Repository navigation
chore(deps): bump the production group across 1 directory with 9 updates - #1172
Merged
Merged
Conversation
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Bumps the production group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@platformatic/kafka](https://github.com/platformatic/kafka) | `2.11.0` | `2.12.0` | | [@xyflow/react](https://github.com/xyflow/xyflow/tree/HEAD/packages/react) | `12.11.6` | `12.12.0` | | [cassandra-driver](https://github.com/apache/cassandra-nodejs-driver) | `4.9.0` | `4.10.0` | | [framer-motion](https://github.com/motiondivision/motion) | `13.4.0` | `13.4.3` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.47.0` | `1.48.0` | | [monaco-editor](https://github.com/microsoft/monaco-editor) | `0.56.0` | `0.57.0` | | [next](https://github.com/vercel/next.js) | `16.3.5` | `16.3.6` | | [react-resizable-panels](https://github.com/bvaughn/react-resizable-panels) | `4.12.4` | `4.13.3` | | [sql-formatter](https://github.com/sql-formatter-org/sql-formatter) | `15.8.2` | `15.9.0` | Updates `@platformatic/kafka` from 2.11.0 to 2.12.0 - [Release notes](https://github.com/platformatic/kafka/releases) - [Commits](platformatic/kafka@v2.11.0...v2.12.0) Updates `@xyflow/react` from 12.11.6 to 12.12.0 - [Release notes](https://github.com/xyflow/xyflow/releases) - [Changelog](https://github.com/xyflow/xyflow/blob/main/packages/react/CHANGELOG.md) - [Commits](https://github.com/xyflow/xyflow/commits/@xyflow/react@12.12.0/packages/react) Updates `cassandra-driver` from 4.9.0 to 4.10.0 - [Changelog](https://github.com/apache/cassandra-nodejs-driver/blob/trunk/CHANGELOG.md) - [Commits](apache/cassandra-nodejs-driver@v4.9.0...v4.10.0) Updates `framer-motion` from 13.4.0 to 13.4.3 - [Changelog](https://github.com/motiondivision/motion/blob/main/CHANGELOG.md) - [Commits](motiondivision/motion@v13.4.0...v13.4.3) Updates `lucide-react` from 1.47.0 to 1.48.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.48.0/packages/lucide-react) Updates `monaco-editor` from 0.56.0 to 0.57.0 - [Release notes](https://github.com/microsoft/monaco-editor/releases) - [Changelog](https://github.com/microsoft/monaco-editor/blob/main/CHANGELOG.md) - [Commits](microsoft/monaco-editor@v0.56.0...v0.57.0) Updates `next` from 16.3.5 to 16.3.6 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.3.5...v16.3.6) Updates `react-resizable-panels` from 4.12.4 to 4.13.3 - [Release notes](https://github.com/bvaughn/react-resizable-panels/releases) - [Changelog](https://github.com/bvaughn/react-resizable-panels/blob/main/CHANGELOG.md) - [Commits](bvaughn/react-resizable-panels@4.12.4...4.13.3) Updates `sql-formatter` from 15.8.2 to 15.9.0 - [Release notes](https://github.com/sql-formatter-org/sql-formatter/releases) - [Commits](sql-formatter-org/sql-formatter@v15.8.2...v15.9.0) --- updated-dependencies: - dependency-name: "@platformatic/kafka" dependency-version: 2.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: "@xyflow/react" dependency-version: 12.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: cassandra-driver dependency-version: 4.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: framer-motion dependency-version: 13.4.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production - dependency-name: lucide-react dependency-version: 1.48.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: monaco-editor dependency-version: 0.57.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: next dependency-version: 16.3.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production - dependency-name: react-resizable-panels dependency-version: 4.13.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: sql-formatter dependency-version: 15.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/bun/production-f8bfa29838
branch
from
September 28, 2026 09:58
75a4f1c to
10ae6a3
Compare
The guard pins the installed version so that a bump fails until someone re-measures. On 0.57.0 the basic contribution registers the same 89 ids as 0.56.0, json is still absent from them, and plsql, tsql and cql are still unregistered, so each citation of the installed bundle moves to 0.57.0 with its claim unchanged. The edit-context focus the shortcuts guard relies on was checked in a browser on a production build. 0.57.0 bundles DOMPurify 3.4.15, read from the staged public/monaco/vs bundle, which is past the 3.4.13 that C10 waited for, so C10 is deleted.
….12.0 The client is pinned exactly because the provider was measured against it, so the bump was taken only after tests/live/kafka-read-only.ts passed on 2.12.0: 57 of 57 on kafka with the tripwire, 39 on redpanda, 47 on kafka-cluster, 8 with --failover and 7 on kafka-auth, each with the broker snapshot unchanged by the run. Under Node, through next start, a connect, the topic listing and two reads left __consumer_offsets absent, and the group seed control created it.
…s for ~0.6.0 cassandra-driver 4.10.0 raises its own adm-zip range to ~0.6.0, so the override no longer holds the dependency past its parent's range and its note had become false. CVE-2026-77301 is fixed in 0.6.1, inside that range, so the override now only forces resolution forward, the way the lodash entry does. The driver's lib/, index.js and index.d.ts are byte-identical to 4.9.0, so the 4.9.0 measurements carry over; the present-tense version citations move to 4.10.0. Verified on Apache Cassandra 5.0.9 under Bun 1.4.2 and Node 24: the cloud module loads, an adm-zip 0.6.1 write and read round-trips, and a connect plus query answers over protocol v4.
|
cevheri
added a commit
that referenced
this pull request
Sep 28, 2026
The override note from #1172 said CVE-2026-76845 had no fixed release. Its advisory, GHSA-vwc7-r8mq-g2x9, names no patched version but bounds the range at >= 0.5.9, <= 0.6.0, and Trivy closed the alert once main resolved 0.6.1.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the production group with 9 updates in the / directory:
2.11.02.12.012.11.612.12.04.9.04.10.013.4.013.4.31.47.01.48.00.56.00.57.016.3.516.3.64.12.44.13.315.8.215.9.0Updates
@platformatic/kafkafrom 2.11.0 to 2.12.0Release notes
Sourced from @platformatic/kafka's releases.
Commits
2040c04chore: Bumped v2.12.0.fa04014chore: Add flag not to require regression run before releasing. (#415)fcdbf8bfix: update consumer lag after manual commits (#413)00c6123test: stabilize consumer assignment metadata error check (#414)07bc8fbfix: allow consumer close after broker disconnect (#411)5fb95a7fix: correct close overload resolution (#410)75419a6fix: install dependencies in the Event Hubs recovery job (#407)f1310e2chore: Added EventHub smoke test. (#406)d866486fix: publish explicit empty KIP-848 assignments (#405)7f30ea0fix: Disable metadata retrying in producer loop. (#403)Updates
@xyflow/reactfrom 12.11.6 to 12.12.0Release notes
Sourced from @xyflow/react's releases.
Changelog
Sourced from @xyflow/react's changelog.
Commits
8716946chore(packages): bumpUpdates
cassandra-driverfrom 4.9.0 to 4.10.0Changelog
Sourced from cassandra-driver's changelog.
Commits
07d9a6eChangelog and version bump for 4.10.0c6ecea0Bump adm-zip from 0.5.10 to 0.6.071fac53CASSNODEJS-12: Deno and Bun support6f563ccCASSNODEJS-12: Deno and Bun support91ab5d9CASSNODEJS-11: Move@types/nodeto devDependenciesa6b92d2CASSNODEJS-10: Proposal for TypeScript Migration927a041Set up default protection ruleset for default and release branchesd2dc86fBump minimatchfa049faCASSNODEJS-6 Fix flaky client-batch-tests of cassandra.pid missing8ddf465CASSNODEJS-6 Fix flaky client-batch-tests of cassandra.pid missingUpdates
framer-motionfrom 13.4.0 to 13.4.3Changelog
Sourced from framer-motion's changelog.
Commits
164be2bv13.4.3d2747a2Updating changelog720530aMerge pull request #3833 from motiondivision/cursor/bc-824bfd3c-7a94-4eee-be1...7eb469aFix #3832: Replay animations when Suspense reveals memoized motion contentbe8a4b3Add failing Cypress test for Suspense reveal of memoized content (#3832)ef59724Add failing tests for animations after Suspense reveals memoized content (#3832)50f9558v13.4.2edc9bc4Updating changlelogc0194e5Updating changelog6300064Merge pull request #3831 from motiondivision/cursor/issue-resolution-process-...Updates
lucide-reactfrom 1.47.0 to 1.48.0Release notes
Sourced from lucide-react's releases.
Commits
f06ac67chore(typchecking): More typecheck jobs for all packages (#4885)Updates
monaco-editorfrom 0.56.0 to 0.57.0Release notes
Sourced from monaco-editor's releases.
... (truncated)
Changelog
Sourced from monaco-editor's changelog.
Commits
d618242Merge pull request #5487 from microsoft/hediet/b/release-0.57.0ef061ffPrepare Monaco Editor 0.57.0 release8e9b0f7Keep editor release version stable across task retries3f31304Prepare VS Code native headers before installing dependenciesebd1312Use authenticated Foundry Local installer for core builds176408bAlign release build Node version with VS Code 1.13997d81caBump uuid and webpack-dev-server in /website (#5415)f7c7f4cBump baseline-browser-mapping from 2.9.19 to 2.11.21 in /website (#5476)36f4fe6Bump svgo from 2.8.3 to 2.8.4 in /samples/browser-esm-parcel (#5474)f24cd7fBump actions/deploy-pages in the github-actions group (#5479)Updates
nextfrom 16.3.5 to 16.3.6Release notes
Sourced from next's releases.
Commits
a758ffcv16.3.6868fad3[active-lts] Harden next/og SVG serialization8c81cbb[lts-active] test: remove unsupported deployment ID builder cases (#98821)Updates
react-resizable-panelsfrom 4.12.4 to 4.13.3Release notes
Sourced from react-resizable-panels's releases.
Changelog
Sourced from react-resizable-panels's changelog.
Commits
ffa22a14.13.2 -> 4.13.3cd49125Bugfix: Separator behind a modal <dialog> can not be dragged (#755)9a2bb1f4.13.1 -> 4.13.23b6671eFix panel (re)ordering bug for environments like JSDom with no positions/offs...f6622c4Bugfix: Separator keeps invisible focus after a drag (#752)a2796d74.13.0 -> 4.13.1dcc6525Bug fixes (#750)56229234.12.4 -> 4.13.0b10eba6Panels support configurable collapse threshold (#749)5ce42e8Resize preview mode (#746)Updates
sql-formatterfrom 15.8.2 to 15.9.0Release notes
Sourced from sql-formatter's releases.
Commits
63dc9f815.9.0a9a2223Add a note about the need topnpm loginfor release021b391Treat a reserved word after AS as an alias (#972)b77a536Add Christopher Pruijsen to AUTHORS55c68bbAddress review: narrow isAsKeyword, move tests to shared helpersbcd3a42Treat a reserved word after AS as an aliasa68e988Support % as the modulo operator in SingleStoreDB (#971)1ff85d8Add Max Freedom Pollard to AUTHORSde7587efix(singlestoredb): support % as the modulo operatorf6de1cdMerge branch 'fix/pgdump-restrict-commands'