Skip to content

chore(deps): Bump the minor-and-patch group across 1 directory with 11 updates - #403

Merged
itsmeakhil merged 2 commits into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-462828b155
Nov 5, 2026
Merged

chore(deps): Bump the minor-and-patch group across 1 directory with 11 updates#403
itsmeakhil merged 2 commits into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-462828b155

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 11 updates in the / directory:

Package From To
@milkdown/crepe 7.22.3 7.23.0
@milkdown/kit 7.22.3 7.23.0
@tanstack/react-virtual 3.14.23 3.14.24
geist 1.8.2 1.9.0
lucide-react 1.63.0 1.65.0
mongodb 7.7.0 7.8.0
react-resizable-panels 4.15.0 4.15.3
@types/node 26.6.5 26.6.6
eslint-config-next 16.4.2 16.4.3
@opennextjs/cloudflare 1.20.14 1.20.15
wrangler 4.154.0 4.156.0

Updates @milkdown/crepe from 7.22.3 to 7.23.0

Release notes

Sourced from @​milkdown/crepe's releases.

v7.23.0

Please refer to CHANGELOG.md for details.

Changelog

Sourced from @​milkdown/crepe's changelog.

7.23.0

Minor Changes

  • 8068e9c: Milkdown patch version release.

    Feat

    • feat(crepe): switch the code block theme at runtime (#2489)

    Fix

    • fix(preset-commonmark): keep hardbreak attrs and map the step range when clearing marks (#2498)
    • fix(preset-commonmark): keep remarkLineBreak linear on long runs of spaces (#2504)
    • fix(crepe): keep prices like $5 and $10 from becoming inline math (#2497)
    • fix(crepe): show the top bar items again after a readonly round trip (#2496)

    Chore

    • chore: bump up postcss-nested version to v9 (#2500)

    Ci

    • ci: key the Playwright browser cache on the runner image (#2509)

Patch Changes

  • Updated dependencies [8068e9c]
    • @​milkdown/kit@​7.23.0
Commits
  • 2e77995 chore: version packages (#2511)
  • 5eb43c1 feat(crepe): switch the code block theme at runtime (#2489)
  • 7b46639 fix(crepe): keep prices like $5 and $10 from becoming inline math (#2497)
  • 7a82b1b fix(crepe): show the top bar items again after a readonly round trip (#2496)
  • See full diff in compare view

Updates @milkdown/kit from 7.22.3 to 7.23.0

Release notes

Sourced from @​milkdown/kit's releases.

v7.23.0

Please refer to CHANGELOG.md for details.

Commits

Updates @tanstack/react-virtual from 3.14.23 to 3.14.24

Release notes

Sourced from @​tanstack/react-virtual's releases.

@​tanstack/react-virtual@​3.14.24

Patch Changes

Changelog

Sourced from @​tanstack/react-virtual's changelog.

3.14.24

Patch Changes

Commits

Updates geist from 1.8.2 to 1.9.0

Changelog

Sourced from geist's changelog.

1.9.0

Minor Changes

  • d33068f: Add Geist Serif variable and static fonts.
Commits

Updates lucide-react from 1.63.0 to 1.65.0

Release notes

Sourced from lucide-react's releases.

Version 1.65.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.64.0...1.65.0

Version 1.64.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.63.0...1.64.0

Commits

Updates mongodb from 7.7.0 to 7.8.0

Release notes

Sourced from mongodb's releases.

v7.8.0

7.8.0 (2026-10-30)

The MongoDB Node.js team is pleased to announce version 7.8.0 of the mongodb package!

Release Notes

[!WARNING]
Node Driver versions from v6.11.0 and from v7.0.0 before v7.8.0 (this release) are affected by a security issue related to the use of the experimental timeoutMS feature where connection pool desynchronization after operation timeout can expose other users' data. Users are encouraged to discontinue the use of timeoutMS as soon as possible.

[!WARNING] Node Driver versions from v3.3.3 before v7.8.0 (this release) are affected by a security issue concerning the verification of host names returned by SRV lookups, which could allow an attacker in control of the DNS response to redirect the driver to a host outside the user's domain. Users using SRV records are encouraged to upgrade to v7.8.0 as soon as possible.

timeoutMS is deprecated and now a no-op

[!WARNING] timeoutMS and timeoutMode are deprecated and have no effect starting in this release. They are still accepted and will not throw, but operations will no longer time out because of them. They are slated for removal in a future release.

Use the per-stage timeouts instead: serverSelectionTimeoutMS, waitQueueTimeoutMS, socketTimeoutMS, and maxTimeMS for server-side execution.

Configurable SRV host validation

This release adds two new methods of validating DNS:

  1. srvAllowedHostsSuffix - A host name suffix that every host returned by the SRV lookup must end with. This option can be configured on the client or the connection string.
  2. srvHostValidator - A synchronous function that decides whether a host returned by the SRV lookup may be used. This option can only be configured on the client. This function must accept a string and has to return a boolean; returning anything else, including the Promise returned by an async function, will result in an error.

[!WARNING] Modifying the default SRV domain name validation can create vulnerabilities.

SRV host names are now compared in a normalized form (case-insensitively, without a trailing dot, and with internationalized names in xn-- form). Connection strings whose SRV host name differs in case from the host names returned by DNS, such as mongodb+srv://TEST1.TEST.BUILD.10GEN.CC, previously failed SRV verification and now connect.

zstd compression no longer requires @mongodb-js/zstd on Node.js 22.15.0+

The driver now uses Node.js' built-in zstd implementation when it is available. On older Node.js versions it continues to use @mongodb-js/zstd, so no changes are needed for existing setups.

Thanks to @​axelonet for the original contribution!

Distinguish between command-level options and index-level options when creating indexes

Before:

// Index options and command options were on the same object
await collection.createIndex(
  { email: 1 },
  {
    // index options
    unique: true,
    name: 'email_unique',
    // command options
    commitQuorum: 'majority',
</tr></table>

... (truncated)

Changelog

Sourced from mongodb's changelog.

7.8.0 (2026-10-30)

Features

  • NODE-6893: Distinguish between command-level options and index-level options when creating indexes (#5012) (ca0e451)
  • NODE-7097: use Node.js built-in zstd when available (#5073) (b7eb8fd)
  • NODE-7657: remove @​experimental tags from no-longer-experimental features (#5058) (694a848)
  • NODE-7830: add srvAllowedHostsSuffix and srvHostValidator options (#5065) (19e2d3b)
  • NODE-7958: make timeoutMS a no-op and deprecate it (#5085) (8345fe1)

Bug Fixes

  • NODE-7643: preserve $meta direction in [field, direction] sort pair (#4988) (16136bb)
  • NODE-7659: key unordered bulk insertedIds by originating operation index (#4989) (df513cf)
  • NODE-7764: use $eq to match file IDs in GridFS queries (#5068) (218b6d7)
  • NODE-7881: hello command is compressed (#5072) (399045a)
Commits
  • c406cab chore(main): release 7.8.0 (#5070)
  • 9c54464 docs: remove timeoutMS from experimental features (#5087)
  • 8345fe1 feat(NODE-7958): make timeoutMS a no-op and deprecate it (#5085)
  • 853ff46 ci(NODE-7963): pin node v26 in ci (#5086)
  • 19e2d3b feat(NODE-7830): add srvAllowedHostsSuffix and srvHostValidator options (#5065)
  • b7eb8fd feat(NODE-7097): use Node.js built-in zstd when available (#5073)
  • 2a13e4b chore(NODE-6984): skip flaky CSOT test (#5079)
  • 399045a fix(NODE-7881): hello command is compressed (#5072)
  • ef6f6f3 chore(NODE-7833): 'latest' server binary behind s3 (#5074)
  • 16136bb fix(NODE-7643): preserve $meta direction in [field, direction] sort pair (#4988)
  • Additional commits viewable in compare view

Updates react-resizable-panels from 4.15.0 to 4.15.3

Release notes

Sourced from react-resizable-panels's releases.

4.15.3

  • Fix unused components not being removed by some bundlers (e.g. esbuild), so an application that only imports Group no longer includes Grid. Components now set their displayName within a pure-annotated expression, and package.json declares "sideEffects": false. - #779

4.15.2

  • Fix vh, vw, and em panel sizes (e.g. defaultSize="25vw") being resolved against the global window instead of the panel's own window, so a Group rendered into another window (e.g. a window.open popout via a portal, or an iframe) was sized against the opener's viewport. - #777

4.15.1

  • Declare @types/react as an optional peer dependency. Under strict package linkers (e.g. pnpm with a global virtual store, Yarn PnP, or Bun isolated installs), TypeScript could fail to resolve it from this package, silently typing props built on React types as any. - #776
Changelog

Sourced from react-resizable-panels's changelog.

4.15.3

  • Fix unused components not being removed by some bundlers (e.g. esbuild), so an application that only imports Group no longer includes Grid. Components now set their displayName within a pure-annotated expression, and package.json declares "sideEffects": false. - #779

4.15.2

  • Fix vh, vw, and em panel sizes (e.g. defaultSize="25vw") being resolved against the global window instead of the panel's own window, so a Group rendered into another window (e.g. a window.open popout via a portal, or an iframe) was sized against the opener's viewport. - #777

4.15.1

  • Declare @types/react as an optional peer dependency. Under strict package linkers (e.g. pnpm with a global virtual store, Yarn PnP, or Bun isolated installs), TypeScript could fail to resolve it from this package, silently typing props built on React types as any. - #776
Commits
  • c61a77b 4.15.2 -> 4.15.3
  • e3fd635 Set displayName via pure-annotated declarations instead of a build plugin (...
  • 1d3a156 4.15.1 -> 4.15.2
  • 3b7c44f Resolve vh/vw sizes against the panel's own window (#777)
  • a499612 4.15.0 -> 4.15.1
  • 44d77fb Declare @​types/react as an optional peer dependency (#776)
  • 14743f1 Polished the Accordion demo
  • 7f087d3 Update react-lib-tools to 0.0.70; support light theme
  • d51bd68 Update react-lib-tools to 0.0.69
  • See full diff in compare view

Updates @types/node from 26.6.5 to 26.6.6

Commits

Updates eslint-config-next from 16.4.2 to 16.4.3

Release notes

Sourced from eslint-config-next's releases.

v16.4.3

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • [lts-active] Fix extensionless Google font URLs in both bundlers (#100277)
  • [lts-active] Don't load the app-page runtime in proxy.ts (#100423)
  • [lts-active] Revert "Turbopack: loader change invalidation (#95732)" (#100438)
  • [lts-active][cd] Gate release bot credentials behind GitHub environments (#100123)
  • [lts-active] test: Pin react-virtualized (#100545)
  • [lts-active][cd] Move release un-draft to a follow-up job in bot-autonomous (#100572)
  • [lts-active] Keep OpenTelemetry request traces together (#100349, #100294, #100324, #100350, #100552, #100583) (#100542)
  • [lts-active] Avoid loading standalone React in server bootstrap (#100610)

Credits

Huge thanks to @​mischnic, @​lukesandberg, @​acdlite, @​eps1lon, and @​sokra for helping!

Commits

Updates @opennextjs/cloudflare from 1.20.14 to 1.20.15

Release notes

Sourced from @​opennextjs/cloudflare's releases.

@​opennextjs/cloudflare@​1.20.15

Patch Changes

  • #1473 cf1e5b9 Thanks @​vicb! - chore: bump @opennextjs/aws to 4.1.14

    See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.14

    • Fix the build-time fetch cache being ignored when deploymentId is set.
    • Fix res.revalidate() in Pages Router API routes on Next 15.4+, pages are now revalidated in-process.
    • Fix pages rendered on demand being reported as stale one second after they were written.
    • Fix entries marked stale by revalidateTag(tag, "max") not being served with stale-while-revalidate on Next 16.4+.

  • #1449 d280ba4 Thanks @​vicb! - fix: invalidate CDN cache tags through the Cloudflare invalidation handler

    On-demand revalidation now purges Cloudflare cache tags through OpenNext's centralized CDN invalidation flow instead of coupling purges to the built-in tag-cache implementations.

    The purge type is now honored for every invalidation. Previously, revalidateTag used the NEXT_CACHE_DO_PURGE Durable Object whenever it was bound and otherwise called the Cloudflare API directly, regardless of type.

    Direct invalidation now rejects unsuccessful API outcomes. In Durable Object mode, a missing NEXT_CACHE_DO_PURGE binding now logs an error and skips the purge for both tag and path invalidation. revalidateTag no longer falls back to unbuffered direct purges, which count against the account-wide purge rate limit. Add the binding to restore CDN purges.

    When cache purge is configured without CACHE_PURGE_ZONE_ID or CACHE_PURGE_API_TOKEN, on-demand revalidation still updates the tag cache, but the purge is now reported as a failed CDN invalidation (Cloudflare cache purge failed: missing-credentials) rather than a skipped purge. Set both variables, or remove the cdnInvalidation override if CDN purging is not needed.

    Custom Durable Objects can extend BucketCachePurgeBase and override its protected storage, batching, execution, and settlement hooks to support alternate schemas while retaining alarm scheduling and queue draining. The concrete BucketCachePurge class preserves the default single-zone behavior.

  • #1429 6026fed Thanks @​mathurshubham! - fix: copy the workerd build of every traced package, not only of serverExternalPackages

    The Cloudflare build of a package exposed through the workerd export condition was only included for packages listed in serverExternalPackages. Packages that Next.js keeps external on its own, and their dependencies, were missing it.

    For example, building a Next.js 16 app using pg or @prisma/adapter-pg (the Hyperdrive setup) with Turbopack failed with:

    ✘ [ERROR] Could not resolve "pg-cloudflare"
The module "./dist/index.js" was not found on the file system

    The workerd build of every package is now used, so pg builds without outputFileTracingIncludes workarounds. A package with a workerd condition now always uses that build, even when it is not listed in serverExternalPackages.

  • #1430 8a9be4e Thanks @​rishabhvenu! - fix: bundle the Node.js middleware (proxy.ts) when @opentelemetry/api is installed

    Since 1.20.3, opennextjs-cloudflare build failed with Could not resolve "@opentelemetry/api" for apps with a Node.js middleware and @opentelemetry/api installed, for example as a dependency of @sentry/nextjs.

  • #1473 cf1e5b9 Thanks @​vicb! - fix: use the Open Next build id for the Durable Objects and drop the unused cache assets SQL manifest

    • The Durable Objects now use getOpenNextBuildId() from @opennextjs/aws, so an empty deploymentId falls back to the build id. The queue Durable Object now clears the state of previous builds in that case.
    • .open-next/cloudflare/cache-assets-manifest.sql is no longer generated. It seeded the D1 tag cache used before 1.0 and no current tag cache reads it.

  • #1332 7fe40aa Thanks @​yuanzhixiang! - fix: support a custom buildOutputPath in the deploy, preview, upload and populateCache commands

    With buildOutputPath set in open-next.config.ts, these commands failed right after a successful build with Could not find compiled Open Next config, did you run the build command?. They now find the build output under the configured buildOutputPath.

... (truncated)

Changelog

Sourced from @​opennextjs/cloudflare's changelog.

1.20.15

Patch Changes

  • #1473 cf1e5b9 Thanks @​vicb! - chore: bump @opennextjs/aws to 4.1.14

    See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.14

    • Fix the build-time fetch cache being ignored when deploymentId is set.
    • Fix res.revalidate() in Pages Router API routes on Next 15.4+, pages are now revalidated in-process.
    • Fix pages rendered on demand being reported as stale one second after they were written.
    • Fix entries marked stale by revalidateTag(tag, "max") not being served with stale-while-revalidate on Next 16.4+.

  • #1449 d280ba4 Thanks @​vicb! - fix: invalidate CDN cache tags through the Cloudflare invalidation handler

    On-demand revalidation now purges Cloudflare cache tags through OpenNext's centralized CDN invalidation flow instead of coupling purges to the built-in tag-cache implementations.

    The purge type is now honored for every invalidation. Previously, revalidateTag used the NEXT_CACHE_DO_PURGE Durable Object whenever it was bound and otherwise called the Cloudflare API directly, regardless of type.

    Direct invalidation now rejects unsuccessful API outcomes. In Durable Object mode, a missing NEXT_CACHE_DO_PURGE binding now logs an error and skips the purge for both tag and path invalidation. revalidateTag no longer falls back to unbuffered direct purges, which count against the account-wide purge rate limit. Add the binding to restore CDN purges.

    When cache purge is configured without CACHE_PURGE_ZONE_ID or CACHE_PURGE_API_TOKEN, on-demand revalidation still updates the tag cache, but the purge is now reported as a failed CDN invalidation (Cloudflare cache purge failed: missing-credentials) rather than a skipped purge. Set both variables, or remove the cdnInvalidation override if CDN purging is not needed.

    Custom Durable Objects can extend BucketCachePurgeBase and override its protected storage, batching, execution, and settlement hooks to support alternate schemas while retaining alarm scheduling and queue draining. The concrete BucketCachePurge class preserves the default single-zone behavior.

  • #1429 6026fed Thanks @​mathurshubham! - fix: copy the workerd build of every traced package, not only of serverExternalPackages

    The Cloudflare build of a package exposed through the workerd export condition was only included for packages listed in serverExternalPackages. Packages that Next.js keeps external on its own, and their dependencies, were missing it.

    For example, building a Next.js 16 app using pg or @prisma/adapter-pg (the Hyperdrive setup) with Turbopack failed with:

    ✘ [ERROR] Could not resolve "pg-cloudflare"
The module "./dist/index.js" was not found on the file system

    The workerd build of every package is now used, so pg builds without outputFileTracingIncludes workarounds. A package with a workerd condition now always uses that build, even when it is not listed in serverExternalPackages.

  • #1430 8a9be4e Thanks @​rishabhvenu! - fix: bundle the Node.js middleware (proxy.ts) when @opentelemetry/api is installed

    Since 1.20.3, opennextjs-cloudflare build failed with Could not resolve "@opentelemetry/api" for apps with a Node.js middleware and @opentelemetry/api installed, for example as a dependency of @sentry/nextjs.

  • #1473 cf1e5b9 Thanks @​vicb! - fix: use the Open Next build id for the Durable Objects and drop the unused cache assets SQL manifest

    • The Durable Objects now use getOpenNextBuildId() from @opennextjs/aws, so an empty deploymentId falls back to the build id. The queue Durable Object now clears the state of previous builds in that case.
    • .open-next/cloudflare/cache-assets-manifest.sql is no longer generated. It seeded the D1 tag cache used before 1.0 and no current tag cache reads it.

  • #1332 7fe40aa Thanks @​yuanzhixiang! - fix: support a custom buildOutputPath in the deploy, preview, upload and populateCache commands

    With buildOutputPath set in open-next.config.ts, these commands failed right after a successful build with Could not find compiled Open Next config, did you run the build command?. They now find the build output under the configured buildOutputPath.

... (truncated)

Commits
  • 0a615e7 Version Packages (#1471)
  • 7fe40aa fix: support a custom buildOutputPath in deploy, preview, upload and populate...
  • d280ba4 fix: centralize cache tag invalidation and make the purge Durable Object exte...
  • cf1e5b9 fix: use the Open Next build id for the Durable Objects and drop the unused c...
  • 8a9be4e fix: bundle the Node.js middleware (proxy.ts) when @opentelemetry/api is ...
  • 6026fed fix: copy the workerd build of every traced package, not only of `serverExter...
  • 803d221 fix: resolve Turbopack hashed externals through their symlink under pnpm (#1438)
  • See full diff in compare view

Updates wrangler from 4.154.0 to 4.156.0

Release notes

Sourced from wrangler's releases.

wrangler@4.156.0

Minor Changes

  • #16532 25802bc Thanks @​simonha9! - Allow the experimental wrangler d1 insights command to run across every D1 database in the account

    The database name is now optional. With no name, the command returns the top queries across every D1 database in the account, and each result gains a databaseId field.

Patch Changes

  • #16369 ec0bea4 Thanks @​MattieTK! - Stop autoconfig in non-interactive runs when a project root holds both static files and a Pages functions directory

    When a project without a detected framework has a functions directory, autoconfig asks whether it is a Cloudflare Pages project. Non-interactive runs (CI and coding agents) assume it is not and continue as a static site. When the static files are in the project root, that deploys the root as static assets, and the Pages Functions (the project's API routes) are not deployed.

    In that case autoconfig now stops with an error explaining that Pages Functions cannot be migrated automatically yet. For Pages Functions it suggests moving the static files into a subdirectory and deploying with wrangler pages deploy, or migrating the Functions to a Worker; for a functions directory that is not Pages Functions, it suggests moving the static files into a subdirectory or adding a configuration file. Projects whose static files are already in a subdirectory, projects detected as Pages or with a detected framework, and interactive runs where the user answers the prompt are unaffected.

  • #16367 b4653b4 Thanks @​MattieTK! - Write a protective .assetsignore when autoconfig uses the project root as the static assets directory

    Autoconfig is meant to write an .assetsignore when the project root itself is the assets directory, so that local files are not uploaded as public assets. The check compared the detected output directory, which is relative ("."), with the absolute project path, so it never matched and no .assetsignore was written. A static project with an index.html at its root (for example after wrangler setup or a zero-config wrangler deploy) then uploaded files such as .env, .dev.vars, .git and node_modules as public assets.

    The check now resolves the assets directory that the generated configuration uses and compares it with the project root, so frameworks that set their own build output directory (such as Nuxt or SvelteKit) do not get an unused root .assetsignore. The generated .assetsignore also covers what a Cloudflare Pages upload skips, alongside the existing .wrangler, .dev.vars* and .env* entries: /_worker.js, /_routes.json and /functions at the root (so nested paths such as blog/functions/index.html are still uploaded), node_modules, .git and .DS_Store at any depth, and .npmrc. If an existing .assetsignore only lists a narrower pattern such as .env, .env* is added so that files like .env.production are skipped too. When the project root of an assets-only project contains a Pages functions directory or _worker.js, autoconfig now warns that it will not be deployed, since it is excluded from the assets and not run as server code.

  • #16532 25802bc Thanks @​simonha9! - Fail the experimental wrangler d1 insights command with an actionable error when the GraphQL Analytics API rejects the request

    Previously the command printed an empty []. Rate limit errors now say how long to wait before retrying, and authorization errors name the "Account Analytics: Read" permission the API token needs.

  • #16013 8b64bec Thanks @​swalker326! - Fix Durable Object self-references in tests and container validation

    Durable Object bindings that explicitly name the Worker itself now resolve to the test runner in @cloudflare/vitest-plugin, for both cloudflare.config.ts and Wrangler configuration files. Named Wrangler environments use their effective Worker name, keeping bindings to the base Worker external. Container validation also accepts these self-references, using the effective deployment name to distinguish local and external bindings.

    Explicit binding targets remain intact during configuration conversion, so deploying with --name or a CI name override preserves the intended Durable Object target.

  • Updated dependencies [15fbaed, d8899ac]:

wrangler@4.155.0

Minor Changes

  • #16536 a95d647 Thanks @​WalshyDev! - Support remote Analytics Engine bindings in local development

    Setting remote: true on an Analytics Engine dataset now sends writeDataPoint() calls from wrangler dev and the Vite plugin to the real dataset. Without it, writes are still dropped locally.

    {
  "analytics_engine_datasets": [
    {
      "binding": "EVENTS",
      "dataset": "my-dataset",
      "remote": true
    }
  ]

... (truncated)

Commits
  • b1ced56 Version Packages (#16556)
  • 8b64bec [config] Fix Durable Object self-references without changing deployment targe...
  • 25802bc [wrangler] Run wrangler d1 insights account-wide (#16532)
  • b4653b4 [autoconfig] Write a protective .assetsignore when the project root is the as...
  • a09957a Version Packages (#16553)
  • c7a3373 Revert "Version Packages" (#16554)
  • a95d647 [wrangler] Support remote Analytics Engine bindings in local dev (#16536)
  • 52315bd Version Packages (#16529)
  • dba0e81 [wrangler] Escape terminal controls in tail output (#16526)
  • fc57bc0 [miniflare] Enable local Flagship management without Worker bindings (#16489)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): Bump the minor-and-patch group across 1 directory with 1…
c2b7931 
…1 updates

Bumps the minor-and-patch group with 11 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@milkdown/crepe](https://github.com/Milkdown/milkdown/tree/HEAD/packages/crepe) | `7.22.3` | `7.23.0` |
| [@milkdown/kit](https://github.com/Milkdown/milkdown/tree/HEAD/packages/milkdown) | `7.22.3` | `7.23.0` |
| [@tanstack/react-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual) | `3.14.23` | `3.14.24` |
| [geist](https://github.com/vercel/geist-font/tree/HEAD/packages/next) | `1.8.2` | `1.9.0` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.63.0` | `1.65.0` |
| [mongodb](https://github.com/mongodb/node-mongodb-native) | `7.7.0` | `7.8.0` |
| [react-resizable-panels](https://github.com/bvaughn/react-resizable-panels) | `4.15.0` | `4.15.3` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.5` | `26.6.6` |
| [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.4.2` | `16.4.3` |
| [@opennextjs/cloudflare](https://github.com/opennextjs/opennextjs-cloudflare/tree/HEAD/packages/cloudflare) | `1.20.14` | `1.20.15` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.154.0` | `4.156.0` |



Updates `@milkdown/crepe` from 7.22.3 to 7.23.0
- [Release notes](https://github.com/Milkdown/milkdown/releases)
- [Changelog](https://github.com/Milkdown/milkdown/blob/main/packages/crepe/CHANGELOG.md)
- [Commits](https://github.com/Milkdown/milkdown/commits/v7.23.0/packages/crepe)

Updates `@milkdown/kit` from 7.22.3 to 7.23.0
- [Release notes](https://github.com/Milkdown/milkdown/releases)
- [Commits](https://github.com/Milkdown/milkdown/commits/v7.23.0/packages/milkdown)

Updates `@tanstack/react-virtual` from 3.14.23 to 3.14.24
- [Release notes](https://github.com/TanStack/virtual/releases)
- [Changelog](https://github.com/TanStack/virtual/blob/main/packages/react-virtual/CHANGELOG.md)
- [Commits](https://github.com/TanStack/virtual/commits/@tanstack/react-virtual@3.14.24/packages/react-virtual)

Updates `geist` from 1.8.2 to 1.9.0
- [Release notes](https://github.com/vercel/geist-font/releases)
- [Changelog](https://github.com/vercel/geist-font/blob/main/packages/next/CHANGELOG.md)
- [Commits](https://github.com/vercel/geist-font/commits/v1.9.0/packages/next)

Updates `lucide-react` from 1.63.0 to 1.65.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.65.0/packages/lucide-react)

Updates `mongodb` from 7.7.0 to 7.8.0
- [Release notes](https://github.com/mongodb/node-mongodb-native/releases)
- [Changelog](https://github.com/mongodb/node-mongodb-native/blob/main/HISTORY.md)
- [Commits](mongodb/node-mongodb-native@v7.7.0...v7.8.0)

Updates `react-resizable-panels` from 4.15.0 to 4.15.3
- [Release notes](https://github.com/bvaughn/react-resizable-panels/releases)
- [Changelog](https://github.com/bvaughn/react-resizable-panels/blob/main/CHANGELOG.md)
- [Commits](bvaughn/react-resizable-panels@4.15.0...4.15.3)

Updates `@types/node` from 26.6.5 to 26.6.6
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `eslint-config-next` from 16.4.2 to 16.4.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.4.3/packages/eslint-config-next)

Updates `@opennextjs/cloudflare` from 1.20.14 to 1.20.15
- [Release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases)
- [Changelog](https://github.com/opennextjs/opennextjs-cloudflare/blob/main/packages/cloudflare/CHANGELOG.md)
- [Commits](https://github.com/opennextjs/opennextjs-cloudflare/commits/@opennextjs/cloudflare@1.20.15/packages/cloudflare)

Updates `wrangler` from 4.154.0 to 4.156.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.156.0/packages/wrangler)

---
updated-dependencies:
- dependency-name: "@milkdown/crepe"
  dependency-version: 7.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@milkdown/kit"
  dependency-version: 7.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@tanstack/react-virtual"
  dependency-version: 3.14.24
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: geist
  dependency-version: 1.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: lucide-react
  dependency-version: 1.65.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: mongodb
  dependency-version: 7.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: react-resizable-panels
  dependency-version: 4.15.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@types/node"
  dependency-version: 26.6.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: eslint-config-next
  dependency-version: 16.4.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@opennextjs/cloudflare"
  dependency-version: 1.20.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: wrangler
  dependency-version: 4.156.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@vercel

vercel Bot commented Nov 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
mydevtools-tech Ready Ready Preview Nov 5, 2026 10:34am UTC

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Nov 2, 2026
@dependabot
dependabot Bot requested a review from itsmeakhil as a code owner November 2, 2026 18:13
@dependabot dependabot Bot added the javascript Pull requests that update javascript code label Nov 2, 2026
@itsmeakhil @claude
Merge main into the minor-and-patch dependency bump
05aa917 
Conflicts in apps/desktop-ui and apps/web package.json: main had already
moved @hookform/resolvers to ^6.0.2 and framer-motion to ^14.9.0, so those
keep main's versions. The group's bumps stay: @milkdown/crepe and
@milkdown/kit 7.23.0, geist ^1.9.0, lucide-react ^1.65.0. pnpm-lock.yaml
regenerated with pnpm install --lockfile-only and checked with
--frozen-lockfile.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@itsmeakhil
itsmeakhil merged commit 9552f51 into main Nov 5, 2026
1 of 4 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/minor-and-patch-462828b155 branch November 5, 2026 10:35

This branch was successfully deployed

1 active deployment
Preview — 05aa9179 Deployed Nov 5, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@itsmeakhil itsmeakhil Awaiting requested review from itsmeakhil itsmeakhil is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@itsmeakhil