chore(deps): bump the js-minor-patch group across 1 directory with 10 updates

[dependabot]

Bumps the js-minor-patch group with 9 updates in the / directory:

Package	From	To
lucide-react	1.27.0	1.28.0
puppeteer	25.4.0	25.5.0
@types/d3-geo	3.1.0	3.1.1
@types/react	19.2.17	19.2.18
@types/react-dom	19.2.3	19.2.4
@typescript-eslint/eslint-plugin	8.65.0	8.66.0
@vitejs/plugin-react	6.0.4	6.0.5
axios	1.18.1	1.19.0
vite	8.1.5	8.2.0

Updates lucide-react from 1.27.0 to 1.28.0

Release notes

Sourced from lucide-react's releases.

Version 1.28.0

What's Changed

• feat(icons): improve calendar icons centre of gravity by @​karsa-mistmere in lucide-icons/lucide#4614

Full Changelog: lucide-icons/lucide@1.27.0...1.28.0

Commits

• See full diff in compare view

Updates puppeteer from 25.4.0 to 25.5.0

Release notes

Sourced from puppeteer's releases.

puppeteer-core: v25.5.0

25.5.0 (2026-08-04)

🎉 Features

• roll to Firefox 153.0 (#15258) (6a54140)
• track dialog status (#15266) (9a6f646)

🛠️ Fixes

• disable WebUIOmniboxPopup and WebUIOmniboxAimPopup features (#15278) (5dc2964)
• do not override the user agent when nothing is emulated (#15274) (39c4653)
• forward headers to browserURL HTTP discovery and WebSocket connection (#15238) (948d870)
• reject PWA access if network conditions are configured (#15271) (6eb2b8c)
• roll to Chrome 151.0.7922.71 (#15272) (a7f07db)
• roll to Firefox 153.0.1 (#15269) (dd365cc)

📄 Documentation

• document units in page.metrics() (#15221) (eae2b9a)

🏗️ Refactor

• move some of the logger to constructor (#15282) (67d1467)
• use a enum to manage the prefixes (#15281) (c8faa53)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​puppeteer/browsers bumped from 3.0.6 to 3.1.0

puppeteer: v25.5.0

25.5.0 (2026-08-04)

♻️ Chores

• puppeteer: Synchronize puppeteer versions

Dependencies

• The following workspace dependencies were updated
  • dependencies

... (truncated)

Changelog

Sourced from puppeteer's changelog.

25.5.0 (2026-08-04)

♻️ Chores

• puppeteer: Synchronize puppeteer versions

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​puppeteer/browsers bumped from 3.0.6 to 3.1.0

🎉 Features

• roll to Firefox 153.0 (#15258) (6a54140)
• track dialog status (#15266) (9a6f646)

🛠️ Fixes

• disable WebUIOmniboxPopup and WebUIOmniboxAimPopup features (#15278) (5dc2964)
• do not override the user agent when nothing is emulated (#15274) (39c4653)
• forward headers to browserURL HTTP discovery and WebSocket connection (#15238) (948d870)
• reject PWA access if network conditions are configured (#15271) (6eb2b8c)
• roll to Chrome 151.0.7922.71 (#15272) (a7f07db)
• roll to Firefox 153.0.1 (#15269) (dd365cc)

📄 Documentation

• document units in page.metrics() (#15221) (eae2b9a)

🏗️ Refactor

• move some of the logger to constructor (#15282) (67d1467)
• use a enum to manage the prefixes (#15281) (c8faa53)

Commits

• f8d63c7 chore: release main (#15263)
• 1e871b0 chore(deps): bump the all group with 2 updates (#15280)
• dd365cc fix: roll to Firefox 153.0.1 (#15269)
• a7f07db fix: roll to Chrome 151.0.7922.71 (#15272)
• 8197e1a revert: run hooks even if we try to kill the process (#15288)
• 39c4653 fix: do not override the user agent when nothing is emulated (#15274)
• 67d1467 refactor: move some of the logger to constructor (#15282)
• c8faa53 refactor: use a enum to manage the prefixes (#15281)
• 3ab1b98 chore(deps): bump the all group in /website with 2 updates (#15279)
• 5dc2964 fix: disable WebUIOmniboxPopup and WebUIOmniboxAimPopup features (#15278)
• Additional commits viewable in compare view

Updates @types/d3-geo from 3.1.0 to 3.1.1

Commits

• See full diff in compare view

Updates @types/react from 19.2.17 to 19.2.18

Commits

• See full diff in compare view

Updates @types/react-dom from 19.2.3 to 19.2.4

Commits

• See full diff in compare view

Updates @typescript-eslint/eslint-plugin from 8.65.0 to 8.66.0

Release notes

Sourced from @​typescript-eslint/eslint-plugin's releases.

v8.66.0

8.66.0 (2026-08-03)

🚀 Features

• typescript-estree: handle import.defer() as ImportExpression (#12609)

🩹 Fixes

• eslint-plugin: [no-unnecessary-type-conversion] ignore shadowed built-ins (#12590)
• eslint-plugin: [prefer-nullish-coalescing] handle shadowed Boolean calls (#12591)
• eslint-plugin: [no-useless-default-assignment] don't report defaults used by other overloads (#12607)
• eslint-plugin: [no-unnecessary-type-parameters] check MappedType key remapping (#12588)
• eslint-plugin: [class-literal-property-style] preserve type annotations and don't drop decorators (#12617)
• website: list onUnsupportedTypeScriptVersion in parser options (#12585)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Kirk Waiblinger @​kirkwaiblinger
• Steffen Schroeder
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @​typescript-eslint/eslint-plugin's changelog.

8.66.0 (2026-08-03)

🩹 Fixes

• eslint-plugin: [class-literal-property-style] preserve type annotations and don't drop decorators (#12617)
• eslint-plugin: [no-unnecessary-type-parameters] check MappedType key remapping (#12588)
• eslint-plugin: [no-useless-default-assignment] don't report defaults used by other overloads (#12607)
• eslint-plugin: [prefer-nullish-coalescing] handle shadowed Boolean calls (#12591)
• eslint-plugin: [no-unnecessary-type-conversion] ignore shadowed built-ins (#12590)

❤️ Thank You

• Evyatar Daud @​StyleShit
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• e51b11b chore(release): publish 8.66.0
• 20cb15e chore(eslint-plugin): split prefer-optional-chain.test.ts in multiple files (...
• 780a8c5 docs(eslint-plugin): [member-ordering] add lacking commas in default member t...
• 08dd427 fix(eslint-plugin): [class-literal-property-style] preserve type annotations ...
• 6be25d3 fix(eslint-plugin): [no-unnecessary-type-parameters] check MappedType key rem...
• 8826d0e fix(eslint-plugin): [no-useless-default-assignment] don't report defaults use...
• 7aecc1c fix(eslint-plugin): [prefer-nullish-coalescing] handle shadowed Boolean calls...
• 5ffa760 fix(eslint-plugin): [no-unnecessary-type-conversion] ignore shadowed built-in...
• f282f84 chore(eslint-plugin): fix all eslint-plugin/require-test-error-positions (#...
• c8cafa4 docs: [unified-signatures] caveats regarding signatures merging (#12581)
• See full diff in compare view

Updates @typescript-eslint/parser from 8.65.0 to 8.66.0

Release notes

Sourced from @​typescript-eslint/parser's releases.

v8.66.0

8.66.0 (2026-08-03)

🚀 Features

• typescript-estree: handle import.defer() as ImportExpression (#12609)

🩹 Fixes

• eslint-plugin: [no-unnecessary-type-conversion] ignore shadowed built-ins (#12590)
• eslint-plugin: [prefer-nullish-coalescing] handle shadowed Boolean calls (#12591)
• eslint-plugin: [no-useless-default-assignment] don't report defaults used by other overloads (#12607)
• eslint-plugin: [no-unnecessary-type-parameters] check MappedType key remapping (#12588)
• eslint-plugin: [class-literal-property-style] preserve type annotations and don't drop decorators (#12617)
• website: list onUnsupportedTypeScriptVersion in parser options (#12585)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Kirk Waiblinger @​kirkwaiblinger
• Steffen Schroeder
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @​typescript-eslint/parser's changelog.

8.66.0 (2026-08-03)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• e51b11b chore(release): publish 8.66.0
• See full diff in compare view

Updates @vitejs/plugin-react from 6.0.4 to 6.0.5

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.0.5

Fixed the react compiler preset filter to be linear (#1353)

The improved filter in v6.0.3 was non-linear and caused a performance regression (#1349). The filter was changed to be linear to avoid that.

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.0.5 (2026-07-30)

Fixed the react compiler preset filter to be linear (#1353)

The improved filter in v6.0.3 was non-linear and caused a performance regression (#1349). The filter was changed to be linear to avoid that.

Commits

• 68c0cb8 release: plugin-react@6.0.5 (#1362)
• 555cdbc fix(react): make the react compiler preset filter linear (#1353)
• a00a9f8 fix(deps): update all non-major dependencies (#1327)
• See full diff in compare view

Updates axios from 1.18.1 to 1.19.0

Release notes

Sourced from axios's releases.

v1.19.0 - July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

• Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

• Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)
• Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
• HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

• Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)
• Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)
• Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)
• Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)
• URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11024, #11038)
• Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)
• Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)
• Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)
• Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

• Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)
• Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)
• Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)
• Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)
• Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)
• Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

• @​afonsojramos (#11028)
• @​MahinAnowar (#11006)
• @​yassertawfik4 (#11024)
• @​AnandSundar (#11029)
• @​lin-hongkuan (#11035)
• @​Wali007-lab (#11054)
• @​magicdawn (#11043)
• @​andrewkernel (#11053)
• @​Sagargupta16 (#11059)
• @​Rpaudel379 (#11078)

... (truncated)

Changelog

Sourced from axios's changelog.

v1.19.0 — July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

• Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

• Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)
• Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
• HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

• Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)

• Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)

• Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)

• Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)

• URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11008, #11038)

• Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)

• Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)

• Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)

• Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

• Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)
• Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)
• Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)
• Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)
• Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)
• Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

• @​afonsojramos (#11028)
• @​MahinAnowar (#11006)
• @​yassertawfik4 (#11024)
• @​AnandSundar (#11029)
• @​lin-hongkuan (#11035)
• @​Wali007-lab (#11054)
• @​magicdawn (#11043)
• @​andrewkernel (#11053)
• @​Sagargupta16 (#11059)

... (truncated)

Commits

• 311fcc5 chore(release): prepare release 1.19.0 (#11095)
• cb4fd74 chore(deps): bump axios from 1.16.1 to 1.18.1 in /docs (#11088)
• 004c93a chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 in the github-action...
• 122edde chore(deps-dev): bump the development_dependencies group with 3 updates (#11089)
• c44f8d0 ci: use bundled npm for v1 publish (#11083)
• 878bb29 fix(sandbox): resolve TypeError on constant variable path assignment (#11073)
• a092bae fix(core): synchronous interceptors swallow errors and proceed with request (...
• 3041b8f feat(HttpStatusCode): add missing 520 status code (#11067)
• 58b16c8 refactor(helpers): extract duplicated setFormDataHeaders into a shared helper...
• 3077e62 feat(types): Allow the Params property to be typed, instead of any (#11081)
• Additional commits viewable in compare view

Updates vite from 8.1.5 to 8.2.0

Release notes

Sourced from vite's releases.

create-vite@8.2.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.2.0

Please refer to CHANGELOG.md for details.

v8.2.0

Please refer to CHANGELOG.md for details.

v8.2.0-beta.0

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.2.0 (2026-07-30)

Features

• add input to server.fs.allow (#23035) (95a3cda)
• bundled-dev: reload once after rebuild instead of via the fallback page (#23106) (b24381d)
• bundled-dev: support worker file update accepted by HMR (#23068) (0d04351)
• config: include column in config incompatibility location (#23064) (8a24572)
• dev: resolve interface name for explicit host in network URLs (#22965) (3ac77d9)

Bug Fixes

• bundledDev: print build errors to the terminal when an HMR update fails (#23024) (41c4658)
• deps: update all non-major dependencies (#23069) (4c07b74)
• hmr: preserve environment snapshot during server restart (#22992) (b1186c3)
• importAnalysis: interop imports injected into optimized dep files by plugins (#23029) (8c2a87d)
• module-runner: keep stack trace interception working when Object.prototype is frozen (#23073) (599c5b0)
• server: strip base in indexHtml module graph lookup (#22932) (fa005d1)
• support resolving top-level input option with plugins (#23101) (41df81a)

Documentation

• config: correct cacheDir default fallback description (#23060) (aafa103)

Tests

• config CJS module vars in ESM case (#23010) (d8cd388)

8.2.0-beta.0 (2026-07-22)

Features

• add input option (#22642) (9beae37)
• config: warn features incompatible with native loader in bundle loader (#22850) (05302b0)
• css: export PostCSS config type for type-safe configs (#22792) (302c755)
• dev: label network URLs with their interface name (#22830) (78accc4)
• optimizer: support aube lockfile (#22813) (6319827)
• optimizer: support nub lockfile (#22891) (65d3604)
• update rolldown-related dependencies and use client-side HMR in bundled-dev (#22961) (960e9ef)
• wasm: expand test suite, unwrap WebAssembly.Global and enable js-string builtins (#22674) (9e79b51)

Bug Fixes

• build: map CSS chunks in chunk import maps (fix #22946) (#22947) (e16ff3a)
• config: exclude virtual modules from native config compat check (#22979) (2ced1fe)
• css: rewrite urls in OnceExit-injected content (#22983) (abb793e)
• deps: update all non-major dependencies (#22985) (04f345b)
• deps: update dependency magic-string to v1 (#22998) (c60b4d7)
• hmr: remove hot data after prune (#23002) (be96316)
• resolve root to real path (#22832) (55bba7b)

Performance Improvements

... (truncated)

Commits

• 24a611f release: v7.2.4
• 2d66b7b fix: revert "perf(deps): replace debug with obug (#21107)"
• a668014 release: v7.2.3
• acfe939 perf(deps): replace debug with obug (#21107)
• 4f8171e fix(deps): update all non-major dependencies (#21128)
• 5029720 chore(deps): update rolldown-related dependencies (#21127)
• 5909efd fix: allow multiple bindCLIShortcuts calls with shortcut merging (#21103)
• 39a0a15 chore(deps): update rolldown-related dependencies (#21095)
• 6a34ac3 fix(deps): update all non-major dependencies (#21096)
• 02ceaec chore(deps): update dependency @​rollup/plugin-commonjs to v29 (#21099)
• Additional commits viewable in compare view