Skip to content

chore(deps): bump the npm-deps group across 2 directories with 15 updates#3811

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/frontend/app/npm-deps-dea7427fa5
Open

chore(deps): bump the npm-deps group across 2 directories with 15 updates#3811
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/frontend/app/npm-deps-dea7427fa5

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 4, 2026

Bumps the npm-deps group with 12 updates in the /frontend/app directory:

Package From To
@sentry/react 10.49.0 10.50.0
@tanstack/react-query 5.99.0 5.100.5
@tanstack/react-query-devtools 5.99.0 5.100.5
@tanstack/react-router 1.141.0 1.168.24
@tanstack/react-router-devtools 1.141.0 1.166.13
axios 1.15.0 1.15.2
dompurify 3.4.0 3.4.2
lucide-react 1.8.0 1.11.0
posthog-js 1.369.2 1.372.1
react-hook-form 7.72.1 7.74.0
react-syntax-highlighter 15.6.1 15.6.6
uuid 13.0.0 13.0.1

Bumps the npm-deps group with 5 updates in the /frontend/docs directory:

Package From To
lucide-react 1.8.0 1.11.0
posthog-js 1.369.2 1.372.1
postcss 8.5.12 8.5.13
posthog-node 5.29.2 5.30.4
swagger-ui-react 5.32.4 5.32.5

Updates @sentry/react from 10.49.0 to 10.50.0

Release notes

Sourced from @​sentry/react's releases.

10.50.0

Important Changes

  • feat(effect): Support v4 beta (#20394)

    The @sentry/effect integration now supports Effect v4 beta, enabling Sentry instrumentation for the latest Effect framework version. Read more in the Effect SDK readme.

  • feat(hono): Add @sentry/hono/bun for Bun runtime (#20355)

    A new @sentry/hono/bun entry point adds first-class support for running Hono applications instrumented with Sentry on the Bun runtime. Read more in the Hono SDK readme.

  • feat(replay): Add replayStart/replayEnd client lifecycle hooks (#20369)

    New replayStart and replayEnd client lifecycle hooks let you react to replay session start and end events in your application.

Other Changes

  • feat(core): Emit no_parent_span client outcomes for discarded spans requiring a parent (#20350)
  • feat(deps): Bump protobufjs from 7.5.4 to 7.5.5 (#20372)
  • feat(hono): Add runtime packages as optional peer dependencies (#20423)
  • feat(opentelemetry): Add tracingChannel utility for context propagation (#20358)
  • fix(browser): Enrich graphqlClient spans for relative URLs (#20370)
  • fix(browser): Filter implausible LCP values (#20338)
  • fix(cloudflare): Use TransformStream to keep track of streams (#20452)
  • fix(console): Re-patch console in AWS Lambda runtimes (#20337)
  • fix(core): Correct GoogleGenAIIstrumentedMethod typo in type name
  • fix(core): Handle stateless MCP wrapper transport correlation (#20293)
  • fix(hono): Remove undefined from options type (#20419)
  • fix(node): Guard against null httpVersion in outgoing request span attributes (#20430)
  • fix(node-core): Pass rejection reason instead of Promise as originalException (#20366)
  • chore: Ignore claude worktrees (#20440)
  • chore: Prevent test from creating zombie process (#20392)
  • chore: Update size-limit (#20412)
  • chore(dev-deps): Bump nx from 22.5.0 to 22.6.5 (#20458)
  • chore(e2e-tests): Use tarball symlinks for E2E tests instead of verdaccio (#20386)
  • chore(lint): Remove lint warnings (#20413)
  • chore(test): Remove empty variant tests (#20443)
  • chore(tests): Use verdaccio as node process instead of docker image (#20336)
  • docs(readme): Update usage instructions for binary scripts (#20426)
  • ref(node): Vendor undici instrumentation (#20190)
  • test(aws-serverless): Ensure aws-serverless E2E tests run locally (#20441)
  • test(aws-serverless): Split npm & layer tests (#20442)
  • test(browser): Fix flaky sessions route-lifecycle test + upgrade axios (#20197)
  • test(cloudflare): Use .makeRequestAndWaitForEnvelope to wait for envelopes (#20208)

... (truncated)

Changelog

Sourced from @​sentry/react's changelog.

10.50.0

Important Changes

  • feat(effect): Support v4 beta (#20394)

    The @sentry/effect integration now supports Effect v4 beta, enabling Sentry instrumentation for the latest Effect framework version. Read more in the Effect SDK readme.

  • feat(hono): Add @sentry/hono/bun for Bun runtime (#20355)

    A new @sentry/hono/bun entry point adds first-class support for running Hono applications instrumented with Sentry on the Bun runtime. Read more in the Hono SDK readme.

  • feat(replay): Add replayStart/replayEnd client lifecycle hooks (#20369)

    New replayStart and replayEnd client lifecycle hooks let you react to replay session start and end events in your application.

Other Changes

  • feat(core): Emit no_parent_span client outcomes for discarded spans requiring a parent (#20350)
  • feat(deps): Bump protobufjs from 7.5.4 to 7.5.5 (#20372)
  • feat(hono): Add runtime packages as optional peer dependencies (#20423)
  • feat(opentelemetry): Add tracingChannel utility for context propagation (#20358)
  • fix(browser): Enrich graphqlClient spans for relative URLs (#20370)
  • fix(browser): Filter implausible LCP values (#20338)
  • fix(cloudflare): Use TransformStream to keep track of streams (#20452)
  • fix(console): Re-patch console in AWS Lambda runtimes (#20337)
  • fix(core): Correct GoogleGenAIIstrumentedMethod typo in type name
  • fix(core): Handle stateless MCP wrapper transport correlation (#20293)
  • fix(hono): Remove undefined from options type (#20419)
  • fix(node): Guard against null httpVersion in outgoing request span attributes (#20430)
  • fix(node-core): Pass rejection reason instead of Promise as originalException (#20366)
  • chore: Ignore claude worktrees (#20440)
  • chore: Prevent test from creating zombie process (#20392)
  • chore: Update size-limit (#20412)
  • chore(dev-deps): Bump nx from 22.5.0 to 22.6.5 (#20458)
  • chore(e2e-tests): Use tarball symlinks for E2E tests instead of verdaccio (#20386)
  • chore(lint): Remove lint warnings (#20413)
  • chore(test): Remove empty variant tests (#20443)
  • chore(tests): Use verdaccio as node process instead of docker image (#20336)
  • docs(readme): Update usage instructions for binary scripts (#20426)
  • ref(node): Vendor undici instrumentation (#20190)
  • test(aws-serverless): Ensure aws-serverless E2E tests run locally (#20441)
  • test(aws-serverless): Split npm & layer tests (#20442)
  • test(browser): Fix flaky sessions route-lifecycle test + upgrade axios (#20197)

... (truncated)

Commits
  • 785e756 release: 10.50.0
  • ed26a19 Merge pull request #20461 from getsentry/prepare-release/10.50.0
  • 7b584c4 meta(changelog): Update changelog for 10.50.0
  • 39740da test(cloudflare): Use .makeRequestAndWaitForEnvelope to wait for envelopes (#...
  • c741030 test(aws-serverless): Split npm & layer tests (#20442)
  • f97076d chore(dev-deps): Bump nx from 22.5.0 to 22.6.5 (#20458)
  • 4b4ac76 fix(node): Guard against null httpVersion in outgoing request span attribut...
  • 7569b10 fix(cloudflare): Use TransformStream to keep track of streams (#20452)
  • a4c9686 test(hono): Add E2E tests for middleware spans (#20451)
  • ff23846 chore: Ignore claude worktrees (#20440)
  • Additional commits viewable in compare view

Updates @tanstack/react-query from 5.99.0 to 5.100.5

Changelog

Sourced from @​tanstack/react-query's changelog.

5.100.5

Patch Changes

  • Updated dependencies [a53ef97]:
    • @​tanstack/query-core@​5.100.5

5.100.4

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.100.4

5.100.3

Patch Changes

  • fix(suspense): skip calling combine when queries would suspend (#10576)

  • Updated dependencies [f85d825]:

    • @​tanstack/query-core@​5.100.3

5.100.2

Patch Changes

5.100.1

Patch Changes

  • Updated dependencies [1bb0d23]:
    • @​tanstack/query-core@​5.100.1

5.100.0

Patch Changes

  • Updated dependencies [6540a41]:
    • @​tanstack/query-core@​5.100.0

5.99.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.99.2

... (truncated)

Commits

Updates @tanstack/react-query-devtools from 5.99.0 to 5.100.5

Changelog

Sourced from @​tanstack/react-query-devtools's changelog.

5.100.5

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.100.5
    • @​tanstack/react-query@​5.100.5

5.100.4

Patch Changes

  • fix(devtools): change onClose callback type from () => unknown to () => void (#10118)

  • Updated dependencies [3d1a62e]:

    • @​tanstack/query-devtools@​5.100.4
    • @​tanstack/react-query@​5.100.4

5.100.3

Patch Changes

  • Updated dependencies [f85d825]:
    • @​tanstack/react-query@​5.100.3
    • @​tanstack/query-devtools@​5.100.3

5.100.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.100.2
    • @​tanstack/react-query@​5.100.2

5.100.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.100.1
    • @​tanstack/react-query@​5.100.1

5.100.0

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.100.0
    • @​tanstack/react-query@​5.100.0

... (truncated)

Commits

Updates @tanstack/react-router from 1.141.0 to 1.168.24

Changelog

Sourced from @​tanstack/react-router's changelog.

1.168.24

Patch Changes

  • Add TanStack Start inline CSS manifest support for SSR so route styles can be embedded in the HTML response and hydrated without duplicate stylesheet links. (#7253)

  • Updated dependencies [4d864ee]:

    • @​tanstack/router-core@​1.168.16

1.168.23

Patch Changes

  • fix(react-router): prevent webpack static analysis of React.use with let binding (#7182)

1.168.22

Patch Changes

  • Preserve shared route stylesheet links across client navigation by rendering route CSS assets with React stylesheet precedence. (#7186)

1.168.21

Patch Changes

  • Updated dependencies [16f6892]:
    • @​tanstack/router-core@​1.168.15

1.168.20

Patch Changes

  • Fix React Server Component imports from @tanstack/react-router by adding a react-server root export that preserves the normal API surface while resolving notFound and redirect from a server-safe entry. (#7183)

    This fixes RSC routes that throw notFound() or redirect() from server functions so they behave correctly during SSR and client navigation.

1.168.19

Patch Changes

  • Fix route file transforms to preserve route ID quoting, handle more exported Route patterns, and avoid incorrect import rewrites in edge cases. (#7167)

    Improve transform robustness with clearer route-call detection, safer import removal, and expanded test coverage for quote preservation, constructor swaps, and unsupported route definitions.

1.168.18

Patch Changes

  • Updated dependencies [0e2c900]:
    • @​tanstack/router-core@​1.168.14

... (truncated)

Commits

Updates @tanstack/react-router-devtools from 1.141.0 to 1.166.13

Changelog

Sourced from @​tanstack/react-router-devtools's changelog.

1.166.13

Patch Changes

  • Updated dependencies [6355bb7]:
    • @​tanstack/router-devtools-core@​1.167.3
    • @​tanstack/react-router@​1.168.15
    • @​tanstack/router-core@​1.168.11

1.166.12

Patch Changes

  • Updated dependencies [459057c]:
    • @​tanstack/router-devtools-core@​1.167.2
    • @​tanstack/react-router@​1.168.14
    • @​tanstack/router-core@​1.168.10

1.166.11

Patch Changes

  • Updated dependencies [c9e1855]:
    • @​tanstack/router-devtools-core@​1.167.1
    • @​tanstack/react-router@​1.168.2
    • @​tanstack/router-core@​1.168.2

1.166.10

Patch Changes

  • Updated dependencies [0545239]:
    • @​tanstack/router-devtools-core@​1.167.0
    • @​tanstack/react-router@​1.168.0
    • @​tanstack/router-core@​1.168.0

1.166.9

Patch Changes

  • build: update to vite-config 5.x (rolldown) (#6926)

  • Updated dependencies [838b0eb]:

    • @​tanstack/router-devtools-core@​1.166.9
    • @​tanstack/react-router@​1.167.2
    • @​tanstack/router-core@​1.167.2

1.166.8

Patch Changes

... (truncated)

Commits

Updates axios from 1.15.0 to 1.15.2

Release notes

Sourced from axios's releases.

v1.15.2

This release delivers prototype-pollution hardening for the Node HTTP adapter, adds an opt-in allowedSocketPaths allowlist to mitigate SSRF via Unix domain sockets, fixes a keep-alive socket memory leak, and ships supply-chain hardening across CI and security docs.

🔒 Security Fixes

  • Prototype Pollution Hardening (HTTP Adapter): Hardened the Node HTTP adapter and resolveConfig/mergeConfig/validator paths to read only own properties and use null-prototype config objects, preventing polluted auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser from influencing requests. (#10779)
  • SSRF via socketPath: Rejects non-string socketPath values and adds an opt-in allowedSocketPaths config option to restrict permitted Unix domain socket paths, returning AxiosError ERR_BAD_OPTION_VALUE on mismatch. (#10777)
  • Supply-chain Hardening: Added .npmrc with ignore-scripts=true, lockfile lint CI, non-blocking reproducible build diff, scoped CODEOWNERS, expanded SECURITY.md/THREATMODEL.md with provenance verification (npm audit signatures), 60-day resolution policy, and maintainer incident-response runbook. (#10776)

🚀 New Features

  • allowedSocketPaths Config Option: New request config option (and TypeScript types) to allowlist Unix domain socket paths used by the Node http adapter; backwards compatible when unset. (#10777)

🐛 Bug Fixes

  • Keep-alive Socket Memory Leak: Installs a single per-socket error listener tracking the active request via kAxiosSocketListener/kAxiosCurrentReq, eliminating per-request listener accumulation, MaxListenersExceededWarning, and linear heap growth under concurrent or long-running keep-alive workloads (fixes #10780). (#10788)

🔧 Maintenance & Chores

  • Changelog: Updated CHANGELOG.md with v1.15.1 release notes. (#10781)

Full Changelog

v1.15.1

This release ships a coordinated set of security hardening fixes across headers, body/redirect limits, multipart handling, and XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes, test migrations, and threat-model documentation updates.

🔒 Security Fixes

  • Header Injection Hardening: Tightened validation and sanitisation across request header construction to close the header-injection attack surface. (#10749)
  • CRLF Stripping in Multipart Headers: Correctly strips CR/LF from multipart header values to prevent injection via field names and filenames. (#10758)
  • Prototype Pollution / Auth Bypass: Replaced unsafe in checks with hasOwnProperty to prevent authentication bypass via prototype pollution on config objects, with additional regression tests. (#10761, #10760)
  • withXSRFToken Truthy Bypass: Short-circuits on any truthy non-boolean value, so an ambiguous config no longer silently leaks the XSRF token cross-origin. (#10762)
  • maxBodyLength With Zero Redirects: Enforces maxBodyLength even when maxRedirects is set to 0, closing a bypass path for oversized request bodies. (#10753)
  • Streamed Response maxContentLength Bypass: Applies maxContentLength to streamed responses that previously bypassed the cap. (#10754)
  • Follow-up CVE Completion: Completes an earlier incomplete CVE fix to fully close the regression window. (#10755)

🚀 New Features

  • AI-Based Docs Translations: Initial scaffold for AI-assisted translations of the documentation site. (#10705)
  • Location Request Header Type: Adds Location to CommonRequestHeadersList for accurate typing of redirect-aware requests. (#7528)

🐛 Bug Fixes

  • FormData Handling: Removes Content-Type when no boundary is present on FormData fetch requests, supports multi-select fields, cancels request.body instead of the source stream on fetch abort, and fixes a recursion bug in form-data serialisation. (#7314, #10676, #10702, #10726)
  • HTTP Adapter: Handles socket-only request errors without leaking keep-alive listeners. (#10576)
  • Progress Events: Clamps loaded to total for computable upload/download progress events. (#7458)
  • Types: Aligns runWhen type with the runtime behaviour in InterceptorManager and makes response header keys case-insensitive. (#7529, #10677)
  • buildFullPath: Uses strict equality in the base/relative URL check. (#7252)
  • AxiosURLSearchParams Regex: Improves the regex used for param serialisation to avoid edge-case mismatches. (#10736)
  • Resilient Value Parsing: Parses out header/config values instead of throwing on malformed input. (#10687)

... (truncated)

Changelog

Sourced from axios's changelog.

v1.15.2 - April 21, 2026

This release delivers prototype-pollution hardening for the Node HTTP adapter, adds an opt-in allowedSocketPaths allowlist to mitigate SSRF via Unix domain sockets, fixes a keep-alive socket memory leak, and ships supply-chain hardening across CI and security docs.

🔒 Security Fixes

  • Prototype Pollution Hardening (HTTP Adapter): Hardened the Node HTTP adapter and resolveConfig/mergeConfig/validator paths to read only own properties and use null-prototype config objects, preventing polluted auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser from influencing requests. (#10779)
  • SSRF via socketPath: Rejects non-string socketPath values and adds an opt-in allowedSocketPaths config option to restrict permitted Unix domain socket paths, returning AxiosError ERR_BAD_OPTION_VALUE on mismatch. (#10777)
  • Supply-chain Hardening: Added .npmrc with ignore-scripts=true, lockfile lint CI, non-blocking reproducible build diff, scoped CODEOWNERS, expanded SECURITY.md/THREATMODEL.md with provenance verification (npm audit signatures), 60-day resolution policy, and maintainer incident-response runbook. (#10776)

🚀 New Features

  • allowedSocketPaths Config Option: New request config option (and TypeScript types) to allowlist Unix domain socket paths used by the Node http adapter; backwards compatible when unset. (#10777)

🐛 Bug Fixes

  • Keep-alive Socket Memory Leak: Installs a single per-socket error listener tracking the active request via kAxiosSocketListener/kAxiosCurrentReq, eliminating per-request listener accumulation, MaxListenersExceededWarning, and linear heap growth under concurrent or long-running keep-alive workloads (fixes #10780). (#10788)

🔧 Maintenance & Chores

  • Changelog: Updated CHANGELOG.md with v1.15.1 release notes. (#10781)

Full Changelog

v1.15.1 - April 19, 2026

This release ships a coordinated set of security hardening fixes across headers, body/redirect limits, multipart handling, and XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes, test migrations, and threat-model documentation updates.

🔒 Security Fixes

  • Header Injection Hardening: Tightened validation and sanitisation across request header construction to close the header-injection attack surface. (#10749)

  • CRLF Stripping in Multipart Headers: Correctly strips CR/LF from multipart header values to prevent injection via field names and filenames. (#10758)

  • Prototype Pollution / Auth Bypass: Replaced unsafe in checks with hasOwnProperty to prevent authentication bypass via prototype pollution on config objects, with additional regression tests. (#10761, #10760)

  • withXSRFToken Truthy Bypass: Short-circuits on any truthy non-boolean value, so an ambiguous config no longer silently leaks the XSRF token cross-origin. (#10762)

  • maxBodyLength With Zero Redirects: Enforces maxBodyLength even when maxRedirects is set to 0, closing a bypass path for oversized request bodies. (#10753)

  • Streamed Response maxContentLength Bypass: Applies maxContentLength to streamed responses that previously bypassed the cap. (#10754)

  • Follow-up CVE Completion: Completes an earlier incomplete CVE fix to fully close the regression window. (#10755)

🚀 New Features

  • AI-Based Docs Translations: Initial scaffold for AI-assisted translations of the documentation site. (#10705)

... (truncated)

Commits

Updates dompurify from 3.4.0 to 3.4.2

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.2

  • Fixed an issue with URI validation on attributes allowed via ADD_ATTR callback, thanks @​nelstrom
  • Fixed an issue with source maps referring to non-existing files, thanks @​cmdcolin
  • Updated existing workflows, fuzzer, release signing, etc., added more tests
  • Bumped several dependencies where possible

DOMPurify 3.4.1

  • Fixed an issue with on-handler stripping for HTML-spec-reserved custom element names (font-face, color-profile, missing-glyph, font-face-src, font-face-uri, font-face-format, font-face-name) under permissive CUSTOM_ELEMENT_HANDLING
  • Fixed a case-sensitivity gap in the annotation-xml check that allowed mixed-case variants to bypass the basic-custom-element exclusion in XHTML mode
  • Fixed SANITIZE_NAMED_PROPS repeatedly prefixing already-prefixed id and name values on subsequent sanitization
  • Fixed the IN_PLACE root-node check to explicitly guard against non-string nodeName (DOM-clobbering robustness)
  • Removed a duplicate slot entry from the default HTML attribute allow-list
  • Strengthened the fast-check fuzz harness with explicit XSS invariants, an expanded seed-payload corpus, an additional idempotence property for SANITIZE_NAMED_PROPS, and a negative-control assertion ensuring the invariants actually fire
  • Added regression and pinning tests covering the above fixes and two accepted-behavior contracts (SAFE_FOR_TEMPLATES greedy scrub, hook-added attribute handling)
  • Extended CodeQL analysis to run on 3.x and 2.x maintenance branches
Commits
Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates lucide-react from 1.8.0 to 1.11.0

Release notes

Sourced from lucide-react's releases.

Version 1.11.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.9.0...1.11.0

Version 1.10.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.9.0...1.10.0

Version 1.9.0

What's Changed

@dependabot
chore(deps): bump the npm-deps group across 2 directories with 15 upd…
23d3340 
…ates

Bumps the npm-deps group with 12 updates in the /frontend/app directory:

| Package | From | To |
| --- | --- | --- |
| [@sentry/react](https://github.com/getsentry/sentry-javascript) | `10.49.0` | `10.50.0` |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.99.0` | `5.100.5` |
| [@tanstack/react-query-devtools](https://github.com/TanStack/query/tree/HEAD/packages/react-query-devtools) | `5.99.0` | `5.100.5` |
| [@tanstack/react-router](https://github.com/TanStack/router/tree/HEAD/packages/react-router) | `1.141.0` | `1.168.24` |
| [@tanstack/react-router-devtools](https://github.com/TanStack/router/tree/HEAD/packages/react-router-devtools) | `1.141.0` | `1.166.13` |
| [axios](https://github.com/axios/axios) | `1.15.0` | `1.15.2` |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.4.0` | `3.4.2` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.8.0` | `1.11.0` |
| [posthog-js](https://github.com/PostHog/posthog-js) | `1.369.2` | `1.372.1` |
| [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.72.1` | `7.74.0` |
| [react-syntax-highlighter](https://github.com/react-syntax-highlighter/react-syntax-highlighter) | `15.6.1` | `15.6.6` |
| [uuid](https://github.com/uuidjs/uuid) | `13.0.0` | `13.0.1` |

Bumps the npm-deps group with 5 updates in the /frontend/docs directory:

| Package | From | To |
| --- | --- | --- |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.8.0` | `1.11.0` |
| [posthog-js](https://github.com/PostHog/posthog-js) | `1.369.2` | `1.372.1` |
| [postcss](https://github.com/postcss/postcss) | `8.5.12` | `8.5.13` |
| [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.29.2` | `5.30.4` |
| [swagger-ui-react](https://github.com/swagger-api/swagger-ui) | `5.32.4` | `5.32.5` |



Updates `@sentry/react` from 10.49.0 to 10.50.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.49.0...10.50.0)

Updates `@tanstack/react-query` from 5.99.0 to 5.100.5
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.100.5/packages/react-query)

Updates `@tanstack/react-query-devtools` from 5.99.0 to 5.100.5
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query-devtools/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query-devtools@5.100.5/packages/react-query-devtools)

Updates `@tanstack/react-router` from 1.141.0 to 1.168.24
- [Release notes](https://github.com/TanStack/router/releases)
- [Changelog](https://github.com/TanStack/router/blob/main/packages/react-router/CHANGELOG.md)
- [Commits](https://github.com/TanStack/router/commits/@tanstack/react-router@1.168.24/packages/react-router)

Updates `@tanstack/react-router-devtools` from 1.141.0 to 1.166.13
- [Release notes](https://github.com/TanStack/router/releases)
- [Changelog](https://github.com/TanStack/router/blob/main/packages/react-router-devtools/CHANGELOG.md)
- [Commits](https://github.com/TanStack/router/commits/@tanstack/react-router-devtools@1.166.13/packages/react-router-devtools)

Updates `axios` from 1.15.0 to 1.15.2
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.15.0...v1.15.2)

Updates `dompurify` from 3.4.0 to 3.4.2
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.0...3.4.2)

Updates `lucide-react` from 1.8.0 to 1.11.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.11.0/packages/lucide-react)

Updates `posthog-js` from 1.369.2 to 1.372.1
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.369.2...posthog-js@1.372.1)

Updates `react-hook-form` from 7.72.1 to 7.74.0
- [Release notes](https://github.com/react-hook-form/react-hook-form/releases)
- [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md)
- [Commits](react-hook-form/react-hook-form@v7.72.1...v7.74.0)

Updates `react-syntax-highlighter` from 15.6.1 to 15.6.6
- [Release notes](https://github.com/react-syntax-highlighter/react-syntax-highlighter/releases)
- [Changelog](https://github.com/react-syntax-highlighter/react-syntax-highlighter/blob/master/CHANGELOG.MD)
- [Commits](react-syntax-highlighter/react-syntax-highlighter@v15.6.1...v15.6.6)

Updates `uuid` from 13.0.0 to 13.0.1
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/v13.0.1/CHANGELOG.md)
- [Commits](uuidjs/uuid@v13.0.0...v13.0.1)

Updates `lucide-react` from 1.8.0 to 1.11.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.11.0/packages/lucide-react)

Updates `posthog-js` from 1.369.2 to 1.372.1
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.369.2...posthog-js@1.372.1)

Updates `lucide-react` from 1.8.0 to 1.11.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.11.0/packages/lucide-react)

Updates `posthog-js` from 1.369.2 to 1.372.1
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.369.2...posthog-js@1.372.1)

Updates `lucide-react` from 1.8.0 to 1.11.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.11.0/packages/lucide-react)

Updates `postcss` from 8.5.12 to 8.5.13
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.12...8.5.13)

Updates `posthog-js` from 1.369.2 to 1.372.1
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.369.2...posthog-js@1.372.1)

Updates `posthog-node` from 5.29.2 to 5.30.4
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.30.4/packages/node)

Updates `swagger-ui-react` from 5.32.4 to 5.32.5
- [Release notes](https://github.com/swagger-api/swagger-ui/releases)
- [Commits](swagger-api/swagger-ui@v5.32.4...v5.32.5)

---
updated-dependencies:
- dependency-name: "@sentry/react"
  dependency-version: 10.50.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-deps
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.100.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-deps
- dependency-name: "@tanstack/react-query-devtools"
  dependency-version: 5.100.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-deps
- dependency-name: "@tanstack/react-router"
  dependency-version: 1.168.24
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-deps
- dependency-name: "@tanstack/react-router-devtools"
  dependency-version: 1.166.13
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-deps
- dependency-name: axios
  dependency-version: 1.15.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-deps
- dependency-name: dompurify
  dependency-version: 3.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-deps
- dependency-name: lucide-react
  dependency-version: 1.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-deps
- dependency-name: posthog-js
  dependency-version: 1.372.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-deps
- dependency-name: react-hook-form
  dependency-version: 7.74.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-deps
- dependency-name: react-syntax-highlighter
  dependency-version: 15.6.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-deps
- dependency-name: uuid
  dependency-version: 13.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-deps
- dependency-name: lucide-react
  dependency-version: 1.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-deps
- dependency-name: posthog-js
  dependency-version: 1.372.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-deps
- dependency-name: lucide-react
  dependency-version: 1.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-deps
- dependency-name: posthog-js
  dependency-version: 1.372.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-deps
- dependency-name: lucide-react
  dependency-version: 1.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-deps
- dependency-name: postcss
  dependency-version: 8.5.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-deps
- dependency-name: posthog-js
  dependency-version: 1.372.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-deps
- dependency-name: posthog-node
  dependency-version: 5.30.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-deps
- dependency-name: swagger-ui-react
  dependency-version: 5.32.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 4, 2026
@vercel
Copy link
Copy Markdown

vercel Bot commented May 4, 2026 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
hatchet-docs Ready Ready Preview, Comment May 4, 2026 5:09am

Request Review

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants