Skip to content

Bump the npm-minor-and-patch group across 1 directory with 14 updates - #3595

Closed
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/npm_and_yarn/npm-minor-and-patch-0344fc64e1
Closed

Bump the npm-minor-and-patch group across 1 directory with 14 updates#3595
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/npm_and_yarn/npm-minor-and-patch-0344fc64e1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-minor-and-patch group with 14 updates in the / directory:

Package From To
@vitest/spy 5.0.4 5.0.5
rollup 4.64.6 4.64.7
webpack 5.111.1 5.112.0
zod 3.23.8 3.25.76
undici 8.12.0 8.12.2
dotenv 18.0.7 18.0.8
express 4.22.2 4.22.3
i18next 26.4.4 26.4.7
i18next-fs-backend 2.6.8 2.6.9
@vitest/browser-playwright 5.0.4 5.0.5
playwright 1.64.0 1.64.1
react 19.3.0 19.3.1
react-dom 19.3.0 19.3.1
cypress 16.1.1 16.2.0

Updates @vitest/spy from 5.0.4 to 5.0.5

Release notes

Sourced from @​vitest/spy's releases.

v5.0.5

   🐞 Bug Fixes

    View changes on GitHub
Commits

Updates rollup from 4.64.6 to 4.64.7

Release notes

Sourced from rollup's releases.

v4.64.7

4.64.7

2026-10-15

Bug Fixes

  • Fix an issue where watching not-yet-created files from plugins did not work if several shared a directory (#6575)

Pull Requests

Changelog

Sourced from rollup's changelog.

4.64.7

2026-10-15

Bug Fixes

  • Fix an issue where watching not-yet-created files from plugins did not work if several shared a directory (#6575)

Pull Requests

Commits

Updates webpack from 5.111.1 to 5.112.0

Release notes

Sourced from webpack's releases.

v5.112.0

Minor Changes

... (truncated)

Changelog

Sourced from webpack's changelog.

5.112.0

Minor Changes

... (truncated)

Commits
  • 755c49e chore(release): new release (#22170)
  • 35b066f feat(javascript): fold switches, PURE IIFEs, null tests, Babel helpers and pr...
  • edea0f5 refactor(css,html): give the ASCII helpers one Infra name in both parsers (#2...
  • 916cf37 fix(css): keep a rule nested under a selector opening on a combinator when lo...
  • 2ebe482 ci: pin Chrome and Firefox to the builds puppeteer-core names (#22703)
  • ed18fa1 fix(css): reach for no newer spelling where a target browser is one the data ...
  • 26d315a refactor: ask the dependency and module kind instead of flags and type string...
  • 3020447 refactor(cache): normalize build dependencies once (#22704)
  • 9b5fab7 fix(deps): bump the dependencies group with 4 updates (#22683)
  • b46763e feat: apply top-level plugins of a multi-configuration to the MultiCompiler (...
  • Additional commits viewable in compare view

Updates zod from 3.23.8 to 3.25.76

Release notes

Sourced from zod's releases.

v3.25.76

Commits:

  • 91c9ca6385bef38278605294498af06c89b9aa68 fix: cleanup _idmap of $ZodRegistry (#4837)
  • 9cce1c5779aea32d00226a931a7f67d3e2529d58 docs: fix typo in flattenError example on error-formatting page (#4819) (#4833)
  • a3560aeb6c3a8675a932601be79cfae897eec9d9 v3.25.76 (#4838)
  • 50606616c0d291caf3210a7521da51271b918333 Release 3.25.76
  • 7baee4e17f86f4017e09e12b0acdee36a5b1c087 Update index.mdx (#4831)

v3.25.75

Commits:

  • c5f349b6c4e76f879eba9fd350dd79950fcb02f9 Fix z.undefined() behavior in toJSONSchema

v3.25.74

Commits:

  • ae0dbe1f79b2421f6d91ec0796295763436b26e2 Partial record
  • 39c5f71c92b9c4c39fc0a59b9375204fa140eaf0 3.25.74

v3.25.73

Commits:

  • 1021d3c230d41d600698a6d98b9db86c19f56904 v3.25.73 (#4822)

v3.25.72

Commits:

  • 4a4dac7cfb787162eeb79165d39bbb4830d4a6de Warn about id uniqueness check on Metadata page (#4782)
  • 7a5838dc0da967e15a217bf5abdd81f725da46c4 feat(locale): Add Esperanto (eo) locale (#4743)
  • 36fe14e1472f2a7cd71415841be8832fc4e9acc5 Fix optionality of schemas (#4769)
  • 20c8c4b67b508d653012808f69c43c7cfe5b39e3 Fix re-export bug
  • 8b0df10c8757a5fbd75bd65128ae183d764b3304 3.25.72

v3.25.71

Commits:

  • 66a0f34bfc746acddbfb68426b8b1b3f1d3d1727 Move source to /src (#4808)
  • 2a15f44606fd66335c6ebc1f91d702bb6bc95693 3.25.71

v3.25.70

Commits:

  • bd81c7cfaa03f61365d1c708c7e0f1cac54ea9ca Add ecosystem listing to homepage
  • 1ddb9719564e644722852193930a09d54f720443 Add Mobb to sponsors
  • 30ba440859f5b9184817f578626ff85d484aec27 Clean up ecosystem.mdx
  • 0ef1b85b5923a1a06a2afab47dbad249d105a997 Add svelte-jsonschema-form to form integrations (#4784)
  • 14715f147363e88e73190bb6ddbdf008914f0b19 docs: fix Lambda spelling (#4804)
  • f6da030188ea30defc025bbc672e5a81fbe93078 Add back src (#4806)
  • 364200a67c9f74ef252dbfa65ea93aab8fb15c06 Revert "Add back src (#4806)"

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by colinhacks, a new releaser for zod since your current version.


Updates undici from 8.12.0 to 8.12.2

Release notes

Sourced from undici's releases.

v8.12.2

Security fixes

High severity

Denial of service via TLS 1.2 certificate-changing renegotiation

CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm

A malicious or compromised HTTPS server could crash the Node.js process by initiating TLS 1.2 renegotiation and presenting a different, CA-trusted certificate whose hostname did not match the requested host. The resulting socket error reached an assertion in undici's HTTP/1.1 and HTTP/2 connection handling. This release handles post-connect certificate errors without terminating the process.

TLS certificate validation bypass through dropped Agent options

CVE-2026-109383 · GHSA-2m5v-pch6-74hx

Agent used a JSON-based clone for constructor options, which silently removed function-valued TLS options such as checkServerIdentity. Applications relying on custom certificate or public-key verification could therefore accept a certificate that the callback was intended to reject. This release preserves TLS options when creating per-origin dispatchers.

Cache poisoning and cross-user disclosure through cross-origin redirects

CVE-2026-109829 · GHSA-4w7w-5xrc-9h26

When an originless Agent combined redirect and shared-cache interceptors as compose(redirect(), cache()), a response from a cross-origin redirect could be stored under the original URL. This could allow persistent cache poisoning or disclosure of user-specific responses to later callers. This release verifies the response origin before caching and preserves redirect-hop cache-control policy.

Denial of service through excessive Content-Encoding values

CVE-2026-109869 · GHSA-xjj6-f33q-929c

A malicious HTTP server could crash the Node.js process by returning more than five content codings and closing the connection before sending the body. Although fetch() rejected the response, an error from an orphaned internal stream could remain unhandled. This release validates the content-encoding chain before creating the body stream and aborts oversized chains safely.

Medium severity

Denial of service through the decompress interceptor

CVE-2026-87029 · GHSA-55wc-3pg8-jfw6

An exception thrown by a downstream response handler from an asynchronous decompression callback could escape as an uncaught exception. A server could trigger this when decompress was composed with a handler such as dump with a size limit. This release converts downstream handler exceptions into per-request errors.

Subresource Integrity bypass with non-lowercase algorithm tokens

CVE-2026-109841 · GHSA-f72v-6w45-q472

fetch() treated valid mixed-case or uppercase SRI algorithm tokens, such as SHA256, as unknown and could accept a response whose body did not match the configured digest. This release normalizes algorithm tokens before validation and digest selection.

Denial of service through unbounded EventSource parser state

CVE-2026-109924 · GHSA-4qv8-2p9j-2685

A malicious Server-Sent Events endpoint could exhaust process memory by sending many tiny data: fields without completing an event, or by splitting an unfinished line across many chunks. This release bounds retained EventSource parser state, including field counts, buffered chunks, unfinished-line length, and retained field data.

... (truncated)

Commits
  • bb6cc0a Bumped v8.12.2 (#6021)
  • b217373 fix(websocket): bound automatic PONG writes under backpressure
  • 789ef26 fix(eventsource): bound retained SSE parser state
  • 4f7ef68 fix(sri): accept non-lowercase algorithm tokens
  • f851f31 fix(decompress): converge downstream handler throws to per-request errors
  • b5084c7 fix(fetch): abort excessive content encoding responses
  • 26c2bfb fix(cache): prevent cross-origin redirect cache confusion
  • f75eac0 fix: preserve Agent connection options
  • e257e9f fix: handle post-connect TLS certificate errors
  • a65ec32 Bumped v8.12.1 (#6010)
  • Additional commits viewable in compare view

Updates dotenv from 18.0.7 to 18.0.8

Changelog

Sourced from dotenv's changelog.

18.0.8 (2026-10-14)

Changed

  • Fast parser should strip appended extra quotes (#1073)
  • Type detail improvement (#1074)
Commits
  • e2fe95e 18.0.8
  • 7aa712a type detail improvement
  • 53405b0 Merge pull request #1074 from himanshu748/codex/fix-dotenv-populate-undefined...
  • 0b4843a changelog
  • 55855ab Merge pull request #1073 from xiehuanyi/fix/unicode-unquoting-parity
  • f757811 fix(types): allow undefined values in populate output
  • fde5db2 Keep fast-parser unquoting consistent at Unicode line boundaries
  • See full diff in compare view

Updates express from 4.22.2 to 4.22.3

Changelog

Sourced from express's changelog.

4.22.3

  • Allow conditional revalidation for QUERY requests
    • req.fresh now includes QUERY in the freshness check, so QUERY responses can return 304 when a validator matches
  • deps: qs@~6.16.0
Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express since your current version.


Updates i18next from 26.4.4 to 26.4.7

Release notes

Sourced from i18next's releases.

v26.4.7

  • perf: cloneInstance() no longer inherits preload. loadResources() adds every preload language to each load, and clones copied preload from the parent, so a clone's init() and every changeLanguage() walked all preloaded languages × all namespaces through queueLoad() / hasResourceBundle(), although the parent had already loaded them into the shared store. With i18next-http-middleware (one clone + changeLanguage() per request), 25 preloaded languages and 20 namespaces, that was most of the per-request CPU: the reproduction from the issue went from ~90 µs to ~10 µs per request, the same as with a single language. A clone now only loads what it uses itself: its changeLanguage() no longer waits for parent preload languages that are still loading (the parent's own init() still does), and clone.loadNamespaces() loads the new namespace for the clone's language and fallbacks instead of every preloaded language. clone.loadLanguages() works as before, the parent instance is unchanged, and passing preload to cloneInstance() keeps the old behavior. Thanks @​theMostCuriousHomunculus for the detailed report (#2451).

v26.4.6

  • fix: a fallback language whose formatted code is already in the hierarchy is no longer added a second time. toResolveHierarchy() checked the raw fallbackLng value against the list, but the list holds formatted codes, so any fallback written differently from its formatted form slipped through: lng: 'de-CH' with fallbackLng: 'de-ch' gave languages ['de-CH', 'de', 'de-CH'], and the same happened with fallbackLng: 'EN' + cleanCode, lowerCaseLng, and Intl aliases (iw-IL → he-IL). Missing keys were looked up in the same language twice. Only exact duplicates are removed; the order is unchanged. Thanks @​lprnmns (#2450).

v26.4.5

  • fix: hasLoadedNamespace(ns, { lng }) no longer stays false forever when the passed in lng is loaded under another code, or not at all. It checked the load state of the raw lng, but loadLanguages() stores a language under its resolved code (de-ch → de-CH, de-CH → de with load: 'languageOnly') and skips a lng outside supportedLngs entirely (only the fallback gets loaded), so that state never got set. react-i18next's useTranslation(ns, { lng }) then never became ready: with useSuspense it kept throwing an already resolved promise and React retried forever (100% CPU, SSR never finished), without it the load effect re-rendered in a loop. It now checks the code the language is actually loaded under, and for a lng outside supportedLngs only waits for the fallback, which is also what t() resolves to. Calls without lng and the precheck (react-i18next's bindI18n: 'languageChanging') are unchanged (react-i18next#1934).
Changelog

Sourced from i18next's changelog.

26.4.7

  • perf: cloneInstance() no longer inherits preload. loadResources() adds every preload language to each load, and clones copied preload from the parent, so a clone's init() and every changeLanguage() walked all preloaded languages × all namespaces through queueLoad() / hasResourceBundle(), although the parent had already loaded them into the shared store. With i18next-http-middleware (one clone + changeLanguage() per request), 25 preloaded languages and 20 namespaces, that was most of the per-request CPU: the reproduction from the issue went from ~90 µs to ~10 µs per request, the same as with a single language. A clone now only loads what it uses itself: its changeLanguage() no longer waits for parent preload languages that are still loading (the parent's own init() still does), and clone.loadNamespaces() loads the new namespace for the clone's language and fallbacks instead of every preloaded language. clone.loadLanguages() works as before, the parent instance is unchanged, and passing preload to cloneInstance() keeps the old behavior. Thanks @​theMostCuriousHomunculus for the detailed report (#2451).

26.4.6

  • fix: a fallback language whose formatted code is already in the hierarchy is no longer added a second time. toResolveHierarchy() checked the raw fallbackLng value against the list, but the list holds formatted codes, so any fallback written differently from its formatted form slipped through: lng: 'de-CH' with fallbackLng: 'de-ch' gave languages ['de-CH', 'de', 'de-CH'], and the same happened with fallbackLng: 'EN' + cleanCode, lowerCaseLng, and Intl aliases (iw-IL → he-IL). Missing keys were looked up in the same language twice. Only exact duplicates are removed; the order is unchanged. Thanks @​lprnmns (#2450).

26.4.5

  • fix: hasLoadedNamespace(ns, { lng }) no longer stays false forever when the passed in lng is loaded under another code, or not at all. It checked the load state of the raw lng, but loadLanguages() stores a language under its resolved code (de-ch → de-CH, de-CH → de with load: 'languageOnly') and skips a lng outside supportedLngs entirely (only the fallback gets loaded), so that state never got set. react-i18next's useTranslation(ns, { lng }) then never became ready: with useSuspense it kept throwing an already resolved promise and React retried forever (100% CPU, SSR never finished), without it the load effect re-rendered in a loop. It now checks the code the language is actually loaded under, and for a lng outside supportedLngs only waits for the fallback, which is also what t() resolves to. Calls without lng and the precheck (react-i18next's bindI18n: 'languageChanging') are unchanged (react-i18next#1934).
Commits

Updates i18next-fs-backend from 2.6.8 to 2.6.9

Changelog

Sourced from i18next-fs-backend's changelog.

2.6.9

  • security (defence-in-depth): interpolatePath now refuses a path whose root differs from the template's root. The per-value checks only looked at each lng / ns on its own, so with a loadPath / addPath template that starts with the placeholder, a value could change what kind of path the result is: ns /etc/foo made {{ns}}/{{lng}}.json absolute (/etc/foo/en.json), lng C: did the same on Windows (C:/...), and ns /host/share after a leading / (or //host/share at the start) became a Windows UNC path to another machine. Reachable when lng / ns come from the request, e.g. via i18next-http-middleware. The default /locales/{{lng}}/{{ns}}.json, join(__dirname, ...) templates, and nested namespaces such as a/b are not affected. Same class as i18next-http-backend's GHSA-9jhj-wvmw-cfx5. The README's security section is updated to match.
Commits

Updates @vitest/browser-playwright from 5.0.4 to 5.0.5

Release notes

Sourced from @​vitest/browser-playwright's releases.

v5.0.5

   🐞 Bug Fixes

    View changes on GitHub
Commits

Updates playwright from 1.64.0 to 1.64.1

Release notes

Sourced from playwright's releases.

v1.64.1

Bug Fixes

  • #43247 [Bug]: _electron.launch intermittently loses a packaged app's first window since 1.64.0
  • #43242 [Regression]: Chromium 155+ aborts a preflighted cross-origin redirect whenever any route is registered (net::ERR_ABORTED)
Commits
  • cfe490d cherry-pick(#43353): docs: release notes for v1.64 Python
  • 866cbb8 chore: mark v1.64.1 (#43354)
  • 1b29247 cherry-pick(#43250): fix(electron): do not drop windows that have not navigat...
  • 632d976 cherry-pick(#43249): fix(chromium): disable AvoidCorsURLLoaderRestartOnRedirect
  • 824d0c5 cherry-pick(#43217): chore(dotnet): fix async suffix of optional-arg overload...
  • See full diff in compare view

Updates react from 19.3.0 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

Commits

Updates react-dom from 19.3.0 to 19.3.1

Release notes

Sourced from react-dom's releases.

19.3.1 (October 14th, 2026)

React Server Components

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Oct 23, 2026
@dependabot
Bump the npm-minor-and-patch group across 1 directory with 14 updates
953a1fb 
Bumps the npm-minor-and-patch group with 14 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@vitest/spy](https://github.com/vitest-dev/vitest/tree/HEAD/packages/spy) | `5.0.4` | `5.0.5` |
| [rollup](https://github.com/rollup/rollup) | `4.64.6` | `4.64.7` |
| [webpack](https://github.com/webpack/webpack) | `5.111.1` | `5.112.0` |
| [zod](https://github.com/colinhacks/zod) | `3.23.8` | `3.25.76` |
| [undici](https://github.com/nodejs/undici) | `8.12.0` | `8.12.2` |
| [dotenv](https://github.com/motdotla/dotenv) | `18.0.7` | `18.0.8` |
| [express](https://github.com/expressjs/express) | `4.22.2` | `4.22.3` |
| [i18next](https://github.com/i18next/i18next) | `26.4.4` | `26.4.7` |
| [i18next-fs-backend](https://github.com/i18next/i18next-fs-backend) | `2.6.8` | `2.6.9` |
| [@vitest/browser-playwright](https://github.com/vitest-dev/vitest/tree/HEAD/packages/browser-playwright) | `5.0.4` | `5.0.5` |
| [playwright](https://github.com/microsoft/playwright) | `1.64.0` | `1.64.1` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.3.0` | `19.3.1` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.3.0` | `19.3.1` |
| [cypress](https://github.com/cypress-io/cypress) | `16.1.1` | `16.2.0` |



Updates `@vitest/spy` from 5.0.4 to 5.0.5
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/spy)

Updates `rollup` from 4.64.6 to 4.64.7
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.64.6...v4.64.7)

Updates `webpack` from 5.111.1 to 5.112.0
- [Release notes](https://github.com/webpack/webpack/releases)
- [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack@v5.111.1...v5.112.0)

Updates `zod` from 3.23.8 to 3.25.76
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v3.23.8...v3.25.76)

Updates `undici` from 8.12.0 to 8.12.2
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v8.12.0...v8.12.2)

Updates `dotenv` from 18.0.7 to 18.0.8
- [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md)
- [Commits](motdotla/dotenv@v18.0.7...v18.0.8)

Updates `express` from 4.22.2 to 4.22.3
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/v4.22.3/History.md)
- [Commits](expressjs/express@v4.22.2...v4.22.3)

Updates `i18next` from 26.4.4 to 26.4.7
- [Release notes](https://github.com/i18next/i18next/releases)
- [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/i18next@v26.4.4...v26.4.7)

Updates `i18next-fs-backend` from 2.6.8 to 2.6.9
- [Changelog](https://github.com/i18next/i18next-fs-backend/blob/master/CHANGELOG.md)
- [Commits](i18next/i18next-fs-backend@v2.6.8...v2.6.9)

Updates `@vitest/browser-playwright` from 5.0.4 to 5.0.5
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/browser-playwright)

Updates `playwright` from 1.64.0 to 1.64.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.64.0...v1.64.1)

Updates `react` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react)

Updates `react-dom` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom)

Updates `cypress` from 16.1.1 to 16.2.0
- [Release notes](https://github.com/cypress-io/cypress/releases)
- [Changelog](https://github.com/cypress-io/cypress/blob/develop/CHANGELOG.md)
- [Commits](cypress-io/cypress@v16.1.1...v16.2.0)

---
updated-dependencies:
- dependency-name: "@vitest/browser-playwright"
  dependency-version: 5.0.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@vitest/spy"
  dependency-version: 5.0.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: cypress
  dependency-version: 16.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: dotenv
  dependency-version: 18.0.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: express
  dependency-version: 4.22.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: i18next
  dependency-version: 26.4.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: i18next-fs-backend
  dependency-version: 2.6.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: playwright
  dependency-version: 1.64.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: react
  dependency-version: 19.3.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: react-dom
  dependency-version: 19.3.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: rollup
  dependency-version: 4.64.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: undici
  dependency-version: 8.12.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: webpack
  dependency-version: 5.112.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: zod
  dependency-version: 3.25.76
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-minor-and-patch-0344fc64e1 branch from 8c2b202 to 953a1fb Compare October 23, 2026 15:41
@dependabot @github

dependabot Bot commented on behalf of github Oct 24, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 24, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm-minor-and-patch-0344fc64e1 branch October 24, 2026 00:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@forgetso forgetso Awaiting requested review from forgetso forgetso is a code owner
@goastler goastler Awaiting requested review from goastler goastler is a code owner
@HughParry HughParry Awaiting requested review from HughParry HughParry is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants