build(deps): bump the production-dependencies group across 1 directory with 12 updates by dependabot[bot] · Pull Request #136 · LilithGames/a2wave

dependabot · 2026-10-23T15:48:27Z

Bumps the production-dependencies group with 12 updates in the / directory:

Package	From	To
@hono/node-server	`2.1.4`	`2.1.5`
@larksuiteoapi/node-sdk	`1.75.0`	`1.76.0`
marked	`18.1.0`	`18.1.1`
sanitize-html	`2.18.0`	`2.18.1`
undici	`7.30.0`	`7.30.1`
@codemirror/autocomplete	`6.20.3`	`6.20.4`
@codemirror/view	`6.43.14`	`6.43.15`
@hookform/resolvers	`5.9.1`	`5.9.2`
@tanstack/react-query	`5.104.2`	`5.104.5`
antd	`6.6.6`	`6.6.7`
react	`19.3.0`	`19.3.1`
react-dom	`19.3.0`	`19.3.1`

Updates @hono/node-server from 2.1.4 to 2.1.5

Release notes

Sourced from @hono/node-server's releases.

v2.1.5

What's Changed

fix(listener): abort the request signal when an HTTP/2 client resets the stream by @affanmomin in honojs/node-server#404

fix(serve-static): only serve GET and HEAD requests by @usualoma in honojs/node-server#405

New Contributors

@affanmomin made their first contribution in honojs/node-server#404

Full Changelog: honojs/node-server@v2.1.4...v2.1.5

Commits

4b47a0d 2.1.5
e77824a fix(serve-static): only serve GET and HEAD requests (#405)
1b6e6bf fix(listener): abort the request signal when an HTTP/2 client resets the stre...
See full diff in compare view

Updates @larksuiteoapi/node-sdk from 1.75.0 to 1.76.0

Commits

See full diff in compare view

Updates marked from 18.1.0 to 18.1.1

Release notes

Sourced from marked's releases.

v18.1.1

18.1.1 (2026-10-12)

Bug Fixes

cli: honor an explicitly empty string input (#4113) (ec3a4e5)

end blockquote before a lazy line after a heading, hr or html block (#4115) (9e64a6a)

keep a backslash in a code span from hiding emphasis (#4117) (6a57018)

keep a decoded character reference from forming a new one (#4111) (6bbac0c), closes #38 #112

let indented and type 3-5 html blocks interrupt a paragraph (#4124) (eaa1fff)

make walkTokens linear by appending values in place (#4121) (627d9ae), closes #4120

match pre, script, style and textarea as whole tag names (#4114) (0db74cb)

preserve enclosing link state after parsing images (#4123) (cc07bb9)

respect tab stops in list continuation indentation (#4119) (4bd2528)

Performance Improvements

avoid repeated raw string copies in nested lists (#4082) (7e8754d)

Commits

cdbdc01 chore(release): 18.1.1 [skip ci]
2134976 docs: add AGENTS.md (#4125)
699a969 chore(deps-dev): bump handlebars from 4.7.9 to 4.7.10 (#4133)
6a57018 fix: keep a backslash in a code span from hiding emphasis (#4117)
eaa1fff fix: let indented and type 3-5 html blocks interrupt a paragraph (#4124)
7e8754d perf: avoid repeated raw string copies in nested lists (#4082)
cc07bb9 fix: preserve enclosing link state after parsing images (#4123)
627d9ae fix: make walkTokens linear by appending values in place (#4121)
4bd2528 fix: respect tab stops in list continuation indentation (#4119)
9e64a6a fix: end blockquote before a lazy line after a heading, hr or html block (#4115)
Additional commits viewable in compare view

Updates sanitize-html from 2.18.0 to 2.18.1

Changelog

Sourced from sanitize-html's changelog.

2.18.1 (2026-10-14)

Changes

Remove the deepmerge dependency, which was used only to combine tag-specific and * (all tags) entries in allowedClasses and allowedStyles. That is now done by a few lines of code within sanitize-html.

This is not a fix for a vulnerability in sanitize-html. Security scanners such as Snyk now report CVE-2026-93753 in deepmerge, which can affect applications that merge untrusted objects, such as parsed JSON request bodies. sanitize-html only ever merged the developer's own configuration, never anything taken from the HTML being sanitized, so it was not exploitable through sanitize-html. Since we needed only a small part of what deepmerge does, we removed the dependency so that these reports no longer appear for sanitize-html users.

Security

Since 2.18.0, the fallback markup of a discarded <iframe> was re-sanitized by a recursive call with no limit, one level per nested unclosed <iframe>. A few kilobytes of crafted input could throw RangeError: Maximum call stack size exceeded with the default options, and the nestingLimit option was not enforced across the fallback because each nested call started counting from zero. The fallback of a discarded <iframe> is still sanitized and kept, but only up to eight nested <iframe> elements (deeper fallback is escaped as text, as before 2.18.0), and the current nesting depth now carries into the nested call so nestingLimit applies to the whole output. Only 2.18.0 was affected, and the exception is thrown synchronously, so applications that catch errors from sanitizeHtml only lost the affected request (CWE-674, GHSA-c9rx-x947-fp3h).

Thanks to hkmj19, JohnBeckley, and amikhailovstiltsoft for reporting the vulnerability.

Commits

a48dd9f Latest release q4 m1 2026: changelog, package.json (#5667)
06e4b37 Latest reconciliation q4 m1 2026 (#5664)
See full diff in compare view

Updates undici from 7.30.0 to 7.30.1

Release notes

Sourced from undici's releases.

v7.30.1

Security fixes

High severity

Denial of service via TLS 1.2 certificate-changing renegotiation

CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm

A malicious or compromised HTTPS server could crash the Node.js process by initiating TLS 1.2 renegotiation and presenting a different, CA-trusted certificate whose hostname did not match the requested host. The resulting socket error reached an assertion in undici's HTTP/1.1 and HTTP/2 connection handling. This release handles post-connect certificate errors without terminating the process.

TLS certificate validation bypass through dropped Agent options

CVE-2026-109383 · GHSA-2m5v-pch6-74hx

Agent used a JSON-based clone for constructor options, which silently removed function-valued TLS options such as checkServerIdentity. Applications relying on custom certificate or public-key verification could therefore accept a certificate that the callback was intended to reject. This release preserves TLS options when creating per-origin dispatchers.

Cache poisoning and cross-user disclosure through cross-origin redirects

CVE-2026-109829 · GHSA-4w7w-5xrc-9h26

When an originless Agent combined redirect and shared-cache interceptors as compose(redirect(), cache()), a response from a cross-origin redirect could be stored under the original URL. This could allow persistent cache poisoning or disclosure of user-specific responses to later callers. This release verifies the response origin before caching and preserves redirect-hop cache-control policy.

Denial of service through excessive Content-Encoding values

CVE-2026-109869 · GHSA-xjj6-f33q-929c

A malicious HTTP server could crash the Node.js process by returning more than five content codings and closing the connection before sending the body. Although fetch() rejected the response, an error from an orphaned internal stream could remain unhandled. This release validates the content-encoding chain before creating the body stream and aborts oversized chains safely.

Medium severity

Denial of service through the decompress interceptor

CVE-2026-87029 · GHSA-55wc-3pg8-jfw6

An exception thrown by a downstream response handler from an asynchronous decompression callback could escape as an uncaught exception. A server could trigger this when decompress was composed with a handler such as dump with a size limit. This release converts downstream handler exceptions into per-request errors.

Subresource Integrity bypass with non-lowercase algorithm tokens

CVE-2026-109841 · GHSA-f72v-6w45-q472

fetch() treated valid mixed-case or uppercase SRI algorithm tokens, such as SHA256, as unknown and could accept a response whose body did not match the configured digest. This release normalizes algorithm tokens before validation and digest selection.

Denial of service through unbounded EventSource parser state

CVE-2026-109924 · GHSA-4qv8-2p9j-2685

A malicious Server-Sent Events endpoint could exhaust process memory by sending many tiny data: fields without completing an event, or by splitting an unfinished line across many chunks. This release bounds retained EventSource parser state, including field counts, buffered chunks, unfinished-line length, and retained field data.

Denial of service through unbounded automatic WebSocket PONG buffering

... (truncated)

Commits

7507102 Bumped v7.30.1 (#6022)
7d60c7b [v7.x] fix(cookies): backport #5663, #5808 and #5832 (#6019)
0227d5d fix: avoid unbounded recursion in Set-Cookie attribute parser (#5757) (#5997)
5394462 fix(websocket): bound automatic PONG writes under backpressure
2991627 fix(eventsource): bound retained SSE parser state
18bc8a1 fix(sri): accept non-lowercase algorithm tokens
63cba77 fix(decompress): converge downstream handler throws to per-request errors
07ded49 fix(fetch): abort excessive content encoding responses
b20b82a fix(cache): prevent cross-origin redirect cache confusion
04cb74b fix: preserve Agent connection options
Additional commits viewable in compare view

Updates @codemirror/autocomplete from 6.20.3 to 6.20.4

Commits

See full diff in compare view

Updates @codemirror/view from 6.43.14 to 6.43.15

Commits

See full diff in compare view

Updates @hookform/resolvers from 5.9.1 to 5.9.2

Release notes

Sourced from @hookform/resolvers's releases.

v5.9.2

5.9.2 (2026-10-17)

Bug Fixes

ajv: preserve escaped field names in validation errors (#879) (71e6052)

Commits

71e6052 fix(ajv): preserve escaped field names in validation errors (#879)
8d088d4 chore(deps): bump ata-validator to ^1.23.0 (#877)
See full diff in compare view

Updates @tanstack/react-query from 5.104.2 to 5.104.5

Release notes

Sourced from @tanstack/react-query's releases.

@tanstack/react-query-devtools@5.104.5

Patch Changes

Updated dependencies [1f8d134]:

@tanstack/react-query@5.104.5

@tanstack/query-devtools@5.104.5

@tanstack/react-query-next-experimental@5.104.5

Patch Changes

Updated dependencies [1f8d134]:

@tanstack/react-query@5.104.5

@tanstack/react-query-persist-client@5.104.5

Patch Changes

Updated dependencies [1f8d134]:

@tanstack/react-query@5.104.5

@tanstack/query-persist-client-core@5.104.5

@tanstack/react-query@5.104.5

Patch Changes

#12117 1f8d134 - Recompute useMutationState and useIsMutating results when their filters, selector, or query client change, without waiting for a mutation cache update.

Updated dependencies [f608f93]:

@tanstack/query-core@5.104.5

@tanstack/react-query-devtools@5.104.4

Patch Changes

#11722 0992a92 - fix(react-query-devtools): create the devtools instance only once instead of on every render

#11728 a108398 - fix(react-query*): declare '@types/react' as an optional peer dependency

Updated dependencies [c8f5eac, c208861, b61abc2, a108398]:

@tanstack/query-devtools@5.104.4

@tanstack/react-query@5.104.4

@tanstack/react-query-next-experimental@5.104.4

Patch Changes

#11728 a108398 - fix(react-query*): declare '@types/react' as an optional peer dependency

Updated dependencies [c208861, a108398]:

@tanstack/react-query@5.104.4

@tanstack/react-query-persist-client@5.104.4

Patch Changes

#11728 a108398 - fix(react-query*): declare '@types/react' as an optional peer dependency

Updated dependencies [c208861, a108398]:

@tanstack/react-query@5.104.4

... (truncated)

Changelog

Sourced from @tanstack/react-query's changelog.

5.104.5

Patch Changes

#12117 1f8d134 - Recompute useMutationState and useIsMutating results when their filters, selector, or query client change, without waiting for a mutation cache update.

Updated dependencies [f608f93]:

@tanstack/query-core@5.104.5

5.104.4

Patch Changes

#11328 c208861 - Allow queries with falsy errors to retry on mount when throwOnError returns false.

#11728 a108398 - fix(react-query*): declare '@types/react' as an optional peer dependency

Updated dependencies [1fee044, fce89dd]:

@tanstack/query-core@5.104.4

5.104.3

Patch Changes

Updated dependencies [0f15bc9]:

@tanstack/query-core@5.104.3

Commits

a8ecc8d ci: Version Packages (#12128)
1f8d134 fix(react, preact): recompute mutation state snapshots (#12117)
1219972 ci: Version Packages (#12062)
1fee044 fix(query-core): clear mutations before notifying subscribers (#11470)
c208861 fix(react-query): retry queries with falsy errors on mount (#11328)
a108398 fix(react-query*): declare '@types/react' as an optional peer dependency (#11...
ee47993 ci: Version Packages (#11998)
0f15bc9 fix(query-core): preserve union narrowing in setQueryData updaters (#11935)
See full diff in compare view

Updates antd from 6.6.6 to 6.6.7

Changelog

Sourced from antd's changelog.

6.6.7

2026-10-20

🐞 Fix antd failing to load in some production builds when the React version export is unavailable. #59560 react-component/util#810 @github-actions @nrps9909

🐞 Fix Button, Form, Slider, Typography, and Upload triggering delayed state updates after unmounting. #59560 react-component/util#806 @github-actions @nrps9909

🐞 Fix Select, TreeSelect, Cascader, and Mentions popupRender content inheriting Form.Item validation status and feedback icons. #59463 @huytdps13400

🐞 Fix Popover and Popconfirm preset color not applying to the panel background. #59549 @dogledogle

Form

🐞 Fix Form custom shouldUpdate comparisons missing updates when nested fields with preserve={false} are unmounted. #59560 react-component/util#807 @github-actions @nrps9909

🐞 Fix Form.Item incorrectly removing a trailing | from a string label when displaying a colon. #59599 @wfatih

⌨️ Fix Form.Item not associating warning-only messages with the control through aria-describedby. #59443 @Chaoqi31

Input

🐞 Fix Input.OTP losing valid characters when pasting text with a filtering formatter. #59580 @yunfeizhu

🐞 Fix Input.OTP ignoring rootClassName on the root element. #59439 @Chaoqi31

🐞 Fix Input.OTP not rendering a numeric 0 as the separator. #59518 @Ye-YiChen

Table

🐞 Fix Table selection menu skipping current-page tree descendants when inverting selection and deselecting disabled rows on other pages when clearing selections. #59570 @yunfeizhu

🐞 Fix Table sorted fixed header hover background and the fixedHeaderSortActiveBg token not taking effect. #59554 @dogledogle

ColorPicker

🐞 Fix ColorPicker applying RTL styles when ConfigProvider direction is ltr. #59441 @Chaoqi31

🐞 Fix ColorPicker number input control button width. #59538 @QDyanbing

🐞 Fix nested Descriptions being affected by the outer component's borders, spacing, and cell layout. #59547 @xushanpei

🐞 Fix Progress line ignoring string widths in size, such as ['50%', 20], and always filling the container. #59597 @wfatih

🐞 Fix Tooltip failing to limit panel corner radius to 8px for left and right placements when the borderRadius token exceeds 8. #59568 @dogledogle

🐞 Fix Popconfirm onPopupClick firing twice for a single click inside the popup content. #59440 @Chaoqi31

🐞 Fix Upload extra content styles when showUploadList.extra is 0 or returns 0. #59438 @Chaoqi31

♿ Fix Typography duplicate button semantics for the default edit icon. #59112 @nrps9909

⚡️ Improve Transfer source list rendering performance. #59524 @QDyanbing

Commits

dc3a92d fix(ColorPicker): restore format selector font size and spacing (#59610)
c275ff8 docs: add changelog for 6.6.7 (#59608)
c65793e refactor(Dropdown): remove obsolete wrap styles (#59605)
57ddf2b refactor(Input): remove obsolete Cascader selectors (#59604)
13d7b16 fix(Form): keep trailing pipe in string label (#59599)
211c6ed fix(Progress): respect string width in line size (#59597)
bbfab08 chore(deps): update nearform-actions/github-action-notify-twitter digest to e...
625a023 chore(deps): update dependency react-highlight-words to v1 (#59601)
3fb9b07 docs: update AGENTS.md docs (#59595)
4980435 site: only fetch contributors api in prod (#59594)
Additional commits viewable in compare view

Updates react from 19.3.0 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

Improve transport protocol (#37845 by @unstubbable and @eps1lon)

Commits

61aa00d [19.3.x][Flight] Improve transport protocol (#37845)
See full diff in compare view

Updates react-dom from 19.3.0 to 19.3.1

Release notes

Sourced from react-dom's releases.

19.3.1 (October 14th, 2026)

React Server Components

Improve transport protocol (#37845 by @unstubbable and @eps1lon)

Commits

61aa00d [19.3.x][Flight] Improve transport protocol (#37845)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…y with 12 updates Bumps the production-dependencies group with 12 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@hono/node-server](https://github.com/honojs/node-server) | `2.1.4` | `2.1.5` | | [@larksuiteoapi/node-sdk](https://github.com/larksuite/node-sdk) | `1.75.0` | `1.76.0` | | [marked](https://github.com/markedjs/marked) | `18.1.0` | `18.1.1` | | [sanitize-html](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html) | `2.18.0` | `2.18.1` | | [undici](https://github.com/nodejs/undici) | `7.30.0` | `7.30.1` | | [@codemirror/autocomplete](https://github.com/codemirror/autocomplete) | `6.20.3` | `6.20.4` | | [@codemirror/view](https://github.com/codemirror/view) | `6.43.14` | `6.43.15` | | [@hookform/resolvers](https://github.com/react-hook-form/resolvers) | `5.9.1` | `5.9.2` | | [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.104.2` | `5.104.5` | | [antd](https://github.com/ant-design/ant-design) | `6.6.6` | `6.6.7` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.3.0` | `19.3.1` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.3.0` | `19.3.1` | Updates `@hono/node-server` from 2.1.4 to 2.1.5 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v2.1.4...v2.1.5) Updates `@larksuiteoapi/node-sdk` from 1.75.0 to 1.76.0 - [Commits](https://github.com/larksuite/node-sdk/commits) Updates `marked` from 18.1.0 to 18.1.1 - [Release notes](https://github.com/markedjs/marked/releases) - [Commits](markedjs/marked@v18.1.0...v18.1.1) Updates `sanitize-html` from 2.18.0 to 2.18.1 - [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md) - [Commits](https://github.com/apostrophecms/apostrophe/commits/sanitize-html@2.18.1/packages/sanitize-html) Updates `undici` from 7.30.0 to 7.30.1 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.30.0...v7.30.1) Updates `@codemirror/autocomplete` from 6.20.3 to 6.20.4 - [Changelog](https://github.com/codemirror/autocomplete/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/autocomplete/commits) Updates `@codemirror/view` from 6.43.14 to 6.43.15 - [Changelog](https://github.com/codemirror/view/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/view/commits) Updates `@hookform/resolvers` from 5.9.1 to 5.9.2 - [Release notes](https://github.com/react-hook-form/resolvers/releases) - [Commits](react-hook-form/resolvers@v5.9.1...v5.9.2) Updates `@tanstack/react-query` from 5.104.2 to 5.104.5 - [Release notes](https://github.com/TanStack/query/releases) - [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md) - [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.104.5/packages/react-query) Updates `antd` from 6.6.6 to 6.6.7 - [Release notes](https://github.com/ant-design/ant-design/releases) - [Changelog](https://github.com/ant-design/ant-design/blob/master/CHANGELOG.en-US.md) - [Commits](ant-design/ant-design@6.6.6...6.6.7) Updates `react` from 19.3.0 to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react) Updates `react-dom` from 19.3.0 to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom) --- updated-dependencies: - dependency-name: "@hono/node-server" dependency-version: 2.1.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: "@larksuiteoapi/node-sdk" dependency-version: 1.76.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: marked dependency-version: 18.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: sanitize-html dependency-version: 2.18.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: undici dependency-version: 7.30.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: "@codemirror/autocomplete" dependency-version: 6.20.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: "@codemirror/view" dependency-version: 6.43.15 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: "@hookform/resolvers" dependency-version: 5.9.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: "@tanstack/react-query" dependency-version: 5.104.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: antd dependency-version: 6.6.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: react dependency-version: 19.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: react-dom dependency-version: 19.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-10-23T15:48:30Z

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

Navigation Menu

Repository navigation

build(deps): bump the production-dependencies group across 1 directory with 12 updates - #136

build(deps): bump the production-dependencies group across 1 directory with 12 updates#136
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-feb618500e

dependabot Bot commented on behalf of github Oct 23, 2026

Uh oh!

dependabot Bot commented on behalf of github Oct 23, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 23, 2026

v2.1.5

What's Changed

New Contributors

v18.1.1

18.1.1 (2026-10-12)

Bug Fixes

Performance Improvements

2.18.1 (2026-10-14)

Changes

Security

v7.30.1

Security fixes

High severity

Denial of service via TLS 1.2 certificate-changing renegotiation

TLS certificate validation bypass through dropped Agent options

Cache poisoning and cross-user disclosure through cross-origin redirects

Denial of service through excessive Content-Encoding values

Medium severity

Denial of service through the decompress interceptor

Subresource Integrity bypass with non-lowercase algorithm tokens

Denial of service through unbounded EventSource parser state

Denial of service through unbounded automatic WebSocket PONG buffering

v5.9.2

5.9.2 (2026-10-17)

Bug Fixes

@​tanstack/react-query-devtools@​5.104.5

Patch Changes

@​tanstack/react-query-next-experimental@​5.104.5

Patch Changes

@​tanstack/react-query-persist-client@​5.104.5

Patch Changes

@​tanstack/react-query@​5.104.5

Patch Changes

@​tanstack/react-query-devtools@​5.104.4

Patch Changes

@​tanstack/react-query-next-experimental@​5.104.4

Patch Changes

@​tanstack/react-query-persist-client@​5.104.4

Patch Changes

5.104.5

Patch Changes

5.104.4

Patch Changes

5.104.3

Patch Changes

6.6.7

19.3.1 (October 14th, 2026)

React Server Components

19.3.1 (October 14th, 2026)

React Server Components

Uh oh!

dependabot Bot commented on behalf of github Oct 23, 2026

Labels

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

TLS certificate validation bypass through dropped `Agent` options

Denial of service through excessive `Content-Encoding` values

Denial of service through the `decompress` interceptor

`@tanstack/react-query-devtools@5`.104.5

`@tanstack/react-query-next-experimental@5`.104.5

`@tanstack/react-query-persist-client@5`.104.5

`@tanstack/react-query@5`.104.5

`@tanstack/react-query-devtools@5`.104.4

`@tanstack/react-query-next-experimental@5`.104.4

`@tanstack/react-query-persist-client@5`.104.4