Skip to content

build(deps): update frontend packages - #17

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/frontend-packages
Open

build(deps): update frontend packages#17
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/frontend-packages

Conversation

@renovate

@renovate renovate Bot commented Oct 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@base-ui/react (source) 1.8.0 → 1.9.0 age confidence
@cloudflare/vite-plugin (source) 1.63.1 → 1.63.2 age confidence
@cloudflare/workers-types 5.20261009.1 → 5.20261013.1 age confidence
@sentry/cloudflare (source) 11.6.0 → 11.7.0 age confidence
@sentry/tanstackstart-react (source) 11.6.0 → 11.7.0 age confidence
@tanstack/react-router (source) 1.170.41 → 1.170.44 age confidence
@tanstack/react-start (source) 1.168.60 → 1.169.1 age confidence
@tanstack/router-cli (source) 1.167.40 → 1.167.43 age confidence
@types/node (source) 26.6.4 → 26.6.5 age confidence
@vitest/coverage-v8 (source) 5.0.3 → 5.0.4 age confidence
lucide-react (source) 1.54.0 → 1.56.0 age confidence
vitest (source) 5.0.3 → 5.0.4 age confidence
wrangler (source) 4.149.0 → 4.150.0 age confidence

Release Notes

mui/base-ui (@​base-ui/react)

v1.9.0

Compare Source

Oct 9, 2026

General changes
Accordion
Alert Dialog
  • Don't associate a programmatically opened popup with a trigger that did not open it (#​5641) by @​michaldudak
Autocomplete
  • Fix autoHighlight for asynchronous results (#​5818) by @​atomiks
  • Pass the originating event to onItemHighlighted. Pointer events may be MouseEvent or PointerEvent; typing reports the reason none (#​5838) by @​atomiks
  • Decouple automatic unmounting from actionsRef. Call eventDetails.preventUnmountOnClose() in onOpenChange to opt out of automatic unmounting (#​5734) by @​michaldudak
Checkbox
Collapsible
Combobox
Dialog
  • Keep parent open when closing a nested dialog in a closed shadow root (#​5780) by @​atomiks
  • Don't associate a programmatically opened popup with a trigger that did not open it (#​5641) by @​michaldudak
Drawer
Field
Menu
Number Field
OTP Field
Popover
Preview Card
Radio Group
Scroll Area
Select
Slider
Switch
Tabs
Toast
Tooltip

All contributors of this release in alphabetical order: @​aarongarciah, @​atomiks, @​brijeshb42, @​citrus, @​cpruijsen, @​flaviendelangle, @​jjenzz, @​LukasTy, @​lyzno1, @​mdm317, @​michaldudak, @​MonstraG, @​padd60, @​sai6855, @​santiago-ramos-02, @​sarthakmalik0810, @​superhooman, @​tjdsksro90

cloudflare/workers-sdk (@​cloudflare/vite-plugin)

v1.63.2

Compare Source

Patch Changes

  • #​16025 61e07fd Thanks @​kohjunhao! - Fix optional Docker lookups printing Docker CLI errors during successful builds

    cf build looks for Container images left behind by earlier builds so it can remove them. This lookup is best effort, but when Docker could not be reached it still printed errors such as Cannot connect to the Docker daemon, even when the build succeeded and no image needed Docker. Docker commands whose output Wrangler reads no longer forward the Docker CLI's error output to the terminal. If one of these commands fails in a way that stops the command, the error message still includes the Docker CLI's output.

  • #​16038 dc3e4df Thanks @​dario-piotrowicz! - Use consumer-specific CLI names and commands in shared user-facing messages

    Shared deployment, container, configuration, and authentication helpers can now render commands and configuration filenames for their calling CLI while preserving Wrangler-compatible defaults. This prevents cf workflows from presenting Wrangler-branded guidance when an equivalent cf command exists.

  • Updated dependencies [fcf625d, 091e5ec, 5152bf8, 9f87de8, daae435, 18f061c, 9be5ec7, 61e07fd, cafd3f9, ea64ec4, d232454]:

cloudflare/workerd (@​cloudflare/workers-types)

v5.20261013.1

Compare Source

v5.20261012.1

Compare Source

v5.20261011.1

Compare Source

v5.20261010.1

Compare Source

getsentry/sentry-javascript (@​sentry/cloudflare)

v11.7.0

Compare Source

Important Changes

  • feat(cloudflare): Add opt-in cron monitoring for Cron Triggers (#​25014)

    The new cronTriggersIntegration sends check-ins for Cron Triggers. Each check-in includes the schedule from controller.cron, so Sentry creates the monitor on the first run. The integration is opt-in, because monitors are billed.

    Cron Triggers have no names, so map each cron expression of your wrangler config to a monitor slug. With the Sentry Cloudflare Vite plugin, add the integration to src/instrument.server.ts:

    // src/monitorSlugs.ts
export const monitorSlugs: Record<string, string> = {
  '30 9 * * MON-FRI': 'daily-report',
};

// src/instrument.server.ts
import * as Sentry from '@sentry/cloudflare';
import { monitorSlugs } from './monitorSlugs';

export default Sentry.defineCloudflareOptions(env => ({
  dsn: env.SENTRY_DSN,
  integrations: [Sentry.cronTriggersIntegration({ monitorSlug: cron => monitorSlugs[cron] })],
}));

// src/index.ts
import { monitorSlugs } from './monitorSlugs';

export default {
  async scheduled(controller, env) {
    switch (monitorSlugs[controller.cron]) {
      case 'daily-report':
        // Your daily report job
        break;
    }
  },
};

    The monitorSlug function can also return monitor settings, for example { monitorSlug: 'daily-report', maxRuntime: 30 }, or undefined to send no check-ins for a trigger. Without monitorSlug, the SDK derives the slug from the cron expression. If you deploy with wrangler directly, pass the same integration to Sentry.withSentry.

  • feat(node): Add neonIntegration for @​neondatabase/serverless (#​25164, #​25176)

    The new neonIntegration creates db spans for queries of the @neondatabase/serverless driver: for the WebSocket Client and Pool, and for the HTTP neon() function. This includes the neon-http and neon-serverless adapters of Drizzle. The integration is on by default when tracing is enabled.

  • feat(node): Stop sending the process session once request sessions are tracked (#​24915)

    Node servers sent release health data two times: as request session aggregates, and as the process session of processSessionIntegration. An error in a request also marked the process session as errored, so the SDK counted the error two times. Now the SDK drops the process session when it tracks the first request session. Scripts, CLIs and workers that do not serve requests keep the process session, and so do servers with httpServerIntegration({ sessions: false }). This changes the release health numbers of Node servers, because they no longer send the errored or crashed update of the process session.

  • feat(server-utils): Record decide calls as gen_ai.decide spans (#​25270, #​25272, #​25274, #​25281)

    Vercel AI experimental_decide calls, Mastra classifier evaluations, TypeSafe and LangChain Jev calls, and Workers AI calls to TypeSafe Jev and Cloudflare Clef models now create decide <model> spans with the op gen_ai.decide. Before, these spans had the op gen_ai.evaluate, which is now deprecated in the Sentry conventions. If you use gen_ai.evaluate in queries, alerts or dashboards, change it to gen_ai.decide.

  • fix(browser): Apply urlQueryParams to more URLs (#​25262, #​25289)

    The dataCollection.urlQueryParams option now also filters the query parameters of these URLs:

    • the page URL in event.request.url
    • the browser.* and resource.* span names with traceLifecycle: 'static'
    • the LCP URL attributes lcp.url and browser.web_vital.lcp.url
    • the URLs in fetch, XHR and navigation breadcrumbs
    • the ui.element.url attribute of elementTimingIntegration

    Before this fix, these URLs could send sensitive query values, for example ?jwt=..., to Sentry.

  • fix(nextjs): Apply top-level bundleSizeOptimizations to webpack and Turbopack builds (#​24818)

    The top-level bundleSizeOptimizations option now removes unused SDK code in webpack and in Turbopack builds. Before, the tree-shaking options had no effect on Turbopack. The webpack.treeshake option is deprecated. It still works, but when you set both options, bundleSizeOptimizations takes precedence.

Other Changes
  • feat(nuxt): Detect the server API with @nuxt/kit 4.6 (#​25138)
  • fix(bundler-plugins): Escape JSON in generated injection code (#​25265)
  • fix(core): Don't mark http client spans as errors when the caller aborts (#​25260)
  • fix(core): Record span client report outcomes when discarding transactions (#​25006)
  • fix(core): Record client outcomes when beforeSend callbacks return invalid values (#​25049)
  • fix(core): Record span outcomes for spans dropped when building a transaction (#​25048)
  • fix(core): Report actual item count in client reports of envelope send failures (#​25185)
  • fix(core): Strip internal custom span name from streamed spans (#​25212)
  • fix(nextjs): Filter query parameters in request error context (#​25233)
  • fix(node): Don't mark fetch spans as errors when the caller aborts (#​25129)
  • fix(nuxt): Delete public source maps before Nitro lists its public assets (#​25267)
  • fix(nuxt): Keep @sentry/server-runtime-injection external on Nitro v3 (#​24901)
  • fix(nuxt): Remove @​opentelemetry/resources dev alias (#​25216)
  • fix(profiling-node): Stop the trace lifecycle profiler when spans are unsampled (#​25210)
  • fix(react-router): Respect custom default integrations (#​25259)
  • fix(remix): Respect custom default integrations (#​25258)
  • fix(server-utils): avoid quadratic SQL summary regex backtracking (#​25255)
  • fix(server-utils): End Express layer spans when the client aborts (#​25209)
  • fix(server-utils): Record amqplib consumer info before the first delivery and instrument the callback API (#​25047)
  • fix(server-utils): Stop treating previous_response_id as the OpenAI conversation id (#​25269)
  • fix(sveltekit): Read load event pathname untracked (#​25235)
  • fix(sveltekit): Stop adapter-node 6 output dir probe from deleting the build (#​25193)
Internal Changes
  • chore: Add external contributor to CHANGELOG.md (#​25230)
  • chore: Add external contributor to CHANGELOG.md (#​25271)
  • chore(deps-dev): Bump oxlint-tsgolint from 7.0.2001 to 7.0.2003 (#​25237)
  • chore(deps-dev): Bump rimraf from 5.0.10 to 6.1.3 (#​25241)
  • chore(deps): Bump @sentry/conventions to 0.27.0 (#​25264)
  • chore(deps): Bump next from 16.2.11 to 16.3.8 in /dev-packages/e2e-tests/test-applications/nextjs-16 (#​25179)
  • chore(deps): Bump next from 16.2.11 to 16.3.8 in /dev-packages/e2e-tests/test-applications/nextjs-16-tunnel (#​25190)
  • chore(size-limit): weekly auto-bump (#​25213)
  • ci: Install Playwright in the background during E2E app builds (#​25207)
  • ci: Run lint steps in parallel (#​25187)
  • ci(bun): Test the oldest supported Bun version and the newest 1.4 (#​25203)
  • docs: Scope pre-PR tests to affected suites (#​25198)
  • feat(deps): Bump @​aws-sdk/client-kinesis from 3.1068.0 to 3.1146.0 (#​25240)
  • feat(deps): Bump handlebars from 4.7.9 to 4.7.10 (#​25206)
  • feat(deps): Bump pino from 9.10.0 to 10.4.0 (#​25238)
  • feat(deps): Bump reflect-metadata from 0.2.1 to 0.2.2 (#​25239)
  • ref(core): Simplify transport item loss recording (#​25224)
  • ref(server-utils): Export the pg query span helpers (#​25163)
  • ref(server-utils): Share Orchestrion channel context (#​25208)
  • test(browser): migrate trace lifecycle and span API tests to streaming (#​24881)
  • test(browser): port browser tracing suites to span streaming (#​24888)
  • test(browser): port requests and web vitals to span streaming (#​24886)
  • test(browser): Register the LCP handlers in the bundle of the SDK (#​25263)
  • test(bun): Run the Node suites that need Bun 1.4 on the Bun 1.4 job (#​25204)
  • test(cloudflare): Add LangChain TypeSafeClassifier integration test (#​25234)
  • test(core): Fix flaky span end timestamp test (#​25211)
  • test(deno): Type-check Deno unit tests (#​25227)
  • test(nextjs): Add vinext e2e tests (#​25001)
  • test(node-integration): Replace conditionalTest with a supports helper (#​25202)
  • test(node-integration): Stop exporting NODE_VERSION and RUNTIME from the test utils (#​25292)
  • test(node): Add integration tests for the Neon serverless driver (#​25177)
  • test(node): Port baggage and metadata tests to span streaming (#​25220)
  • test(node): Port basic and nested startSpan tests to streaming (#​25214)
  • test(node): Port fetch request suites to span streaming (#​25189)
  • test(node): Port HTTP options and hooks to span streaming (#​25195)
  • test(node): Port HTTP propagation and transport suites to streaming (#​25197)
  • test(node): Port HTTP request suites to span streaming (#​25191)
  • test(node): Port incoming HTTP behavior to span streaming (#​25194)
  • test(node): Port MongoDB integration tests to span streaming (#​25150)
  • test(node): Port Mongoose integration tests to span streaming (#​25151)
  • test(node): Port outgoing HTTP client spans to streaming (#​25192)
  • test(node): Port parallel span and naming tests to streaming (#​25217)
  • test(node): Port Postgres integration tests to span streaming (#​25140)
  • test(node): Port Prisma integration tests to span streaming (#​25152)
  • test(node): Port Redis integration tests to span streaming (#​25153)
  • test(node): Port span linking and raw OTel tests to streaming (#​25219)
  • test(node): Port trace context tests to span streaming (#​25218)
  • test(node): Run sampling propagation tests with default streaming (#​25221)
  • test(node): Use default streaming in scope and span suites (#​25222)
  • test(nuxt): Test imports from nuxt/server in the nuxt-5 E2E app (#​25232)

Work in this release was contributed by @​Philip-Nwabuwa and @​4ktLuffy. Thank you for your contributions!

TanStack/router (@​tanstack/react-router)

v1.170.44

Compare Source

Patch Changes

v1.170.43

Compare Source

Patch Changes

v1.170.42

Compare Source

Patch Changes

  • #​8594 2413cc0 - reduce component nesting per route match

  • #​8602 efc2042 - Links of a route that the pending navigation leaves skip deriving the destination location, and clicks and preloads follow the href a Link displays. buildLocation now builds mask and routeMasks locations from the same _fromLocation as the destination.

  • #​8602 efc2042 - Fixed Link destinations that resolve to a route mask are now reused across navigations instead of being rebuilt every time. A mounted Link now follows changes to its href and reloadDocument props, and React Links no longer each subscribe to a hydration flag.

  • #​8579 d35aab4 - Cancel pending link preload timers when starting navigation to avoid redundant preloading while the destination is loading.

  • Updated dependencies [dfe3dea, dfe3dea, dfe3dea, efc2042, efc2042, dfe3dea, 663282b]:

TanStack/router (@​tanstack/react-start)

v1.169.1

Compare Source

Patch Changes

v1.169.0

Compare Source

Minor Changes
Patch Changes

  • #​8694 550f478 - Remove the deprecated .inputValidator() from createServerFn and createMiddleware. Use .validator(), which takes the same validator.

  • #​7588 94d6d8e - Keep streaming a page when request middleware returns a response that reads the page body, such as a copy made through a wrapped global Response, a copy in Bun, or a body piped through a transform. Start now disposes a replaced page stream only when nothing reads it. transferResponseBodyOwnership is removed: return the derived response directly.

  • #​7588 94d6d8e - Remove the built-in useSession API. Applications choose a session library, such as iron-session, and save or destroy sessions explicitly before returning or redirecting. Connect a cookie adapter through getCookie and setCookie, or append serialized cookies with appendResponseHeader('set-cookie', cookie). Existing session cookies require a deliberate migration or signing in again with a new cookie name.

    createServerEntry keeps the complete callback, including custom error handling, inside the request context and converts errors that escape it. The built-in entry still converts errors automatically. Raw createStartHandler handlers now rethrow the original error. For custom reporting, catch inside createServerEntry, then rethrow for default conversion or return handleStartError(error) to preserve response-helper status, headers, and cookies. Return an explicit Response when choosing a custom error payload.

    Response helpers now apply consistently across server routes, SSR, server functions, redirects, errors, and middleware response replacements. Helper setters override returned values; cookie helpers preserve independent cookies and replace matching cookie identities. Use appendResponseHeader('set-cookie', cookie) when adding a serialized cookie without replacing other cookies. Changed responses receive copied headers and reuse the body stream, so applications should inspect the response returned by Start rather than relying on mutation of the original response.

  • #​8696 f243c61 - Require Vite 8 for Vite builds. Vite 7 is no longer supported.

  • Updated dependencies [94d6d8e, 550f478, 94d6d8e, f3d7ee3, 4104b8e, 94d6d8e, 94d6d8e, 94d6d8e, f243c61, 19524cc]:

v1.168.61

Compare Source

Patch Changes

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Berlin)

  • Branch creation
    • "before 8am on monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from maxstue October 12, 2026 01:47
@renovate
renovate Bot force-pushed the renovate/frontend-packages branch 4 times, most recently from 67decf1 to ef7864b Compare October 14, 2026 04:45
@sonarqubecloud

sonarqubecloud Bot commented Oct 14, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@renovate
renovate Bot force-pushed the renovate/frontend-packages branch 3 times, most recently from bf67152 to 79f928d Compare October 15, 2026 05:58
@renovate
renovate Bot force-pushed the renovate/frontend-packages branch from 79f928d to be902b0 Compare October 15, 2026 10:44

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@maxstue maxstue Awaiting requested review from maxstue

Assignees

@maxstue maxstue

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@maxstue