Bump the npm_and_yarn group across 1 directory with 15 updates by dependabot[bot] · Pull Request #5 · Solizardking/registry

dependabot · 2026-10-05T14:05:56Z

Bumps the npm_and_yarn group with 15 updates in the /ui directory:

Package	From	To
next	`16.2.4`	`16.3.8`
@hey-api/openapi-ts	`0.93.1`	`0.97.3`
baseline-browser-mapping	`2.10.7`	`2.11.27`
postcss	`8.5.6`	`8.5.23`
vitest	`4.0.18`	`4.1.11`
@babel/core	`7.28.5`	`7.29.7`
brace-expansion	`1.1.14`	`1.1.21`
@humanfs/node	`0.16.7`	`0.16.8`
@vitest/mocker	`3.2.4`	`4.1.11`
browserslist	`4.27.0`	`4.29.3`
nanoid	`3.3.11`	`3.3.20`
postcss-selector-parser	`6.1.2`	`6.1.4`
sharp	`0.34.5`	`0.35.5`
vite	`6.4.2`	`7.3.6`
ws	`8.19.0`	`8.22.0`

Updates next from 16.2.4 to 16.3.8

Release notes

Sourced from next's releases.

v16.3.8

This release contains security fixes for the following advisories:

High:

Server-Side Request Forgery in Image Optimization

Medium:

Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass

Cache poisoning of SSG and ISR pages in self-hosted Next.js applications

Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service

Pending use cache fill can leak Draft Mode content into regular responses and persisted pages

Cache leak across root param values in nested 'use cache' functions

Low:

Information disclosure in the Next.js development server's Model Context Protocol endpoint

v16.3.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

turbo-tasks-backend: fix strongly consistent read hanging on a canceled task (#98931)

Credits

Huge thanks to @lukesandberg for helping!

v16.3.6

This release contains a security fix for GHSA-vcvr-r3jv-pc5j: Remote Code Execution in next/og ImageResponse

v16.3.5

The following bug fixes have been backported. It does not include all pending features/changes on canary.

next/image: Skip 0-byte entries when initializing disk LRU cache (#98185)

next/image: Reject empty images when reading/writing to the disk cache (#98186)

Emit whole-app server NFTs when output: 'standalone' is used with an adapter (#98167)

Add CSP nonce to script tags of loading and template files (#98403)

Fix use cache prerender signal retention (#98448)

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

testmode: Fix infinite recursion in testmode passthrough fetch (#97691)

Fix build error when aliasing typescript to @typescript/typescript6 (#97997)

Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

... (truncated)

Commits

b0fad0d v16.3.8
719e4c6 [lts-active] Scope response cache keys to their source route (#218)
e92db45 [lts-active] Fix metadata propagation for deduplicated nested caches (#223)
40c2ba9 [lts-active] Match Next data paths case-sensitively (#196)
2d9f50a [lts-active] Fix MCP middleware DNS rebinding (#213)
bd9214f [lts-active] Fix draft mode leaks through cross-request 'use cache' dedupli...
8db4a62 [lts-active][webpack] Ensure dynamicParams is respected in `opengraph-image...
e002ad6 [lts-active] fix(next/image): Pin DNS resolution when fetching external image...
4c20699 v16.3.7
2521aec [backport] turbo-tasks-backend: fix strongly consistent read hanging on a can...
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.

Updates @hey-api/openapi-ts from 0.93.1 to 0.97.3

Release notes

Sourced from @hey-api/openapi-ts's releases.

@hey-api/openapi-ts@0.95.0

Minor Changes

plugin(valibot): remove request data schema (#3671) (96f60ad) by @mrlubos

Validator request schemas

Valibot plugin no longer exports composite request Data schemas. Instead, each layer is exported as a separate schema. If you're using validators with SDKs, you can preserve the composite schema with shouldExtract:
export default {
  input: "hey-api/backend", // sign up at app.heyapi.dev
  output: "src/client",
  plugins: [
    // ...other plugins
    {
      name: "sdk",
      validator: "valibot",
    },
    {
      name: "valibot",
      requests: {
        shouldExtract: true,
      },
    },
  ],
};
internal: remove plugin.getSymbol() function (#3671) (96f60ad) by @mrlubos

Removed plugin.getSymbol() function

This function has been removed. You can use plugin.querySymbol() instead. It accepts the same arguments and returns the same result.

plugin(zod): remove request data schema (#3671) (96f60ad) by @mrlubos

Validator request schemas

Zod plugin no longer exports composite request Data schemas. Instead, each layer is exported as a separate schema. If you're using validators with SDKs, you can preserve the composite schema with shouldExtract:
export default {
  input: "hey-api/backend", // sign up at app.heyapi.dev
  output: "src/client",
  plugins: [
    // ...other plugins
    {
      name: "sdk",
      validator: "zod",
</tr></table> 

... (truncated)

Changelog

Sourced from @hey-api/openapi-ts's changelog.

0.97.3

Patch Changes

plugin(@hey-api/client-axios): fix: correct return type in SSE (#3919) (a19b3a4) by @kitlangton

plugin(@tanstack/preact-query): add getQueryData option (#3827) (1aa4785) by @inas-sirhan

plugin(@hey-api/client-ofetch): fix: correct return type in SSE (#3919) (a19b3a4) by @kitlangton

plugin(@tanstack/svelte-query): add getQueryData option (#3827) (1aa4785) by @inas-sirhan

plugin(@tanstack/angular-query-experimental): add getQueryData option (#3827) (1aa4785) by @inas-sirhan

plugin(@tanstack/react-query): add getQueryData option (#3827) (1aa4785) by @inas-sirhan

plugin(@hey-api/client-fetch): fix: correct return type in SSE (#3919) (a19b3a4) by @kitlangton

plugin(@tanstack/react-query): add useGetQueryData option (#3827) (1aa4785) by @inas-sirhan

plugin(@hey-api/client-ky): fix: correct return type in SSE (#3919) (a19b3a4) by @kitlangton

plugin(@tanstack/solid-query): add getQueryData option (#3827) (1aa4785) by @inas-sirhan

plugin(@hey-api/client-next): fix: correct return type in SSE (#3919) (a19b3a4) by @kitlangton

plugin(@tanstack/preact-query): add useGetQueryData option (#3827) (1aa4785) by @inas-sirhan

plugin(@hey-api/client-angular): fix: correct return type in SSE (#3919) (58962a0) by @kitlangton

plugin(@hey-api/transformers): add support for Temporal API via temporal-polyfill in dates (#3916) (bfa457a) by @OptoCloud

plugin(@tanstack/vue-query): add getQueryData option (#3827) (1aa4785) by @inas-sirhan

plugin(zod): fix: avoid invalid .extend() on z.record() when a discriminated union member is an empty object (#3915) (8fa9f3a) by @pullfrog

Updated Dependencies:

@hey-api/shared@0.4.5

@hey-api/codegen-core@0.8.2

0.97.2

Patch Changes

plugin(zod): use enums from TypeScript if available (#3884) (abc8ceb) by @mrlubos

plugin(@hey-api/client-next): fix: preserve query auth when when there are no other query parameters (#3853) (a6ee7eb) by @copilot-swe-agent

plugin(@hey-api/sdk): support valibot as response transformer (#3847) (6770f78) by @SukkaW

... (truncated)

Commits

d833f73 ci: release
4987bc3 docs: add changesets
30498ce Merge branch 'main' of https://github.com/hey-api/openapi-ts into feat/tansta...
9be7e7f chore: one more try
4c5916d chore: one more try
83b4464 chore: one more try
597e151 Merge branch 'main' into pullfrog/3914-zod-discriminated-union-empty-object
462c2e9 Merge branch 'main' into feat/transformers-temporal
3367e64 Merge branch 'main' into fix/sse-iterator-treturn-miswiring
e6d4416 refactor: valibot plugin
Additional commits viewable in compare view

Updates baseline-browser-mapping from 2.10.7 to 2.11.27

Release notes

Sourced from baseline-browser-mapping's releases.

v2.11.0

What's Changed in 2.11.0

feat: Adds a new getTimeline() method for getting the series of minimum browser changes, either grouped by date or by browser.

refactor: Substantial refactoring of the data compression process that replaces the full list of browsers from @mdn/browser-compat-data and downstream-browsers.json and features from web-features (in their very pared down form) with a change-list timeline that reflects which versions supported Baseline (newly available) on a given date. Thanks to @swwind for the idea!

refactor: Some common functions have been moved to a util.ts module for use in other scripts.

fix: Removes process.exit() calls when unsupported option combinations are passed to getCompatibleVersions() and getAllVersions() in favour of throwing an Error. There is a small security risk with process.exit() calls that sites accepting unsanitised inputs could be the subject of attacks. Unsupported config options now throw and Error which should allow for more graceful handling. Thanks to @bnbdr for flagging this as vulnerability CVE-2026-45819 .

Fixes #134

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.10.44...v2.11.0

Commits

6141d06 Patch to 2.11.27 because browser or feature data changed
e1d166b Browser or feature data changed
42972a7 Updating static site
c1934c6 Patch to 2.11.26 because browser or feature data changed
4873684 Browser or feature data changed
9030798 Updating static site
a5df351 Updating static site
ecc5b54 Updating static site
719bf7a Patch to 2.11.25 because browser or feature data changed
c4f5b49 Browser or feature data changed
Additional commits viewable in compare view

Updates postcss from 8.5.6 to 8.5.23

Release notes

Sourced from postcss's releases.

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

Fixed postcss-scss commend regression.

8.5.12

Fixed reading any file via user-generated CSS.

Added opts.unsafeMap to disable checks.

8.5.11

Fixed nested brackets parsing performance (by @offset).

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

... (truncated)

Commits

eb9e1fe Release 8.5.23 version
9d19c78 Update dependencies
7beca13 Does no load source map file without opts.from
decea51 Typo
c18e30d Update EM banner
98a39ad Update EM banner
a3e48c4 Release 8.5.22 version
f49d691 Fix custom property losing its semicolon before a comment (#2117)
28e0daf Release 8.5.21 version
3d2b4e4 Update dependencies
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates vitest from 4.0.18 to 4.1.11

Release notes

Sourced from vitest's releases.

v4.1.11

   🐞 Bug Fixes

Revive global concurrency limit for test lifecycle [backport to v4] - by @sheremet-va and @hi-ogawa in vitest-dev/vitest#10992 (5146d)

browser:

Encode iframeId in tester iframe URL [backport to v4] - by @sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)

Trigger playwright/chromium gc on lower disk availability [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)

mocker:

Restrict redirect mocks to the fs allowlist [backport to v4] - by @sheremet-va in vitest-dev/vitest#10974 (fe5a1)

    View changes on GitHub

v4.1.10

   🐞 Bug Fixes

browser: Check fs access in builtin commands [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10680 (5c18d)

vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4] - by @SveLil and @hi-ogawa in vitest-dev/vitest#10661 (bae52)

    View changes on GitHub

v4.1.9

🐞 Bug Fixes

Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in vitest-dev/vitest#10546 (a5180)

browser:

Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10555 (7fb29)

Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10497 and vitest-dev/vitest#10556 (fbc62)

mocker:

Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in vitest-dev/vitest#10548 (2c955)

pool:

Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in vitest-dev/vitest#10543 and vitest-dev/vitest#10564 (934b0)

View changes on GitHub

v4.1.8

   🐞 Bug Fixes

browser:

Disable client cdp API when allowWrite/allowExec: false [backport to v4] - by @hi-ogawa and Codex in vitest-dev/vitest#10450 (e4067)

Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4] - by @toxik and @Zelys-DFKH in vitest-dev/vitest#10474 (675b4)

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

runner: Limit concurrency per task branch in addition to per leaf callbacks (backport) - by @hi-ogawa in vitest-dev/vitest#10384 (4f0f2)

    View changes on GitHub

... (truncated)

Commits

9bd8d46 chore: release v4.1.11 (#10995)
9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
db616d2 chore: release v4.1.10 (#10718)
bae52b5 fix(vm): fix external module resolve error with deps optimizer query for enco...
a7a61e7 chore: release v4.1.9 (#10598)
934b0f5 fix(pool): prevent test run hang on worker crash (#10543) [backport to v4] (#...
7fb2965 fix(browser): wait for orchestrator readiness before resolving browser sessio...
a518019 fix: fix importOriginal with optimizer and query import [backport to v4] (#...
e61f2dd chore: release v4.1.8
e4067b3 fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
Additional commits viewable in compare view

Updates @babel/core from 7.28.5 to 7.29.7

Release notes

Sourced from @babel/core's releases.

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

v7.29.6 (2026-05-25)

🐛 Bug Fix

babel-generator

#18014 Catchup source map position in preserveFormat (@nicolo-ribaudo)

babel-core

#18001 [7.x packport]Improve input source map handling (@JLHwung)

babel-core, babel-generator

#17998 Preserve original identifier names from input sourcemaps (#17992) (@Andarist)

Committers: 3

Huáng Jùnliàng (@JLHwung)

Mateusz Burzyński (@Andarist)

Nicolò Ribaudo (@nicolo-ribaudo)

v7.29.5 (2026-05-05)

🏠 Internal

babel-preset-env

Update @babel/* dependencies

v7.29.4 (2026-05-05)

🐛 Bug Fix

babel-plugin-transform-modules-systemjs

#17974 [7.x backport]fix(systemjs): improve module string name support (@JLHwung)

Committers: 1

Huáng Jùnliàng (@JLHwung)

v7.29.3 (2026-04-30)

👓 Spec Compliance

babel-parser

#17923 Support flow extends bound (@JLHwung)

🐛 Bug Fix

babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators

#17931 fix(decorators): replace super within all removed static elements (@JLHwung)

babel-register

#17915 Fix thread synchronization issues in @babel/register (@liuxingbaoyu)

babel-compat-data, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-preset-env

#17788 Add bugfix plugin for Safari array rest destructuring bug (@JLHwung)

💅 Polish

babel-parser

... (truncated)

Commits

4fba754 v7.29.7
04ea6b2 v7.29.6
99f498a [7.x packport]Improve input source map handling (#18001)
feba0a3 Preserve original identifier names from input sourcemaps (#17992) (#17998)
aa8394e v7.29.0
ad0d03f [7.x backport] feat: Allow specifying startLine in code frame (#17739)
d7f4008 v7.28.6
e130225 Polish(standalone): improve message on invalid preset/plugin (#17606)
99dcba5 chore: enable some ts-eslint rules (#17592)
c92c491 Improve Unicode handling in code-frame tokenizer (#17589)
Additional commits viewable in compare view

Updates brace-expansion from 1.1.14 to 1.1.21

Release notes

Sourced from brace-expansion's releases.

v1.1.15

Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

Commits

8e81e18 1.1.21
ffdfa3e Merge commit from fork
c6513ad 1.1.20
1efee7c Merge commit from fork
a34340a 1.1.19
0bcbfc0 Merge commit from fork
758fcd6 1.1.18
27fbeed Merge commit from fork
5c57cc2 1.1.17
d757f1d npm ignore .claude
Additional commits viewable in compare view

Updates @humanfs/node from 0.16.7 to 0.16.8

Release notes

Sourced from @humanfs/node's releases.

node: v0.16.8

0.16.8 (2026-04-17)

Bug Fixes

Include type dependencies at runtime (956ce7a), closes #145

Dependencies

The following workspace dependencies were updated

dependencies

@humanfs/core bumped from ^0.19.1 to ^0.19.2

Changelog

Sourced from @humanfs/node's changelog.

0.16.8 (2026-04-17)

Bug Fixes

Ensure symlinks are copied as symlinks in copy() and copyAll() (22bbaa44)

Include type dependencies at runtime (956ce7a), closes #145

Dependencies

The following workspace dependencies were updated

dependencies

@humanfs/core bumped from ^0.19.1 to ^0.19.2

Commits

e96070e chore: release main (#146)
22bbaa4 Merge commit from fork
956ce7a fix: Include type dependencies at runtime
See full diff in compare view

Updates @vitest/mocker from 3.2.4 to 4.1.11

Release notes

Sourced from @vitest/mocker's releases.

v4.1.11

   🐞 Bug Fixes

Revive global concurrency limit for test lifecycle [backport to v4] - by @sheremet-va and @hi-ogawa in vitest-dev/vitest#10992 (5146d)

browser:

Encode iframeId in tester iframe URL [backport to v4] - by @sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)

Trigger playwright/chromium gc on lower disk availability [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)

mocker:

Restrict redirect mocks to the fs allowlist [backport to v4] - by @sheremet-va in vitest-dev/vitest#10974 (fe5a1)

    View changes on GitHub

v4.1.10

   🐞 Bug Fixes

browser: Check fs access in builtin commands [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10680 (5c18d)

vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4] - by @SveLil and @hi-ogawa in vitest-dev/vitest#10661 (bae52)

    View changes on GitHub

v4.1.9

🐞 Bug Fixes

Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in vitest-dev/vitest#10546 (a5180)

browser:

Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10555 (7fb29)

Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10497 and vitest-dev/vitest#10556 (fbc62)

mocker:

Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in vitest-dev/vitest#10548 (2c955)

pool:

Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in vitest-dev/vitest#10543 and vitest-dev/vitest#10564 (934b0)

View changes on GitHub

v4.1.8

   🐞 Bug Fixes

browser:

Disable client cdp API when allowWrite/allowExec: false [backport to v4] - by @hi-ogawa and Codex in vitest-dev/vitest#10450 (e4067)

Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4] - by @toxik and @Zelys-DFKH in vitest-dev/vitest#10474 (675b4)

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

runner: Limit concurrency per task branch in addition to per leaf callbacks (backport) - by @hi-ogawa in vitest-dev/vitest#10384 (4f0f2)

    View changes on GitHub

... (truncated)

Commits

9bd8d46 chore: release v4.1.11 (#10995)
fe5a11d fix(mocker): restrict redirect mocks to the fs allowlist [backport to v4] (#1...
db616d2 chore: release v4.1.10 (#10718)
a7a61e7 chore: release v4.1.9 (#10598)
2c9559c fix(mocker): hoist vi.mock() for vite-plus/test imports [backport to v4] (#10...
e61f2dd chore: release v4.1.8
a09d472 chore: release v4.1.7
a8fd24c chore: release v4.1.6
e399846 chore: release v4.1.5
ac04bac chore: release v4.1.4
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @vitest/mocker since your current version.

Updates browserslist from 4.27.0 to 4.29.3

Release notes

Sourced from browserslist's releases.

4.29.3

Updated Firefox ESR.

4.29.2

Fixed ignoring null usage in cover X in Y query (by @wahidrizka).

4.29.1

Fixed config name loading protection on Windows (by @oss-security-shop).

Fixed case-insensitive negatio...
Description has been truncated

Bumps the npm_and_yarn group with 15 updates in the /ui directory: | Package | From | To | | --- | --- | --- | | [next](https://github.com/vercel/next.js) | `16.2.4` | `16.3.8` | | [@hey-api/openapi-ts](https://github.com/hey-api/hey-api/tree/HEAD/packages/openapi-ts) | `0.93.1` | `0.97.3` | | [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) | `2.10.7` | `2.11.27` | | [postcss](https://github.com/postcss/postcss) | `8.5.6` | `8.5.23` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.0.18` | `4.1.11` | | [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) | `7.28.5` | `7.29.7` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.14` | `1.1.21` | | [@humanfs/node](https://github.com/humanwhocodes/humanfs/tree/HEAD/packages/node) | `0.16.7` | `0.16.8` | | [@vitest/mocker](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker) | `3.2.4` | `4.1.11` | | [browserslist](https://github.com/browserslist/browserslist) | `4.27.0` | `4.29.3` | | [nanoid](https://github.com/ai/nanoid) | `3.3.11` | `3.3.20` | | [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser) | `6.1.2` | `6.1.4` | | [sharp](https://github.com/lovell/sharp) | `0.34.5` | `0.35.5` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `6.4.2` | `7.3.6` | | [ws](https://github.com/websockets/ws) | `8.19.0` | `8.22.0` | Updates `next` from 16.2.4 to 16.3.8 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.2.4...v16.3.8) Updates `@hey-api/openapi-ts` from 0.93.1 to 0.97.3 - [Release notes](https://github.com/hey-api/hey-api/releases) - [Changelog](https://github.com/hey-api/hey-api/blob/main/packages/openapi-ts/CHANGELOG.md) - [Commits](https://github.com/hey-api/hey-api/commits/@hey-api/openapi-ts@0.97.3/packages/openapi-ts) Updates `baseline-browser-mapping` from 2.10.7 to 2.11.27 - [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases) - [Commits](web-platform-dx/baseline-browser-mapping@v2.10.7...v2.11.27) Updates `postcss` from 8.5.6 to 8.5.23 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.6...8.5.23) Updates `vitest` from 4.0.18 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest) Updates `@babel/core` from 7.28.5 to 7.29.7 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.7/packages/babel-core) Updates `brace-expansion` from 1.1.14 to 1.1.21 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.14...v1.1.21) Updates `@humanfs/node` from 0.16.7 to 0.16.8 - [Release notes](https://github.com/humanwhocodes/humanfs/releases) - [Changelog](https://github.com/humanwhocodes/humanfs/blob/main/packages/node/CHANGELOG.md) - [Commits](https://github.com/humanwhocodes/humanfs/commits/node-v0.16.8/packages/node) Updates `@vitest/mocker` from 3.2.4 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/mocker) Updates `browserslist` from 4.27.0 to 4.29.3 - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.27.0...4.29.3) Updates `nanoid` from 3.3.11 to 3.3.20 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@3.3.11...3.3.20) Updates `postcss-selector-parser` from 6.1.2 to 6.1.4 - [Release notes](https://github.com/postcss/postcss-selector-parser/releases) - [Changelog](https://github.com/postcss/postcss-selector-parser/blob/main/CHANGELOG.md) - [Commits](postcss/postcss-selector-parser@v6.1.2...6.1.4) Updates `sharp` from 0.34.5 to 0.35.5 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.34.5...v0.35.5) Updates `vite` from 6.4.2 to 7.3.6 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v7.3.6/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v7.3.6/packages/vite) Updates `ws` from 8.19.0 to 8.22.0 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.19.0...8.22.0) --- updated-dependencies: - dependency-name: next dependency-version: 16.3.8 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@hey-api/openapi-ts" dependency-version: 0.97.3 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: baseline-browser-mapping dependency-version: 2.11.27 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.23 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vitest dependency-version: 4.1.11 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@babel/core" dependency-version: 7.29.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.21 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@humanfs/node" dependency-version: 0.16.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@vitest/mocker" dependency-version: 4.1.11 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: browserslist dependency-version: 4.29.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: nanoid dependency-version: 3.3.20 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss-selector-parser dependency-version: 6.1.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: sharp dependency-version: 0.35.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 7.3.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 8.22.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 5, 2026

github-actions Bot added do-not-merge/description-invalid do-not-merge/kind-invalid do-not-merge/release-note-invalid labels Oct 5, 2026

Navigation Menu

Repository navigation

Bump the npm_and_yarn group across 1 directory with 15 updates - #5

Bump the npm_and_yarn group across 1 directory with 15 updates#5
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/ui/npm_and_yarn-577c4cd045

dependabot Bot commented on behalf of github Oct 5, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 5, 2026

v16.3.8

v16.3.7

Core Changes

Credits

v16.3.6

v16.3.5

v16.3.4

Credits

@​hey-api/openapi-ts@​0.95.0

Minor Changes

Validator request schemas

Removed plugin.getSymbol() function

Validator request schemas

0.97.3

Patch Changes

Updated Dependencies:

0.97.2

Patch Changes

v2.11.0

What's Changed in 2.11.0

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

8.5.15

8.5.14

8.5.13

8.5.12

8.5.11

8.5.10

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

8.5.15

8.5.14

8.5.13

v4.1.11

🐞 Bug Fixes

v4.1.10

🐞 Bug Fixes

v4.1.9

🐞 Bug Fixes

v4.1.8

🐞 Bug Fixes

v4.1.7

🐞 Bug Fixes

v7.29.7 (2026-05-25)

v7.29.6 (2026-05-25)

🐛 Bug Fix

Committers: 3

v7.29.5 (2026-05-05)

🏠 Internal

v7.29.4 (2026-05-05)

🐛 Bug Fix

Committers: 1

v7.29.3 (2026-04-30)

👓 Spec Compliance

🐛 Bug Fix

💅 Polish

v1.1.15

node: v0.16.8

0.16.8 (2026-04-17)

Bug Fixes

Dependencies

0.16.8 (2026-04-17)

Bug Fixes

Dependencies

v4.1.11

🐞 Bug Fixes

`@hey-api/openapi-ts@0`.95.0

Removed `plugin.getSymbol()` function