Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 8 updates - #4

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-83ae03083e
Open

chore(deps): bump the production-dependencies group across 1 directory with 8 updates#4
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-83ae03083e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the production-dependencies group with 8 updates in the / directory:

Package From To
@supabase/supabase-js 2.105.4 2.118.0
dotenv 17.4.2 18.0.8
express 5.2.1 5.3.0
express-rate-limit 7.5.1 8.7.1
lucide-react 0.468.0 1.57.0
nodemailer 8.0.7 10.1.1
react 19.2.6 19.3.1
react-dom 19.2.6 19.3.1

Updates @supabase/supabase-js from 2.105.4 to 2.118.0

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.118.0

2.118.0 (2026-10-15)

🚀 Features

  • postgrest: leave computed fields out of select('*') and resolve no-argument rpc overloads for postgrest-typegen output (#2730)
  • storage: add content-encoding support for uploads (#1949)

🩹 Fixes

  • ci: patch next and sharp advisories and pin node-browser playwright (#2753)

❤️ Thank You

  • Atharv Gaur @​Athaxv
  • Ferhat Elmas
  • Lukas Klingsbo

v2.118.0-canary.2

2.118.0-canary.2 (2026-10-12)

This was a version bump only, there were no code changes.

v2.118.0-canary.1

2.118.0-canary.1 (2026-10-12)

This was a version bump only, there were no code changes.

v2.118.0-canary.0

2.118.0-canary.0 (2026-10-09)

🚀 Features

  • postgrest: leave computed fields out of select('*') and resolve no-argument rpc overloads for postgrest-typegen output (#2730)

🩹 Fixes

  • ci: patch next and sharp advisories and pin node-browser playwright (#2753)

❤️ Thank You

  • Lukas Klingsbo

v2.117.3

2.117.3 (2026-10-07)

🩹 Fixes

  • deps: bump next to patch RCE in realtime-js example (#2733)
  • functions: send a Blob or File with its own content type (#2714)

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.118.0 (2026-10-15)

🚀 Features

  • postgrest: leave computed fields out of select('*') and resolve no-argument rpc overloads for postgrest-typegen output (#2730)

❤️ Thank You

  • Lukas Klingsbo

2.117.3 (2026-10-07)

🩹 Fixes

  • storage: send multipart fields before files (#2736)

❤️ Thank You

2.117.2 (2026-09-25)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.117.1 (2026-09-23)

🩹 Fixes

  • auth: return stored session when a refresh loses to another tab (#2698)

❤️ Thank You

2.117.0 (2026-09-22)

🚀 Features

  • auth: enable passkey API by default and deprecate experimental passkey opt-in (#2695)

❤️ Thank You

  • fadymak

2.116.0 (2026-09-07)

🚀 Features

  • auth: add MFA recovery codes API (#2676)

... (truncated)

Commits
  • b9753a1 feat(postgrest): leave computed fields out of select('*') and resolve no-argu...
  • 88faa11 fix(ci): patch next and sharp advisories and pin node-browser playwright (#2753)
  • aac9d32 chore(release): version 2.117.3 changelogs (#2744)
  • 4d23055 fix(storage): send multipart fields before files (#2736)
  • a684cf9 chore(release): version 2.117.2 changelogs (#2707)
  • 54c225d chore(release): version 2.117.1 changelogs (#2700)
  • 739b351 fix(auth): return stored session when a refresh loses to another tab (#2698)
  • f34d428 chore(release): version 2.117.0 changelogs (#2697)
  • cc45ccf feat(auth): enable passkey API by default and deprecate experimental passkey ...
  • c511286 docs(realtime): document relationship of accessToken() and heartbeat (#2680)
  • Additional commits viewable in compare view

Updates dotenv from 17.4.2 to 18.0.8

Changelog

Sourced from dotenv's changelog.

18.0.8 (2026-10-14)

Changed

  • Fast parser should strip appended extra quotes (#1073)
  • Type detail improvement (#1074)

18.0.7 (2026-10-09)

Changed

  • Treat undefined settings like quiet: true as null rather than falsey (#1070)
  • CLI should honor DOTENV_QUIET setting in .env file (#1071)

18.0.6 (2026-10-06)

Changed

  • Use smarter parseBoolean not Boolean() to fix override (#1069)

18.0.5 (2026-09-30)

Changed

  • Fix missing typescript module declaration (#1068)
  • Improve performance for large .env files (#1066)

18.0.4 (2026-09-25)

Changed

  • import dotenv/config should default quiet: true (#1063)

18.0.3 (2026-09-22)

Changed

  • Patch DOTENV_QUIET setting when inside .env file (#1059)

18.0.2 (2026-09-21)

Changed

  • Patch additional edge cases for the fast parser (#1056)

18.0.1 (2026-09-18)

Changed

  • Handle file urls in config logging (#1054)

... (truncated)

Commits
  • e2fe95e 18.0.8
  • 7aa712a type detail improvement
  • 53405b0 Merge pull request #1074 from himanshu748/codex/fix-dotenv-populate-undefined...
  • 0b4843a changelog
  • 55855ab Merge pull request #1073 from xiehuanyi/fix/unicode-unquoting-parity
  • f757811 fix(types): allow undefined values in populate output
  • fde5db2 Keep fast-parser unquoting consistent at Unicode line boundaries
  • 2953207 18.0.7
  • 9944723 make more readable for undefined -> null
  • d455db0 Merge branch 'master' of github.com:motdotla/dotenv
  • Additional commits viewable in compare view

Updates express from 5.2.1 to 5.3.0

Release notes

Sourced from express's releases.

v5.3.0

Highlights

🐞 Bug fixes

  • Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

    Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

🚀 Improvements

  • Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

    // QUERY /reports with If-None-Match: "12345"
app.query('/reports', (req, res) => {
  res.set('ETag', '"12345"');
  res.send(results); // now responds 304 Not Modified
});

  • Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

  • When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

    app.render('index', null, callback); // now works as expected

  • Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

    res.set('Content-Type', 'text/plain; foo=bar').send('hey');
// -> Content-Type: text/plain; foo=bar; charset=utf-8

  • The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

  • Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

    res.attachment('user.html');
// before -> Content-Disposition: attachment; filename="user.html"
// after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Changelog

Sourced from express's changelog.

5.3.0

🐞 Bug fixes

  • Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

    Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

🚀 Improvements

  • Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

    // QUERY /reports with If-None-Match: "12345"
app.query('/reports', (req, res) => {
  res.set('ETag', '"12345"');
  res.send(results); // now responds 304 Not Modified
});

  • Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

  • When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

    app.render('index', null, callback); // now works as expected

  • Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

    res.set('Content-Type', 'text/plain; foo=bar').send('hey');
// -> Content-Type: text/plain; foo=bar; charset=utf-8

  • The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

  • Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

    res.attachment('user.html');
// before -> Content-Disposition: attachment; filename="user.html"
// after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express since your current version.


Updates express-rate-limit from 7.5.1 to 8.7.1

Release notes

Sourced from express-rate-limit's releases.

v8.7.1

You can view the changelog here.

v8.7.0

You can view the changelog here.

v8.6.2

You can view the changelog here.

v8.6.1

You can view the changelog here.

v8.6.0

You can view the changelog here.

v8.5.2

You can view the changelog here.

v8.5.1

You can view the changelog here.

v8.5.0

You can view the changelog here.

v8.4.1

You can view the changelog here.

v8.4.0

You can view the changelog here.

v8.3.2

You can view the changelog here.

v8.3.1

You can view the changelog here.

v8.3.0

You can view the changelog here.

v8.2.1

You can view the changelog here.

v8.2.0

You can view the changelog here.

v8.1.0

You can view the changelog here.

v8.0.1

You can view the changelog here.

... (truncated)

Commits
  • c2e30b3 8.7.1
  • b40a390 v8.7.1 changelog
  • ccbee88 fix: correct es2020/es2022 version mismatch between tsconfig and esbuild comm...
  • 11a143a chore: fix duplicate entries in pnpm-lockfile.yaml (#685)
  • 92f685d chore(deps): bump softprops/action-gh-release from 1 to 3 (#692)
  • 0c7c066 chore(deps): bump actions/checkout from 4.4.0 to 7.0.1 (#694)
  • 9735b69 chore(deps): bump pnpm/action-setup from 3.0.0 to 6.1.0 (#695)
  • 7f401b7 chore(deps): bump actions/setup-node from 4.4.0 to 7.0.0 (#693)
  • 7a49bb0 ci: add guard that fails the build on unpinned GitHub Actions (companion to #...
  • 784c447 ci: pin GitHub Actions to immutable commit SHAs (#690)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express-rate-limit since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates lucide-react from 0.468.0 to 1.57.0

Release notes

Sourced from lucide-react's releases.

Version 1.57.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.56.0...1.57.0

Version 1.56.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.55.0...1.56.0

Version 1.55.0

What's Changed

... (truncated)

Commits
  • 3f1255e chore(deps-dev): bump @​vitejs/plugin-react (#4995)
  • 949bc6d test(lucide-react): add tests for DynamicIcon fallback and ref forwarding (#4...
  • 98331e2 chore(deps): bump the react-deps group across 1 directory with 3 updates (#4951)
  • 09aa9c5 chore(deps): Upgrade to vite 8 (#4950)
  • e042fec fix(packages): declare @types/react as an optional peer dependency (#4892)
  • f06ac67 chore(typchecking): More typecheck jobs for all packages (#4885)
  • 94e4cb9 chore(dependencies): Update dependencies (#4806)
  • 99d25bd feat(packages): extract icon build logic into @lucide/shared (#4409)
  • 75b5516 chore(dev): upgrade ESLint to latest compatible stack (v10) (#4378)
  • 0f8d48b test(packages): updates unit test snapshots with face-slightly-smiling (#4676)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for lucide-react since your current version.


Updates nodemailer from 8.0.7 to 10.1.1

Release notes

Sourced from nodemailer's releases.

v10.1.1

10.1.1 (2026-10-14)

Bug Fixes

  • fetch: strip credentials on any cross-origin redirect (a15360c)

v10.1.0

10.1.0 (2026-10-10)

Behaviour changes

  • Pooled connections are closed after 4 minutes without a message (new idleTimeout pool option, set it to 0 to keep them open). A message whose recipients are rejected no longer closes the pooled connection, it is reset with RSET and reused, and a message is requeued when the server dropped a reused connection before any of it was sent.
  • connectionTimeout covers setting the session up as a whole: the DNS lookup, a proxy handshake, the TCP connection, TLS, the greeting and a STARTTLS upgrade. greetingTimeout still bounds the greeting and the STARTTLS handshake within it.
  • Any 421 reply ends the SMTP session. When the server closes an idle connection, SMTPConnection emits only end, not an ECONNECTION error.
  • A content stream that was already read or destroyed fails the message with ESTREAM instead of producing an empty attachment. Content streams of a message that fails are destroyed.
  • With opportunisticTLS, authentication is skipped on the unencrypted connection after a failed STARTTLS, unless forceAuth is set.
  • The envelope is pipelined (MAIL FROM, RCPT TO and DATA in one batch) when the server announces PIPELINING.
  • Errors carry originalCode (the system error code Nodemailer replaced, such as ECONNREFUSED) and, for ETIMEDOUT, timeoutType.

Features

  • harden message streams, SMTP connections and the connection pool (8009da6)

Bug Fixes

  • do not read the environment or the interface table on import (094179d)
  • end the SMTP session on any 421 reply and drive the envelope through one step (5638ac1)
  • keep ERR_ACCESS_DENIED from the Node.js permission model (8b33a3d)
  • let the proxy handshake and the SMTP connection share one deadline (91ed683)
  • mime-node: decode an SMTPUTF8 domain from its A-label form (e436f4d)
  • mime-node: finish an encoded part only after its output was read (ec97d8f)
  • qp: encode a lone CR or LF in binary quoted-printable parts (42b91d9)
  • smtp-connection: count the wait for the greeting against connectionTimeout (bdcd046)
  • smtp-connection: drop the connection when DATA is taken after a refused sender (f90fb04)
  • smtp-connection: refuse a second connect() call (24ba2e0)
  • turn Nagle off for SMTP sockets and report an early sendmail exit as such (fa9b8d3)

Performance Improvements

  • encode base64 and quoted-printable without per-chunk delays (fd377bb)

v10.0.16

10.0.16 (2026-10-07)

Bug Fixes

... (truncated)

Changelog

Sourced from nodemailer's changelog.

10.1.1 (2026-10-14)

Bug Fixes

  • fetch: strip credentials on any cross-origin redirect (a15360c)

10.1.0 (2026-10-10)

Features

  • harden message streams, SMTP connections and the connection pool (8009da6)

Bug Fixes

  • do not read the environment or the interface table on import (094179d)
  • end the SMTP session on any 421 reply and drive the envelope through one step (5638ac1)
  • keep ERR_ACCESS_DENIED from the Node.js permission model (8b33a3d)
  • let the proxy handshake and the SMTP connection share one deadline (91ed683)
  • mime-node: decode an SMTPUTF8 domain from its A-label form (e436f4d)
  • mime-node: finish an encoded part only after its output was read (ec97d8f)
  • qp: encode a lone CR or LF in binary quoted-printable parts (42b91d9)
  • smtp-connection: count the wait for the greeting against connectionTimeout (bdcd046)
  • smtp-connection: drop the connection when DATA is taken after a refused sender (f90fb04)
  • smtp-connection: refuse a second connect() call (24ba2e0)
  • turn Nagle off for SMTP sockets and report an early sendmail exit as such (fa9b8d3)

Performance Improvements

  • encode base64 and quoted-printable without per-chunk delays (fd377bb)

10.0.16 (2026-10-07)

Bug Fixes

  • addressparser: keep an escaped parenthesis inside a comment (c4ae20d)
  • fetch: keep the case of cookie names (#1888) (9f16eed)
  • fetch: read the cookie name-value pair by position (645e97c)

10.0.15 (2026-10-05)

Bug Fixes

  • errors: inherit NodemailerError code from ErrnoException (e99db61), closes #1884
  • errors: keep NodemailerError compatible with @​types/node 26 ErrnoException (#1885) (b660328)

... (truncated)

Commits
  • 9396cca chore(master): release 10.1.1 (#1893)
  • 65d7498 chore(deps): bump dev dependencies
  • 647ee44 test(smtp-connection): pin connectionTimeout across all resolved addresses
  • a15360c fix(fetch): strip credentials on any cross-origin redirect
  • c8671c4 Updated SECURITY.md formatting
  • be6fe72 testing VUlnerability firm
  • 7bdaa77 chore: Updated Security Policy
  • 0780032 chore(master): release 10.1.0 (#1890)
  • 42b91d9 fix(qp): encode a lone CR or LF in binary quoted-printable parts
  • b9b8c84 test(smtp-pool): fail the clear event test with the pool state instead of han...
  • Additional commits viewable in compare view
Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates react from 19.2.6 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 14, 2026
@dependabot
chore(deps): bump the production-dependencies group across 1 director…
d5f49ea 
…y with 8 updates

Bumps the production-dependencies group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.105.4` | `2.118.0` |
| [dotenv](https://github.com/motdotla/dotenv) | `17.4.2` | `18.0.8` |
| [express](https://github.com/expressjs/express) | `5.2.1` | `5.3.0` |
| [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `7.5.1` | `8.7.1` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `0.468.0` | `1.57.0` |
| [nodemailer](https://github.com/nodemailer/nodemailer) | `8.0.7` | `10.1.1` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.6` | `19.3.1` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.6` | `19.3.1` |



Updates `@supabase/supabase-js` from 2.105.4 to 2.118.0
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.118.0/packages/core/supabase-js)

Updates `dotenv` from 17.4.2 to 18.0.8
- [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md)
- [Commits](motdotla/dotenv@v17.4.2...v18.0.8)

Updates `express` from 5.2.1 to 5.3.0
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/master/History.md)
- [Commits](expressjs/express@v5.2.1...v5.3.0)

Updates `express-rate-limit` from 7.5.1 to 8.7.1
- [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases)
- [Commits](express-rate-limit/express-rate-limit@v7.5.1...v8.7.1)

Updates `lucide-react` from 0.468.0 to 1.57.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.57.0/packages/lucide-react)

Updates `nodemailer` from 8.0.7 to 10.1.1
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v8.0.7...v10.1.1)

Updates `react` from 19.2.6 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react)

Updates `react-dom` from 19.2.6 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom)

---
updated-dependencies:
- dependency-name: "@supabase/supabase-js"
  dependency-version: 2.117.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: dotenv
  dependency-version: 18.0.7
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: express
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: express-rate-limit
  dependency-version: 8.7.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: lucide-react
  dependency-version: 1.55.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: nodemailer
  dependency-version: 10.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: react
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: react-dom
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore(deps): bump the production-dependencies group with 8 updates chore(deps): bump the production-dependencies group across 1 directory with 8 updates Oct 19, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/production-dependencies-83ae03083e branch from 9173bc4 to d5f49ea Compare October 19, 2026 05:28

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants