chore(deps): bump the production-minor-and-patch group across 1 directory with 10 updates - #3468
Open
dependabot[bot] wants to merge 1 commit into
Open
Conversation
…tory with 10 updates Bumps the production-minor-and-patch group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@shikijs/rehype](https://github.com/shikijs/shiki/tree/HEAD/packages/rehype) | `4.4.1` | `4.4.3` | | [@tanstack/react-router](https://github.com/TanStack/router/tree/HEAD/packages/react-router) | `1.170.18` | `1.170.25` | | [@tanstack/react-start](https://github.com/TanStack/router/tree/HEAD/packages/react-start) | `1.168.34` | `1.168.42` | | [@vercel/oidc](https://github.com/vercel/vercel/tree/HEAD/packages/oidc) | `3.8.1` | `3.8.4` | | [convex-helpers](https://github.com/get-convex/convex-helpers/tree/HEAD/packages/convex-helpers) | `0.1.120` | `0.1.122` | | [jose](https://github.com/panva/jose) | `6.2.3` | `6.2.8` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.28.0` | `1.31.0` | | [resend](https://github.com/resend/resend-node) | `6.18.1` | `6.19.0` | | [shiki](https://github.com/shikijs/shiki/tree/HEAD/packages/shiki) | `4.4.1` | `4.4.3` | | [sonner](https://github.com/emilkowalski/sonner) | `2.0.7` | `2.0.8` | Updates `@shikijs/rehype` from 4.4.1 to 4.4.3 - [Release notes](https://github.com/shikijs/shiki/releases) - [Commits](https://github.com/shikijs/shiki/commits/v4.4.3/packages/rehype) Updates `@tanstack/react-router` from 1.170.18 to 1.170.25 - [Release notes](https://github.com/TanStack/router/releases) - [Changelog](https://github.com/TanStack/router/blob/main/packages/react-router/CHANGELOG.md) - [Commits](https://github.com/TanStack/router/commits/@tanstack/react-router@1.170.25/packages/react-router) Updates `@tanstack/react-start` from 1.168.34 to 1.168.42 - [Release notes](https://github.com/TanStack/router/releases) - [Changelog](https://github.com/TanStack/router/blob/main/packages/react-start/CHANGELOG.md) - [Commits](https://github.com/TanStack/router/commits/@tanstack/react-start@1.168.42/packages/react-start) Updates `@vercel/oidc` from 3.8.1 to 3.8.4 - [Release notes](https://github.com/vercel/vercel/releases) - [Changelog](https://github.com/vercel/vercel/blob/main/packages/oidc/CHANGELOG.md) - [Commits](https://github.com/vercel/vercel/commits/@vercel/next@3.8.4/packages/oidc) Updates `convex-helpers` from 0.1.120 to 0.1.122 - [Changelog](https://github.com/get-convex/convex-helpers/blob/main/packages/convex-helpers/CHANGELOG.md) - [Commits](https://github.com/get-convex/convex-helpers/commits/npm/0.1.122/packages/convex-helpers) Updates `jose` from 6.2.3 to 6.2.8 - [Release notes](https://github.com/panva/jose/releases) - [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md) - [Commits](panva/jose@v6.2.3...v6.2.8) Updates `lucide-react` from 1.28.0 to 1.31.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.31.0/packages/lucide-react) Updates `resend` from 6.18.1 to 6.19.0 - [Release notes](https://github.com/resend/resend-node/releases) - [Changelog](https://github.com/resend/resend-node/blob/canary/CHANGELOG.md) - [Commits](resend/resend-node@v6.18.1...v6.19.0) Updates `shiki` from 4.4.1 to 4.4.3 - [Release notes](https://github.com/shikijs/shiki/releases) - [Commits](https://github.com/shikijs/shiki/commits/v4.4.3/packages/shiki) Updates `sonner` from 2.0.7 to 2.0.8 - [Release notes](https://github.com/emilkowalski/sonner/releases) - [Commits](emilkowalski/sonner@v2.0.7...v2.0.8) --- updated-dependencies: - dependency-name: "@shikijs/rehype" dependency-version: 4.4.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-and-patch - dependency-name: "@tanstack/react-router" dependency-version: 1.170.25 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-and-patch - dependency-name: "@tanstack/react-start" dependency-version: 1.168.42 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-and-patch - dependency-name: "@vercel/oidc" dependency-version: 3.8.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-and-patch - dependency-name: convex-helpers dependency-version: 0.1.122 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-and-patch - dependency-name: jose dependency-version: 6.2.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-and-patch - dependency-name: lucide-react dependency-version: 1.31.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-and-patch - dependency-name: resend dependency-version: 6.19.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-and-patch - dependency-name: shiki dependency-version: 4.4.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-and-patch - dependency-name: sonner dependency-version: 2.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Contributor
|
🦞👀 Pull request received. I will update this pull request when review starts. |
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
clawsweeper
Bot
added
merge-risk: 🚨 auth-provider
Contributor
|
Codex review: found issues before merge. Reviewed August 14, 2026, 12:09 PM ET / 16:09 UTC. ClawSweeper reviewWhat this changesThe PR updates ten direct production dependencies in Merge readiness⛔ Blocked by patch quality or review findings - 7 items remain Keep open: the focused dependency update introduces a second, older Priority: P2 Review scores
Verification
How this fits togetherClawHub’s web app and Convex backend resolve runtime packages from the root dependency manifest and Bun lockfile. Those packages support routing, authentication, token verification, email, and UI rendering in the deployed registry. flowchart LR
A[Package manifest] --> B[Bun lockfile]
B --> C[Web application build]
B --> D[Convex authentication]
C --> E[Registry interface]
D --> F[Login and token checks]
Before merge
Findings
Agent review detailsSecurityNeeds attention: The lockfile introduces an older Review metrics
Merge-risk optionsMaintainer options:
Technical reviewBest possible solution: Regenerate or constrain the Bun graph so direct token code and Do we have a high-confidence way to reproduce the issue? Yes: the PR-head lockfile directly shows root Is this the best way to solve the issue? No: the grouped update is appropriate, but the resulting split Full review comments:
Overall correctness: patch is incorrect AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning high; reviewed against 36b775a6d9a0. LabelsLabel changes:
Label justifications:
EvidenceSecurity concerns:
What I checked:
Likely related people:
Rating scale
Overall follows the weaker of proof and patch quality. Workflow
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the production-minor-and-patch group with 10 updates in the / directory:
4.4.14.4.31.170.181.170.251.168.341.168.423.8.13.8.40.1.1200.1.1226.2.36.2.81.28.01.31.06.18.16.19.04.4.14.4.32.0.72.0.8Updates
@shikijs/rehypefrom 4.4.1 to 4.4.3Release notes
Sourced from @shikijs/rehype's releases.
Commits
48cd2ccchore: release v4.4.32aec856chore: release v4.4.2Updates
@tanstack/react-routerfrom 1.170.18 to 1.170.25Changelog
Sourced from @tanstack/react-router's changelog.
... (truncated)
Commits
91a848eci: Version Packages (#8021)5500fd3fix(router-core): handle excessive parent relative links (#8018)6f8f534ci: Version Packages (#8011)c568cafinline isServer for proper DCE (#7996)2265129ci: Version Packages (#7994)95dec51perf(react-router): bail out of Link re-renders when href and active state ar...995bd97ci: Version Packages (#7993)ea3a665fix(router): retain mounted UI during revalidation (#7992)ac1d0abci: Version Packages (#7968)2435885Create file routes directly (#7970)Updates
@tanstack/react-startfrom 1.168.34 to 1.168.42Changelog
Sourced from @tanstack/react-start's changelog.
... (truncated)
Commits
91a848eci: Version Packages (#8021)6f8f534ci: Version Packages (#8011)2265129ci: Version Packages (#7994)995bd97ci: Version Packages (#7993)ac1d0abci: Version Packages (#7968)790e062ci: Version Packages (#7963)704145cci: Version Packages (#7946)65ae78cci: Version Packages (#7945)b5e540ddocs: use the dynamic README header endpoint (#7940)Updates
@vercel/oidcfrom 3.8.1 to 3.8.4Changelog
Sourced from @vercel/oidc's changelog.
Commits
Updates
convex-helpersfrom 0.1.120 to 0.1.122Changelog
Sourced from convex-helpers's changelog.
Commits
e3e6225npm 0.1.122f824dd7support typescript 7e9f7275npm 0.1.1218f12aafsupport convex 1.43.05ec38fdUpdate CHANGELOG for compareValues deprecationd0aebc2Re-export compareValues from convex/values (#993)055443fAdd changelog link to READMEsMaintainer changes
This version was pushed to npm by reece-convex, a new releaser for convex-helpers since your current version.
Updates
josefrom 6.2.3 to 6.2.8Release notes
Sourced from jose's releases.
... (truncated)
Changelog
Sourced from jose's changelog.
... (truncated)
Commits
8b768ebchore(release): 6.2.81500459refactor: name the "alg" source in unsupported algorithm failures714f870fix: reject a non-string "alg" in EmbeddedJWK925f3bbrefactor: index the JWS and JWE registries without a wrapper505c383fix: enforce a single recipient when decrypting dir and ECDH-ES514831dchore(deps): bump the actions group with 3 updates45965dbchore: cleanup after release60b941fchore(release): 6.2.790ab09cfix: require own JOSE properties for presence checks767d7f1refactor: reduce bundle sizeUpdates
lucide-reactfrom 1.28.0 to 1.31.0Release notes
Sourced from lucide-react's releases.
Commits
0f8d48btest(packages): updates unit test snapshots with face-slightly-smiling (#4676)Updates
resendfrom 6.18.1 to 6.19.0Release notes
Sourced from resend's releases.
Commits
47dcc08feat: add broadcasts.cancel() method (#1064) (#1065)4a2dd4fchore: migrate biome config from deprecated recommended field to preset (#1057)fc3d3affeat: buildPaginationUrl helper to simplify code (#1056)9864b8cchore: use the API timestamp format in test fixtures (#1049)286abb2chore: add typecheck CI check (#1048)95be362fix: replace deprecated node10 moduleResolution (#1047)13cfce2feat: add message_id to email webhook event types (#1041)Updates
shikifrom 4.4.1 to 4.4.3Release notes
Sourced from shiki's releases.
Commits
48cd2ccchore: release v4.4.32aec856chore: release v4.4.2c5d310bfix: unbreak CI after vite 8 bump and grammar/deps updates (#1300)Updates
sonnerfrom 2.0.7 to 2.0.8Release notes
Sourced from sonner's releases.
Commits
6739acav2.0.8ecce184Fix a batch of reported issues (#777)45d8940Use variables in close button colors instead of hardcoded values (#726)fe51da1Fix dismiss for custom toast (#717)c2d6990fix: event listener removal in hooks.tsx (#711)5caadb1Add safari prefix (#710)ea3410ffix: format (#707)a685ffcfix: keep the toaster as top layer when react-aria modal is open (#699)7760223fix(index.tsx): ensure hotkey array is not empty before checking (#703)8c0ce1efeat(toaster): add support for custom aria labels (#704)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions