Skip to content

deps(deps): bump the minor-and-patch group with 14 updates - #191

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/minor-and-patch-b464697ffe
Open

deps(deps): bump the minor-and-patch group with 14 updates#191
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/minor-and-patch-b464697ffe

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 24, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 14 updates:

Package From To
framer-motion 13.1.0 13.1.1
hls.js 1.7.0 1.7.1
lucide-react 1.31.0 1.33.0
next 16.3.1 16.3.2
node-datachannel 0.33.0 0.33.1
openai 7.4.0 7.5.0
posthog-js 1.417.1 1.418.10
puppeteer 25.7.0 25.8.0
react-pdf 10.4.1 10.5.0
resend 6.20.0 6.21.0
@testing-library/user-event 14.6.4 14.6.5
@vitest/coverage-v8 4.1.10 4.1.11
eslint-config-next 16.3.1 16.3.2
vitest 4.1.10 4.1.11

Updates framer-motion from 13.1.0 to 13.1.1

Changelog

Sourced from framer-motion's changelog.

[13.1.1] 2026-08-18

Fixed

  • Guard animation window access in non-browser runtimes.
  • AnimatePresence: Improved compat with React 19 strict mode.
Commits
  • 1b037b0 v13.1.1
  • d734481 Updating changelog
  • 9b9190d Latest
  • c07d12e Merge pull request #3752 from motiondivision/fix-3746-animatepresence-strictm...
  • b497f1d Merge branch 'main' into fix-3746-animatepresence-strictmode-remount
  • bbabb00 Merge pull request #3751 from motiondivision/worktree-fix-issue-3735
  • 06540fa Merge branch 'main' into worktree-fix-issue-3735
  • See full diff in compare view

Updates hls.js from 1.7.0 to 1.7.1

Release notes

Sourced from hls.js's releases.

v1.7.1

Summary

HLS.js v1.7.1 includes bug fixes and improvements over the previous release.

Changes Since The Last Release

video-dev/hls.js@v1.7.0...v1.7.1

  • Fix Interstitial snap-out at live edge and BUFFER_APPEND_NO_PROGRESS false positives (#7979) @​robwalch
  • Workaround issue where ManagedMediaSource does not emit "startstreaming" when seeking (#7984)
  • Fix permanent stall loading fragment-hint parts of encrypted low-latency streams (#7976) @​zaki699-blip
  • Document decode timebase change in MIGRATING (#7986) @​robwalch

Demo Page

https://26ea065a.hls-js-dev.pages.dev/demo/

API and Breaking Changes

No public exports were removed and no runtime behavior changes are required to upgrade from v1.6 to v1.7. TypeScript consumers might see new compile errors where previously loose types have been narrowed. Each is listed with upgrade guidance in the migration guide: https://github.com/video-dev/hls.js/blob/v1.7.0/MIGRATING.md#migrating-from-hlsjs-16-to-17

Some exported type dependencies ("eventemitter3", "@​svta/cml-cmcd", "@​svta/cml-utils", "@​svta/cml-structured-field-values") have not been bundled with hls.d.ts. Please file an issue if this is blocking you from upgrading.

Feedback

Please provide feedback via Issues in GitHub. For more details on how to contribute to HLS.js, see our CONTRIBUTING guide.

Commits
  • 565f70e Document decode timebase change in MIGRATING (#7986)
  • fcf7c9f Merge pull request #7987 from video-dev/renovate/wrangler-4.x
  • 2b8cb82 Update dependency wrangler to v4.121.0
  • 07767e9 Merge branch 'patch/v1.6.x' (v1.6.19 tag)
  • a14ffab Workaround for regression in ManagedMediaSource "startstreaming"
  • 1546898 Workaround for regression in ManagedMediaSource "startstreaming"
  • 83a2435 Fix Interstitial snap-out at live edge and BUFFER_APPEND_NO_PROGRESS false po...
  • 0e9e208 Merge pull request #7985 from video-dev/renovate/wrangler-4.x
  • f37a001 Update dependency wrangler to v4.120.1
  • 713d747 Merge pull request #7983 from video-dev/renovate/wrangler-4.x
  • Additional commits viewable in compare view

Updates lucide-react from 1.31.0 to 1.33.0

Release notes

Sourced from lucide-react's releases.

Version 1.33.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.32.0...1.33.0

Version 1.32.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.31.0...1.32.0

Commits

Updates next from 16.3.1 to 16.3.2

Release notes

Sourced from next's releases.

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • [backport] Scope app-entry export validation to files inside the app directory (#97357)
  • [backport] Fix catch-all index page being served for every other slug (#97416)
  • [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
  • [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
  • [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
  • [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @​lubieowoce, @​unstubbable, @​timneutkens, @​mischnic, and @​eps1lon for helping!

Commits
  • d0ac882 v16.3.2
  • 81deb92 [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static ...
  • cd714d9 [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
  • 5ac2327 [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
  • 0ccb3e7 [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
  • f4dc7c8 [backport] Fix catch-all index page being served for every other slug (#97416)
  • eba236b [backport] Scope app-entry export validation to files inside the app director...
  • See full diff in compare view

Updates node-datachannel from 0.33.0 to 0.33.1

Release notes

Sourced from node-datachannel's releases.

v0.33.1

  • +Win ARM64

Full Changelog: murat-dogan/node-datachannel@v0.33.0...v0.33.1

Commits

Updates openai from 7.4.0 to 7.5.0

Release notes

Sourced from openai's releases.

v7.5.0

7.5.0 (2026-08-17)

Features

  • add Bedrock Runtime endpoint support (SDK-290) (#2348) (4a199af)
  • api: add new Daybreak and gpt-5.6-cyber model identifiers (9a38e63)
  • api: add new Daybreak and gpt-5.6-cyber model identifiers (#2278) (9a38e63)
  • api: Add ServiceTier and ImageDetail types (#2364) (602d481)
  • api: add WebSocket stream IDs (#2314) (156a8db)
  • api: add workload identity access token issued event (#2307) (322a5b1)
  • api: deprecate Sora video APIs (#2313) (4424b40)
  • api: Ultrafast tier, structured MCP and websocket errors, separate websocket events (#2332) (a3deafb)

Bug Fixes

  • api: clarify audio upload metadata requirements (#2279) (34ecf3f)
  • audio: prevent microphone leaks and playback pipe deadlocks (#2339) (1c692fe)
  • audio: reject ffplay spawn errors (#2012) (6d42d4d)
  • auth: reject redirects during workload identity token exchange (#2321) (240385e)
  • auth: reject unsafe workload-identity token expirations (#2345) (1f0349d)
  • avoid TypeError in toFile for Responses without a URL (#2311) (3313f54)
  • await webhook verification in README examples (#2302) (0fe7ad0)
  • azure: honor explicit browser denial for Entra token providers (#2328) (9d47510)
  • azure: preserve model-to-deployment mapping for images.edit (#1918) (6c207c6)
  • azure: prevent API-key disclosure across HTTP redirects (#2320) (f36c418)
  • azure: prevent deployment path traversal (#2337) (a9d9d41)
  • bedrock: safely sign inherited query parameter names (#2375) (3f8d5cc)
  • chat: support custom tool calls in parser and ChatCompletionStream (#2023) (6fa9152)
  • client: handle empty JSON response body without content-length (#1998) (b6447e9)
  • configure Bash for pnpm scripts on Windows (#2330) (f5a0ad1)
  • deps: remediate Dependabot and fixture vulnerabilities (#2282) (783da8f)
  • embedding: response type for base64 encoding format (#1554) (ef69801)
  • export AzureClientOptions (#1760) (511bf6d), closes #1735
  • export workload identity helpers from openai/auth (#2344) (af8f14f)
  • fail ecosystem CI when live credentials are missing (#2349) (a47dc75)
  • format: restore formatting for generated SDK files (#2089) (6d69d4b)
  • harden runTools against inherited function names (#2333) (f4496d1)
  • honor defaultHeaders null for helper method header (#1857) (8eab09a)
  • include items for strict Zod v3 any arrays (#2357) (4c32089)
  • isolate Vercel ecosystem tests per request (#2359) (2831290)
  • keep streamed Responses output text linear and canonical (#2354) (6827a40)
  • lint: recognize Castiron-generated headers (#2124) (cf6237f)
  • lint: restore generated SDK lint rules (#2126) (6b8162c)
  • parse empty chat content when present (#2331) (53dd723)
  • parser: recognize raw json_schema response format in auto-parsing checks (#2015) (fbd2541)
  • pass file batch helper options through (#1855) (05ce028)
  • preserve File-like metadata in toFile (#1883) (ba1a781)

... (truncated)

Changelog

Sourced from openai's changelog.

7.5.0 (2026-08-17)

Features

  • add Bedrock Runtime endpoint support (SDK-290) (#2348) (4a199af)
  • api: add new Daybreak and gpt-5.6-cyber model identifiers (9a38e63)
  • api: add new Daybreak and gpt-5.6-cyber model identifiers (#2278) (9a38e63)
  • api: Add ServiceTier and ImageDetail types (#2364) (602d481)
  • api: add WebSocket stream IDs (#2314) (156a8db)
  • api: add workload identity access token issued event (#2307) (322a5b1)
  • api: deprecate Sora video APIs (#2313) (4424b40)
  • api: Ultrafast tier, structured MCP and websocket errors, separate websocket events (#2332) (a3deafb)

Bug Fixes

  • api: clarify audio upload metadata requirements (#2279) (34ecf3f)
  • audio: prevent microphone leaks and playback pipe deadlocks (#2339) (1c692fe)
  • audio: reject ffplay spawn errors (#2012) (6d42d4d)
  • auth: reject redirects during workload identity token exchange (#2321) (240385e)
  • auth: reject unsafe workload-identity token expirations (#2345) (1f0349d)
  • avoid TypeError in toFile for Responses without a URL (#2311) (3313f54)
  • await webhook verification in README examples (#2302) (0fe7ad0)
  • azure: honor explicit browser denial for Entra token providers (#2328) (9d47510)
  • azure: preserve model-to-deployment mapping for images.edit (#1918) (6c207c6)
  • azure: prevent API-key disclosure across HTTP redirects (#2320) (f36c418)
  • azure: prevent deployment path traversal (#2337) (a9d9d41)
  • bedrock: safely sign inherited query parameter names (#2375) (3f8d5cc)
  • chat: support custom tool calls in parser and ChatCompletionStream (#2023) (6fa9152)
  • client: handle empty JSON response body without content-length (#1998) (b6447e9)
  • configure Bash for pnpm scripts on Windows (#2330) (f5a0ad1)
  • deps: remediate Dependabot and fixture vulnerabilities (#2282) (783da8f)
  • embedding: response type for base64 encoding format (#1554) (ef69801)
  • export AzureClientOptions (#1760) (511bf6d), closes #1735
  • export workload identity helpers from openai/auth (#2344) (af8f14f)
  • fail ecosystem CI when live credentials are missing (#2349) (a47dc75)
  • format: restore formatting for generated SDK files (#2089) (6d69d4b)
  • harden runTools against inherited function names (#2333) (f4496d1)
  • honor defaultHeaders null for helper method header (#1857) (8eab09a)
  • include items for strict Zod v3 any arrays (#2357) (4c32089)
  • isolate Vercel ecosystem tests per request (#2359) (2831290)
  • keep streamed Responses output text linear and canonical (#2354) (6827a40)
  • lint: recognize Castiron-generated headers (#2124) (cf6237f)
  • lint: restore generated SDK lint rules (#2126) (6b8162c)
  • parse empty chat content when present (#2331) (53dd723)
  • parser: recognize raw json_schema response format in auto-parsing checks (#2015) (fbd2541)
  • pass file batch helper options through (#1855) (05ce028)
  • preserve File-like metadata in toFile (#1883) (ba1a781)
  • preserve skill upload paths without buffering native files (#2303) (30b9c41)

... (truncated)

Commits
  • 5b96016 release: 7.5.0 (#2087)
  • bfcccad fix(security): prevent Bedrock bearer credential disclosure across redirects ...
  • 3f8d5cc fix(bedrock): safely sign inherited query parameter names (#2375)
  • 16172a4 chore(deps-dev): bump oxfmt from 0.61.0 to 0.62.0 (#2373)
  • 6320b64 chore(deps-dev): bump ts-jest from 29.4.11 to 29.4.12 (#2374)
  • b49b227 chore(deps-dev): bump webpack from 5.108.4 to 5.109.2 in /ecosystem-tests/ts-...
  • 2cc57c3 chore(deps-dev): bump @​aws-sdk/credential-provider-node from 3.972.77 to 3.97...
  • 6983363 chore(deps-dev): bump @​cloudflare/workers-types from 5.20260804.1 to 5.202608...
  • 50db5db chore(deps-dev): bump @​types/node from 24.12.4 to 26.2.0 (#2370)
  • 7259f9f chore(deps-dev): bump html-webpack-plugin from 5.6.7 to 5.6.8 in /ecosystem-t...
  • Additional commits viewable in compare view

Updates posthog-js from 1.417.1 to 1.418.10

Release notes

Sourced from posthog-js's releases.

posthog-js@1.418.10

1.418.10

Patch Changes

  • #4451 e1d993c Thanks @​posthog! - Guard the replayer's hover handling against non-element and detached hover targets, which previously threw an unhandled TypeError (querySelectorAll on a node without that method) and stopped session recording playback mid-stream. (2026-08-21)

  • #4557 4451274 Thanks @​posthog! - Keep replay playback running when a recording adopts constructed stylesheets across a document swap. A constructed stylesheet can only be adopted by the document that created it, so a sheet held over a swap is rejected and the error previously stopped the player. Adoption now falls back to whatever is already applied. (2026-08-21)

posthog-js@1.418.9

1.418.9

Patch Changes

  • #4588 c8df61c Thanks @​clr182! - fix(replay): attribute the backdated sessionIdle marker to the session that went idle, so a rotation-born session's recording no longer starts hours before its first snapshot (2026-08-21)

posthog-js@1.418.8

1.418.8

Patch Changes

  • #4583 6322f09 Thanks @​turnipdabeets! - Fix logs and metrics being silently dropped when an attribute holds a very large integer, a function, a symbol, a sparse array, or a truncated emoji. Cap log and metric attributes at 20 levels of nesting, 1,000 entries per object and 10,000 values in total, marking anything beyond as [Truncated]. Type OtlpAnyValue.intValue as string | number — code reading that field must handle both. (2026-08-21)
  • Updated dependencies [6322f09]:
    • @​posthog/core@​1.48.7
    • @​posthog/types@​1.405.1

posthog-js@1.418.7

1.418.7

Patch Changes

  • #4459 caed377 Thanks @​posthog! - fix(browser): stop the $posthog_cookieless sentinel from leaking into identify() and real events. A tab that missed a cross-tab consent flip could emit the sentinel as a durable distinct_id — merging distinct real users into a single person. It now adopts the identity persisted by the tab that handled consent, falling back to a fresh anonymous device id when persistence is not shared. (2026-08-21)

  • #4567 5bd2c8d Thanks @​github-actions! - Render React component stacks as linked exception causes so error tracking identifies the crashing component. (2026-08-21)

posthog-js@1.418.6

1.418.6

Patch Changes

  • #4578 bae46bf Thanks @​marandaneto! - Drop events when a before-send hook throws instead of sending the unmodified event. (2026-08-20)

... (truncated)

Commits
  • 3508c05 chore: update versions and lockfile [version bump]
  • 557140e feat(node): isEnabled() accepts a caller-supplied default value (#4484)
  • 4451274 fix(replay): keep playback alive when a stylesheet adoption is rejected (#4557)
  • e1d993c fix(replay): keep playback alive when a hover target is not an element (#4451)
  • ab5c30c chore: update versions and lockfile [version bump]
  • 556d235 fix(core): settle displaced flag reloads against a request that carried their...
  • 6ccc78e chore: update versions and lockfile [version bump]
  • 00d22ea fix(node): return undefined instead of null variant in getFeatureFlagResult (...
  • c81aeb8 chore: update versions and lockfile [version bump]
  • c8df61c fix(replay): keep backdated idle lifecycle markers out of rotation-born sessi...
  • Additional commits viewable in compare view

Updates puppeteer from 25.7.0 to 25.8.0

Release notes

Sourced from puppeteer's releases.

puppeteer-core: v25.8.0

25.8.0 (2026-08-17)

🎉 Features

🛠️ Fixes

  • computeSystemExecutablePath support validatePath (#15340) (73da9a4)
  • launch browsers in detached mode on Windows to fix flakiness (#15339) (8e1022b)
  • remove redundant overwrite and file access from ScreenRecorder (#15352) (61a1675)

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​puppeteer/browsers bumped from 3.2.0 to 3.2.1

puppeteer: v25.8.0

25.8.0 (2026-08-17)

🎉 Features

🛠️ Fixes

  • tell the user how to recover a partial browser folder (#15319) (bbc51bd)

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​puppeteer/browsers bumped from 3.2.0 to 3.2.1
      • puppeteer-core bumped from 25.7.0 to 25.8.0
Changelog

Sourced from puppeteer's changelog.

25.8.0 (2026-08-17)

🎉 Features

🛠️ Fixes

  • computeSystemExecutablePath support validatePath (#15340) (73da9a4)
  • launch browsers in detached mode on Windows to fix flakiness (#15339) (8e1022b)
  • remove redundant overwrite and file access from ScreenRecorder (#15352) (61a1675)

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​puppeteer/browsers bumped from 3.2.0 to 3.2.1
Commits

Updates react-pdf from 10.4.1 to 10.5.0

Release notes

Sourced from react-pdf's releases.

v10.5.0

What's changed?

  • Text layer styles are now in sync with PDF.js 5.4.296 (#2077). If you were customizing text layer styles, note that --highlight-bg-color and --highlight-selected-bg-color moved from :root to .textLayer .highlight and are now semi-transparent, and that .textLayer z-index changed from 2 to 0.
  • Documented legacy PDF.js worker, reported to work on iOS 16.4 and newer.
  • Updated pnpm hoisting instructions for pnpm 11+ (#2114).
  • Clarified that filtering of HTML returned by customTextRenderer is best-effort, and sanitizing it is up to you.

Bug fixes

  • Fixed text layer being misaligned with page content (#2064).
  • Fixed crash when <Document /> was hidden and revealed by <Activity> (#2128).
  • Disallowed data: URLs in URL attributes returned by customTextRenderer.
Commits
  • 7d12fa2 v10.5.0
  • ad66e76 Fix crash when Document is hidden and revealed by <Activity> (#2129)
  • 1cfc8bb Bump @​biomejs/biome from 2.4.10 to 2.5.8
  • 2d713d4 Clarify security guidance for customTextRenderer
  • eb5c944 Bump vitest from 4.1.8 to 4.1.10
  • b00fb0b Bump typescript from 6.0.2 to 7.0.2
  • c2e0782 Update pnpm 11+ hoisting instructions (#2114)
  • 44faeb7 Bump vitest from 4.1.3 to 4.1.8
  • 879e044 Bump playwright from 1.56.1 to 1.60.0
  • af3e30c Minor formatting
  • Additional commits viewable in compare view

Updates resend from 6.20.0 to 6.21.0

Release notes

Sourced from resend's releases.

v6.21.0

What's Changed

Full Changelog: resend/resend-node@v6.20.0...v6.21.0

Commits

Updates @testing-library/user-event from 14.6.4 to 14.6.5

Release notes

Sourced from @​testing-library/user-event's releases.

v14.6.5

14.6.5 (2026-08-18)

Bug Fixes

  • tab retargeting if focus moved during keydown (#1296) (43efda7)
Commits

Updates @vitest/coverage-v8 from 4.1.10 to 4.1.11
<detail...

Description has been truncated

Bumps the minor-and-patch group with 14 updates:

| Package | From | To |
| --- | --- | --- |
| [framer-motion](https://github.com/motiondivision/motion) | `13.1.0` | `13.1.1` |
| [hls.js](https://github.com/video-dev/hls.js) | `1.7.0` | `1.7.1` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.31.0` | `1.33.0` |
| [next](https://github.com/vercel/next.js) | `16.3.1` | `16.3.2` |
| [node-datachannel](https://github.com/murat-dogan/node-datachannel) | `0.33.0` | `0.33.1` |
| [openai](https://github.com/openai/openai-node) | `7.4.0` | `7.5.0` |
| [posthog-js](https://github.com/PostHog/posthog-js) | `1.417.1` | `1.418.10` |
| [puppeteer](https://github.com/puppeteer/puppeteer) | `25.7.0` | `25.8.0` |
| [react-pdf](https://github.com/wojtekmaj/react-pdf/tree/HEAD/packages/react-pdf) | `10.4.1` | `10.5.0` |
| [resend](https://github.com/resend/resend-node) | `6.20.0` | `6.21.0` |
| [@testing-library/user-event](https://github.com/testing-library/user-event) | `14.6.4` | `14.6.5` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.10` | `4.1.11` |
| [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.3.1` | `16.3.2` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.10` | `4.1.11` |


Updates `framer-motion` from 13.1.0 to 13.1.1
- [Changelog](https://github.com/motiondivision/motion/blob/main/CHANGELOG.md)
- [Commits](motiondivision/motion@v13.1.0...v13.1.1)

Updates `hls.js` from 1.7.0 to 1.7.1
- [Release notes](https://github.com/video-dev/hls.js/releases)
- [Changelog](https://github.com/video-dev/hls.js/blob/master/docs/release-process.md)
- [Commits](video-dev/hls.js@v1.7.0...v1.7.1)

Updates `lucide-react` from 1.31.0 to 1.33.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.33.0/packages/lucide-react)

Updates `next` from 16.3.1 to 16.3.2
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.3.1...v16.3.2)

Updates `node-datachannel` from 0.33.0 to 0.33.1
- [Release notes](https://github.com/murat-dogan/node-datachannel/releases)
- [Commits](murat-dogan/node-datachannel@v0.33.0...v0.33.1)

Updates `openai` from 7.4.0 to 7.5.0
- [Release notes](https://github.com/openai/openai-node/releases)
- [Changelog](https://github.com/openai/openai-node/blob/main/CHANGELOG.md)
- [Commits](openai/openai-node@v7.4.0...v7.5.0)

Updates `posthog-js` from 1.417.1 to 1.418.10
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.417.1...posthog-js@1.418.10)

Updates `puppeteer` from 25.7.0 to 25.8.0
- [Release notes](https://github.com/puppeteer/puppeteer/releases)
- [Changelog](https://github.com/puppeteer/puppeteer/blob/main/CHANGELOG.md)
- [Commits](puppeteer/puppeteer@puppeteer-v25.7.0...puppeteer-v25.8.0)

Updates `react-pdf` from 10.4.1 to 10.5.0
- [Release notes](https://github.com/wojtekmaj/react-pdf/releases)
- [Commits](https://github.com/wojtekmaj/react-pdf/commits/v10.5.0/packages/react-pdf)

Updates `resend` from 6.20.0 to 6.21.0
- [Release notes](https://github.com/resend/resend-node/releases)
- [Changelog](https://github.com/resend/resend-node/blob/canary/CHANGELOG.md)
- [Commits](resend/resend-node@v6.20.0...v6.21.0)

Updates `@testing-library/user-event` from 14.6.4 to 14.6.5
- [Release notes](https://github.com/testing-library/user-event/releases)
- [Changelog](https://github.com/testing-library/user-event/blob/main/CHANGELOG.md)
- [Commits](testing-library/user-event@v14.6.4...v14.6.5)

Updates `@vitest/coverage-v8` from 4.1.10 to 4.1.11
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/coverage-v8)

Updates `eslint-config-next` from 16.3.1 to 16.3.2
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.2/packages/eslint-config-next)

Updates `vitest` from 4.1.10 to 4.1.11
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest)

---
updated-dependencies:
- dependency-name: framer-motion
  dependency-version: 13.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: hls.js
  dependency-version: 1.7.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: lucide-react
  dependency-version: 1.33.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: next
  dependency-version: 16.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: node-datachannel
  dependency-version: 0.33.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: openai
  dependency-version: 7.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: posthog-js
  dependency-version: 1.418.10
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: puppeteer
  dependency-version: 25.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: react-pdf
  dependency-version: 10.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: resend
  dependency-version: 6.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@testing-library/user-event"
  dependency-version: 14.6.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 4.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: eslint-config-next
  dependency-version: 16.3.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: vitest
  dependency-version: 4.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Aug 24, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@socket-security

Copy link
Copy Markdown

@socket-security

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
License policy violation: npm rollup under unrecognized license

License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/LICENSE.md)

From: pnpm-lock.yamlnpm/@vitejs/plugin-react@5.2.0npm/vitest@4.1.11npm/rollup@4.62.5

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rollup@4.62.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @node-datachannel/darwin-arm64

Location: Package overview

From: pnpm-lock.yamlnpm/node-datachannel@0.33.1npm/@node-datachannel/darwin-arm64@0.33.1

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@node-datachannel/darwin-arm64@0.33.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @node-datachannel/darwin-x64

Location: Package overview

From: pnpm-lock.yamlnpm/node-datachannel@0.33.1npm/@node-datachannel/darwin-x64@0.33.1

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@node-datachannel/darwin-x64@0.33.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @node-datachannel/linux-arm64-gnu

Location: Package overview

From: pnpm-lock.yamlnpm/node-datachannel@0.33.1npm/@node-datachannel/linux-arm64-gnu@0.33.1

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@node-datachannel/linux-arm64-gnu@0.33.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @node-datachannel/linux-arm64-musl

Location: Package overview

From: pnpm-lock.yamlnpm/node-datachannel@0.33.1npm/@node-datachannel/linux-arm64-musl@0.33.1

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@node-datachannel/linux-arm64-musl@0.33.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @node-datachannel/linux-x64-gnu

Location: Package overview

From: pnpm-lock.yamlnpm/node-datachannel@0.33.1npm/@node-datachannel/linux-x64-gnu@0.33.1

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@node-datachannel/linux-x64-gnu@0.33.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @node-datachannel/linux-x64-musl

Location: Package overview

From: pnpm-lock.yamlnpm/node-datachannel@0.33.1npm/@node-datachannel/linux-x64-musl@0.33.1

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@node-datachannel/linux-x64-musl@0.33.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @node-datachannel/win32-x64-msvc

Location: Package overview

From: pnpm-lock.yamlnpm/node-datachannel@0.33.1npm/@node-datachannel/win32-x64-msvc@0.33.1

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@node-datachannel/win32-x64-msvc@0.33.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants