Skip to content

chore(deps): combined dependabot bump - #3111

Merged
HughParry merged 22 commits into
mainfrom
chore/deps-bump-2026-08-24
Aug 24, 2026
Merged

HughParry merged 22 commits into
mainfrom
chore/deps-bump-2026-08-24

Conversation

@HughParry

@HughParry HughParry commented Aug 24, 2026 •

Copy link
Copy Markdown
Contributor

Combines the open Dependabot PRs into a single bump so the lockfile is resolved once.

Rolls up:

Not included

#3082 (zod 3 → 4) was dropped. It is a breaking major needing a source migration —
z.record(v) → z.record(k, v) (11 sites), .Values removed (6), ZodError.errors →
.issues (23 ZodError refs), z.nativeEnum deprecated (11), .catchall (6). That
belongs in its own PR, not a dependency roll-up. Branch preserved as deps/zod-4-migration.

Deviations from Dependabot

  1. react-dom pulled up to match react. chore(deps): bump react and @types/react #3081 bumped react/@types/react to 19 but left
    react-dom/@types/react-dom at 18.3.1 — a mismatched major pair. Bumped to 19.2.8 / 19.2.5.

  2. esbuild declared at the workspace root. vite 8 takes esbuild as an optional peer and its
    ESBuildOptions extends esbuild's TransformOptions. esbuild was only declared in dev/config
    and reached the root node_modules by hoisting luck; declaring it at the root makes that
    deterministic instead.

  3. package-lock.json rebuilt from scratch, not merged by hand. Note this requires the
    packages/fingerprintjs submodule to be checked out, or npm tries the registry and 404s.

dependabot Bot and others added 18 commits August 19, 2026 15:49
…updates

Bumps the github-actions group with 3 updates in the / directory: [actions/checkout](https://github.com/actions/checkout), [actions/setup-java](https://github.com/actions/setup-java) and [android-actions/setup-android](https://github.com/android-actions/setup-android).


Updates `actions/checkout` from 4 to 7
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v7)

Updates `actions/setup-java` from 4 to 5
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](actions/setup-java@v4...v5)

Updates `android-actions/setup-android` from 3 to 4
- [Release notes](https://github.com/android-actions/setup-android/releases)
- [Commits](android-actions/setup-android@v3...v4)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-java
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: android-actions/setup-android
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [zod](https://github.com/colinhacks/zod) from 3.23.8 to 4.4.3.
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v3.23.8...v4.4.3)

---
updated-dependencies:
- dependency-name: zod
  dependency-version: 4.4.3
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [@maxmind/geoip2-node](https://github.com/maxmind/GeoIP2-node) from 5.0.0 to 7.1.0.
- [Release notes](https://github.com/maxmind/GeoIP2-node/releases)
- [Changelog](https://github.com/maxmind/GeoIP2-node/blob/main/CHANGELOG.md)
- [Commits](maxmind/GeoIP2-node@v5.0.0...v7.1.0)

---
updated-dependencies:
- dependency-name: "@maxmind/geoip2-node"
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [@babel/plugin-transform-object-rest-spread](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-object-rest-spread) from 7.28.4 to 8.0.1.
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v8.0.1/packages/babel-plugin-transform-object-rest-spread)

---
updated-dependencies:
- dependency-name: "@babel/plugin-transform-object-rest-spread"
  dependency-version: 8.0.1
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [react](https://github.com/react/react/tree/HEAD/packages/react) and [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react). These dependencies needed to be updated together.

Updates `react` from 18.3.1 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react)

Updates `@types/react` from 18.3.1 to 19.2.18
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

---
updated-dependencies:
- dependency-name: "@types/react"
  dependency-version: 19.2.18
  dependency-type: direct:development
  update-type: version-update:semver-major
- dependency-name: react
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
…th 36 updates

Bumps the npm-minor-and-patch group with 36 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [turbo](https://github.com/vercel/turborepo) | `2.9.14` | `2.10.10` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.4` | `6.0.5` |
| [esbuild](https://github.com/evanw/esbuild) | `0.28.1` | `0.28.2` |
| [fast-glob](https://github.com/mrmlnc/fast-glob) | `3.3.2` | `3.3.3` |
| [html-webpack-plugin](https://github.com/jantimon/html-webpack-plugin) | `5.6.0` | `5.6.8` |
| [mini-css-extract-plugin](https://github.com/webpack/mini-css-extract-plugin) | `2.9.1` | `2.10.2` |
| [rollup](https://github.com/rollup/rollup) | `4.52.5` | `4.62.4` |
| [rollup-plugin-import-css](https://github.com/jleeson/rollup-plugin-import-css) | `4.1.1` | `4.2.1` |
| [terser-webpack-plugin](https://github.com/webpack/minimizer-webpack-plugin) | `5.3.14` | `5.6.1` |
| [@babel/plugin-proposal-import-attributes-to-assertions](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-proposal-import-attributes-to-assertions) | `7.27.1` | `7.29.7` |
| [@babel/plugin-syntax-import-attributes](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-syntax-import-attributes) | `7.27.1` | `7.29.7` |
| [css-loader](https://github.com/webpack/css-loader) | `7.1.2` | `7.1.4` |
| [string-replace-loader](https://github.com/Va1/string-replace-loader) | `3.1.0` | `3.3.0` |
| [webpack](https://github.com/webpack/webpack) | `5.102.1` | `5.109.2` |
| [fs-extra](https://github.com/jprichardson/node-fs-extra) | `11.2.0` | `11.4.0` |
| [@polkadot/extension-base](https://github.com/polkadot-js/extension/tree/HEAD/packages/extension-base) | `0.62.3` | `0.63.1` |
| [@polkadot/extension-dapp](https://github.com/polkadot-js/extension/tree/HEAD/packages/extension-dapp) | `0.62.3` | `0.63.1` |
| [@polkadot/extension-inject](https://github.com/polkadot-js/extension/tree/HEAD/packages/extension-inject) | `0.62.3` | `0.63.1` |
| [@polkadot/types-codec](https://github.com/polkadot-js/api/tree/HEAD/packages/types-codec) | `16.4.9` | `16.5.6` |
| [@polkadot-api/substrate-client](https://github.com/polkadot-api/polkadot-api) | `0.1.4` | `0.7.0` |
| [i18next-browser-languagedetector](https://github.com/i18next/i18next-browser-languageDetector) | `8.0.2` | `8.2.1` |
| [i18next-fs-backend](https://github.com/i18next/i18next-fs-backend) | `2.6.6` | `2.6.7` |
| [i18next-http-middleware](https://github.com/i18next/i18next-http-middleware) | `3.9.7` | `3.9.8` |
| [i18next-resources-to-backend](https://github.com/i18next/i18next-resources-to-backend) | `1.2.1` | `1.2.3` |
| [@emotion/cache](https://github.com/emotion-js/emotion) | `11.11.0` | `11.14.0` |
| [@emotion/react](https://github.com/emotion-js/emotion) | `11.11.1` | `11.14.0` |
| [@emotion/styled](https://github.com/emotion-js/emotion) | `11.11.0` | `11.14.1` |
| [csstype](https://github.com/frenic/csstype) | `3.1.3` | `3.2.3` |
| [geolib](https://github.com/manuelbieh/geolib) | `3.3.4` | `3.3.14` |
| [@types/pg](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/pg) | `8.16.0` | `8.23.1` |
| [cors](https://github.com/expressjs/cors) | `2.8.5` | `2.8.6` |
| [@types/cors](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/cors) | `2.8.17` | `2.8.19` |
| [@polkadot/types](https://github.com/polkadot-js/api/tree/HEAD/packages/types) | `16.4.9` | `16.5.6` |
| [@types/lodash](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/lodash) | `4.17.7` | `4.17.25` |
| [jsonwebtoken](https://github.com/auth0/node-jsonwebtoken) | `9.0.2` | `9.0.3` |
| [@types/jsonwebtoken](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/jsonwebtoken) | `9.0.6` | `9.0.10` |



Updates `turbo` from 2.9.14 to 2.10.10
- [Release notes](https://github.com/vercel/turborepo/releases)
- [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md)
- [Commits](vercel/turborepo@v2.9.14...v2.10.10)

Updates `@vitejs/plugin-react` from 6.0.4 to 6.0.5
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.0.5/packages/plugin-react)

Updates `esbuild` from 0.28.1 to 0.28.2
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](evanw/esbuild@v0.28.1...v0.28.2)

Updates `fast-glob` from 3.3.2 to 3.3.3
- [Release notes](https://github.com/mrmlnc/fast-glob/releases)
- [Commits](mrmlnc/fast-glob@3.3.2...3.3.3)

Updates `html-webpack-plugin` from 5.6.0 to 5.6.8
- [Release notes](https://github.com/jantimon/html-webpack-plugin/releases)
- [Changelog](https://github.com/jantimon/html-webpack-plugin/blob/main/CHANGELOG.md)
- [Commits](jantimon/html-webpack-plugin@v5.6.0...v5.6.8)

Updates `mini-css-extract-plugin` from 2.9.1 to 2.10.2
- [Release notes](https://github.com/webpack/mini-css-extract-plugin/releases)
- [Changelog](https://github.com/webpack/mini-css-extract-plugin/blob/main/CHANGELOG.md)
- [Commits](webpack/mini-css-extract-plugin@v2.9.1...v2.10.2)

Updates `rollup` from 4.52.5 to 4.62.4
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.52.5...v4.62.4)

Updates `rollup-plugin-import-css` from 4.1.1 to 4.2.1
- [Commits](https://github.com/jleeson/rollup-plugin-import-css/commits)

Updates `terser-webpack-plugin` from 5.3.14 to 5.6.1
- [Release notes](https://github.com/webpack/minimizer-webpack-plugin/releases)
- [Changelog](https://github.com/webpack/minimizer-webpack-plugin/blob/main/CHANGELOG.md)
- [Commits](webpack/minimizer-webpack-plugin@v5.3.14...v5.6.1)

Updates `@babel/plugin-proposal-import-attributes-to-assertions` from 7.27.1 to 7.29.7
- [Release notes](https://github.com/babel/babel/releases)
- [Commits](https://github.com/babel/babel/commits/v7.29.7/packages/babel-plugin-proposal-import-attributes-to-assertions)

Updates `@babel/plugin-syntax-import-attributes` from 7.27.1 to 7.29.7
- [Release notes](https://github.com/babel/babel/releases)
- [Commits](https://github.com/babel/babel/commits/v7.29.7/packages/babel-plugin-syntax-import-attributes)

Updates `css-loader` from 7.1.2 to 7.1.4
- [Release notes](https://github.com/webpack/css-loader/releases)
- [Changelog](https://github.com/webpack/css-loader/blob/main/CHANGELOG.md)
- [Commits](webpack/css-loader@v7.1.2...v7.1.4)

Updates `string-replace-loader` from 3.1.0 to 3.3.0
- [Release notes](https://github.com/Va1/string-replace-loader/releases)
- [Commits](Va1/string-replace-loader@v3.1.0...v3.3.0)

Updates `webpack` from 5.102.1 to 5.109.2
- [Release notes](https://github.com/webpack/webpack/releases)
- [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack@v5.102.1...v5.109.2)

Updates `fs-extra` from 11.2.0 to 11.4.0
- [Changelog](https://github.com/jprichardson/node-fs-extra/blob/master/CHANGELOG.md)
- [Commits](jprichardson/node-fs-extra@11.2.0...11.4.0)

Updates `@polkadot/extension-base` from 0.62.3 to 0.63.1
- [Release notes](https://github.com/polkadot-js/extension/releases)
- [Changelog](https://github.com/polkadot-js/extension/blob/master/CHANGELOG.md)
- [Commits](https://github.com/polkadot-js/extension/commits/v0.63.1/packages/extension-base)

Updates `@polkadot/extension-dapp` from 0.62.3 to 0.63.1
- [Release notes](https://github.com/polkadot-js/extension/releases)
- [Changelog](https://github.com/polkadot-js/extension/blob/master/CHANGELOG.md)
- [Commits](https://github.com/polkadot-js/extension/commits/v0.63.1/packages/extension-dapp)

Updates `@polkadot/extension-inject` from 0.62.3 to 0.63.1
- [Release notes](https://github.com/polkadot-js/extension/releases)
- [Changelog](https://github.com/polkadot-js/extension/blob/master/CHANGELOG.md)
- [Commits](https://github.com/polkadot-js/extension/commits/v0.63.1/packages/extension-inject)

Updates `@polkadot/types-codec` from 16.4.9 to 16.5.6
- [Release notes](https://github.com/polkadot-js/api/releases)
- [Changelog](https://github.com/polkadot-js/api/blob/master/CHANGELOG.md)
- [Commits](https://github.com/polkadot-js/api/commits/v16.5.6/packages/types-codec)

Updates `@polkadot-api/substrate-client` from 0.1.4 to 0.7.0
- [Release notes](https://github.com/polkadot-api/polkadot-api/releases)
- [Changelog](https://github.com/polkadot-api/polkadot-api/blob/main/NEWS.md)
- [Commits](https://github.com/polkadot-api/polkadot-api/commits/polkadot-api@0.7.0)

Updates `i18next-browser-languagedetector` from 8.0.2 to 8.2.1
- [Changelog](https://github.com/i18next/i18next-browser-languageDetector/blob/master/CHANGELOG.md)
- [Commits](i18next/i18next-browser-languageDetector@v8.0.2...v8.2.1)

Updates `i18next-fs-backend` from 2.6.6 to 2.6.7
- [Changelog](https://github.com/i18next/i18next-fs-backend/blob/master/CHANGELOG.md)
- [Commits](i18next/i18next-fs-backend@v2.6.6...v2.6.7)

Updates `i18next-http-middleware` from 3.9.7 to 3.9.8
- [Changelog](https://github.com/i18next/i18next-http-middleware/blob/master/CHANGELOG.md)
- [Commits](i18next/i18next-http-middleware@v3.9.7...v3.9.8)

Updates `i18next-resources-to-backend` from 1.2.1 to 1.2.3
- [Changelog](https://github.com/i18next/i18next-resources-to-backend/blob/main/CHANGELOG.md)
- [Commits](i18next/i18next-resources-to-backend@v1.2.1...v1.2.3)

Updates `@emotion/cache` from 11.11.0 to 11.14.0
- [Release notes](https://github.com/emotion-js/emotion/releases)
- [Changelog](https://github.com/emotion-js/emotion/blob/main/CHANGELOG.md)
- [Commits](https://github.com/emotion-js/emotion/compare/@emotion/cache@11.11.0...@emotion/cache@11.14.0)

Updates `@emotion/react` from 11.11.1 to 11.14.0
- [Release notes](https://github.com/emotion-js/emotion/releases)
- [Changelog](https://github.com/emotion-js/emotion/blob/main/CHANGELOG.md)
- [Commits](https://github.com/emotion-js/emotion/compare/@emotion/react@11.11.1...@emotion/react@11.14.0)

Updates `@emotion/styled` from 11.11.0 to 11.14.1
- [Release notes](https://github.com/emotion-js/emotion/releases)
- [Changelog](https://github.com/emotion-js/emotion/blob/main/CHANGELOG.md)
- [Commits](https://github.com/emotion-js/emotion/compare/@emotion/styled@11.11.0...@emotion/styled@11.14.1)

Updates `csstype` from 3.1.3 to 3.2.3
- [Release notes](https://github.com/frenic/csstype/releases)
- [Commits](frenic/csstype@v3.1.3...v3.2.3)

Updates `geolib` from 3.3.4 to 3.3.14
- [Release notes](https://github.com/manuelbieh/geolib/releases)
- [Changelog](https://github.com/manuelbieh/geolib/blob/master/CHANGELOG.md)
- [Commits](manuelbieh/geolib@v3.3.4...v3.3.14)

Updates `@types/pg` from 8.16.0 to 8.23.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/pg)

Updates `cors` from 2.8.5 to 2.8.6
- [Release notes](https://github.com/expressjs/cors/releases)
- [Changelog](https://github.com/expressjs/cors/blob/master/HISTORY.md)
- [Commits](expressjs/cors@v2.8.5...v2.8.6)

Updates `@types/cors` from 2.8.17 to 2.8.19
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/cors)

Updates `@polkadot/types` from 16.4.9 to 16.5.6
- [Release notes](https://github.com/polkadot-js/api/releases)
- [Changelog](https://github.com/polkadot-js/api/blob/master/CHANGELOG.md)
- [Commits](https://github.com/polkadot-js/api/commits/v16.5.6/packages/types)

Updates `@types/lodash` from 4.17.7 to 4.17.25
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/lodash)

Updates `jsonwebtoken` from 9.0.2 to 9.0.3
- [Changelog](https://github.com/auth0/node-jsonwebtoken/blob/master/CHANGELOG.md)
- [Commits](auth0/node-jsonwebtoken@v9.0.2...v9.0.3)

Updates `@types/jsonwebtoken` from 9.0.6 to 9.0.10
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/jsonwebtoken)

Updates `@types/jsonwebtoken` from 9.0.6 to 9.0.10
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/jsonwebtoken)

---
updated-dependencies:
- dependency-name: "@babel/plugin-proposal-import-attributes-to-assertions"
  dependency-version: 7.29.7
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@babel/plugin-syntax-import-attributes"
  dependency-version: 7.29.7
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@emotion/cache"
  dependency-version: 11.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@emotion/react"
  dependency-version: 11.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@emotion/styled"
  dependency-version: 11.14.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@polkadot-api/substrate-client"
  dependency-version: 0.7.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@polkadot/extension-base"
  dependency-version: 0.63.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@polkadot/extension-dapp"
  dependency-version: 0.63.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@polkadot/extension-inject"
  dependency-version: 0.63.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@polkadot/types"
  dependency-version: 16.5.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@polkadot/types-codec"
  dependency-version: 16.5.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@types/cors"
  dependency-version: 2.8.19
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@types/jsonwebtoken"
  dependency-version: 9.0.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@types/jsonwebtoken"
  dependency-version: 9.0.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@types/lodash"
  dependency-version: 4.17.25
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@types/pg"
  dependency-version: 8.21.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: cors
  dependency-version: 2.8.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: css-loader
  dependency-version: 7.1.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: csstype
  dependency-version: 3.2.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: esbuild
  dependency-version: 0.28.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: fast-glob
  dependency-version: 3.3.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: fs-extra
  dependency-version: 11.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: geolib
  dependency-version: 3.3.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: html-webpack-plugin
  dependency-version: 5.6.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: i18next-browser-languagedetector
  dependency-version: 8.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: i18next-fs-backend
  dependency-version: 2.6.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: i18next-http-middleware
  dependency-version: 3.9.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: i18next-resources-to-backend
  dependency-version: 1.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: jsonwebtoken
  dependency-version: 9.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: mini-css-extract-plugin
  dependency-version: 2.10.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: rollup
  dependency-version: 4.62.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: rollup-plugin-import-css
  dependency-version: 4.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: string-replace-loader
  dependency-version: 3.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: terser-webpack-plugin
  dependency-version: 5.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: turbo
  dependency-version: 2.10.10
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: webpack
  dependency-version: 5.109.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
…ugin-transform-object-rest-spread-8.0.1' into chore/deps-bump-2026-08-24

# Conflicts:
#	package-lock.json
…geoip2-node-7.1.0' into chore/deps-bump-2026-08-24
…1536b8cd' into chore/deps-bump-2026-08-24

# Conflicts:
#	package-lock.json
#	packages/procaptcha-bundle/package.json
#	packages/procaptcha-react/package.json
…3' into chore/deps-bump-2026-08-24

# Conflicts:
#	package-lock.json
…-actions-e5eb9817b5' into chore/deps-bump-2026-08-24

# Conflicts:
#	package-lock.json
Dependabot's react PR (#3081) bumped react/@types/react to 19 but left
react-dom/@types/react-dom on 18.3.1. Bump them to match, then rebuild
package-lock.json from the merged manifests.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VtU7Yg2wLWZeoKL35AB2h9
HughParry and others added 4 commits August 24, 2026 09:20
vite 8 takes esbuild as an optional peer and its ESBuildOptions type
extends esbuild's TransformOptions. Previously esbuild was only declared
in dev/config and reached the root node_modules by hoisting luck; after
the lockfile regeneration it nested under dev/config, so vite could no
longer resolve the peer and `platform`/`jsx` stopped type-checking in
dev/config's vite configs.

Declare it at the root so the hoist is deterministic.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VtU7Yg2wLWZeoKL35AB2h9
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VtU7Yg2wLWZeoKL35AB2h9
zod 3->4 is a breaking major that needs a source migration (z.record now
takes key and value types, .Values is gone, ZodError.errors -> .issues,
z.nativeEnum deprecated). That does not belong in a dependency roll-up,
so revert zod to 3.23.8 and leave the upgrade to its own PR.

Also rebuild package-lock.json from scratch rather than patching the
merged-then-resolved one. The incremental regeneration had de-hoisted 49
packages that main keeps at the root -- including 15 copies of zod and 5
of @emotion/react, where duplicate instances break instanceof checks and
style injection. A clean resolve needs the packages/fingerprintjs
submodule checked out, otherwise npm tries the registry and 404s.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VtU7Yg2wLWZeoKL35AB2h9
React 19 no longer renders src="" on an img; it drops the attribute so the
browser does not re-request the current page. getAttribute("src") therefore
returns null instead of "". Assert the tile still renders and carries no src.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VtU7Yg2wLWZeoKL35AB2h9
@HughParry
HughParry merged commit 68a9b41 into main Aug 24, 2026
14 checks passed
@HughParry
HughParry deleted the chore/deps-bump-2026-08-24 branch August 24, 2026 09:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant