx's releases.

v4.23.1

4.23.1 (2026-07-13)

Bug Fixes

  • support tsImport after global preload (8d4ffc2)
  • watch: avoid clearing piped output (95d0672)
  • watch: treat script and dependency paths literally (79fddde)

Performance Improvements

  • index transform cache lazily (e818ad6)
  • load esbuild lazily in CLI (d067938)
  • map Node TypeScript formats directly (cdcc623)
  • use sync module hooks on Node v22.22.3+ (f8992f1)

This release is also available on:

Commits
  • 79fddde fix(watch): treat script and dependency paths literally
  • e818ad6 perf: index transform cache lazily
  • cdcc623 perf: map Node TypeScript formats directly
  • d067938 perf: load esbuild lazily in CLI
  • 95d0672 fix(watch): avoid clearing piped output
  • 6fd4607 docs: add per-page metadata
  • f4176d8 docs: generate sitemap
  • 8d4ffc2 fix: support tsImport after global preload
  • f0e89b2 docs: document Node's public type-stripping API vs internal loader path
  • f8992f1 perf: use sync module hooks on Node v22.22.3+
  • See full diff in compare view

Updates typescript from 6.0.3 to 7.0.2

Commits
Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the production-dependencies group across 1 director…
82fcf04 
…y with 14 updates

Bumps the production-dependencies group with 14 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@floating-ui/dom](https://github.com/floating-ui/floating-ui/tree/HEAD/packages/dom) | `1.7.6` | `1.8.0` |
| [@napi-rs/simple-git](https://github.com/Brooooooklyn/simple-git) | `1.0.0` | `1.1.0` |
| [globby](https://github.com/sindresorhus/globby) | `16.2.1` | `16.2.2` |
| [lightningcss](https://github.com/parcel-bundler/lightningcss) | `1.32.0` | `1.33.0` |
| [preact](https://github.com/preactjs/preact) | `10.29.4` | `10.29.7` |
| [pretty-bytes](https://github.com/sindresorhus/pretty-bytes) | `7.1.0` | `7.1.1` |
| [satori](https://github.com/vercel/satori) | `0.26.0` | `0.28.1` |
| [toml](https://github.com/BinaryMuse/toml-node) | `4.1.2` | `5.0.0` |
| [ws](https://github.com/websockets/ws) | `8.21.0` | `8.21.1` |
| [@types/hast](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/hast) | `3.0.4` | `3.0.5` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.0` | `26.1.1` |
| [prettier](https://github.com/prettier/prettier) | `3.9.4` | `3.9.5` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.0` | `4.23.1` |
| [typescript](https://github.com/microsoft/TypeScript) | `6.0.3` | `7.0.2` |



Updates `@floating-ui/dom` from 1.7.6 to 1.8.0
- [Release notes](https://github.com/floating-ui/floating-ui/releases)
- [Changelog](https://github.com/floating-ui/floating-ui/blob/master/packages/dom/CHANGELOG.md)
- [Commits](https://github.com/floating-ui/floating-ui/commits/@floating-ui/dom@1.8.0/packages/dom)

Updates `@napi-rs/simple-git` from 1.0.0 to 1.1.0
- [Release notes](https://github.com/Brooooooklyn/simple-git/releases)
- [Commits](Brooooooklyn/simple-git@v1.0.0...v1.1.0)

Updates `globby` from 16.2.1 to 16.2.2
- [Release notes](https://github.com/sindresorhus/globby/releases)
- [Commits](sindresorhus/globby@v16.2.1...v16.2.2)

Updates `lightningcss` from 1.32.0 to 1.33.0
- [Release notes](https://github.com/parcel-bundler/lightningcss/releases)
- [Commits](parcel-bundler/lightningcss@v1.32.0...v1.33.0)

Updates `preact` from 10.29.4 to 10.29.7
- [Release notes](https://github.com/preactjs/preact/releases)
- [Commits](preactjs/preact@10.29.4...10.29.7)

Updates `pretty-bytes` from 7.1.0 to 7.1.1
- [Release notes](https://github.com/sindresorhus/pretty-bytes/releases)
- [Commits](sindresorhus/pretty-bytes@v7.1.0...v7.1.1)

Updates `satori` from 0.26.0 to 0.28.1
- [Release notes](https://github.com/vercel/satori/releases)
- [Commits](vercel/satori@0.26.0...0.28.1)

Updates `toml` from 4.1.2 to 5.0.0
- [Changelog](https://github.com/BinaryMuse/toml-node/blob/master/CHANGELOG.md)
- [Commits](BinaryMuse/toml-node@v4.1.2...v5.0.0)

Updates `ws` from 8.21.0 to 8.21.1
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.21.0...8.21.1)

Updates `@types/hast` from 3.0.4 to 3.0.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/hast)

Updates `@types/node` from 26.1.0 to 26.1.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `prettier` from 3.9.4 to 3.9.5
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.9.4...3.9.5)

Updates `tsx` from 4.23.0 to 4.23.1
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.23.0...v4.23.1)

Updates `typescript` from 6.0.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/commits)

---
updated-dependencies:
- dependency-name: "@floating-ui/dom"
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@napi-rs/simple-git"
  dependency-version: 1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: globby
  dependency-version: 16.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: lightningcss
  dependency-version: 1.33.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: preact
  dependency-version: 10.29.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: pretty-bytes
  dependency-version: 7.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: satori
  dependency-version: 0.28.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: toml
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: ws
  dependency-version: 8.21.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@types/hast"
  dependency-version: 3.0.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@types/node"
  dependency-version: 26.1.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: prettier
  dependency-version: 3.9.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: tsx
  dependency-version: 4.23.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants