Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 8 updates - #19

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-9ca204d44d
Closed

chore(deps): bump the production-dependencies group across 1 directory with 8 updates#19
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-9ca204d44d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 3, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the production-dependencies group with 8 updates in the / directory:

Package From To
@tanstack/react-router 1.170.18 1.170.33
dexie 4.4.4 4.4.5
lucide-react 1.25.0 1.42.0
papaparse 5.5.4 5.7.0
radix-ui 1.6.4 1.6.7
recharts 3.10.0 3.10.1
sonner 2.0.7 2.0.8
zod 4.4.3 4.5.4

Updates @tanstack/react-router from 1.170.18 to 1.170.33

Release notes

Sourced from @​tanstack/react-router's releases.

@​tanstack/react-router@​1.170.33

Patch Changes

  • #8165 2f20c00 - Exclude structural descendants below error and not-found boundaries from route lifecycle callbacks. Preserve lifecycle membership through invalidation, hydration, background reloads, and superseded navigation publication.

  • #8209 28a5e45 - Preserve falsy thrown values in React and Vue error boundaries. Type React and Vue boundary error components and onCatch callbacks as unknown. Solid boundary errors remain typed as Error; SSR now wraps non-Error loader errors to match Solid’s native boundary behavior, preserving the original value in cause. Router state and loader onError values are unchanged.

    When upgrading React or Vue, narrow boundary errors (for example, with error instanceof Error) before reading message or stack. ErrorComponentProps<TError> remains available for values narrowed to a specific error type. Route onError types are unchanged.

  • #8161 f0b5eda - Retain successful not-found matches as terminal shared boundaries during client navigation, preserving route context while the destination loads.

  • #8251 0497cae - Use URL.canParse for absolute URL checks in links, navigation, redirects, and build configuration. Preserve a URL constructor fallback for older browsers.

  • #8169 0caf6b9 - Fix route-scoped useMatch, useSearch, and useParams APIs to forward the shouldThrow option and preserve optional return types when shouldThrow: false.

  • #8257 cf166d1 - Fix repeated innerHTML writes for unchanged styles and data scripts during React re-renders. This prevents unnecessary CSS parsing and Trusted Types errors during client navigation.

  • Updated dependencies [edf0e16, 2f20c00, 28a5e45, 08eff50, 216c0c4, 2f91503, f0b5eda, 50eafca, 0497cae, ee28348, 9035abc, c18e690]:

    • @​tanstack/router-core@​1.171.28
    • @​tanstack/history@​1.162.2
Changelog

Sourced from @​tanstack/react-router's changelog.

1.170.33

Patch Changes

  • #8165 2f20c00 - Exclude structural descendants below error and not-found boundaries from route lifecycle callbacks. Preserve lifecycle membership through invalidation, hydration, background reloads, and superseded navigation publication.

  • #8209 28a5e45 - Preserve falsy thrown values in React and Vue error boundaries. Type React and Vue boundary error components and onCatch callbacks as unknown. Solid boundary errors remain typed as Error; SSR now wraps non-Error loader errors to match Solid’s native boundary behavior, preserving the original value in cause. Router state and loader onError values are unchanged.

    When upgrading React or Vue, narrow boundary errors (for example, with error instanceof Error) before reading message or stack. ErrorComponentProps<TError> remains available for values narrowed to a specific error type. Route onError types are unchanged.

  • #8161 f0b5eda - Retain successful not-found matches as terminal shared boundaries during client navigation, preserving route context while the destination loads.

  • #8251 0497cae - Use URL.canParse for absolute URL checks in links, navigation, redirects, and build configuration. Preserve a URL constructor fallback for older browsers.

  • #8169 0caf6b9 - Fix route-scoped useMatch, useSearch, and useParams APIs to forward the shouldThrow option and preserve optional return types when shouldThrow: false.

  • #8257 cf166d1 - Fix repeated innerHTML writes for unchanged styles and data scripts during React re-renders. This prevents unnecessary CSS parsing and Trusted Types errors during client navigation.

  • Updated dependencies [edf0e16, 2f20c00, 28a5e45, 08eff50, 216c0c4, 2f91503, f0b5eda, 50eafca, 0497cae, ee28348, 9035abc, c18e690]:

    • @​tanstack/router-core@​1.171.28
    • @​tanstack/history@​1.162.2

1.170.32

Patch Changes

1.170.31

Patch Changes

  • Updated dependencies [3e016ac]:
    • @​tanstack/router-core@​1.171.26

1.170.30

Patch Changes

  • #8084 5d3785d - preserve pending UI across retained routes

  • #8068 f75cada - direct export of CatchBoundary class component, remove function wrapper

  • Updated dependencies [5d3785d, 63d2cc9]:

    • @​tanstack/router-core@​1.171.25

1.170.29

... (truncated)

Commits
  • a58e01c ci: Version Packages (#8182)
  • 08eff50 fix(router-core): fix dangling references in published declarations (#8207)
  • cf166d1 fix(react-router): avoid rewriting unchanged head assets (#8257)
  • 07b3bc9 test(react-router): cover pending and not-found context (#8243)
  • 2f20c00 fix(router-core): skip lifecycle callbacks below fallback boundaries (#8165)
  • 0497cae perf(router): use URL.canParse for absolute URL checks (#8251)
  • 28a5e45 fix(router): handle unknown error boundary values (#8209)
  • f0b5eda fix(router-core): retain not-found boundary during navigation (#8161)
  • 0caf6b9 fix: preserve shouldThrow in route-scoped hooks (#8169)
  • a5a5bac ci: Version Packages (#8133)
  • Additional commits viewable in compare view

Updates dexie from 4.4.4 to 4.4.5

Release notes

Sourced from dexie's releases.

Dexie v4.4.5

This is a maintenance release that fixes an issue with indexes named after inherited Object properties and improves authentication recovery in dexie-cloud-addon.

Related Package Releases

Package Version
dexie 4.4.5
dexie-cloud-addon 4.4.14
dexie-react-hooks 4.4.0 (no change)
y-dexie 4.4.0 (no change)
dexie-export-import 4.4.0 (no change)

Bug Fixes

dexie@4.4.5

  • fix: don't crash when an index is named constructor — Tables with a primary key or index named constructor could cause db.open() to fail with TypeError: indexList.push is not a function. The internal index lookup now uses an object without a prototype, avoiding collisions with inherited Object.prototype properties such as constructor, toString, and valueOf. (#2325, fixes #1920). Contributed by @​tarann26.

dexie-cloud-addon@4.4.14

  • fix: recover from failed refresh-token renewal — When a locally unexpired refresh token is rejected by the server, login() now falls back to the regular fetchTokens authentication path instead of propagating the refresh error. This allows custom authentication integrations to silently obtain new tokens when possible, or trigger their normal login flow when required. OAuth redirect errors continue to propagate normally. (#2326). Fixed by @​liz709 and @​dfahlander.
Commits
  • 22bdff1 dexie@4.4.5
  • 6a7b452 fix(dbcore): don't crash when an index is named 'constructor' (#2325)
  • dbaf960 dexie-cloud-addon@4.4.14
  • 3fd4745 fix(dexie-cloud-addon): fall back to fetchTokens when refresh fails
  • 962052f updated pnpm lockfile
  • 12038d1 Updated deps of dexie-cloud-todo-app
  • See full diff in compare view

Updates lucide-react from 1.25.0 to 1.42.0

Release notes

Sourced from lucide-react's releases.

Version 1.42.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.41.0...1.42.0

Version 1.41.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.40.0...1.41.0

Version 1.40.0

What's Changed

... (truncated)

Commits
  • 94e4cb9 chore(dependencies): Update dependencies (#4806)
  • 99d25bd feat(packages): extract icon build logic into @lucide/shared (#4409)
  • 75b5516 chore(dev): upgrade ESLint to latest compatible stack (v10) (#4378)
  • 0f8d48b test(packages): updates unit test snapshots with face-slightly-smiling (#4676)
  • See full diff in compare view

Updates papaparse from 5.5.4 to 5.7.0

Release notes

Sourced from papaparse's releases.

5.7.0

We are happy to annunce a new minor release of PapaParse.

This release includes the following change:

Add the `downloadTimeout` option to abort slow remote requests after a configurable duration (https://github.com/mholt/PapaParse/pull/1138)

Thanks @​Kocayilmaz for contributing it

5.6.0

We are happy to annunce a new minor release of PapaParse.

This release includes the following change:

  • Remove jQuery as dependency (#1137)

Thanks @​Kocayilmaz for contributing it

Changelog

Sourced from papaparse's changelog.

5.7.0

Features

  • Add the downloadTimeout option to abort slow remote requests after a configurable duration (#1138, #786)

5.6.1

Bug Fixes

  • Call transformHeader only once per header in streaming mode (#1130)
  • Prevent header de-duplication from running again after resuming parsing (#1135)

5.6.0

Features

  • Remove the optional jQuery plugin integration (#1137)

5.5.5

Bug Fixes

  • Improve automatic delimiter detection by prioritizing row consistency over field count (#1128, #1077)
  • Serialize dates with Date.toISOString(), preserving expanded years and writing invalid dates as empty fields (#1140)
Commits
  • 555c1c1 Minor version bump
  • a5cc2dc Patch version bump
  • 29e3a09 Add downloadTimeout option to abort slow remote requests (#1138)
  • 2e20001 Use tabs for identation on comment
  • b98bd0e Simplify comments
  • a869cd9 Fix header de-duplication re-running on every resumed row (#1135)
  • b3b6a64 Remove coment describing old behaviour
  • 8dd3318 call transformHeader once per header in streaming mode (#1130)
  • e6c2b7b Update CHANGELOG
  • bc382b7 Minor version bump
  • Additional commits viewable in compare view

Updates radix-ui from 1.6.4 to 1.6.7

Changelog

Sourced from radix-ui's changelog.

1.6.6, 1.6.7

  • Reverted breaking changes that caused compatibility issues with React Server Components.

1.6.5

  • Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation.
Commits

Updates recharts from 3.10.0 to 3.10.1

Release notes

Sourced from recharts's releases.

v3.10.1

What's Changed

New Contributors

Full Changelog: recharts/recharts@v3.10.0...v3.10.1

Commits
  • ffb9187 3.10.1
  • 411b6f2 fix(bar): keep barGap correct when maxBarSize clamps the bar width (#2774) (#...
  • 58c321b chore(deps-dev): bump postcss from 8.5.10 to 8.5.22 (#7581)
  • f08972b chore(deps-dev): bump the storybook group with 8 updates (#7578)
  • 89599d0 chore(deps-dev): bump chromatic from 11.29.0 to 18.1.0 (#7579)
  • 3da7d87 chore(deps-dev): bump typescript-eslint from 8.64.0 to 8.65.0 in the typescri...
  • 9764273 chore(deps-dev): bump marked from 18.0.5 to 18.0.7 (#7577)
  • a5d7737 fix(tooltip): fall back to index-based search when label-based search returns...
  • 497e8df chore(deps-dev): bump fast-uri from 3.1.2 to 3.1.4 (#7576)
  • 0776eb0 chore(deps): bump immer from 11.1.9 to 11.1.15 (#7575)
  • Additional commits viewable in compare view

Updates sonner from 2.0.7 to 2.0.8

Release notes

Sourced from sonner's releases.

v2.0.8

What's Changed

New Contributors

Full Changelog: emilkowalski/sonner@v2.0.7...v2.0.8

Commits

Updates zod from 4.4.3 to 4.5.4

Release notes

Sourced from zod's releases.

v4.5.4

Commits:

  • 84e416fbf4740527bbc8f319634f4e1b065bb42c fix(v4): stop the cycle walk from firing a default factory (#6500)
  • e8e206fa33ac5fe7ce20a2beb12d57b1cb3df653 4.5.4

v4.5.3

Commits:

  • e6b6ab347675cd2bd54b1bdbed16f98c59be82a9 docs(blog): widen the z.compile example to a 20-property schema
  • 87d6464418582bb96fc665a01f852ca6da324ad0 fix(docs): drop the OG description when the title wraps past two lines
  • 99fce394a026823e602b9c30d8d5d9f5f1932ce7 bench(v4): z.compile() against zod-compiler (#6499)
  • e3a695b6bf3f0d591ea682816e3cdaea04b0f967 docs(v4): record the email regex and container output-shape findings under Open
  • 7e24a24288183ce02554f1ded7775d0650a7b7e6 docs(blog): drop the reading time and put a GitHub link in the navbar
  • eab51ff3592b2d11d863f4ee4d5452f31a3de1b6 fix(v4): emit record numeric keys as strings in toJSONSchema (#6497)

v4.5.2

Commits:

  • a354314ac04fdd5484aa62dd5c3a4b553211a0e4 fix(docs): keep blog posts out of the docs collection (#6484)
  • d378c42aff6869f0929058a7923cd775880f5c4c ci: drop canary publishing from the release workflow (#6487)
  • 212b941791e7faae078e17645eb612824fd8f79a fix(v4): let a prototype method getter answer a bare call so vi.spyOn works (#6488)
  • e7576f542a7bc7ef3cc5eeec237714fd0e6b6e98 docs(blog): let the page show through the navbar in dark mode (#6489)
  • fedb06fafe33a66ce0b5c236ad2557e0a5a170fe fix(docs): match the blog TOC hover bar to the 2px active indicator
  • 6c932fcb2eea6eb671710ea058ca9fdc382ada89 chore: bump devcontainer image to Node 24 (#6470)
  • 6635d9dd367a664109de83c021995821f48efa29 docs(blog): soften the "method memoization" attribution
  • 019ae299cc75daa132bf1acf59086a520abf6b85 fix(docs): drop ISR on the docs route so the home page hydrates
  • 652bb438aa4c626c1cd7948c6849c4691239fca7 chore(docs): drop the scroll log from the route-change scroller
  • 571c8e8a3d73b4305f4abfdd6977773cc12f2bf5 fix(docs): render blog tabs with the stock fumadocs tab card
  • 9a193aa24b4efa3b315b91d4c56c8bc385b8513f 4.5.2

v4.5.1

Commits:

  • 2e862dbf89da2835e5206a8fd3d3be61afe3cf7f ci: gate the GitHub release and JSR publish on the version being live on npm
  • 8e03380510db36fa6fda979fc78a375fdea8021c 4.5.1

v4.5.0

Zod 4.5 is now available.

npm install zod@latest

At a glance:

... (truncated)

Commits
  • e8e206f 4.5.4
  • 84e416f fix(v4): stop the cycle walk from firing a default factory (#6500)
  • 1a16102 4.5.3
  • eab51ff fix(v4): emit record numeric keys as strings in toJSONSchema (#6497)
  • 7e24a24 docs(blog): drop the reading...

    Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 3, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/production-dependencies-9ca204d44d branch 3 times, most recently from 436095c to 628e037 Compare September 6, 2026 03:59
@dependabot
chore(deps): bump the production-dependencies group across 1 director…
0e0bc50 
…y with 8 updates

Bumps the production-dependencies group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@tanstack/react-router](https://github.com/TanStack/router/tree/HEAD/packages/react-router) | `1.170.18` | `1.170.33` |
| [dexie](https://github.com/dexie/Dexie.js) | `4.4.4` | `4.4.5` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.25.0` | `1.42.0` |
| [papaparse](https://github.com/mholt/PapaParse) | `5.5.4` | `5.7.0` |
| [radix-ui](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/radix-ui) | `1.6.4` | `1.6.7` |
| [recharts](https://github.com/recharts/recharts) | `3.10.0` | `3.10.1` |
| [sonner](https://github.com/emilkowalski/sonner) | `2.0.7` | `2.0.8` |
| [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.5.4` |



Updates `@tanstack/react-router` from 1.170.18 to 1.170.33
- [Release notes](https://github.com/TanStack/router/releases)
- [Changelog](https://github.com/TanStack/router/blob/main/packages/react-router/CHANGELOG.md)
- [Commits](https://github.com/TanStack/router/commits/@tanstack/react-router@1.170.33/packages/react-router)

Updates `dexie` from 4.4.4 to 4.4.5
- [Release notes](https://github.com/dexie/Dexie.js/releases)
- [Commits](dexie/Dexie.js@v4.4.4...v4.4.5)

Updates `lucide-react` from 1.25.0 to 1.42.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.42.0/packages/lucide-react)

Updates `papaparse` from 5.5.4 to 5.7.0
- [Release notes](https://github.com/mholt/PapaParse/releases)
- [Changelog](https://github.com/mholt/PapaParse/blob/master/CHANGELOG.md)
- [Commits](mholt/PapaParse@5.5.4...5.7.0)

Updates `radix-ui` from 1.6.4 to 1.6.7
- [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/radix-ui/CHANGELOG.md)
- [Commits](https://github.com/radix-ui/primitives/commits/1.6.7/packages/react/radix-ui)

Updates `recharts` from 3.10.0 to 3.10.1
- [Release notes](https://github.com/recharts/recharts/releases)
- [Changelog](https://github.com/recharts/recharts/blob/main/CHANGELOG.md)
- [Commits](recharts/recharts@v3.10.0...v3.10.1)

Updates `sonner` from 2.0.7 to 2.0.8
- [Release notes](https://github.com/emilkowalski/sonner/releases)
- [Commits](emilkowalski/sonner@v2.0.7...v2.0.8)

Updates `zod` from 4.4.3 to 4.5.4
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.4.3...v4.5.4)

---
updated-dependencies:
- dependency-name: "@tanstack/react-router"
  dependency-version: 1.170.32
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: dexie
  dependency-version: 4.4.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: lucide-react
  dependency-version: 1.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: papaparse
  dependency-version: 5.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: radix-ui
  dependency-version: 1.6.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: recharts
  dependency-version: 3.10.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: sonner
  dependency-version: 2.0.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: zod
  dependency-version: 4.5.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title Bump the production-dependencies group across 1 directory with 8 updates chore(deps): bump the production-dependencies group across 1 directory with 8 updates Sep 10, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/production-dependencies-9ca204d44d branch from 628e037 to 0e0bc50 Compare September 10, 2026 12:28
@coderabbitai

coderabbitai Bot commented Sep 10, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: eda6bcb0-d3c6-4e2d-95ce-b911fb88568c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@dependabot @github

dependabot Bot commented on behalf of github Sep 17, 2026

Copy link
Copy Markdown
Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 17, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-9ca204d44d branch September 17, 2026 12:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants