Skip to content

build(deps): bump the minor-and-patch group in /frontend with 11 updates - #3631

Merged
PetrefiedThunder merged 3 commits into
mainfrom
dependabot/npm_and_yarn/frontend/minor-and-patch-7b2e722075
Oct 28, 2026
Merged

build(deps): bump the minor-and-patch group in /frontend with 11 updates#3631
PetrefiedThunder merged 3 commits into
mainfrom
dependabot/npm_and_yarn/frontend/minor-and-patch-7b2e722075

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 26, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group in /frontend with 11 updates:

Package From To
@sentry/nextjs 11.7.0 11.8.0
@supabase/supabase-js 2.117.3 2.118.0
@tanstack/react-query 5.104.2 5.104.4
dexie 4.4.6 4.4.7
framer-motion 14.1.0 14.3.1
jspdf-autotable 5.0.8 5.0.9
lucide-react 1.56.0 1.59.0
posthog-js 1.438.9 1.438.12
@playwright/test 1.64.0 1.64.1
@rollup/rollup-linux-x64-gnu 4.64.5 4.64.10
@rollup/rollup-linux-x64-musl 4.64.5 4.64.10

Updates @sentry/nextjs from 11.7.0 to 11.8.0

Release notes

Sourced from @​sentry/nextjs's releases.

11.8.0

Important Changes

  • feat(bundler-plugins): Release @sentry/webpack-plugin, @sentry/vite-plugin, @sentry/rollup-plugin and @sentry/esbuild-plugin from the SDK repository (#25095)

    The four standalone bundler plugins now release together with the SDK, so their version jumps from 5.4.1 to the SDK version. Each package re-exports the matching @sentry/bundler-plugins entry point, which we recommend for new projects. The plugin options do not change, but the update brings these breaking changes:

    • Node.js 20.19.0 or higher is required.
    • @sentry/webpack-plugin requires webpack 5.1 or higher. The @sentry/webpack-plugin/webpack5 entry point still works and exports the same plugin as @sentry/webpack-plugin.
    • The plugins use the sentry CLI SDK instead of @sentry/cli. Sentry self-hosted 26.4.2 or higher is supported. Lower versions may continue to work.
    • Deploys that the plugins create on Vercel use the value of VERCEL_TARGET_ENV (production, preview or a custom name) as their environment, instead of vercel-production or vercel-preview. To keep the old value, set release.deploy.env.

  • feat(server-utils): Instrument the OpenAI decisions API as gen_ai.decide spans (#25285)

    OpenAI decisions.create calls now create gen_ai.decide spans.

Other Changes

  • feat(core): Support SuppressedError in LinkedErrors integration (#25246)
  • fix(astro): Delete generated source maps for static output (#25310)
  • fix(astro): Upload source maps of Astro 7's prerender build (#25309)
  • fix(browser): Apply urlQueryParams to the Referer header (#25324)
  • fix(cloudflare): auto-instrument when wrangler main is a package (#25343)
  • fix(hono): Expose runtime-specific SDK options (#25290)
  • fix(node): Instrument Prisma 8 CollectionBase from rc.15 (#25301)
  • fix(nuxt): Skip 3xx/4xx Nuxt errors in the vue:error hook (#25341)
  • fix(server-utils): Read pi-durable 1.2.0 tool results from output (#25312)
  • fix(server-utils): Transform modules once when two Sentry Vite plugins add orchestrion (#25043)
  • fix(sveltekit): add op and origin to Kit's sveltekit.endpoint span (#25376)
  • fix(tanstackstart-react): Keep parametrized route names in Nitro 3 builds (#25307)
  • fix(tanstackstart-react): Rewrite source paths of split route modules (#25361)
  • chore: Add external contributor to CHANGELOG.md (#25375)
  • ci: Install the pnpm version that Volta pins (#25287)
  • license: Add cli FSL notice to package licenses (#25314)
  • ref(core): use shared MCP attribute conventions (#25059)
  • ref(tanstackstart-react): Reuse shared component annotation options (#25313)
  • test(browser): Keep whitespace text out of the handlers-lcp page (#25280)
  • test(bun): Restore @​sentry/core spies after the Bun.serve tests (#25276)
  • test(bundler-plugins): Disable CLI telemetry in the CLI contract tests (#25308)
  • test(e2e): Add node-openai-decisions-send-to-sentry test app (#25331)
  • test(e2e): Add node-openai-send-to-sentry test app (#24824)
  • test(e2e): Add nuxt-5-sourcemaps test (#25268)
  • test(e2e): Inherit root Volta config in all e2e test apps (#25369)
  • test(e2e): Use an external host address for the Lambda DSN on loopback hostnames (#25282)
  • test(nextjs): Run nextjs-16-tunnel on Cloudflare (#25161)
  • test(nextjs): Switch DEBUG_BUILD with a getter instead of re-importing the SDK (#25279)

... (truncated)

Changelog

Sourced from @​sentry/nextjs's changelog.

11.8.0

Important Changes

  • feat(bundler-plugins): Release @sentry/webpack-plugin, @sentry/vite-plugin, @sentry/rollup-plugin and @sentry/esbuild-plugin from the SDK repository (#25095)

    The four standalone bundler plugins now release together with the SDK, so their version jumps from 5.4.1 to the SDK version. Each package re-exports the matching @sentry/bundler-plugins entry point, which we recommend for new projects. The plugin options do not change, but the update brings these breaking changes:

    • Node.js 20.19.0 or higher is required.
    • @sentry/webpack-plugin requires webpack 5.1 or higher. The @sentry/webpack-plugin/webpack5 entry point still works and exports the same plugin as @sentry/webpack-plugin.
    • The plugins use the sentry CLI SDK instead of @sentry/cli. Sentry self-hosted 26.4.2 or higher is supported. Lower versions may continue to work.
    • Deploys that the plugins create on Vercel use the value of VERCEL_TARGET_ENV (production, preview or a custom name) as their environment, instead of vercel-production or vercel-preview. To keep the old value, set release.deploy.env.

  • feat(server-utils): Instrument the OpenAI decisions API as gen_ai.decide spans (#25285)

    OpenAI decisions.create calls now create gen_ai.decide spans.

Other Changes

  • feat(core): Support SuppressedError in LinkedErrors integration (#25246)
  • fix(astro): Delete generated source maps for static output (#25310)
  • fix(astro): Upload source maps of Astro 7's prerender build (#25309)
  • fix(browser): Apply urlQueryParams to the Referer header (#25324)
  • fix(cloudflare): auto-instrument when wrangler main is a package (#25343)
  • fix(hono): Expose runtime-specific SDK options (#25290)
  • fix(node): Instrument Prisma 8 CollectionBase from rc.15 (#25301)
  • fix(nuxt): Skip 3xx/4xx Nuxt errors in the vue:error hook (#25341)
  • fix(server-utils): Read pi-durable 1.2.0 tool results from output (#25312)
  • fix(server-utils): Transform modules once when two Sentry Vite plugins add orchestrion (#25043)
  • fix(sveltekit): add op and origin to Kit's sveltekit.endpoint span (#25376)
  • fix(tanstackstart-react): Keep parametrized route names in Nitro 3 builds (#25307)
  • fix(tanstackstart-react): Rewrite source paths of split route modules (#25361)
  • chore: Add external contributor to CHANGELOG.md (#25375)
  • ci: Install the pnpm version that Volta pins (#25287)
  • license: Add cli FSL notice to package licenses (#25314)
  • ref(core): use shared MCP attribute conventions (#25059)
  • ref(tanstackstart-react): Reuse shared component annotation options (#25313)
  • test(browser): Keep whitespace text out of the handlers-lcp page (#25280)
  • test(bun): Restore @​sentry/core spies after the Bun.serve tests (#25276)
  • test(bundler-plugins): Disable CLI telemetry in the CLI contract tests (#25308)
  • test(e2e): Add node-openai-decisions-send-to-sentry test app (#25331)
  • test(e2e): Add node-openai-send-to-sentry test app (#24824)
  • test(e2e): Add nuxt-5-sourcemaps test (#25268)
  • test(e2e): Inherit root Volta config in all e2e test apps (#25369)
  • test(e2e): Use an external host address for the Lambda DSN on loopback hostnames (#25282)
  • test(nextjs): Run nextjs-16-tunnel on Cloudflare (#25161)

... (truncated)

Commits
  • c6492ef release: 11.8.0
  • e091f7f meta(changelog): Update changelog for 11.8.0 (#25388)
  • 30ec754 meta(changelog): Update changelog for 11.8.0
  • a309cf8 test(bundler-plugins): Disable CLI telemetry in the CLI contract tests (#25308)
  • 71f1ef9 test(e2e): Inherit root Volta config in all e2e test apps (#25369)
  • e54e577 chore: Add external contributor to CHANGELOG.md (#25375)
  • 0ed4606 fix(sveltekit): add op and origin to Kit's sveltekit.endpoint span (#25376)
  • 9516aeb fix(cloudflare): auto-instrument when wrangler main is a package (#25343)
  • 7471347 feat(core): Support SuppressedError in LinkedErrors integration (#25246)
  • f4ae6c5 fix(browser): Apply urlQueryParams to the Referer header (#25324)
  • Additional commits viewable in compare view

Updates @supabase/supabase-js from 2.117.3 to 2.118.0

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.118.0

2.118.0 (2026-10-15)

🚀 Features

  • postgrest: leave computed fields out of select('*') and resolve no-argument rpc overloads for postgrest-typegen output (#2730)
  • storage: add content-encoding support for uploads (#1949)

🩹 Fixes

  • ci: patch next and sharp advisories and pin node-browser playwright (#2753)

❤️ Thank You

  • Atharv Gaur @​Athaxv
  • Ferhat Elmas
  • Lukas Klingsbo

v2.118.0-canary.2

2.118.0-canary.2 (2026-10-12)

This was a version bump only, there were no code changes.

v2.118.0-canary.1

2.118.0-canary.1 (2026-10-12)

This was a version bump only, there were no code changes.

v2.118.0-canary.0

2.118.0-canary.0 (2026-10-09)

🚀 Features

  • postgrest: leave computed fields out of select('*') and resolve no-argument rpc overloads for postgrest-typegen output (#2730)

🩹 Fixes

  • ci: patch next and sharp advisories and pin node-browser playwright (#2753)

❤️ Thank You

  • Lukas Klingsbo
Changelog

Sourced from @​supabase/supabase-js's changelog.

2.118.0 (2026-10-15)

🚀 Features

  • postgrest: leave computed fields out of select('*') and resolve no-argument rpc overloads for postgrest-typegen output (#2730)

❤️ Thank You

  • Lukas Klingsbo
Commits
  • b9753a1 feat(postgrest): leave computed fields out of select('*') and resolve no-argu...
  • 88faa11 fix(ci): patch next and sharp advisories and pin node-browser playwright (#2753)
  • aac9d32 chore(release): version 2.117.3 changelogs (#2744)
  • See full diff in compare view

Updates @tanstack/react-query from 5.104.2 to 5.104.4

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.104.4

Patch Changes

  • #11722 0992a92 - fix(react-query-devtools): create the devtools instance only once instead of on every render

  • #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency

  • Updated dependencies [c8f5eac, c208861, b61abc2, a108398]:

    • @​tanstack/query-devtools@​5.104.4
    • @​tanstack/react-query@​5.104.4

@​tanstack/react-query-next-experimental@​5.104.4

Patch Changes

  • #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency
  • Updated dependencies [c208861, a108398]:
    • @​tanstack/react-query@​5.104.4

@​tanstack/react-query-persist-client@​5.104.4

Patch Changes

  • #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency
  • Updated dependencies [c208861, a108398]:
    • @​tanstack/react-query@​5.104.4
    • @​tanstack/query-persist-client-core@​5.104.4

@​tanstack/react-query@​5.104.4

Patch Changes

  • #11328 c208861 - Allow queries with falsy errors to retry on mount when throwOnError returns false.

  • #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency

  • Updated dependencies [1fee044, fce89dd]:

    • @​tanstack/query-core@​5.104.4

@​tanstack/react-query-devtools@​5.104.3

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.104.3
    • @​tanstack/query-devtools@​5.104.3

@​tanstack/react-query-next-experimental@​5.104.3

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.104.3

@​tanstack/react-query-persist-client@​5.104.3

Patch Changes

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.104.4

Patch Changes

  • #11328 c208861 - Allow queries with falsy errors to retry on mount when throwOnError returns false.

  • #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency

  • Updated dependencies [1fee044, fce89dd]:

    • @​tanstack/query-core@​5.104.4

5.104.3

Patch Changes

  • Updated dependencies [0f15bc9]:
    • @​tanstack/query-core@​5.104.3
Commits
  • 1219972 ci: Version Packages (#12062)
  • 1fee044 fix(query-core): clear mutations before notifying subscribers (#11470)
  • c208861 fix(react-query): retry queries with falsy errors on mount (#11328)
  • a108398 fix(react-query*): declare '@​types/react' as an optional peer dependency (#11...
  • ee47993 ci: Version Packages (#11998)
  • 0f15bc9 fix(query-core): preserve union narrowing in setQueryData updaters (#11935)
  • See full diff in compare view

Updates dexie from 4.4.6 to 4.4.7

Release notes

Sourced from dexie's releases.

Dexie v4.4.7

This maintenance release fixes query, live-query, bulk-update, and database lifecycle edge cases; improves production bundler compatibility; makes Dexie Cloud sync retries recover faster; and restores compatibility with legacy Dexie exports.

Related Package Releases

Package Version
dexie 4.4.7
dexie-cloud-addon 4.4.16
dexie-react-hooks 4.4.0 (no change)
y-dexie 4.4.0 (no change)
dexie-export-import 4.4.2
dexie-cloud-common 1.0.60

Bug Fixes

dexie@4.4.7

  • Fix empty query branches in unions — Empty anyOf() and reversed between() clauses no longer suppress matches from other branches in an or() query; a standalone empty clause still returns no results. (#2319)
  • Fix live-query change detection and cancellation — Mutations for valid falsy primary keys such as 0 and the empty string now trigger matching live queries, and late errors from superseded runs are ignored. (#2324, #2353)
  • Harden bulkUpdate() — Changes to nested or compound primary keys now throw ConstraintError, and bulkUpdate() works when called before the database has opened. (#2320, #2334)
  • Fix database lifecycle and opening edge cases — hasBeenClosed() now reports the closed state correctly; Safari-like environments without a global indexedDB get a clear missing-API error, while an explicitly supplied indexedDB implementation can still be opened. (#2340, #2342)
  • Improve production bundle compatibility — Package exports now resolve to the unminified build in production, avoiding downstream double-minification issues. The minified bundle remains in the package, but production exports may now select the unminified distribution. (#2344)

dexie-cloud-addon@4.4.16

  • Wake local sync retries on reconnect or foregrounding — A scheduled retry can resume promptly when connectivity returns or the app becomes visible, rather than waiting through the remaining backoff; retry behavior avoids overlapping requests and clears stale worker state on close. (#2351)

dexie-export-import@4.4.2

  • Import legacy hidden-primary-key exports — Legacy exports that encode the schema as the string "null" are normalized and imported instead of being rejected as a primary-key mismatch. (#2329)

Contributors

Release coordination: @​dfahlander. Thanks to @​buildwithakhila, @​chatman-media, @​claude, @​cpruijsen, @​liz709, @​morgan-coded, @​ShangYJQ, @​tarann26, @​theblang, and @​zzoraemon043 for code, documentation, sample-app, and package changes. Automated dependency updates were contributed by @​dependabot[bot].

Commits
  • da6b2b8 fix: add repository metadata for cloud common publish
  • aadf00a chore: prepare coordinated Dexie release
  • d31ca47 fix(WhereClause): empty anyOf()/between() no longer empties an or()-union (#1...
  • ff98f7e fix(live-query): react on mutations of falsy but valid primary keys (issue #2...
  • 84fd2cf Reject bulkUpdate changes to nested and compound primary keys (#2320)
  • 4fae8d4 fix: db.hasBeenClosed() never returned true (#2340)
  • b21d7d4 fix(dexie-export-import): tolerate legacy schema:"null" when importing a hidd...
  • c376e46 fix(open): skip the Safari 14 workaround when the global indexedDB is missing...
  • c8b2eb5 Fix todo app navbar dropdown button nesting (#2343)
  • dccc3c5 fix(dexie-cloud): wake local sync retries on reconnect (#2350) (#2351)
  • Additional commits viewable in compare view

Updates framer-motion from 14.1.0 to 14.3.1

Changelog

Sourced from framer-motion's changelog.

[14.3.1] 2026-10-18

Fixed

  • AnimatePresence: Fire onExitComplete after exiting children unmount.
  • AnimatePresence: popLayout children that don't accept ref are now popped when root component is <motion> element.
  • Fix interpolation of axis rotate and skew transforms during shared layout animation.
  • Fix layout animations when layout is enabled after mount.
  • Fix drag jumping to 0 after animate x/y to CSS variable.
  • arc: Fix path animations with animate.
  • Ensure shared elements are freed from memory when unmounted.
  • Fix accelerated independent transform animations vanishing when they start from a float residue.

[14.3.0] 2026-10-15

Added

  • stagger: New grid, from: "edges" | "random" options.
  • Support for scaleZ.

Fixed

  • Fix matrix3d and other digit-named transform functions being tokenised as numbers.
  • useSpring: Ensure when switching targets we animate to the new target on switch.
  • Fix SVG MotionValue children being written as a children attribute.

[14.2.0] 2026-10-13

Added

  • Hardware accelerated independent transforms like x, y, scaleX etc.

[14.1.1] 2026-10-13

Fixed

  • Fix velocity hand-off for hardware-accelerated springs.
  • cubicBezier: More accurate, 2x faster.
  • Reorder: Fix click events on reoredered items.
  • useTransform: Fix desync when source is set in an effect under Strict Mode.
Commits
  • 1785a88 v14.3.1
  • 94c0580 Merge pull request #3943 from motiondivision/fix/transform-stop-overwrite
  • 4e8bf48 Merge pull request #3946 from motiondivision/claude/project-thread-vvp7g3
  • e483b47 Move unreleased changelog entries to 14.3.1
  • 9dd3908 Accelerated transforms: only drop the stopped animation on release
  • 5d620ba Accelerated transforms: don't overwrite the caller's transform after stop()
  • ce1d082 Updating changelog
  • 2d27b04 Merge pull request #3938 from motiondivision/claude/fix-issue-3937-erwehk
  • 2773e46 Merge branch 'main' into claude/fix-issue-3937-erwehk
  • 1b70d7c Merge pull request #3941 from motiondivision/claude/project-thread-2rmlzw
  • Additional commits viewable in compare view

Updates jspdf-autotable from 5.0.8 to 5.0.9

Release notes

Sourced from jspdf-autotable's releases.

v5.0.9

What's Changed

New Contributors

Full Changelog: simonbengtsson/jsPDF-AutoTable@v5.0.8...v5.0.9

Commits
  • af6dd38 5.0.9
  • bad76df test: add test case that textOptions is passed to jspdf.text
  • 443bb0e feat: pass textOptions to autoTableText in printRow
  • d66b06b feat: pass textOptions to jspdf.text in autoTableText
  • 898e275 feat: add textOptions to Styles
  • See full diff in compare view

Updates lucide-react from 1.56.0 to 1.59.0

Release notes

Sourced from lucide-react's releases.

Version 1.59.0

What's Changed

Full Changelog: lucide-icons/lucide@1.58.0...1.59.0

Version 1.58.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.57.0...1.58.0

Version 1.57.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.56.0...1.57.0

Commits

Updates posthog-js from 1.438.9 to 1.438.12

Release notes

Sourced from posthog-js's releases.

posthog-js@1.438.12

1.438.12

Patch Changes

posthog-js@1.438.11

1.438.11

Patch Changes

  • #5260 845bf99 Thanks @​gesh! - Capture WebMCP failures in Error Tracking when exception autocapture is enabled. With posthog-js/slim, add ErrorTrackingExtensions next to WebMCPExtensions to get these events. (2026-10-15)

posthog-js@1.438.10

1.438.10

Patch Changes

  • #5300 09d4ba2 Thanks @​rafaeelaudibert! - Capture the Freebuff click identifier (bfcid) as a campaign parameter, so it is set on events and as $initial_bfcid like every other ad click ID. (2026-10-14)
  • Updated dependencies [09d4ba2]:
    • @​posthog/browser-common@​0.9.5
    • @​posthog/core@​1.59.1
Commits
  • de2c035 chore: update versions and lockfile [version bump]
  • e940c92 fix: Backward clock changes make the browser rate-limit token balance negativ...
  • c775115 chore: update versions and lockfile [version bump]
  • 7319620 chore: allow anthropic sdk 0134 (#5305)
  • 845bf99 feat: capture WebMCP exceptions (#5260)
  • 64a2b36 chore: update versions and lockfile [version bump]
  • b21765a fix(react-native): stop dropping native crash reports for fatals JS did not s...
  • 25f6b28 chore: update versions and lockfile [version bump]
  • 09d4ba2 feat(browser): capture the Freebuff bfcid click ID (#5300)
  • d7e7652 chore: update versions and lockfile [version bump]
  • Additional commits viewable in compare view

Updates @playwright/test from 1.64.0 to 1.64.1

Release notes

Sourced from @​playwright/test's releases.

v1.64.1

Bug Fixes

  • #43247 [Bug]: _electron.launch intermittently loses a packaged app's first window since 1.64.0
  • #43242 [Regression]: Chromium 155+ aborts a preflighted cross-origin redirect whenever any route is registered (net::ERR_ABORTED)
Commits
  • cfe490d cherry-pick(#43353): docs: release notes for v1.64 Python
  • 866cbb8 chore: mark v1.64.1 (#43354)
  • 1b29247 cherry-pick(#43250): fix(electron): do not drop windows that have not navigat...
  • 632d976 cherry-pick(#43249): fix(chromium): disable AvoidCorsURLLoaderRestartOnRedirect
  • 824d0c5 cherry-pick(#43217): chore(dotnet): fix async suffix of optional-arg overload...
  • See full diff in compare view

Updates @rollup/rollup-linux-x64-gnu from 4.64.5 to 4.64.10

Release notes

Sourced from @​rollup/rollup-linux-x64-gnu's releases.

v4.64.10

4.64.10

2026-10-18

Bug Fixes

  • Avoid breaking lazy loading when a dynamic import only contains reexports from a manual chunk (#6583)
  • Ensure HTML entities in JSX are properly decoded in the output (#6584)

Pull Requests

v4.64.9

4.64.9

2026-10-17

Bug Fixes

  • Ensure export live-bindings are properly maintained for aliased exports (#6576)
  • Retain typed array constructor calls if the argument has iteration side effects (#6582)

Pull Requests

v4.64.8

4.64.8

2026-10-17

Bug Fixes

  • Ensure chunk hashes change when sourcemap comments change (#6509)
  • Resolve some relative import resolution edge cases (#6522)

Pull Requests

... (truncated)

Changelog

Sourced from @​rollup/rollup-linux-x64-gnu's changelog.

4.64.10

2026-10-18

Bug Fixes

  • Avoid breaking lazy loading when a dynamic import only contains reexports from a manual chunk (#6583)
  • Ensure HTML entities in JSX are properly decoded in the output (#6584)

Pull Requests

4.64.9

2026-10-17

Bug Fixes

  • Ensure export live-bindings are properly maintained for aliased exports (#6576)
  • Retain typed array constructor calls if the argument has iteration side effects (#6582)

Pull Requests

4.64.8

2026-10-17

Bug Fixes

  • Ensure chunk hashes change...

    Description has been truncated

@dependabot
build(deps): bump the minor-and-patch group in /frontend with 11 updates
2524ac1 
Bumps the minor-and-patch group in /frontend with 11 updates:

| Package | From | To |
| --- | --- | --- |
| [@sentry/nextjs](https://github.com/getsentry/sentry-javascript) | `11.7.0` | `11.8.0` |
| [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.117.3` | `2.118.0` |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.104.2` | `5.104.4` |
| [dexie](https://github.com/dexie/Dexie.js) | `4.4.6` | `4.4.7` |
| [framer-motion](https://github.com/motiondivision/motion) | `14.1.0` | `14.3.1` |
| [jspdf-autotable](https://github.com/simonbengtsson/jsPDF-AutoTable) | `5.0.8` | `5.0.9` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.56.0` | `1.59.0` |
| [posthog-js](https://github.com/PostHog/posthog-js) | `1.438.9` | `1.438.12` |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.64.0` | `1.64.1` |
| [@rollup/rollup-linux-x64-gnu](https://github.com/rollup/rollup) | `4.64.5` | `4.64.10` |
| [@rollup/rollup-linux-x64-musl](https://github.com/rollup/rollup) | `4.64.5` | `4.64.10` |


Updates `@sentry/nextjs` from 11.7.0 to 11.8.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@11.7.0...11.8.0)

Updates `@supabase/supabase-js` from 2.117.3 to 2.118.0
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.118.0/packages/core/supabase-js)

Updates `@tanstack/react-query` from 5.104.2 to 5.104.4
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.104.4/packages/react-query)

Updates `dexie` from 4.4.6 to 4.4.7
- [Release notes](https://github.com/dexie/Dexie.js/releases)
- [Commits](dexie/Dexie.js@v4.4.6...v4.4.7)

Updates `framer-motion` from 14.1.0 to 14.3.1
- [Changelog](https://github.com/motiondivision/motion/blob/main/CHANGELOG.md)
- [Commits](motiondivision/motion@v14.1.0...v14.3.1)

Updates `jspdf-autotable` from 5.0.8 to 5.0.9
- [Release notes](https://github.com/simonbengtsson/jsPDF-AutoTable/releases)
- [Commits](simonbengtsson/jsPDF-AutoTable@v5.0.8...v5.0.9)

Updates `lucide-react` from 1.56.0 to 1.59.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.59.0/packages/lucide-react)

Updates `posthog-js` from 1.438.9 to 1.438.12
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.438.9...posthog-js@1.438.12)

Updates `@playwright/test` from 1.64.0 to 1.64.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.64.0...v1.64.1)

Updates `@rollup/rollup-linux-x64-gnu` from 4.64.5 to 4.64.10
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.64.5...v4.64.10)

Updates `@rollup/rollup-linux-x64-musl` from 4.64.5 to 4.64.10
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.64.5...v4.64.10)

---
updated-dependencies:
- dependency-name: "@sentry/nextjs"
  dependency-version: 11.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@supabase/supabase-js"
  dependency-version: 2.118.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.104.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: dexie
  dependency-version: 4.4.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: framer-motion
  dependency-version: 14.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: jspdf-autotable
  dependency-version: 5.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: lucide-react
  dependency-version: 1.59.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: posthog-js
  dependency-version: 1.438.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@playwright/test"
  dependency-version: 1.64.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@rollup/rollup-linux-x64-gnu"
  dependency-version: 4.64.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@rollup/rollup-linux-x64-musl"
  dependency-version: 4.64.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file frontend labels Oct 26, 2026
@vercel

vercel Bot commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Actions Updated
regengine Ignored Ignored Preview Oct 28, 2026 4:31am UTC

Request Review

@github-actions

github-actions Bot commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

PR Blocker Checklist

Head SHA: 3f7face32e10f24b434bc8bf9e895f73fa90bf64

Status: Ready

  • All review threads resolved
  • No reviews requesting changes
  • No blocked review engines

@github-actions

github-actions Bot commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

✅ Bundle Size Report

Metric Size
Total JS 5581.2KB (5.45MB)
Total CSS 131.9KB
Limit 10.0MB

Bundle is within the 10.0MB limit.

@PetrefiedThunder
merge: bring main into dependabot frontend minor-and-patch (#3631)
013028c
@PetrefiedThunder
fix: bump authlib>=1.9.1 and dnspython>=2.9.0 for CVEs
3f7face 
Security/Dependency Audit fails after merging main: pip-audit
flags authlib 1.8.0 and dnspython 2.8.0. Floor both packages
and regenerate the hashed lock with the CI pip-tools toolchain.

Signed-off-by: Christopher Sellers <1@christophersellers.com>
@PetrefiedThunder

PetrefiedThunder commented Oct 28, 2026

Copy link
Copy Markdown
Collaborator

REVIEW: PASS hermes 3f7face

Read the full diff at this head: the frontend minor/patch group (11 packages) plus the authlib>=1.9.1 / dnspython>=2.9.0 CVE floor bump in requirements.in/lock. All CI checks pass except Engine Review Pass (fails on the Dependabot branch prefix, not code) and the Head SHA Check Guard / PR Blocker Checklist runs, which were cancelled by workflow concurrency rather than failing a step.

  • @sentry/nextjs 11.7.0 to 11.8.0: the only breaking notes are for the standalone bundler plugins (Node >= 20.19, webpack >= 5.1, Vercel deploy env now uses VERCEL_TARGET_ENV). The frontend pins node ^22.13 || ^24 and only uses withSentryConfig in frontend/next.config.js; nothing in the repo matches on "vercel-production". Worth knowing that Sentry deploy env names will read production/preview from now on.
  • framer-motion 14.1 to 14.3.1: additive features and bug fixes only (changelog 14.1.1 to 14.3.1).
  • lucide-react 1.56 to 1.59: icon additions; the one changed icon (chess-queen) isn't used in the repo.
  • @supabase/supabase-js 2.118.0: features (storage content-encoding, typegen select behavior) and a CI fix; no breaking notes.
  • react-query, dexie, jspdf-autotable, posthog-js, @playwright/test, rollup natives: patch bumps; Vercel build, unit tests and the frontend checks are green.
  • authlib 1.9.x: security hardening (JOSE key/scope/audience, nonce/JAR validation). The repo declares authlib in requirements.in but code search finds no direct imports. dnspython 2.9.0 fixes GHSA-45c3-73f7-pv4m and needs Python >= 3.11, which matches the lock's Python 3.11.

@PetrefiedThunder
PetrefiedThunder merged commit 310efaa into main Oct 28, 2026
100 of 104 checks passed
@PetrefiedThunder
PetrefiedThunder deleted the dependabot/npm_and_yarn/frontend/minor-and-patch-7b2e722075 branch October 28, 2026 07:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@PetrefiedThunder PetrefiedThunder Awaiting requested review from PetrefiedThunder PetrefiedThunder is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file frontend

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@PetrefiedThunder