Skip to content

Bump the npm-minor-patch group with 8 updates - #140

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-39fe56e388
Open

Bump the npm-minor-patch group with 8 updates#140
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-39fe56e388

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 8, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-minor-patch group with 8 updates:

Package From To
@remotion/bundler 4.0.500 4.0.506
@remotion/cli 4.0.500 4.0.506
@remotion/renderer 4.0.500 4.0.506
lucide-react 1.27.0 1.28.0
remotion 4.0.500 4.0.506
@types/react 19.2.17 19.2.18
@types/react-dom 19.2.3 19.2.4
tsx 4.23.1 4.23.7

Updates @remotion/bundler from 4.0.500 to 4.0.506

Release notes

Sourced from @​remotion/bundler's releases.

v4.0.506

What's Changed

Elements

Templates

Docs

... (truncated)

Commits
  • 5e5586f v4.0.506
  • 1bf5402 @remotion/studio: Deprecate visualControl() (#10148)
  • 7320b8f @remotion/player: Replace usePlayer with imperative methods (#10142)
  • 1572f80 remotion: Add fine-grained runtime value reactivity (#10144)
  • 8bb3151 @remotion/studio-protocol: Restore Chrome tab switching during Element drag...
  • 20514bd Internal: Add aggregate required CI check (#10140)
  • 37033a4 Remove broken Open Studio installation link (#10145)
  • 6569814 Docs: Add Create with ChatGPT button (#10143)
  • 9ce6b58 Skills: Add /remotion-studio skill (#10141)
  • 2eba8a2 Bump postcss from 8.5.18 to 8.5.23 in /packages/template-recorder (#10120)
  • Additional commits viewable in compare view

Updates @remotion/cli from 4.0.500 to 4.0.506

Release notes

Sourced from @​remotion/cli's releases.

v4.0.506

What's Changed

Elements

Templates

Docs

... (truncated)

Commits
  • 5e5586f v4.0.506
  • 1bf5402 @remotion/studio: Deprecate visualControl() (#10148)
  • 7320b8f @remotion/player: Replace usePlayer with imperative methods (#10142)
  • 1572f80 remotion: Add fine-grained runtime value reactivity (#10144)
  • 8bb3151 @remotion/studio-protocol: Restore Chrome tab switching during Element drag...
  • 20514bd Internal: Add aggregate required CI check (#10140)
  • 37033a4 Remove broken Open Studio installation link (#10145)
  • 6569814 Docs: Add Create with ChatGPT button (#10143)
  • 9ce6b58 Skills: Add /remotion-studio skill (#10141)
  • 2eba8a2 Bump postcss from 8.5.18 to 8.5.23 in /packages/template-recorder (#10120)
  • Additional commits viewable in compare view

Updates @remotion/renderer from 4.0.500 to 4.0.506

Release notes

Sourced from @​remotion/renderer's releases.

v4.0.506

What's Changed

Elements

Templates

Docs

... (truncated)

Commits
  • 5e5586f v4.0.506
  • 1bf5402 @remotion/studio: Deprecate visualControl() (#10148)
  • 7320b8f @remotion/player: Replace usePlayer with imperative methods (#10142)
  • 1572f80 remotion: Add fine-grained runtime value reactivity (#10144)
  • 8bb3151 @remotion/studio-protocol: Restore Chrome tab switching during Element drag...
  • 20514bd Internal: Add aggregate required CI check (#10140)
  • 37033a4 Remove broken Open Studio installation link (#10145)
  • 6569814 Docs: Add Create with ChatGPT button (#10143)
  • 9ce6b58 Skills: Add /remotion-studio skill (#10141)
  • 2eba8a2 Bump postcss from 8.5.18 to 8.5.23 in /packages/template-recorder (#10120)
  • Additional commits viewable in compare view

Updates lucide-react from 1.27.0 to 1.28.0

Release notes

Sourced from lucide-react's releases.

Version 1.28.0

What's Changed

Full Changelog: lucide-icons/lucide@1.27.0...1.28.0

Commits

Updates remotion from 4.0.500 to 4.0.506

Release notes

Sourced from remotion's releases.

v4.0.506

What's Changed

Elements

Templates

Docs

... (truncated)

Commits
  • 5e5586f v4.0.506
  • 1bf5402 @remotion/studio: Deprecate visualControl() (#10148)
  • 7320b8f @remotion/player: Replace usePlayer with imperative methods (#10142)
  • 1572f80 remotion: Add fine-grained runtime value reactivity (#10144)
  • 8bb3151 @remotion/studio-protocol: Restore Chrome tab switching during Element drag...
  • 20514bd Internal: Add aggregate required CI check (#10140)
  • 37033a4 Remove broken Open Studio installation link (#10145)
  • 6569814 Docs: Add Create with ChatGPT button (#10143)
  • 9ce6b58 Skills: Add /remotion-studio skill (#10141)
  • 2eba8a2 Bump postcss from 8.5.18 to 8.5.23 in /packages/template-recorder (#10120)
  • Additional commits viewable in compare view

Updates @types/react from 19.2.17 to 19.2.18

Commits

Updates @types/react-dom from 19.2.3 to 19.2.4

Commits

Updates tsx from 4.23.1 to 4.23.7

Release notes

Sourced from tsx's releases.

v4.23.7

4.23.7 (2026-08-05)

Bug Fixes

  • prevent tsImport cache collisions (4e5a138)

This release is also available on:

v4.23.6

4.23.6 (2026-08-05)

Bug Fixes

  • compose resolver URL metadata (5040762)
  • preserve Node resolution with allowJs (2046d9e)
  • preserve resolver URL metadata (a91df46)

This release is also available on:

v4.23.5

4.23.5 (2026-08-02)

Bug Fixes

  • detect the Node inspector enabled via NODE_OPTIONS (3c1d051)

This release is also available on:

v4.23.4

4.23.4 (2026-08-02)

Bug Fixes

  • cli: allow async process.once() signal handlers to finish (#827) (2afc7bb)

This release is also available on:

... (truncated)

Commits
  • 4e5a138 fix: prevent tsImport cache collisions
  • 205868f test: wait for complete PTY lines
  • 5040762 fix: compose resolver URL metadata
  • a91df46 fix: preserve resolver URL metadata
  • 2046d9e fix: preserve Node resolution with allowJs
  • 6241bae test: force-kill unresponsive PTY shells
  • 8d326a4 refactor: separate extension resolution phases
  • 67d02b7 docs: organize resolver research by owner
  • c55004d test: remove legacy PTY retry
  • e368161 chore(deps): update pty-spawn to 1.1.1
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the npm-minor-patch group with 8 updates
b756ed1 
Bumps the npm-minor-patch group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [@remotion/bundler](https://github.com/remotion-dev/remotion) | `4.0.500` | `4.0.506` |
| [@remotion/cli](https://github.com/remotion-dev/remotion) | `4.0.500` | `4.0.506` |
| [@remotion/renderer](https://github.com/remotion-dev/remotion) | `4.0.500` | `4.0.506` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.27.0` | `1.28.0` |
| [remotion](https://github.com/remotion-dev/remotion) | `4.0.500` | `4.0.506` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.17` | `19.2.18` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.3` | `19.2.4` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.1` | `4.23.7` |


Updates `@remotion/bundler` from 4.0.500 to 4.0.506
- [Release notes](https://github.com/remotion-dev/remotion/releases)
- [Commits](remotion-dev/remotion@v4.0.500...v4.0.506)

Updates `@remotion/cli` from 4.0.500 to 4.0.506
- [Release notes](https://github.com/remotion-dev/remotion/releases)
- [Commits](remotion-dev/remotion@v4.0.500...v4.0.506)

Updates `@remotion/renderer` from 4.0.500 to 4.0.506
- [Release notes](https://github.com/remotion-dev/remotion/releases)
- [Commits](remotion-dev/remotion@v4.0.500...v4.0.506)

Updates `lucide-react` from 1.27.0 to 1.28.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.28.0/packages/lucide-react)

Updates `remotion` from 4.0.500 to 4.0.506
- [Release notes](https://github.com/remotion-dev/remotion/releases)
- [Commits](remotion-dev/remotion@v4.0.500...v4.0.506)

Updates `@types/react` from 19.2.17 to 19.2.18
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `@types/react-dom` from 19.2.3 to 19.2.4
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `tsx` from 4.23.1 to 4.23.7
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.23.1...v4.23.7)

---
updated-dependencies:
- dependency-name: "@remotion/bundler"
  dependency-version: 4.0.506
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@remotion/cli"
  dependency-version: 4.0.506
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@remotion/renderer"
  dependency-version: 4.0.506
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: lucide-react
  dependency-version: 1.28.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: remotion
  dependency-version: 4.0.506
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@types/react"
  dependency-version: 19.2.18
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@types/react-dom"
  dependency-version: 19.2.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: tsx
  dependency-version: 4.23.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from nmbrthirteen as a code owner August 8, 2026 06:53
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 8, 2026
@socket-security

socket-security Bot commented Aug 8, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatednpm/​@​types/​react-dom@​19.2.3 ⏵ 19.2.4100 +110075 +190 +2100
Updatednpm/​@​remotion/​bundler@​4.0.500 ⏵ 4.0.50698 +110078 +196 +180
Updatednpm/​@​types/​react@​19.2.17 ⏵ 19.2.18100 +110079 +192 -1100
Updatednpm/​@​remotion/​cli@​4.0.500 ⏵ 4.0.5069410080 +19680
Updatednpm/​@​remotion/​renderer@​4.0.500 ⏵ 4.0.5068910082 +19680
Updatednpm/​lucide-react@​1.27.0 ⏵ 1.28.0100100989680
Updatednpm/​remotion@​4.0.500 ⏵ 4.0.50699 +1100100 +19680
Updatednpm/​tsx@​4.23.1 ⏵ 4.23.78810081 +195100

View full report

@socket-security

socket-security Bot commented Aug 8, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Potentially malicious package (AI signal): npm tsx is 70.0% likely malicious

Notes: High-risk design for supply-chain/security review: although the core parsing is delegated to an embedded WebAssembly module, the JavaScript wrapper conditionally calls eval() on substrings derived from the untrusted input string (triggered by quote heuristics). This creates a direct path from attacker-controlled text to arbitrary JavaScript execution. Additionally, parse failures embed input excerpts into thrown errors (possible information disclosure) and large inputs can trigger WASM memory growth (DoS). This module should be treated as unsafe unless the calling context strictly guarantees that inputs are fully trusted and non-executable (or the eval behavior is removed/disabled).

Confidence: 0.70

Severity: 0.86

From: package-lock.json → npm/tsx@4.23.7

ℹ Read more on: This package | This alert | What is AI-detected potential malware?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Given the AI system's identification of this package as malware, extreme caution is advised. It is recommended to avoid downloading or installing this package until the threat is confirmed or flagged as a false positive.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/tsx@4.23.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@nmbrthirteen nmbrthirteen Awaiting requested review from nmbrthirteen nmbrthirteen is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants