chore(deps): bump the minor-versions group across 5 directories with 59 updates

[dependabot]

Bumps the minor-versions group with 34 updates in the / directory:

Package	From	To
commitizen	4.3.1	4.3.2
react	19.2.3	19.2.7
@types/react	19.2.7	19.2.17
react-test-renderer	19.2.3	19.2.7
wait-on	9.0.5	9.0.10
@bloom-housing/ui-seeds	3.4.1	3.4.3
@mapbox/mapbox-sdk	0.13.7	0.16.2
@vis.gl/react-google-maps	1.7.1	1.8.3
autoprefixer	10.4.20	10.5.0
dayjs	1.11.8	1.11.21
dotenv	17.2.3	17.4.2
mapbox-gl	3.16.0	3.24.1
react-dom	19.2.3	19.2.7
react-google-recaptcha-v3	1.10.1	1.11.0
react-map-gl	8.1.0	8.1.1
@babel/core	7.21.4	7.29.7
@babel/preset-env	7.25.7	7.29.7
@testing-library/dom	10.4.0	10.4.1
@testing-library/jest-dom	6.6.3	6.9.1
@testing-library/react	16.2.0	16.3.2
postcss	8.5.13	8.5.15
sass	1.93.3	1.101.0
ts-loader	9.5.2	9.6.0
@tiptap/core	3.23.6	3.26.1
@tiptap/extension-character-count	3.23.6	3.26.1
@tiptap/react	3.23.6	3.26.1
@tiptap/starter-kit	3.23.6	3.26.1
swr	2.2.5	2.4.1
@types/mapbox__mapbox-sdk	0.13.11	0.16.5
@opentelemetry/api	1.9.0	1.9.1
@opentelemetry/exporter-metrics-otlp-grpc	0.215.0	0.219.0
@opentelemetry/sdk-node	0.218.0	0.219.0
@opentelemetry/semantic-conventions	1.40.0	1.41.1
@google-cloud/translate	9.2.0	9.4.2

Bumps the minor-versions group with 28 updates in the /api directory:

Package	From	To
ts-jest	29.1.1	29.4.11
ts-node	10.9.1	10.9.2
axios	1.16.0	1.18.0
dayjs	1.11.9	1.11.21
dotenv	17.2.3	17.4.2
ts-loader	9.5.2	9.6.0
webpack	5.105.1	5.107.2
@opentelemetry/exporter-metrics-otlp-grpc	0.218.0	0.219.0
@opentelemetry/sdk-node	0.218.0	0.219.0
@google-cloud/translate	9.4.1	9.4.2
@aws-sdk/client-s3	3.1003.0	3.1068.0
@aws-sdk/client-sesv2	3.1003.0	3.1068.0
@aws-sdk/lib-storage	3.1003.0	3.1068.0
@aws-sdk/rds-signer	3.1003.0	3.1068.0
@aws-sdk/s3-request-presigner	3.1003.0	3.1068.0
@google-cloud/recaptcha-enterprise	6.4.1	6.4.2
casbin	5.27.1	5.50.0
class-validator	0.14.0	0.15.1
compression	1.7.4	1.8.1
@types/compression	1.7.5	1.8.1
cookie-parser	1.4.6	1.4.7
jsonwebtoken	9.0.2	9.0.3
passport	0.6.0	0.7.0
pg	8.17.2	8.21.0
reflect-metadata	0.1.13	0.2.2
rxjs	7.8.1	7.8.2
sanitize-html	2.17.4	2.17.5
@types/exceljs	1.3.0	1.3.2

Bumps the minor-versions group with 7 updates in the /shared-helpers directory:

Package	From	To
react	19.2.3	19.2.7
react-test-renderer	19.2.3	19.2.7
@bloom-housing/ui-seeds	3.4.1	3.4.3
react-dom	19.2.3	19.2.7
@testing-library/react	16.3.0	16.3.2
@opentelemetry/exporter-metrics-otlp-grpc	0.215.0	0.219.0
@opentelemetry/sdk-node	0.218.0	0.219.0

Bumps the minor-versions group with 5 updates in the /sites/partners directory:

Package	From	To
react	19.2.3	19.2.7
@bloom-housing/ui-seeds	3.4.1	3.4.3
@mapbox/mapbox-sdk	0.13.7	0.16.2
react-dom	19.2.3	19.2.7
@types/mapbox__mapbox-sdk	0.13.11	0.16.5

Bumps the minor-versions group with 4 updates in the /sites/public directory: react, @bloom-housing/ui-seeds, @mapbox/mapbox-sdk and react-dom.

Updates commitizen from 4.3.1 to 4.3.2

Release notes

Sourced from commitizen's releases.

v4.3.2

4.3.2 (2026-06-12)

• chore(deps): bump semantic-release to 25 for npm trusted publishing (#1029) (6eb168c), closes #1029
• ci(release): bump actions/checkout and actions/setup-node to v4 (#1024) (f5702c4), closes #1024
• ci(release): use npm trusted publishing via OIDC (#1028) (096ed52), closes #1028
• chore(deps) Update all non-major dependencies (#1026) (4e98218), closes #1026
• chore(deps) Update dependency lodash to v4.18.1 [SECURITY] (#1010) (11be6a1), closes #1010
• fix(ci): fix pipelines and update matrices to node 18/20/22 (#1023) (48e4b8b), closes #1023
• docs: update README.md to add contributors (#985) (3c08866), closes #985

Commits

• 6eb168c chore(deps): bump semantic-release to 25 for npm trusted publishing (#1029)
• 096ed52 ci(release): use npm trusted publishing via OIDC (#1028)
• 4e98218 chore(deps) Update all non-major dependencies (#1026)
• f5702c4 ci(release): bump actions/checkout and actions/setup-node to v4 (#1024)
• 11be6a1 chore(deps) Update dependency lodash to v4.18.1 [SECURITY] (#1010)
• 48e4b8b fix(ci): fix pipelines and update matrices to node 18/20/22 (#1023)
• 3c08866 docs: update README.md to add contributors (#985)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for commitizen since your current version.

Updates react from 19.2.3 to 19.2.7

Release notes

Sourced from react's releases.

19.2.7 (June 1st, 2026)

React Server Components

• Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (#36566 by @​unstubbable)

19.2.6 (May 6th, 2026)

React Server Components

• Type hardening and performance improvements (#36425 by @​eps1lon and @​unstubbable)

19.2.5 (April 8th, 2026)

React Server Components

• Add more cycle protections (#36236 by @​eps1lon and @​unstubbable)

19.2.4 (January 26th, 2026)

React Server Components

• Add more DoS mitigations to Server Actions, and harden Server Components (#35632 by @​gnoff, @​lubieowoce, @​sebmarkbage, @​unstubbable)

Commits

• 6117d7c Version 19.2.7 (#36591)
• eaf3e95 Version 19.2.6
• 23f4f9f 19.2.5
• 90ab3f8 Version 19.2.4
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react since your current version.

Updates @types/react from 19.2.7 to 19.2.17

Commits

• See full diff in compare view

Updates react-test-renderer from 19.2.3 to 19.2.7

Release notes

Sourced from react-test-renderer's releases.

19.2.7 (June 1st, 2026)

React Server Components

• Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (#36566 by @​unstubbable)

19.2.6 (May 6th, 2026)

React Server Components

• Type hardening and performance improvements (#36425 by @​eps1lon and @​unstubbable)

19.2.5 (April 8th, 2026)

React Server Components

• Add more cycle protections (#36236 by @​eps1lon and @​unstubbable)

19.2.4 (January 26th, 2026)

React Server Components

• Add more DoS mitigations to Server Actions, and harden Server Components (#35632 by @​gnoff, @​lubieowoce, @​sebmarkbage, @​unstubbable)

Commits

• 6117d7c Version 19.2.7 (#36591)
• eaf3e95 Version 19.2.6
• 23f4f9f 19.2.5
• 90ab3f8 Version 19.2.4
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react-test-renderer since your current version.

Updates wait-on from 9.0.5 to 9.0.10

Release notes

Sourced from wait-on's releases.

v9.0.10

Cleaned up unnecessary files from npm published package, added code coverage

Removed:

• .fastembed_cache
• .github
• .nyc_output
• coverage
• .editorconfig
• .nycrc.json
• .prettierrc.js
• eslint.config.mjs

Increased code coverage

Thanks @​aarongoldenthal

v9.0.6

Update minor deps for security vulnerabilities

• axios
  • follow-redirects
• joi

Commits

• 27d5744 9.0.10
• c7c97df correct .npmignore for .prettierrc.js
• c152252 9.0.9
• 95f01cd Merge pull request #210 from jeffbski/cleanup-more-npm-publish
• d45cff3 more npm publish cleanup
• bab38d2 9.0.8
• 0ab9473 Merge pull request #209 from jeffbski/exclude-coverage
• 881dfaa also exclude .nyc_output and coverage from npm
• e3dad37 9.0.7
• 5a681e5 Merge pull request #208 from jeffbski/exclude-fastembed-cache-from-npm-publish
• Additional commits viewable in compare view

Updates @bloom-housing/ui-seeds from 3.4.1 to 3.4.3

Release notes

Sourced from @​bloom-housing/ui-seeds's releases.

v3.4.3

3.4.3 (2026-04-22)

Bug Fixes

• ensure button loading states show in all variants (#153) (405f940)

v3.4.2

3.4.2 (2026-04-22)

Bug Fixes

• allow disabling live for loading state (#148) (09f8142)

Commits

• 405f940 fix: ensure button loading states show in all variants (#153)
• 09f8142 fix: allow disabling live for loading state (#148)
• See full diff in compare view

Updates @heroicons/react from 2.1.1 to 2.2.0

Release notes

Sourced from @​heroicons/react's releases.

v2.2.0

Added

• Add React 19 support (#1247)

Fixed

• Removed unnecessary clipping path from solid/arrow-left-circle (#1211)

v2.1.5

Added

• Add new icons (arrow-turn-*, bold, calendar-date-range, divide, document-currency-*, equals, h1, h2, h3, italic, link-slash, numbered-list, percent-badge, slash, strikethrough, underline)

v2.1.4

Fixed

• Improve tree-shakability of React package (#1192)

v2.1.3

• Improve project READMEs (#1152)

v2.1.2

• Include license file with published packages (#1151)

Changelog

Sourced from @​heroicons/react's changelog.

[2.2.0] - 2024-11-18

Added

• Add React 19 support (#1247)

Fixed

• Removed unnecessary clipping path from solid/arrow-left-circle (#1211)

[2.1.5] - 2024-07-10

Added

• Add new icons (arrow-turn-*, bold, calendar-date-range, divide, document-currency-*, equals, h1, h2, h3, italic, link-slash, numbered-list, percent-badge, slash, strikethrough, underline)

[2.1.4] - 2024-06-17

Fixed

• Improve tree-shakability of React package (#1192)

[2.1.3] - 2024-03-22

• Improve project READMEs (#1152)

[2.1.2] - 2024-03-22

• Include license file with published packages (#1151)

Commits

• 0435d4c 2.2.0
• f327cbe Add React 19 support (#1247)
• 56c073c Update changelog
• 64e2368 Remove clip-path from 20/arrow-left-circle (#1211)
• ad0ad1f 2.1.5
• 58d511e Add new icons (#1204)
• c1b192b 2.1.4
• e2e487f Make sure calls to forwardRef are marked as pure (#1192)
• cafc7d6 use size-* instead of w-* h-* (#1182)
• 9a17872 Update README.md (#1167)
• Additional commits viewable in compare view

Updates @mapbox/mapbox-sdk from 0.13.7 to 0.16.2

Release notes

Sourced from @​mapbox/mapbox-sdk's releases.

v0.16.2

0.16.2

• Addressed security issues CVE-2025-7783 and CVE-2022-25881

v0.16.1

0.16.1

• Add: Add session_token as optional parameter in the geocoding services

v0.15.16

0.15.6

• Add: Add secondary_address to list of accepted types for Geocoding v6

v0.15.4

No release notes provided.

Changelog

Sourced from @​mapbox/mapbox-sdk's changelog.

Changelog

0.16.1

• Add: Add session_token as optional parameter in the geocoding services

0.16.0

• Add: Add depart_at as optional parameter in the isochrone service

0.15.6

• Fix: Add secondary_address to list of accepted types for Geocoding v6

0.15.5

• Fix: Rename directions api annotation option max_speed to maxspeed #480

0.15.4

• Fix: Set body = '' for POST, PUT, PATCH, and DELETE requests that do not have a body #479

0.15.3

• Fix: Maximum Optimization V1 request size limits should not be enforced client-side

0.15.2

• Add: Add depart_at and arrive_by as optional parameters in the directions service

0.15.1

• Add: Add driving-traffic as a profile option in the isochrone service

0.15.0

• Add: Geocoding v6 service

0.14.0

• Add: Config for Tokens#createToken and Tokens#updateToken can now include the allowedApplications property.

Commits

• 8b8dc60 Merge pull request #502 from mapbox/max/CVE-2025-7783
• f897e42 [CVE-2025-7783] Upgrade form-data
• 12f5a42 Merge pull request #493 from mapbox/geocoding-sessionid
• 0e19cc9 docs, bump package version
• ae00cc5 change to token
• 19b012d add sessionId param to geocoding services
• 41c7da5 0.16.0
• d5a34be prepare v0.16.0
• eb8e804 Merge pull request #473 from mapbox/add-depart-at
• 1b5c24b Merge pull request #483 from mapbox/geocoding-v6-secondary-address
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by mbx-npm-07-production, a new releaser for @​mapbox/mapbox-sdk since your current version.

Updates @vis.gl/react-google-maps from 1.7.1 to 1.8.3

Release notes

Sourced from @​vis.gl/react-google-maps's releases.

v1.8.3

1.8.3 (2026-04-09)

Bug Fixes

• hooks: avoid static useInsertionEffect imports (#960) (f2870c1)

v1.8.2

1.8.2 (2026-04-01)

Bug Fixes

• move vite back to devDependencies (#955) (d3535ac)

v1.8.1

1.8.1 (2026-03-27)

Bug Fixes

• hooks: add fallback to useLayoutEffect for React 16/17 compatibility (#950) (86ad8ee)

v1.8.0

1.8.0 (2026-03-26)

Features

• add 2d geometry components - circle, polyline and polygon (#917) (54b1d0e)
• add 3D map, marker and popover components (#898) (2ba09a1)
• add fetchAppCheckToken prop to APIProvider (#913) (992994d)
• api-loader: migrate to @​googlemaps/js-api-loader (#885) (4af51dd)
• map3d: refactor components to use custom elements (#765) (8b60a78)
• pin: split Pin component into modern and legacy implementations (#945) (4826836)

Bug Fixes

• better handling for clickable prop in AdvancedMarker (#906) (c8ff82f)
• introduce useEffectEvent to improve stability of event handlers (#866) (e44933e)
• map: improve reuseMaps reliability after remounting (#920) (e9296de)
• more efficient useMemoized hook and fixed infowindow issues (#903) (8cb7151)
• trigger release-please action (0eaabeb)

Changelog

Sourced from @​vis.gl/react-google-maps's changelog.

1.8.3 (2026-04-09)

Bug Fixes

• hooks: avoid static useInsertionEffect imports (#960) (f2870c1)

1.8.2 (2026-04-01)

Bug Fixes

• move vite back to devDependencies (#955) (d3535ac)

1.8.1 (2026-03-27)

Bug Fixes

• hooks: add fallback to useLayoutEffect for React 16/17 compatibility (#950) (86ad8ee)

1.8.0 (2026-03-26)

Features

• add 2d geometry components - circle, polyline and polygon (#917) (54b1d0e)
• add 3D map, marker and popover components (#898) (2ba09a1)
• add fetchAppCheckToken prop to APIProvider (#913) (992994d)
• api-loader: migrate to @​googlemaps/js-api-loader (#885) (4af51dd)
• map3d: refactor components to use custom elements (#765) (8b60a78)
• pin: split Pin component into modern and legacy implementations (#945) (4826836)

Bug Fixes

• better handling for clickable prop in AdvancedMarker (#906) (c8ff82f)
• introduce useEffectEvent to improve stability of event handlers (#866) (e44933e)
• map: improve reuseMaps reliability after remounting (#920) (e9296de)
• more efficient useMemoized hook and fixed infowindow issues (#903) (8cb7151)
• trigger release-please action (0eaabeb)

Commits

• 6441657 chore(main): release 1.8.3 (#962)
• 03d0424 chore(deps-dev): bump lodash from 4.17.23 to 4.18.1 in /website (#961)
• 12784cc chore(deps-dev): bump typescript from 5.9.3 to 6.0.2 (#954)
• f2870c1 fix(hooks): avoid static useInsertionEffect imports (#960)
• 33709a3 chore(deps-dev): bump vite from 8.0.3 to 8.0.5 (#959)
• 5e2cfad chore(deps-dev): bump the dependencies group with 2 updates (#958)
• f4476ca chore(deps-dev): bump path-to-regexp from 0.1.12 to 0.1.13 in /website (#952)
• 4ecd7d6 chore(main): release 1.8.2 (#956)
• d3535ac fix: move vite back to devDependencies (#955)
• 6f0f549 chore(main): release 1.8.1 (#951)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​vis.gl/react-google-maps since your current version.

Updates autoprefixer from 10.4.20 to 10.5.0

Release notes

Sourced from autoprefixer's releases.

10.5.0 “Each Endeavouring, All Achieving”

• Added mask-position-x and mask-position-y support (by @​toporek).

10.4.27

• Removed development key from package.json.

10.4.26

• Reduced package size.

10.4.25

• Fixed broken gradients on CSS Custom Properties (by @​serger777).

10.4.24

• Made Autoprefixer a little faster (by @​Cherry).

10.4.23

• Reduced dependencies (by @​hyperz111).

10.4.22

• Fixed stretch prefixes on new Can I Use database.
• Updated fraction.js.

10.4.21

• Fixed old -moz- prefix for :placeholder-shown (by @​Marukome0743).

Changelog

Sourced from autoprefixer's changelog.

10.5.0 “Each Endeavouring, All Achieving”

• Added mask-position-x and mask-position-y support (by @​toporek).

10.4.27

• Removed development key from package.json.

10.4.26

• Reduced package size.

10.4.25

• Fixed broken gradients on CSS Custom Properties (by @​serger777).

10.4.24

• Made Autoprefixer a little faster (by @​Cherry).

10.4.23

• Reduced dependencies (by @​hyperz111).

10.4.22

• Fixed stretch prefixes on new Can I Use database.
• Updated fraction.js.

10.4.21

• Fixed old -moz- prefix for :placeholder-shown (by @​Marukome0743).

Commits

• faf456a Release 10.5 version
• b841fc5 Update dependencies
• 47d6e68 Update email
• 45cfc08 Replace ESLint and Prettier to oxlint and oxfmt
• 7e3ec7d Add prefixing support for mask-position-x and mask-position-y (#1548)
• 360f2d9 Release 10.4.27 version
• ab5260c Update clean-publish
• 09e9dd1 Release 10.4.26 version
• ec75540 Ignore local patches
• 59601b8 Update c8 and clean-publish
• Additional commits viewable in compare view

Updates axios from 1.16.0 to 1.18.0

Release notes

Sourced from axios's releases.

v1.18.0 — June 13, 2026

This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.

🔒 Security Fixes

• Redirect Header Safety: Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (#10892)

• URL And Request Hardening: Rejects malformed http: and https: URLs that omit // with ERR_INVALID_URL, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local NO_PROXY matching. (#11000)

🐛 Bug Fixes

• Status Validation: Added transitional.validateStatusUndefinedResolves so applications can opt in to treating validateStatus: undefined like the option was omitted, while validateStatus: null remains the explicit way to accept every status. (#10899)

🔧 Maintenance & Chores

• Documentation: Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the proxy request config as Node.js-only in the advanced docs. (#10984, #10988, #10992, #10995)

• Dependencies: Bumped @babel/core, @babel/preset-env, @commitlint/cli, @commitlint/config-conventional, @rollup/plugin-babel, @rollup/plugin-commonjs, @vitest/browser, @vitest/browser-playwright, eslint, lint-staged, rollup, vitest, and actions/checkout. (#10989, #10996, #10997)

• Release Metadata: Prepared the 1.18.0 release by updating package metadata and the runtime VERSION value. (#11003)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

• @​drori12 (#10984)
• @​eyupcanakman (#10899)
• @​Adi-Beker (#10995)

Full Changelog

v1.17.0 — June 1, 2026

This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

🔒 Security Fixes

• Config Hardening: Guarded socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)
• Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#10926)

🚀 New Features

• HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding. (#6792, #10920)

🐛 Bug Fixes

• Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (#10929, #10896)
• Proxy TLS: Preserved user httpsAgent TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (#10957)
• React Native FormData: Cleared default Content-Type for React Native FormData so multipart boundaries can be generated correctly. (#10898)

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

v1.17.0 — June 1, 2026

This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

🔒 Security Fixes

• Config Hardening: Guarded socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)
• Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#10926)

🚀 New Features

• HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding. (#6792, #10920)

🐛 Bug Fixes

• Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (#10929, #10896)
• Proxy TLS: Preserved user httpsAgent TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (#10957)
• React Native FormData: Cleared default Content-Type for React Native FormData so multipart boundaries can be generated correctly. (#10898)
• Headers: Silently skipped empty or whitespace-only header names instead of throwing, matching parsed-header behavior and avoiding React Native response crashes. (#10875)
• Request Data Merging: Preserved enumerable symbol keys when cloning plain request data through axios merge logic. (#10812)
• Bundler Compatibility: Converted resolveConfig from an arrow default export to a named function export to avoid webpack and Babel transform interop failures. (#10891)
• Types: Corrected AxiosHeaders.toJSON() return types and updated CommonJS isCancel typings to narrow to CanceledError<T>. (#10956, #10952)
• Build Tooling: Avoided emitting a null Authorization header from the GitHub build helper when GITHUB_TOKEN is unset. (#10931)

🔧 Maintenance & Chores

• HTTP/2 Internals: Extracted Http2Sessions into its own helper module and added direct unit coverage for session pooling, timeout, and cleanup behavior. (#10861)
• Package Publishing: Reduced published package size by switching to a files allowlist and dropping unneeded unminified bundle source maps. (#10939)
• CI and Release Automation: Added bundle-size reporting, moved reports to the job summary, fixed bundle-size comparison coverage, added Node 26 to the matrix, pinned npm for staged publishing, and prepared the 1.17.0 release. (#10907, #10911, #10916, #10927, #10935, #10983)
• Developer Workflow: Added a dev container and iterated on OpenSpec workflow files before removing them from the release branch. (#10925, #10914, #10958)
• Documentation and Policy: Updated disclosure, contributor, collaboration, threat-model, advanced docs, README badges, release notes, moderator configuration, and project metadata. (#10890, #10889, #10921, #10945, #10905, #10933, #10915, #10887, #10955)
• Dependencies: Bumped Babel tooling, Commitlint, ESLint, Rollup, Globals, Vitest, Playwright, fs-extra, qs, docs dependencies, and GitHub Actions dependencies including actions/dependency-review-action and zizmorcore/zizmor-action. (#10871, #10879, #10918, #10919, #10934, #10947, #10954, #10960)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

• @​BasixKOR (#6792Description has been truncated

[netlify]

✅ Deploy Preview for bloom-angelopolis canceled.

Name	Link
🔨 Latest commit	c837873
🔍 Latest deploy log	https://app.netlify.com/projects/bloom-angelopolis/deploys/6a31b93d05beaf0008969025

[netlify]

✅ Deploy Preview for partners-bloom-dev ready!

Name	Link
🔨 Latest commit	c837873
🔍 Latest deploy log	https://app.netlify.com/projects/partners-bloom-dev/deploys/6a31b93d31bf300008c6eca5
😎 Deploy Preview	https://deploy-preview-6417--partners-bloom-dev.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[netlify]

✅ Deploy Preview for bloom-exygy-dev ready!

Name	Link
🔨 Latest commit	c837873
🔍 Latest deploy log	https://app.netlify.com/projects/bloom-exygy-dev/deploys/6a31b93dcbee3a0008ca567c
😎 Deploy Preview	https://deploy-preview-6417--bloom-exygy-dev.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[netlify]

✅ Deploy Preview for bloom-public-seeds ready!

Name	Link
🔨 Latest commit	c837873
🔍 Latest deploy log	https://app.netlify.com/projects/bloom-public-seeds/deploys/6a31b93d47d3dc00089edf3e
😎 Deploy Preview	https://deploy-preview-6417--bloom-public-seeds.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.