Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 34 updates - #266

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-ac8ca6e3a9
Open

chore(deps): bump the production-dependencies group across 1 directory with 34 updates#266
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-ac8ca6e3a9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 31, 2026

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 34 updates in the / directory:

Package From To
typescript 6.0.3 7.0.2
@astrojs/cloudflare 14.1.4 14.2.5
@hugeicons/core-free-icons 4.2.3 4.3.0
@sentry/browser 10.67.0 10.71.0
@tabler/icons 3.45.0 3.46.0
@tanstack/virtual-core 3.17.5 3.17.8
astro 7.1.3 7.2.9
posthog-js 1.405.3 1.422.1
tailwind-variants 3.2.2 3.3.1
@astrojs/react 6.0.1 6.0.4
@base-ui/react 1.6.0 1.7.0
@tanstack/react-virtual 3.14.7 3.14.10
lucide-react 1.25.0 1.35.0
react 19.2.7 19.2.8
react-dom 19.2.7 19.2.8
shadcn 4.13.1 4.19.0
sonner 2.0.7 2.0.8
@astrojs/starlight 0.41.3 0.41.9
sharp 0.35.3 0.35.4
@modelcontextprotocol/sdk 1.29.0 1.30.0
pg 8.22.0 8.23.0
@aws-sdk/client-s3 3.1091.0 3.1120.0
@fastify/busboy 3.2.0 3.2.2
@hono/mcp 0.3.1 0.3.2
@hono/node-server 2.0.11 2.1.1
@hono/zod-openapi 1.5.1 1.6.1
@sentry/bun 10.67.0 10.71.0
@sentry/node 10.67.0 10.71.0
@ungap/structured-clone 1.3.3 1.4.0
add-mcp 1.13.0 2.3.0
hono 4.12.31 4.13.5
posthog-node 5.46.0 5.51.4
ws 8.21.1 8.21.3
@astrojs/language-server 2.16.12 2.16.15

Updates typescript from 6.0.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

Commits
  • 1e4744d Merge branch 'main' into ts7-release
  • a5a219cmicrosoft/typescript-go#4558
  • ecfe30d Update status localization
  • 5de25b5 Hide executable name in TypeScript status
  • d7ce74a Show bundled TypeScript version for packaged servers
  • 29be66a Correct TS 7 release version to 7.0.2
  • ed2bd1b Merge branch 'main' into ts7-release
  • 8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
  • 9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
  • d4eaca5microsoft/typescript-go#4549
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.


Updates @astrojs/cloudflare from 14.1.4 to 14.2.5

Release notes

Sourced from @​astrojs/cloudflare's releases.

@​astrojs/cloudflare@​14.2.5

Patch Changes

  • #17819 633855b Thanks @​matthewp! - Updates generated and default Cloudflare compatibility_date values to match the installed runtime and requires Wrangler ^4.125.0

  • #17675 44d384c Thanks @​danielmlr! - Adds the Worker version to the cache metadata of cached responses when the CF_VERSION_METADATA binding is configured. Responses carry an astro-version:<id> cache tag for version-specific purging, and responses that already send Last-Modified get a weak ETag that folds the version in. Conditional revalidation then returns fresh content after a deploy that changes rendered output but not content — most commonly the hashed asset URLs in server-rendered HTML. Without the binding, nothing changes.

  • Updated dependencies []:

    • @​astrojs/underscore-redirects@​1.0.4

@​astrojs/cloudflare@​14.2.4

Patch Changes

  • #17789 7c541a7 Thanks @​astro-factory! - Fixes dep scanning failure when .astro frontmatter contains regex literals with quote characters (e.g. /"/g)

  • Updated dependencies []:

    • @​astrojs/underscore-redirects@​1.0.4

@​astrojs/cloudflare@​14.2.3

Patch Changes

  • Updated dependencies [05763a0]:
    • @​astrojs/internal-helpers@​0.10.4
    • @​astrojs/underscore-redirects@​1.0.4

@​astrojs/cloudflare@​14.2.2

Patch Changes

  • Updated dependencies [8c193f6]:
    • @​astrojs/internal-helpers@​0.10.3
    • @​astrojs/underscore-redirects@​1.0.4

@​astrojs/cloudflare@​14.2.1

Patch Changes

  • #17627 ba6a9f6 Thanks @​astrobot-houston! - Fixes the astro peer dependency range from ^7.0.0 to ^7.2.0. The adapter imports symbols (beginContentEntryCollection, beginImageCollection, endContentEntryCollection, endImageCollection) from astro/app that were added in Astro 7.2.0, so earlier versions fail at build time with a MISSING_EXPORT error.

  • Updated dependencies [0891ac9]:

    • @​astrojs/underscore-redirects@​1.0.4

@​astrojs/cloudflare@​14.2.0

Minor Changes

  • #16194 2a59663 Thanks @​Daedalus-Icarus! - Adds opt-in build-time image optimization for the cloudflare-binding image service.

    When enabled, the Cloudflare IMAGES binding transforms static images in the workerd prerender environment, and the optimized bytes are written directly to the output directory. If the binding fails, it falls back to Sharp.

    To opt in, use the compound configuration form:

... (truncated)

Changelog

Sourced from @​astrojs/cloudflare's changelog.

14.2.5

Patch Changes

  • #17819 633855b Thanks @​matthewp! - Updates generated and default Cloudflare compatibility_date values to match the installed runtime and requires Wrangler ^4.125.0

  • #17675 44d384c Thanks @​danielmlr! - Adds the Worker version to the cache metadata of cached responses when the CF_VERSION_METADATA binding is configured. Responses carry an astro-version:<id> cache tag for version-specific purging, and responses that already send Last-Modified get a weak ETag that folds the version in. Conditional revalidation then returns fresh content after a deploy that changes rendered output but not content — most commonly the hashed asset URLs in server-rendered HTML. Without the binding, nothing changes.

  • Updated dependencies []:

    • @​astrojs/underscore-redirects@​1.0.4

14.2.4

Patch Changes

  • #17789 7c541a7 Thanks @​astro-factory! - Fixes dep scanning failure when .astro frontmatter contains regex literals with quote characters (e.g. /"/g)

  • Updated dependencies []:

    • @​astrojs/underscore-redirects@​1.0.4

14.2.3

Patch Changes

  • Updated dependencies [05763a0]:
    • @​astrojs/internal-helpers@​0.10.4
    • @​astrojs/underscore-redirects@​1.0.4

14.2.2

Patch Changes

  • Updated dependencies [8c193f6]:
    • @​astrojs/internal-helpers@​0.10.3
    • @​astrojs/underscore-redirects@​1.0.4

14.2.1

Patch Changes

  • #17627 ba6a9f6 Thanks @​astrobot-houston! - Fixes the astro peer dependency range from ^7.0.0 to ^7.2.0. The adapter imports symbols (beginContentEntryCollection, beginImageCollection, endContentEntryCollection, endImageCollection) from astro/app that were added in Astro 7.2.0, so earlier versions fail at build time with a MISSING_EXPORT error.

  • Updated dependencies [0891ac9]:

    • @​astrojs/underscore-redirects@​1.0.4

14.2.0

Minor Changes

... (truncated)

Commits

Updates @hugeicons/core-free-icons from 4.2.3 to 4.3.0

Updates @sentry/browser from 10.67.0 to 10.71.0

Release notes

Sourced from @​sentry/browser's releases.

10.71.0

Important Changes

  • feat(v10/core)!: Enable logs by default (#23311)

The enableLogs client option now defaults to true, so Sentry Logs work without any manual opt-in. Nothing is captured unless you call the Sentry.logger.* APIs or add a log-forwarding integration (such as consoleLoggingIntegration, pinoIntegration, or the winston transport), and you can set enableLogs: false to opt out. Although a default change like this would normally land in a major release, we are shipping it in a minor after careful consideration, since it sends no data on its own and only takes effect once you actively use the logging APIs or a logging integration.

Other Changes

  • feat(v10/core): Deprecate scope.clear() method (#23231)
  • fix(v10/core): Bound child span tracking on long-lived spans (#23406)
  • fix(v10/core): Read Supabase PostgREST headers from Headers instances (#23241)
  • fix(v10/hono): Use captureException from scope, not from Client (#23280)
  • fix(v10/nuxt): Delete source maps after Nitro finishes building (#23508)
  • fix(v10/react-router): Carry multi-byte UTF-8 across SSR stream chunk boundaries (#23421)
  • fix(v10/react): Match TanStack Router pageload against the router location (#23494)
  • test(v10/nextjs): Add e2e app for a user-owned OpenTelemetry setup (#23278)

Bundle size 📦

Path Size
@​sentry/browser 27.1 KB
@​sentry/browser - with treeshaking flags 25.58 KB
@​sentry/browser (incl. Tracing) 45.51 KB
@​sentry/browser (incl. Tracing + Span Streaming) 47.25 KB
@​sentry/browser (incl. Tracing, Profiling) 50.15 KB
@​sentry/browser (incl. Tracing, Replay) 83.83 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags 73.71 KB
@​sentry/browser (incl. Tracing, Replay with Canvas) 88.45 KB
@​sentry/browser (incl. Tracing, Replay, Feedback) 100.79 KB
@​sentry/browser (incl. Feedback) 43.87 KB
@​sentry/browser (incl. sendFeedback) 31.78 KB
@​sentry/browser (incl. FeedbackAsync) 36.79 KB
@​sentry/browser (incl. Metrics) 28.16 KB
@​sentry/browser (incl. Logs) 28.38 KB
@​sentry/browser (incl. Metrics & Logs) 29.06 KB
@​sentry/react 28.86 KB
@​sentry/react (incl. Tracing) 47.72 KB
@​sentry/vue 32.4 KB
@​sentry/vue (incl. Tracing) 47.43 KB
@​sentry/svelte 27.12 KB
CDN Bundle 29.43 KB
CDN Bundle (incl. Tracing) 47.43 KB

... (truncated)

Changelog

Sourced from @​sentry/browser's changelog.

10.71.0

Important Changes

  • feat(v10/core)!: Enable logs by default (#23311)

The enableLogs client option now defaults to true, so Sentry Logs work without any manual opt-in. Nothing is captured unless you call the Sentry.logger.* APIs or add a log-forwarding integration (such as consoleLoggingIntegration, pinoIntegration, or the winston transport), and you can set enableLogs: false to opt out. Although a default change like this would normally land in a major release, we are shipping it in a minor after careful consideration, since it sends no data on its own and only takes effect once you actively use the logging APIs or a logging integration.

Other Changes

  • feat(v10/core): Deprecate scope.clear() method (#23231)
  • fix(v10/core): Bound child span tracking on long-lived spans (#23406)
  • fix(v10/core): Read Supabase PostgREST headers from Headers instances (#23241)
  • fix(v10/hono): Use captureException from scope, not from Client (#23280)
  • fix(v10/nuxt): Delete source maps after Nitro finishes building (#23508)
  • fix(v10/react-router): Carry multi-byte UTF-8 across SSR stream chunk boundaries (#23421)
  • fix(v10/react): Match TanStack Router pageload against the router location (#23494)
  • test(v10/nextjs): Add e2e app for a user-owned OpenTelemetry setup (#23278)

10.70.0

  • feat(v10/core): Support stable MCP SDK v2 (#22986)
  • feat(v10/deps): Bump @sentry/node-cpu-profiler to 2.4.3 (#22992)
  • feat(v10/solid,solidstart): Support @solidjs/router v1 (#23163)
  • fix(v10/cloudflare): Fork the isolation scope for Durable Object methods (#23189)
  • fix(v10/cloudflare): Get original waituntil in workflows (#23192)
  • fix(v10/cloudflare): Instrument DO RPC methods on the prototype, not a Proxy (#23190)
  • fix(v10/cloudflare): Set agent conversation id on the onRequest path (#22985)
  • fix(v10/cloudflare): Set conversation id independent of session name (#23193)
  • fix(v10/cloudflare): Try/catch on non-configurable prototypes (#23191)
  • fix(v10/cloudflare): Use gen_ai.agent.name for class names (#22987)
  • fix(v10/core,browser): Handle errors from other realms (#23201)
  • fix(v10/core): Sample errors after beforeSend while preserving session updates (#22819)
  • fix(v10/hono): Include originalException in captured exception hint (#22990)
  • fix(v10/nextjs): meriyah issue for standalone build (#23055)
  • fix(v10/nextjs): Remove tracing from middleware wrappers (#22904)
  • fix(v10/profiling-node): Respect profileSessionSampleRate in trace profile lifecycle (#22940)
  • fix(v10/react-router): Preserve sourcemaps.disable when unstable_sentryVitePluginOptions is set (#22966)
  • fix(v10/react): Remove routes from shared set on <Routes> unmount (#22948)
  • fix(v10/sveltekit): Export metrics from worker entry point (#23027)

... (truncated)

Commits
  • 9fcb063 release: 10.71.0
  • fbc14d8 meta(changelog): Update changelog for 10.71.0 (#23517)
  • 671f4b1 fix(v10/nuxt): Delete source maps after Nitro finishes building (#23508)
  • 0211227 fix(v10/react): Match TanStack Router pageload against the router location (#...
  • bbea828 feat(v10/core)!: Enable logs by default (#23311)
  • 7ded310 fix(v10/core): Bound child span tracking on long-lived spans (#23406)
  • 245d807 fix(v10/react-router): Carry multi-byte UTF-8 across SSR stream chunk boundar...
  • 1d439a3 fix(v10/core): Read Supabase PostgREST headers from Headers instances (#23241)
  • 8f03efe test(v10/nextjs): Add e2e app for a user-owned OpenTelemetry setup (#23278)
  • c884ae1 fix(v10/hono): Use captureException from scope, not from Client (#23280)
  • Additional commits viewable in compare view

Updates @tabler/icons from 3.45.0 to 3.46.0

Release notes

Sourced from @​tabler/icons's releases.

Release 3.46.0

18 new icons:

  • outline/play-bug
  • outline/play-bugs
  • outline/remote-control
  • outline/rocking-chair
  • outline/run-sprint
  • outline/sparkles-2-off
  • outline/tabs
  • outline/tags-chevron-down
  • outline/tags-chevron-left
  • outline/tags-chevron-right
  • outline/tags-chevron-up
  • outline/thinking-high
  • outline/thinking-low
  • outline/thinking-medium
  • outline/treasure-chest
  • outline/twig
  • outline/vault
  • outline/yarn

Fixed icons: outline/credits, outline/currency-tether, outline/device-3d-camera, outline/device-screen, outline/home-lock, outline/map-lock, outline/notdef, outline/queue-pop-in, outline/server-bolt, outline/server, outline/sparkles-2, outline/transform-point-bottom-left, outline/transform-point-bottom-right, outline/transform-point-top-left, outline/transform-point-top-right

Commits
  • 8ac7d81 Release 3.46.0
  • 2727ba9 Enhance release process in package.json: add GitHub authentication check and ...
  • 4ff4802 Add npm login check before release-it initialization in package.json
  • 74a7690 Merge branch 'main' of https://github.com/tabler/tabler-icons
  • f828849 Update dependencies in package.json and pnpm-lock.yaml: remove @​release-it-pl...
  • 1a39582 Fix rect width/height swap in optimize script (#1570)
  • 54bac86 Secure PR validation: run fork code without privileges (#1569)
  • eaaf32d Update Turbo package to version 2.10.7 and adjust schema reference in turbo.json
  • 2cfcde7 Remove unused AI tag generation script and related package dependency from pr...
  • be0e5a8 Refactor SVG paths for several icons to improve structure and consistency: `o...
  • Additional commits viewable in compare view

Updates @tanstack/virtual-core from 3.17.5 to 3.17.8

Release notes

Sourced from @​tanstack/virtual-core's releases.

@​tanstack/virtual-core@​3.17.8

Patch Changes

  • #1256 a0a411e - Cancel the pending isScrolling reset when a scroll observer is torn down, and reset isScrolling and scrollDirection in cleanup() so they don't stay stuck after the scroll element changes or is removed.

  • #1246 d2cf98b - Ignore connected measurement nodes whose indexes are outside the current item count.

@​tanstack/virtual-core@​3.17.7

Patch Changes

  • #1239 a5417b4 - Fix a one-frame viewport jump when above-viewport rows resize while scrolling up (#1227). resizeItem writes scrollTop synchronously inside the ResizeObserver callback to compensate for the size change, but then notified asynchronously — so the browser could paint a frame with the new scrollTop and the old item transforms, making the content jerk by the resize delta and snap back. When a compensation actually moves the scroll position, resizeItem now notifies synchronously so the transform commit lands in the same paint as the scroll write. Resizes that don't move the scroll position (below-fold measurements, iOS-deferred adjustments) keep the cheaper async notify.

@​tanstack/virtual-core@​3.17.6

Patch Changes

  • #1236 7ae32b5 - Stop the default scroll-adjustment heuristic from drifting the viewport when a viewport-spanning item grows. Previously any item whose top sat above the fold (itemStart < scrollOffset) had its size delta compensated on every re-measure — including a streaming chat message that spans the fold and grows at its bottom, dragging scrollTop downward token by token (#1218). Re-measurements now only compensate items that are entirely above the fold (itemStart + itemSize <= scrollOffset); growth below the anchor point leaves the scroll position untouched. First measurements (estimate→actual) still compensate any above-fold item, and a custom shouldAdjustScrollPositionOnItemSizeChange still overrides the default.
Changelog

Sourced from @​tanstack/virtual-core's changelog.

3.17.8

Patch Changes

  • #1256 a0a411e - Cancel the pending isScrolling reset when a scroll observer is torn down, and reset isScrolling and scrollDirection in cleanup() so they don't stay stuck after the scroll element changes or is removed.

  • #1246 d2cf98b - Ignore connected measurement nodes whose indexes are outside the current item count.

3.17.7

Patch Changes

  • #1239 a5417b4 - Fix a one-frame viewport jump when above-viewport rows resize while scrolling up (#1227). resizeItem writes scrollTop synchronously inside the ResizeObserver callback to compensate for the size change, but then notified asynchronously — so the browser could paint a frame with the new scrollTop and the old item transforms, making the content jerk by the resize delta and snap back. When a compensation actually moves the scroll position, resizeItem now notifies synchronously so the transform commit lands in the same paint as the scroll write. Resizes that don't move the scroll position (below-fold measurements, iOS-deferred adjustments) keep the cheaper async notify.

3.17.6

Patch Changes

  • #1236 7ae32b5 - Stop the default scroll-adjustment heuristic from drifting the viewport when a viewport-spanning item grows. Previously any item whose top sat above the fold (itemStart < scrollOffset) had its size delta compensated on every re-measure — including a streaming chat message that spans the fold and grows at its bottom, dragging scrollTop downward token by token (#1218). Re-measurements now only compensate items that are entirely above the fold (itemStart + itemSize <= scrollOffset); growth below the anchor point leaves the scroll position untouched. First measurements (estimate→actual) still compensate any above-fold item, and a custom shouldAdjustScrollPositionOnItemSizeChange still overrides the default.
Commits
  • e9874f0 ci: Version Packages (#1247)
  • a0a411e fix(virtual-core): cancel the isScrolling debounce on scroll-observer cleanup...
  • d2cf98b fix(virtual-core): ignore stale connected measurements (#1246)
  • deca524 ci: Version Packages (#1240)
  • a5417b4 fix(virtual-core): notify synchronously after above-viewport resize compensat...
  • 32b2f2b ci: Version Packages (#1238)
  • ef6e92a docs(virtual-core): clarify shouldAdjustScrollPositionOnItemSizeChange usage ...
  • 7ae32b5 fix(virtual-core): stop viewport-spanning item growth from drifting scroll (#...
  • See full diff in compare view

Updates astro from 7.1.3 to 7.2.9

Release notes

Sourced from astro's releases.

astro@7.2.9

Patch Changes

astro@7.2.8

Patch Changes

astro@7.2.7

Patch Changes

  • #17415 55d38c8 Thanks @​iseraph-dev! - Deserializes each route once when loading the SSR manifest

  • #17772 023b48b Thanks @​matthewp! - Fixes route selection for normalized request paths in adapter and development request handling

  • #17819 633855b Thanks @​matthewp! - Updates generated and default Cloudflare compatibility_date values to match the installed runtime and requires Wrangler ^4.125.0

  • #17813 ae26d18 Thanks @​matthewp! - Fixes rewrite() and next(payload) for GET and HEAD requests with host-provided bodies

  • #17816 a0d2fe3 Thanks @​astro-factory! - Fixes the experimental svgOptimizer not generating unique per-file ID prefixes when using SVGO's prefixIds plugin

astro@7.2.6

Patch Changes

  • #17812 29af6da Thanks @​matthewp! - Fixes a bug where new FetchState(request) could fail in development when server dependencies were optimized

astro@7.2.5

Patch Changes

  • #17758 5f419e2 Thanks @​astro-factory! - Fixes a bug where experimental_getFontFileURL() rejected valid font URLs when using the Cloudflare adapter

  • #17416 493796b Thanks @​iseraph-dev! - Skips no-op pathname writes when normalizing SSR request URLs

  • #17712 bd374b7 Thanks @​fkatsuhiro! - Updates deprecation messages target from Astro 7 to 8

  • #17719 dac1768 Thanks @​astrobot-houston! - Fixes session ID validation to reject non-UUID cookie values before using them as storage keys

  • #17770 84eb7e7 Thanks @​astro-factory! - Fixes --mode, --site, --base, --out-dir, --verbose, --silent, and --open flags being silently dropped when using astro dev --background or astro preview --background

  • #17713 d035290 Thanks @​wakqasahmed! - Fixes content-modules.mjs not removing entries for deleted or renamed content files, which could cause Vite to attempt to resolve non-existent modules

... (truncated)

Changelog

Sourced from astro's changelog.

7.2.9

Patch Changes

7.2.8

Patch Changes

7.2.7

Patch Changes

  • #17415 55d38c8 Thanks @​iseraph-dev! - Deserializes each route once when loading the SSR manifest

  • #17772 023b48b Thanks @​matthewp! - Fixes route selection for normalized request paths in adapter and development request handling

  • #17819 633855b Thanks @​matthewp! - Updates generated and default Cloudflare compatibility_date values to match the installed runtime and requires Wrangler ^4.125.0

  • #17813 ae26d18 Thanks @​matthewp! - Fixes rewrite() and next(payload) for GET and HEAD requests with host-provided bodies

  • #17816 a0d2fe3 Thanks @​astro-factory! - Fixes the experimental svgOptimizer not generating unique per-file ID prefixes when using SVGO's prefixIds plugin

7.2.6

Patch Changes

  • #17812 29af6da Thanks @​matthewp! - Fixes a bug where new FetchState(request) could fail in development when server dependencies were optimized

7.2.5

Patch Changes

... (truncated)

Commits

Updates posthog-js from 1.405.3 to 1.422.1

Release notes

Sourced from posthog-js's releases.

posthog-js@1.422.1

1.422.1

Patch Changes

  • #4636 74ff567 Thanks @​yfwmaniish! - Narrow the pinterest entry in the bot-detection blocklist to pinterestbot, so real users on Pinterest's in-app browser (whose UA also contains the substring pinterest) are no longer misclassified as bots and silently excluded from analytics. The crawler's other UA variant remains covered by the existing generic bot.htm entry, so no bot-detection coverage is lost. (2026-08-27)
  • Updated dependencies [74ff567]:
    • @​posthog/core@​1.49.1
    • @​posthog/browser-common@​0.6.1

posthog-js@1.422.0

1.422.0

Minor Changes

  • #4658 db8687c Thanks @​posthog! - Report $sdk_debug_replay_throttled_mutations_dropped on captured events, counting the attribute changes the session recorder discarded during that session. The recorder throttles elements that change hundreds of times a second, and a discarded class or style change never reaches the player — so a recording can keep showing an element the live page had already hidden. Query this property to see whether your app is affected. (2026-08-27)

posthog-js@1.421.2

1.421.2

Patch Changes

…y with 34 updates

Bumps the production-dependencies group with 34 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [typescript](https://github.com/microsoft/TypeScript) | `6.0.3` | `7.0.2` |
| [@astrojs/cloudflare](https://github.com/withastro/astro/tree/HEAD/packages/integrations/cloudflare) | `14.1.4` | `14.2.5` |
| @hugeicons/core-free-icons | `4.2.3` | `4.3.0` |
| [@sentry/browser](https://github.com/getsentry/sentry-javascript) | `10.67.0` | `10.71.0` |
| [@tabler/icons](https://github.com/tabler/tabler-icons) | `3.45.0` | `3.46.0` |
| [@tanstack/virtual-core](https://github.com/TanStack/virtual/tree/HEAD/packages/virtual-core) | `3.17.5` | `3.17.8` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.1.3` | `7.2.9` |
| [posthog-js](https://github.com/PostHog/posthog-js) | `1.405.3` | `1.422.1` |
| [tailwind-variants](https://github.com/heroui-inc/tailwind-variants) | `3.2.2` | `3.3.1` |
| [@astrojs/react](https://github.com/withastro/astro/tree/HEAD/packages/integrations/react) | `6.0.1` | `6.0.4` |
| [@base-ui/react](https://github.com/mui/base-ui/tree/HEAD/packages/react) | `1.6.0` | `1.7.0` |
| [@tanstack/react-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual) | `3.14.7` | `3.14.10` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.25.0` | `1.35.0` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.7` | `19.2.8` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.7` | `19.2.8` |
| [shadcn](https://github.com/shadcn-ui/ui/tree/HEAD/packages/shadcn) | `4.13.1` | `4.19.0` |
| [sonner](https://github.com/emilkowalski/sonner) | `2.0.7` | `2.0.8` |
| [@astrojs/starlight](https://github.com/withastro/starlight/tree/HEAD/packages/starlight) | `0.41.3` | `0.41.9` |
| [sharp](https://github.com/lovell/sharp) | `0.35.3` | `0.35.4` |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.29.0` | `1.30.0` |
| [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.22.0` | `8.23.0` |
| [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1091.0` | `3.1120.0` |
| [@fastify/busboy](https://github.com/fastify/busboy) | `3.2.0` | `3.2.2` |
| [@hono/mcp](https://github.com/honojs/middleware/tree/HEAD/packages/mcp) | `0.3.1` | `0.3.2` |
| [@hono/node-server](https://github.com/honojs/node-server) | `2.0.11` | `2.1.1` |
| [@hono/zod-openapi](https://github.com/honojs/middleware/tree/HEAD/packages/zod-openapi) | `1.5.1` | `1.6.1` |
| [@sentry/bun](https://github.com/getsentry/sentry-javascript) | `10.67.0` | `10.71.0` |
| [@sentry/node](https://github.com/getsentry/sentry-javascript) | `10.67.0` | `10.71.0` |
| [@ungap/structured-clone](https://github.com/ungap/structured-clone) | `1.3.3` | `1.4.0` |
| [add-mcp](https://github.com/neon-solutions/add-mcp) | `1.13.0` | `2.3.0` |
| [hono](https://github.com/honojs/hono) | `4.12.31` | `4.13.5` |
| [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.46.0` | `5.51.4` |
| [ws](https://github.com/websockets/ws) | `8.21.1` | `8.21.3` |
| [@astrojs/language-server](https://github.com/withastro/astro/tree/HEAD/packages/language-tools/language-server) | `2.16.12` | `2.16.15` |



Updates `typescript` from 6.0.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](microsoft/TypeScript@v6.0.3...v7.0.2)

Updates `@astrojs/cloudflare` from 14.1.4 to 14.2.5
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/cloudflare/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/cloudflare@14.2.5/packages/integrations/cloudflare)

Updates `@hugeicons/core-free-icons` from 4.2.3 to 4.3.0

Updates `@sentry/browser` from 10.67.0 to 10.71.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.71.0/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.67.0...10.71.0)

Updates `@tabler/icons` from 3.45.0 to 3.46.0
- [Release notes](https://github.com/tabler/tabler-icons/releases)
- [Commits](tabler/tabler-icons@v3.45.0...v3.46.0)

Updates `@tanstack/virtual-core` from 3.17.5 to 3.17.8
- [Release notes](https://github.com/TanStack/virtual/releases)
- [Changelog](https://github.com/TanStack/virtual/blob/main/packages/virtual-core/CHANGELOG.md)
- [Commits](https://github.com/TanStack/virtual/commits/@tanstack/virtual-core@3.17.8/packages/virtual-core)

Updates `astro` from 7.1.3 to 7.2.9
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.2.9/packages/astro)

Updates `posthog-js` from 1.405.3 to 1.422.1
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.405.3...posthog-js@1.422.1)

Updates `tailwind-variants` from 3.2.2 to 3.3.1
- [Release notes](https://github.com/heroui-inc/tailwind-variants/releases)
- [Changelog](https://github.com/heroui-inc/tailwind-variants/blob/main/CHANGELOG.md)
- [Commits](heroui-inc/tailwind-variants@v3.2.2...v3.3.1)

Updates `@astrojs/react` from 6.0.1 to 6.0.4
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/react/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/react@6.0.4/packages/integrations/react)

Updates `@base-ui/react` from 1.6.0 to 1.7.0
- [Release notes](https://github.com/mui/base-ui/releases)
- [Changelog](https://github.com/mui/base-ui/blob/master/CHANGELOG.md)
- [Commits](https://github.com/mui/base-ui/commits/v1.7.0/packages/react)

Updates `@tanstack/react-virtual` from 3.14.7 to 3.14.10
- [Release notes](https://github.com/TanStack/virtual/releases)
- [Changelog](https://github.com/TanStack/virtual/blob/main/packages/react-virtual/CHANGELOG.md)
- [Commits](https://github.com/TanStack/virtual/commits/@tanstack/react-virtual@3.14.10/packages/react-virtual)

Updates `lucide-react` from 1.25.0 to 1.35.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.35.0/packages/lucide-react)

Updates `react` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react)

Updates `react-dom` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom)

Updates `shadcn` from 4.13.1 to 4.19.0
- [Release notes](https://github.com/shadcn-ui/ui/releases)
- [Changelog](https://github.com/shadcn-ui/ui/blob/main/packages/shadcn/CHANGELOG.md)
- [Commits](https://github.com/shadcn-ui/ui/commits/shadcn@4.19.0/packages/shadcn)

Updates `sonner` from 2.0.7 to 2.0.8
- [Release notes](https://github.com/emilkowalski/sonner/releases)
- [Commits](emilkowalski/sonner@v2.0.7...v2.0.8)

Updates `@astrojs/starlight` from 0.41.3 to 0.41.9
- [Release notes](https://github.com/withastro/starlight/releases)
- [Changelog](https://github.com/withastro/starlight/blob/main/packages/starlight/CHANGELOG.md)
- [Commits](https://github.com/withastro/starlight/commits/@astrojs/starlight@0.41.9/packages/starlight)

Updates `sharp` from 0.35.3 to 0.35.4
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.35.3...v0.35.4)

Updates `@modelcontextprotocol/sdk` from 1.29.0 to 1.30.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0)

Updates `pg` from 8.22.0 to 8.23.0
- [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md)
- [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.0/packages/pg)

Updates `@aws-sdk/client-s3` from 3.1091.0 to 3.1120.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1120.0/clients/client-s3)

Updates `@fastify/busboy` from 3.2.0 to 3.2.2
- [Release notes](https://github.com/fastify/busboy/releases)
- [Commits](fastify/busboy@v3.2.0...v3.2.2)

Updates `@hono/mcp` from 0.3.1 to 0.3.2
- [Release notes](https://github.com/honojs/middleware/releases)
- [Changelog](https://github.com/honojs/middleware/blob/main/packages/mcp/CHANGELOG.md)
- [Commits](https://github.com/honojs/middleware/commits/@hono/mcp@0.3.2/packages/mcp)

Updates `@hono/node-server` from 2.0.11 to 2.1.1
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v2.0.11...v2.1.1)

Updates `@hono/zod-openapi` from 1.5.1 to 1.6.1
- [Release notes](https://github.com/honojs/middleware/releases)
- [Changelog](https://github.com/honojs/middleware/blob/main/packages/zod-openapi/CHANGELOG.md)
- [Commits](https://github.com/honojs/middleware/commits/@hono/zod-openapi@1.6.1/packages/zod-openapi)

Updates `@sentry/bun` from 10.67.0 to 10.71.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.71.0/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.67.0...10.71.0)

Updates `@sentry/node` from 10.67.0 to 10.71.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.71.0/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.67.0...10.71.0)

Updates `@ungap/structured-clone` from 1.3.3 to 1.4.0
- [Commits](ungap/structured-clone@v1.3.3...v1.4.0)

Updates `add-mcp` from 1.13.0 to 2.3.0
- [Release notes](https://github.com/neon-solutions/add-mcp/releases)
- [Changelog](https://github.com/neon-solutions/add-mcp/blob/main/CHANGELOG.md)
- [Commits](neon-solutions/add-mcp@v1.13.0...v2.3.0)

Updates `hono` from 4.12.31 to 4.13.5
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.31...v4.13.5)

Updates `posthog-node` from 5.46.0 to 5.51.4
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.51.4/packages/node)

Updates `ws` from 8.21.1 to 8.21.3
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.21.1...8.21.3)

Updates `@astrojs/language-server` from 2.16.12 to 2.16.15
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/language-tools/language-server/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/language-server@2.16.15/packages/language-tools/language-server)

---
updated-dependencies:
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: "@astrojs/cloudflare"
  dependency-version: 14.2.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@hugeicons/core-free-icons"
  dependency-version: 4.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@sentry/browser"
  dependency-version: 10.71.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@tabler/icons"
  dependency-version: 3.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@tanstack/virtual-core"
  dependency-version: 3.17.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: astro
  dependency-version: 7.2.9
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: posthog-js
  dependency-version: 1.422.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: tailwind-variants
  dependency-version: 3.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@astrojs/react"
  dependency-version: 6.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@base-ui/react"
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@tanstack/react-virtual"
  dependency-version: 3.14.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: lucide-react
  dependency-version: 1.35.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: react
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: react-dom
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: shadcn
  dependency-version: 4.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: sonner
  dependency-version: 2.0.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@astrojs/starlight"
  dependency-version: 0.41.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: sharp
  dependency-version: 0.35.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: pg
  dependency-version: 8.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@aws-sdk/client-s3"
  dependency-version: 3.1120.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@fastify/busboy"
  dependency-version: 3.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@hono/mcp"
  dependency-version: 0.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@hono/node-server"
  dependency-version: 2.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@hono/zod-openapi"
  dependency-version: 1.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@sentry/bun"
  dependency-version: 10.71.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@sentry/node"
  dependency-version: 10.71.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@ungap/structured-clone"
  dependency-version: 1.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: add-mcp
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: hono
  dependency-version: 4.13.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: posthog-node
  dependency-version: 5.51.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: ws
  dependency-version: 8.21.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@astrojs/language-server"
  dependency-version: 2.16.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 31, 2026
@greptile-apps

greptile-apps Bot commented Aug 31, 2026

Copy link
Copy Markdown
Contributor

PR author is in the excluded authors list.

@socket-security

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm @sentry/node-core is 60.0% likely obfuscated

Confidence: 0.60

Location: Package overview

From: pnpm-lock.yamlnpm/@sentry/node@10.71.0npm/@sentry/node-core@10.71.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@sentry/node-core@10.71.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants