Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 27 updates#226

Open
dependabot[bot] wants to merge 6 commits into
mainfrom
dependabot/npm_and_yarn/production-dependencies-a0b7b495df
Open

chore(deps): bump the production-dependencies group across 1 directory with 27 updates#226
dependabot[bot] wants to merge 6 commits into
mainfrom
dependabot/npm_and_yarn/production-dependencies-a0b7b495df

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 19, 2026

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 27 updates in the / directory:

Package From To
typescript 6.0.3 7.0.2
@astrojs/cloudflare 14.0.1 14.1.3
@sentry/browser 10.62.0 10.66.0
@tabler/icons 3.44.0 3.45.0
@tailwindcss/vite 4.3.1 4.3.3
@tanstack/virtual-core 3.17.2 3.17.4
astro 7.0.3 7.1.1
posthog-js 1.395.0 1.404.1
tailwindcss 4.3.1 4.3.3
@tanstack/react-virtual 3.14.5 3.14.6
lucide-react 1.23.0 1.25.0
shadcn 4.12.0 4.13.1
@astrojs/starlight 0.41.1 0.41.3
sharp 0.35.2 0.35.3
three 0.185.0 0.185.1
@aws-sdk/client-s3 3.1089.0 3.1090.0
@babel/parser 8.0.0 8.0.4
@hono/mcp 0.3.0 0.3.1
@hono/node-server 2.0.6 2.0.10
@sentry/node 10.62.0 10.66.0
@ungap/structured-clone 1.3.2 1.3.3
add-mcp 1.13.0 1.14.0
graphql 17.0.1 17.0.2
hono 4.12.27 4.12.31
posthog-node 5.38.6 5.45.2
whatwg-url 16.0.1 17.1.0
ws 8.21.0 8.21.1

Updates typescript from 6.0.3 to 7.0.2

Commits
Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.


Updates @astrojs/cloudflare from 14.0.1 to 14.1.3

Release notes

Sourced from @​astrojs/cloudflare's releases.

@​astrojs/cloudflare@​14.1.3

Patch Changes

  • #17363 3f4efc5 Thanks @​astrobot-houston! - Fixes astro preview --open not opening a browser when using an adapter with a custom preview entrypoint, such as @astrojs/cloudflare

  • Updated dependencies []:

    • @​astrojs/underscore-redirects@​1.0.3

@​astrojs/cloudflare@​14.1.2

Patch Changes

  • #17323 4298883 Thanks @​ematipico! - Fixes build-time image optimization ignoring a custom image service registered by an integration

    Previously, when using imageService: 'compile' or imageService: 'custom', a custom image service was only respected if it was set directly in the image.service option of astro.config. If an integration registered the service instead, images were silently optimized with the default Sharp service at build time. A custom image service now transforms your images at build time no matter how it was configured.

  • #17323 4298883 Thanks @​ematipico! - Prebundles astro/components and the <ClientRouter /> transition runtime modules in the dev server environment so pages using them no longer trigger a mid-session dep optimizer reload, which caused React "Invalid hook call" errors in islands on the first request after a cold cache

  • #17323 4298883 Thanks @​ematipico! - Fixes an issue where vars weren't available at build time. Now the adapter loads vars from the Wrangler config so astro:env public variables resolve at build time

  • Updated dependencies []:

    • @​astrojs/underscore-redirects@​1.0.3

@​astrojs/cloudflare@​14.1.1

Patch Changes

  • Updated dependencies [eb6f97e]:
    • @​astrojs/internal-helpers@​0.10.1
    • @​astrojs/underscore-redirects@​1.0.3

@​astrojs/cloudflare@​14.1.0

Minor Changes

  • #17099 fdab7ce Thanks @​adamchal! - Adds configured image service support with the compile and custom options.

    The Cloudflare adapter supports various options that affect how images are processed for both pre-rendered and on-demand routes:

    • Setting imageService: 'compile' now ensures it is used for pre-rendered routes. When no custom image service is defined, the behavior remains unchanged.
    • With imageService: 'custom', assets are now processed at build time for pre-rendered routes. If you have configured an image service, it will be bundled to handle images at runtime; otherwise, the behavior remains unchanged.
    • The other imageService options remain unchanged.

    Learn more about the image service options available in the Cloudflare adapter guide.

Patch Changes

  • #17236 c411200 Thanks @​matthewp! - Prevents warnings in the Cloudflare adapter about optimizing the @astrojs/cloudflare/entrypoints/server module in dev.

  • #17249 02b73b0 Thanks @​ematipico! - Fixes an issue where the peerDependencies field used incorrect dependencies.

  • Updated dependencies []:

    • @​astrojs/underscore-redirects@​1.0.3

... (truncated)

Changelog

Sourced from @​astrojs/cloudflare's changelog.

14.1.3

Patch Changes

  • #17363 3f4efc5 Thanks @​astrobot-houston! - Fixes astro preview --open not opening a browser when using an adapter with a custom preview entrypoint, such as @astrojs/cloudflare

  • Updated dependencies []:

    • @​astrojs/underscore-redirects@​1.0.3

14.1.2

Patch Changes

  • #17323 4298883 Thanks @​ematipico! - Fixes build-time image optimization ignoring a custom image service registered by an integration

    Previously, when using imageService: 'compile' or imageService: 'custom', a custom image service was only respected if it was set directly in the image.service option of astro.config. If an integration registered the service instead, images were silently optimized with the default Sharp service at build time. A custom image service now transforms your images at build time no matter how it was configured.

  • #17323 4298883 Thanks @​ematipico! - Prebundles astro/components and the <ClientRouter /> transition runtime modules in the dev server environment so pages using them no longer trigger a mid-session dep optimizer reload, which caused React "Invalid hook call" errors in islands on the first request after a cold cache

  • #17323 4298883 Thanks @​ematipico! - Fixes an issue where vars weren't available at build time. Now the adapter loads vars from the Wrangler config so astro:env public variables resolve at build time

  • Updated dependencies []:

    • @​astrojs/underscore-redirects@​1.0.3

14.1.1

Patch Changes

  • Updated dependencies [eb6f97e]:
    • @​astrojs/internal-helpers@​0.10.1
    • @​astrojs/underscore-redirects@​1.0.3

14.1.0

Minor Changes

  • #17099 fdab7ce Thanks @​adamchal! - Adds configured image service support with the compile and custom options.

    The Cloudflare adapter supports various options that affect how images are processed for both pre-rendered and on-demand routes:

    • Setting imageService: 'compile' now ensures it is used for pre-rendered routes. When no custom image service is defined, the behavior remains unchanged.
    • With imageService: 'custom', assets are now processed at build time for pre-rendered routes. If you have configured an image service, it will be bundled to handle images at runtime; otherwise, the behavior remains unchanged.
    • The other imageService options remain unchanged.

    Learn more about the image service options available in the Cloudflare adapter guide.

Patch Changes

  • #17236 c411200 Thanks @​matthewp! - Prevents warnings in the Cloudflare adapter about optimizing the @astrojs/cloudflare/entrypoints/server module in dev.

  • #17249 02b73b0 Thanks @​ematipico! - Fixes an issue where the peerDependencies field used incorrect dependencies.

... (truncated)

Commits

Updates @sentry/browser from 10.62.0 to 10.66.0

Release notes

Sourced from @​sentry/browser's releases.

10.66.0

  • chore(node-core): Deprecate @sentry/node-core package (#22285)
  • chore(tanstackstart): Deprecate @sentry/tanstackstart package (#22284)
  • deps(server-utils): bump @​apm-js-collab/code-transformer and tracing-hooks (#22172)
  • feat(bun): Add initWithoutDefaultIntegrations and getDefaultIntegrationsWithoutPerformance (#22036)
  • feat(bundlers): Add orchestrion bundler plugins (#22124)
  • feat(cloudflare): Support Cloudflare types v5 & newer wrangler versions (#22180)
  • feat(core): Add and use dataCollection.databaseQueryData (for e.g. Supabase filter values and mutation bodies) (#22219)
  • feat(core): Add and use dataCollection.graphQL (#22221)
  • feat(core): Add stringify helper and make AI-tracing serializers safe (#22163)
  • feat(nestjs): Add orchestrion diagnostics-channel instrumentation (#22176)
  • feat(nextjs): Add opt-in for orchestrion instrumentation (#22043)
  • feat(node): Rewrite knex instrumentation to orchestrion tracing channels (#22237)
  • feat(server-utils): Capture and log orchestrion stats (#22269)
  • feat(server-utils): Migrate @opentelemetry/instrumentation-kafkajs to orchestrion (#21923)
  • feat(server-utils): Migrate @opentelemetry/instrumentation-mysql2 to orchestrion (#22229)
  • feat(server-utils): Rewrite @opentelemetry/instrumentation-dataloader to orchestrion (#22236)
  • feat(server-utils): Rewrite @opentelemetry/instrumentation-generic-pool to orchestrion (#22240)
  • feat(sveltekit): Detect SvelteKit 3 native tracing from the Vite plugin (#21580)
  • fix: Include bundler CJS exports to fix Node warning (#22286)
  • fix(browser-utils): Remove readystatechange listener to prevent memory leaks (#22216)
  • fix(browser): Propagate trace data from active span if http.client span is non-recording (#22246)
  • fix(core): Preserve propagation across ignored spans (#22277)
  • fix(node): move dc integration swap to _init (#22173)
  • fix(react-router): Correct url attributes for history and relative navigations (#22131)
  • fix(react): Preserve parent path prefix for descendant route names in react-router (#22225)
  • fix(server-utils): Dedupe ioredis orchestrion span for offline-queued commands (#22279)
  • fix(vue): Refresh pageload URL attrs on TanStack onResolved (#22140)
  • chore: Add external contributor to CHANGELOG.md (#22295)
  • chore: Do not treat flaky test issues as bug (#22272)
  • chore: stub modules for orchestrion configs, channels (#22195)
  • chore: Update claude PR instructions (#22241)
  • chore(changelog): Add external contributor to next changelog (#22234)
  • chore(ci): Temporarily assign node/node-core reviews to whole JS SDK team (#22226)
  • chore(ci): Temporarily assign orchestrion reviews to whole JS SDK team (#22215)
  • chore(deps): Bump orchestrion dependencies to latest (#22287)
  • chore(deps): Bump @sentry/conventions to 0.16.0 (#22270)
  • chore(gitignore): Add .pnpm-store to gitignore (#22223)
  • chore(skills): Add bump-conventions skill (#22271)
  • fix(ci): Improve flaky test issue deduplication (#22042)
  • fix(ci): Unblock external-contributors checkout on fork PR merges (#22235)
  • ref(build): Replace ts-node with tsx for build and CI scripts (#22186)
  • ref(core): Remove redundant log buffer flush (#22278)
  • ref(nestjs): extract shared span helpers (#22175)
  • ref(node): Refactor some otel internals in http integrations (#22292)
  • ref(nuxt): Build the Nuxt module in-house instead of @​nuxt/module-builder (#22190)

... (truncated)

Changelog

Sourced from @​sentry/browser's changelog.

10.66.0

  • chore(node-core): Deprecate @sentry/node-core package (#22285)
  • chore(tanstackstart): Deprecate @sentry/tanstackstart package (#22284)
  • deps(server-utils): bump @​apm-js-collab/code-transformer and tracing-hooks (#22172)
  • feat(bun): Add initWithoutDefaultIntegrations and getDefaultIntegrationsWithoutPerformance (#22036)
  • feat(bundlers): Add orchestrion bundler plugins (#22124)
  • feat(cloudflare): Support Cloudflare types v5 & newer wrangler versions (#22180)
  • feat(core): Add and use dataCollection.databaseQueryData (for e.g. Supabase filter values and mutation bodies) (#22219)
  • feat(core): Add and use dataCollection.graphQL (#22221)
  • feat(core): Add stringify helper and make AI-tracing serializers safe (#22163)
  • feat(nestjs): Add orchestrion diagnostics-channel instrumentation (#22176)
  • feat(nextjs): Add opt-in for orchestrion instrumentation (#22043)
  • feat(node): Rewrite knex instrumentation to orchestrion tracing channels (#22237)
  • feat(server-utils): Capture and log orchestrion stats (#22269)
  • feat(server-utils): Migrate @opentelemetry/instrumentation-kafkajs to orchestrion (#21923)
  • feat(server-utils): Migrate @opentelemetry/instrumentation-mysql2 to orchestrion (#22229)
  • feat(server-utils): Rewrite @opentelemetry/instrumentation-dataloader to orchestrion (#22236)
  • feat(server-utils): Rewrite @opentelemetry/instrumentation-generic-pool to orchestrion (#22240)
  • feat(sveltekit): Detect SvelteKit 3 native tracing from the Vite plugin (#21580)
  • fix: Include bundler CJS exports to fix Node warning (#22286)
  • fix(browser-utils): Remove readystatechange listener to prevent memory leaks (#22216)
  • fix(browser): Propagate trace data from active span if http.client span is non-recording (#22246)
  • fix(core): Preserve propagation across ignored spans (#22277)
  • fix(node): move dc integration swap to _init (#22173)
  • fix(react-router): Correct url attributes for history and relative navigations (#22131)
  • fix(react): Preserve parent path prefix for descendant route names in react-router (#22225)
  • fix(server-utils): Dedupe ioredis orchestrion span for offline-queued commands (#22279)
  • fix(vue): Refresh pageload URL attrs on TanStack onResolved (#22140)
  • chore: Add external contributor to CHANGELOG.md (#22295)
  • chore: Do not treat flaky test issues as bug (#22272)
  • chore: stub modules for orchestrion configs, channels (#22195)
  • chore: Update claude PR instructions (#22241)
  • chore(changelog): Add external contributor to next changelog (#22234)
  • chore(ci): Temporarily assign node/node-core reviews to whole JS SDK team (#22226)
  • chore(ci): Temporarily assign orchestrion reviews to whole JS SDK team (#22215)
  • chore(deps): Bump orchestrion dependencies to latest (#22287)
  • chore(deps): Bump @sentry/conventions to 0.16.0 (#22270)
  • chore(gitignore): Add .pnpm-store to gitignore (#22223)
  • chore(skills): Add bump-conventions skill (#22271)
  • fix(ci): Improve flaky test issue deduplication (#22042)
  • fix(ci): Unblock external-contributors checkout on fork PR merges (#22235)
  • ref(build): Replace ts-node with tsx for build and CI scripts (#22186)
  • ref(core): Remove redundant log buffer flush (#22278)
  • ref(nestjs): extract shared span helpers (#22175)
  • ref(node): Refactor some otel internals in http integrations (#22292)

... (truncated)

Commits
  • 323cbf6 release: 10.66.0
  • 85d0619 Merge pull request #22315 from getsentry/prepare-release/10.66.0
  • bddcb83 meta(changelog): Update changelog for 10.66.0
  • 595e940 feat(sveltekit): Detect SvelteKit 3 native tracing from the Vite plugin (#21580)
  • 667cb71 fix(browser): Propagate trace data from active span if http.client span is ...
  • e8d7bd4 fix(core): Preserve propagation across ignored spans (#22277)
  • bd69bd9 chore(node-core): Deprecate @sentry/node-core package (#22285)
  • c04ebda fix(react): Preserve parent path prefix for descendant route names in `react-...
  • 2cbacb5 feat(node): Rewrite knex instrumentation to orchestrion tracing channels (#22...
  • c9716eb feat(server-utils): Capture and log orchestrion stats (#22269)
  • Additional commits viewable in compare view

Updates @tabler/icons from 3.44.0 to 3.45.0

Release notes

Sourced from @​tabler/icons's releases.

Release 3.45.0

20 new icons:

  • filled/brand-signal
  • outline/app-window-bottom-left
  • outline/app-window-bottom-right
  • outline/app-window-bottom
  • outline/app-window-center
  • outline/arrow-fork-triple
  • outline/brand-signal
  • outline/device-vision-pro-wifi
  • outline/device-workstation
  • outline/dragon
  • outline/italic-off
  • outline/tab-close
  • outline/text-outline
  • outline/text-regex-asterisk
  • outline/text-regex-end
  • outline/text-regex-plus
  • outline/text-regex-question
  • outline/text-regex-start
  • outline/underline-off
  • outline/virtual-space

New features

  • New package: @tabler/icons-astro — Astro support
  • Added sideEffects: false for better tree-shaking in Vue package
  • Spelling fixes: corrected misspelled icon names

Fixed icons: outline/flip-horizontal, outline/flip-vertical

Renamed icons:

  • filled/mood-confuzed renamed to filled/mood-confused
  • outline/brand-adobe-after-effect renamed to outline/brand-adobe-after-effects
  • outline/brand-kako-talk renamed to outline/brand-kakao-talk
  • outline/currency-rubel renamed to outline/currency-ruble
  • outline/foodsteps renamed to outline/footsteps
  • outline/gender-trasvesti renamed to outline/gender-travesti
  • outline/ikosaedr renamed to outline/icosahedron
  • outline/mood-confuzed renamed to outline/mood-confused
  • outline/physotherapist renamed to outline/physiotherapist
  • outline/sport-billard renamed to outline/sport-billiard
Commits
  • 975920f Release 3.45.0
  • c7242e4 Remove version metadata from italic-off.svg and underline-off.svg icons f...
  • 44a4cf6 Refactor SVG paths for app window icons to improve structure and consistency ...
  • 0959305 Add new icon: outline/device-workstation for workspace and office setups
  • c8f539d Fixed icons: outline/app-window-bottom-left, `outline/app-window-bottom-rig...
  • 5075bf4 3 new icons: outline/text-regex-asterisk, outline/text-regex-plus, `outli...
  • fcb4a28 3 new icons: outline/tab-close, outline/text-regex-end, `outline/text-reg...
  • b8b4473 3 new icons: outline/arrow-fork-triple, outline/text-outline, `outline/vi...
  • d153136 6 new icons: outline/app-window-bottom-left, `outline/app-window-bottom-rig...
  • b9bbeb9 fix: correct misspelled icon names (#1549)
  • Additional commits viewable in compare view

Updates @tailwindcss/vite from 4.3.1 to 4.3.3

Release notes

Sourced from @​tailwindcss/vite's releases.

v4.3.3

Fixed

  • Support --watch --poll[=ms] in @tailwindcss/cli when filesystem events are unreliable or unavailable (#20297)
  • Canonicalization: match arbitrary hex colors against theme colors case-insensitively (e.g. bg-[#fff] and bg-[#FFF] → bg-white) (#20298)
  • Prevent Preflight from overriding Firefox's native iframe:focus-visible outline styles (#20292)
  • Ensure theme('colors.foo') in JS plugins resolves correctly when both --color-foo and --color-foo-bar exist (#20299)
  • Ensure fractional opacity modifiers work with named shadow sizes like shadow-sm/12.5, text-shadow-sm/12.5, drop-shadow-sm/12.5, and inset-shadow-sm/12.5 (#20302)
  • Parse selectors like [data-foo]div as two selectors instead of one (#20303)
  • Ensure @tailwindcss/postcss rebuilds when a preprocessor like Sass changes the input CSS without changing the input file on disk (#20310)
  • Ensure CSS nesting is handled even when Lightning CSS isn't run, such as in @tailwindcss/browser and Tailwind Play (#20124)
  • Prevent achromatic theme colors from shifting hue when mixed in polar color spaces like oklch (#20314)
  • Ensure --spacing(0) is optimized to 0px instead of 0 so it remains a <length> when used in calc(…) (#20319)
  • Load @parcel/watcher only when needed in @tailwindcss/cli --watch mode, so one-off builds and --watch --poll work when @parcel/watcher can't be loaded (#20325)
  • Use explicit platform fonts instead of system-ui and ui-sans-serif so CJK text respects the page's lang attribute on Windows (#20318)
  • Prevent @tailwindcss/upgrade from rewriting ignored files when run from a subdirectory (#20329)
  • Ensure earlier @source rules pointing to nested files are scanned when later @source rules point to files in parent folders (#20335)
  • Prevent @tailwindcss/vite from triggering full page reloads when scanned files are processed by Vite but haven't been loaded as modules yet (#20336)

v4.3.2

Fixed

  • Support bare spacing values for auto-rows-* and auto-cols-* utilities (e.g. auto-rows-12 and auto-cols-16) (#20229)
  • Prevent @tailwindcss/cli in --watch mode from crashing on Windows when @source points to a directory that doesn't exist (#20242)
  • Prevent @tailwindcss/vite from crashing in Deno v2.8.x when context.parentURL is not a valid URL (#20245)
  • Ensure @tailwindcss/cli in --watch mode rebuilds when the input CSS file changes in an ignored directory (#20246)
  • Allow @variant rules used in addBase(…) to use custom variants defined later (#20247)
  • Prevent @tailwindcss/vite from crashing during HMR when scanned files or directories are deleted (#20259)
  • Generate font-size instead of color declarations for text-[--spacing(…)] (#20260)
  • Prevent @source patterns from scanning unrelated sibling files and folders (#20263)
  • Extract class candidates adjacent to Template Toolkit delimiters like %]…[% in .tt, .tt2, and .tx files (#20269)
  • Extract class candidates from conditional Maud syntax like p.text-black[condition] (#20269)
  • Prevent @position-try rules from triggering unknown at-rule warnings when optimizing CSS (#20277)
  • Support class suggestions for named opacity modifiers from --opacity theme values (#20287)
  • Prevent type errors in @tailwindcss/postcss when used with newer PostCSS patch releases (#20289)
Changelog

Sourced from @​tailwindcss/vite's changelog.

[4.3.3] - 2026-07-16

Fixed

  • Support --watch --poll[=ms] in @tailwindcss/cli when filesystem events are unreliable or unavailable (#20297)
  • Canonicalization: match arbitrary hex colors against theme colors case-insensitively (e.g. bg-[#fff] and bg-[#FFF] → bg-white) (#20298)
  • Prevent Preflight from overriding Firefox's native iframe:focus-visible outline styles (#20292)
  • Ensure theme('colors.foo') in JS plugins resolves correctly when both --color-foo and --color-foo-bar exist (#20299)
  • Ensure fractional opacity modifiers work with named shadow sizes like shadow-sm/12.5, text-shadow-sm/12.5, drop-shadow-sm/12.5, and inset-shadow-sm/12.5 (#20302)
  • Parse selectors like [data-foo]div as two selectors instead of one (#20303)
  • Ensure @tailwindcss/postcss rebuilds when a preprocessor like Sass changes the input CSS without changing the input file on disk (#20310)
  • Ensure CSS nesting is handled even when Lightning CSS isn't run, such as in @tailwindcss/browser and Tailwind Play (#20124)
  • Prevent achromatic theme colors from shifting hue when mixed in polar color spaces like oklch (#20314)
  • Ensure --spacing(0) is optimized to 0px instead of 0 so it remains a <length> when used in calc(…) (#20319)
  • Load @parcel/watcher only when needed in @tailwindcss/cli --watch mode, so one-off builds and --watch --poll work when @parcel/watcher can't be loaded (#20325)
  • Use explicit platform fonts instead of system-ui and ui-sans-serif so CJK text respects the page's lang attribute on Windows (#20318)
  • Prevent @tailwindcss/upgrade from rewriting ignored files when run from a subdirectory (#20329)
  • Ensure earlier @source rules pointing to nested files are scanned when later @source rules point to files in parent folders (#20335)
  • Prevent @tailwindcss/vite from triggering full page reloads when scanned files are processed by Vite but haven't been loaded as modules yet (#20336)

[4.3.2] - 2026-06-26

Fixed

  • Support bare spacing values for auto-rows-* and auto-cols-* utilities (e.g. auto-rows-12 and auto-cols-16) (#20229)
  • Prevent @tailwindcss/cli in --watch mode from crashing on Windows when @source points to a directory that doesn't exist (#20242)
  • Prevent @tailwindcss/vite from crashing in Deno v2.8.x when context.parentURL is not a valid URL (#20245)
  • Ensure @tailwindcss/cli in --watch mode rebuilds when the input CSS file changes in an ignored directory (#20246)
  • Allow @variant rules used in addBase(…) to use custom variants defined later (#20247)
  • Prevent @tailwindcss/vite from crashing during HMR when scanned files or directories are deleted (#20259)
  • Generate font-size instead of color declarations for text-[--spacing(…)] (#20260)
  • Prevent @source patterns from scanning unrelated sibling files and folders (#20263)
  • Extract class candidates adjacent to Template Toolkit delimiters like %]…[% in .tt, .tt2, and .tx files (#20269)
  • Extract class candidates from conditional Maud syntax like p.text-black[condition] (#20269)
  • Prevent @position-try rules from triggering unknown at-rule warnings when optimizing CSS (#20277)
  • Support class suggestions for named opacity modifiers from --opacity theme values (#20287)
  • Prevent type errors in @tailwindcss/postcss when used with newer PostCSS patch releases (#20289)
Commits

Updates @tanstack/virtual-core from 3.17.2 to 3.17.4

Release notes

Sourced from @​tanstack/virtual-core's releases.

@​tanstack/virtual-core@​3.17.4

Patch Changes

  • #1224 6cbecd8 - Improve multi-lane virtualization performance: replace the backward scan in getMeasurements with an incremental per-lane argmin (O(lanes) shortest-lane lookup). Placement output is unchanged and the single-lane fast path is untouched.

  • #1223 d49cc52 - Made gap option changes invalidate measurements

  • #1220 cf7834d - Reset iOS gesture/deferral state in cleanup() so it no longer leaks across scroll element swaps.

@​tanstack/virtual-core@​3.17.3

Patch Changes

  • #1206 767ead4 - Cut per-scroll-frame allocations on the default lanes === 1 path. Range computation previously allocated an options object and two closures on every scroll event; it now does the same work allocation-free, reducing GC pressure during continuous scroll.

  • #1212 bc8643b - Don't latch a scroll direction from the read-back of the virtualizer's own adjustment write

    applyScrollAdjustment folds the pending adjustment into scrollOffset eagerly, so the browser's scroll event for that write arrives at exactly the held offset. The scroll-direction computation treated that equality as 'backward', which made the default shouldAdjustScrollPositionOnItemSizeChange skip above-viewport re-measure compensation for the rest of the isScrollingResetDelay window — so during multi-frame reflows (e.g. a side pane's width animation re-wrapping rows while scrolled up) most frames went uncompensated and the viewport drifted. An event at the held offset carries no direction information, so the direction now stays unchanged in that case; real gestures always move the offset and still latch normally.

Changelog

Sourced from @​tanstack/virtual-core's changelog.

3.17.4

Patch Changes

  • #1224 6cbecd8 - Improve multi-lane virtualization performance: replace the backward scan in getMeasurements with an incremental per-lane argmin (O(lanes) shortest-lane lookup). Placement output is unchanged and the single-lane fast path is untouched.

  • #1223 d49cc52 - Made gap option changes invalidate measurements

  • #1220 cf7834d - Reset iOS gesture/deferral state in cleanup() so it no longer leaks across scroll element swaps.

3.17.3

Patch Changes

  • #1206 767ead4 - Cut per-scroll-frame allocations on the default lanes === 1 path. Range computation previously allocated an options object and two closures on every scroll event; it now does the same work allocation-free, reducing GC pressure during continuous scroll.

  • #1212 bc8643b - Don't latch a scroll direction from the read-back of the virtualizer's own adjustment write

    applyScrollAdjustment folds the pending adjustment into scrollOffset eagerly, so the browser's scroll event for that write arrives at exactly the held offset. The scroll-direction computation treated that equality as 'backward', which made the default shouldAdjustScrollPositionOnItemSizeChange skip above-viewport re-measure compensation for the rest of the isScrollingResetDelay window — so during multi-frame reflows (e.g. a side pane's width animation re-wrapping rows while scrolled up) most frames went uncompensated and the viewport drifted. An event at the held offset carries no direction information, so the direction now stays unchanged in that case; real gestures always move the offset and still latch normally.

Commits
  • e2cb096 ci: Version Packages (#1225)
  • cf7834d fix(virtual-core): reset iOS gesture/deferral state on cleanup (#1220)
  • d49cc52 fix(virtual-core): invalidate measurements when gap option changes (#1223)
  • 6cbecd8 perf(virtual-core): replace multi-lane backward scan with incremental laneEnd...
  • 151e9f4 ci: Version Packages (#1213)
  • 767ead4 perf(virtual-core): drop closures from calculateRange on the lanes===1 ho...
  • bc8643b fix(virtual-core): viewport drifts when above-viewport rows resize over multi...
  • See full diff in compare view

Updates astro from 7.0.3 to 7.1.1

Release notes

Sourced from astro's releases.

astro@7.1.1

Patch Changes

astro@7.1.0

Minor Changes

  • #17302 5f4dc03 Thanks @​astrobot-houston! - Adds a new deferRender option to the glob() content loader

    When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.

    This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehyp...

    Description has been truncated

@dependabot
chore(deps): bump the production-dependencies group across 1 director…
6ec444b 
…y with 27 updates

Bumps the production-dependencies group with 27 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [typescript](https://github.com/microsoft/TypeScript) | `6.0.3` | `7.0.2` |
| [@astrojs/cloudflare](https://github.com/withastro/astro/tree/HEAD/packages/integrations/cloudflare) | `14.0.1` | `14.1.3` |
| [@sentry/browser](https://github.com/getsentry/sentry-javascript) | `10.62.0` | `10.66.0` |
| [@tabler/icons](https://github.com/tabler/tabler-icons) | `3.44.0` | `3.45.0` |
| [@tailwindcss/vite](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite) | `4.3.1` | `4.3.3` |
| [@tanstack/virtual-core](https://github.com/TanStack/virtual/tree/HEAD/packages/virtual-core) | `3.17.2` | `3.17.4` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.0.3` | `7.1.1` |
| [posthog-js](https://github.com/PostHog/posthog-js) | `1.395.0` | `1.404.1` |
| [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.3.1` | `4.3.3` |
| [@tanstack/react-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual) | `3.14.5` | `3.14.6` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.23.0` | `1.25.0` |
| [shadcn](https://github.com/shadcn-ui/ui/tree/HEAD/packages/shadcn) | `4.12.0` | `4.13.1` |
| [@astrojs/starlight](https://github.com/withastro/starlight/tree/HEAD/packages/starlight) | `0.41.1` | `0.41.3` |
| [sharp](https://github.com/lovell/sharp) | `0.35.2` | `0.35.3` |
| [three](https://github.com/mrdoob/three.js) | `0.185.0` | `0.185.1` |
| [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1089.0` | `3.1090.0` |
| [@babel/parser](https://github.com/babel/babel/tree/HEAD/packages/babel-parser) | `8.0.0` | `8.0.4` |
| [@hono/mcp](https://github.com/honojs/middleware/tree/HEAD/packages/mcp) | `0.3.0` | `0.3.1` |
| [@hono/node-server](https://github.com/honojs/node-server) | `2.0.6` | `2.0.10` |
| [@sentry/node](https://github.com/getsentry/sentry-javascript) | `10.62.0` | `10.66.0` |
| [@ungap/structured-clone](https://github.com/ungap/structured-clone) | `1.3.2` | `1.3.3` |
| [add-mcp](https://github.com/neon-solutions/add-mcp) | `1.13.0` | `1.14.0` |
| [graphql](https://github.com/graphql/graphql-js) | `17.0.1` | `17.0.2` |
| [hono](https://github.com/honojs/hono) | `4.12.27` | `4.12.31` |
| [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.38.6` | `5.45.2` |
| [whatwg-url](https://github.com/jsdom/whatwg-url) | `16.0.1` | `17.1.0` |
| [ws](https://github.com/websockets/ws) | `8.21.0` | `8.21.1` |



Updates `typescript` from 6.0.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/commits)

Updates `@astrojs/cloudflare` from 14.0.1 to 14.1.3
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/cloudflare/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/cloudflare@14.1.3/packages/integrations/cloudflare)

Updates `@sentry/browser` from 10.62.0 to 10.66.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.62.0...10.66.0)

Updates `@tabler/icons` from 3.44.0 to 3.45.0
- [Release notes](https://github.com/tabler/tabler-icons/releases)
- [Commits](tabler/tabler-icons@v3.44.0...v3.45.0)

Updates `@tailwindcss/vite` from 4.3.1 to 4.3.3
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.3/packages/@tailwindcss-vite)

Updates `@tanstack/virtual-core` from 3.17.2 to 3.17.4
- [Release notes](https://github.com/TanStack/virtual/releases)
- [Changelog](https://github.com/TanStack/virtual/blob/main/packages/virtual-core/CHANGELOG.md)
- [Commits](https://github.com/TanStack/virtual/commits/@tanstack/virtual-core@3.17.4/packages/virtual-core)

Updates `astro` from 7.0.3 to 7.1.1
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.1.1/packages/astro)

Updates `posthog-js` from 1.395.0 to 1.404.1
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.395.0...posthog-js@1.404.1)

Updates `tailwindcss` from 4.3.1 to 4.3.3
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.3/packages/tailwindcss)

Updates `@tanstack/react-virtual` from 3.14.5 to 3.14.6
- [Release notes](https://github.com/TanStack/virtual/releases)
- [Changelog](https://github.com/TanStack/virtual/blob/main/packages/react-virtual/CHANGELOG.md)
- [Commits](https://github.com/TanStack/virtual/commits/@tanstack/react-virtual@3.14.6/packages/react-virtual)

Updates `lucide-react` from 1.23.0 to 1.25.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.25.0/packages/lucide-react)

Updates `shadcn` from 4.12.0 to 4.13.1
- [Release notes](https://github.com/shadcn-ui/ui/releases)
- [Changelog](https://github.com/shadcn-ui/ui/blob/main/packages/shadcn/CHANGELOG.md)
- [Commits](https://github.com/shadcn-ui/ui/commits/shadcn@4.13.1/packages/shadcn)

Updates `@astrojs/starlight` from 0.41.1 to 0.41.3
- [Release notes](https://github.com/withastro/starlight/releases)
- [Changelog](https://github.com/withastro/starlight/blob/main/packages/starlight/CHANGELOG.md)
- [Commits](https://github.com/withastro/starlight/commits/@astrojs/starlight@0.41.3/packages/starlight)

Updates `sharp` from 0.35.2 to 0.35.3
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.35.2...v0.35.3)

Updates `three` from 0.185.0 to 0.185.1
- [Release notes](https://github.com/mrdoob/three.js/releases)
- [Commits](https://github.com/mrdoob/three.js/commits)

Updates `@aws-sdk/client-s3` from 3.1089.0 to 3.1090.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1090.0/clients/client-s3)

Updates `@babel/parser` from 8.0.0 to 8.0.4
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v8.0.4/packages/babel-parser)

Updates `@hono/mcp` from 0.3.0 to 0.3.1
- [Release notes](https://github.com/honojs/middleware/releases)
- [Changelog](https://github.com/honojs/middleware/blob/main/packages/mcp/CHANGELOG.md)
- [Commits](https://github.com/honojs/middleware/commits/@hono/mcp@0.3.1/packages/mcp)

Updates `@hono/node-server` from 2.0.6 to 2.0.10
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v2.0.6...v2.0.10)

Updates `@sentry/node` from 10.62.0 to 10.66.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.62.0...10.66.0)

Updates `@ungap/structured-clone` from 1.3.2 to 1.3.3
- [Commits](ungap/structured-clone@v1.3.2...v1.3.3)

Updates `add-mcp` from 1.13.0 to 1.14.0
- [Release notes](https://github.com/neon-solutions/add-mcp/releases)
- [Changelog](https://github.com/neon-solutions/add-mcp/blob/main/CHANGELOG.md)
- [Commits](neon-solutions/add-mcp@v1.13.0...v1.14.0)

Updates `graphql` from 17.0.1 to 17.0.2
- [Release notes](https://github.com/graphql/graphql-js/releases)
- [Commits](graphql/graphql-js@v17.0.1...v17.0.2)

Updates `hono` from 4.12.27 to 4.12.31
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.27...v4.12.31)

Updates `posthog-node` from 5.38.6 to 5.45.2
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.45.2/packages/node)

Updates `whatwg-url` from 16.0.1 to 17.1.0
- [Release notes](https://github.com/jsdom/whatwg-url/releases)
- [Commits](jsdom/whatwg-url@v16.0.1...v17.1.0)

Updates `ws` from 8.21.0 to 8.21.1
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.21.0...8.21.1)

---
updated-dependencies:
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: "@astrojs/cloudflare"
  dependency-version: 14.1.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@sentry/browser"
  dependency-version: 10.66.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@tabler/icons"
  dependency-version: 3.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@tailwindcss/vite"
  dependency-version: 4.3.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@tanstack/virtual-core"
  dependency-version: 3.17.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: astro
  dependency-version: 7.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: posthog-js
  dependency-version: 1.404.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: tailwindcss
  dependency-version: 4.3.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@tanstack/react-virtual"
  dependency-version: 3.14.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: lucide-react
  dependency-version: 1.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: shadcn
  dependency-version: 4.13.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@astrojs/starlight"
  dependency-version: 0.41.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: sharp
  dependency-version: 0.35.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: three
  dependency-version: 0.185.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@aws-sdk/client-s3"
  dependency-version: 3.1090.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@babel/parser"
  dependency-version: 8.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@hono/mcp"
  dependency-version: 0.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@hono/node-server"
  dependency-version: 2.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@sentry/node"
  dependency-version: 10.66.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@ungap/structured-clone"
  dependency-version: 1.3.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: add-mcp
  dependency-version: 1.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: graphql
  dependency-version: 17.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: hono
  dependency-version: 4.12.31
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: posthog-node
  dependency-version: 5.45.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: whatwg-url
  dependency-version: 17.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: ws
  dependency-version: 8.21.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 19, 2026
@greptile-apps

greptile-apps Bot commented Jul 19, 2026

Copy link
Copy Markdown
Contributor

PR author is in the excluded authors list.

@socket-security

socket-security Bot commented Jul 19, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addedastro@​7.1.1661008798100
Added@​tanstack/​react-virtual@​3.14.61001006997100
Addedposthog-js@​1.404.19210072100100
Addedposthog-node@​5.45.27210079100100
Addedhono@​4.12.31721009796100
Added@​tanstack/​virtual-core@​3.17.4991007397100
Addedadd-mcp@​1.14.07610010096100
Added@​sentry/​browser@​10.66.0781009196100
Added@​types/​three@​0.185.11001008090100
Addedlucide-react@​1.25.0100100989680
Added@​babel/​parser@​8.0.41001008195100
Addedtailwindcss@​4.3.31001008198100
Added@​astrojs/​cloudflare@​14.1.31001008498100
Added@​astrojs/​starlight@​0.41.3981008597100
Addedtypescript@​7.0.29410089100100
Added@​tailwindcss/​vite@​4.3.31001008998100
Added@​ungap/​structured-clone@​1.3.31001009989100
Addedshadcn@​4.13.1981009197100
Updatedwhatwg-url@​16.0.1 ⏵ 17.1.0100100100 +191 -1100
Added@​tabler/​icons@​3.45.010010010091100
Added@​hono/​mcp@​0.3.1981009592100
Addedthree@​0.185.1981009893100
Addedsharp@​0.35.39710010094100
Added@​sentry/​node@​10.66.0981009596100
Added@​hono/​node-server@​2.0.109810010096100
Addedws@​8.21.19910010097100
Addedgraphql@​17.0.210010010097100
Added@​aws-sdk/​client-s3@​3.1090.09910010098100

View full report

@socket-security

socket-security Bot commented Jul 19, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm astro is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: apps/catalog/package.json → npm/astro@7.1.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/astro@7.1.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

github-actions Bot and others added 5 commits July 19, 2026 09:16
@github-actions @ian-pascoe
chore: version packages (#224)
42af0d4 
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@ian-pascoe
fix: harden legacy host-state migration and documentation (#228)
f24edf6 
* fix: harden legacy storage migration

* test: cover shared legacy admin state
@ian-pascoe
feat: publish standalone Docker Compose deployments (#227)
60f7cc8 
* feat: publish standalone compose deployments

* fix: address standalone compose review
@github-actions @ian-pascoe
chore: version packages (#229)
31c01c0 
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@ian-pascoe
fix: support dependency upgrades with TypeScript 7
88a9604
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ian-pascoe