chore(deps): bump the npm-minor-patch group across 1 directory with 39 updates

[dependabot]

Bumps the npm-minor-patch group with 36 updates in the / directory:

Package	From	To
@hono/node-server	2.0.4	2.0.5
@radix-ui/react-alert-dialog	1.1.15	1.1.17
@radix-ui/react-checkbox	1.3.3	1.3.5
@radix-ui/react-collapsible	1.1.12	1.1.14
@radix-ui/react-dropdown-menu	2.1.16	2.1.18
@radix-ui/react-hover-card	1.1.15	1.1.17
@radix-ui/react-label	2.1.8	2.1.10
@radix-ui/react-popover	1.1.15	1.1.17
@radix-ui/react-scroll-area	1.2.10	1.2.12
@radix-ui/react-separator	1.1.8	1.1.10
@radix-ui/react-switch	1.2.6	1.3.1
@radix-ui/react-toggle	1.1.10	1.1.12
@radix-ui/react-toggle-group	1.1.11	1.1.13
@radix-ui/react-tooltip	1.2.8	1.2.10
@tanstack/react-virtual	3.13.25	3.14.3
defuddle	0.18.1	0.19.0
dexie	4.4.2	4.4.4
dompurify	3.4.5	3.4.11
hono	4.12.23	4.12.26
lucide-react	1.16.0	1.21.0
marked	18.0.4	18.0.5
react	19.2.6	19.2.7
@types/react	19.2.15	19.2.17
react-dom	19.2.6	19.2.7
stripe	22.1.1	22.2.2
tsx	4.22.3	4.22.4
zustand	5.0.13	5.0.14
@playwright/test	1.60.0	1.61.0
@tailwindcss/typography	0.5.19	0.5.20
@tailwindcss/vite	4.3.0	4.3.1
@types/chrome	0.1.42	0.2.0
happy-dom	20.9.0	20.10.6
lint-staged	17.0.5	17.0.7
shadcn	4.8.2	4.11.0
vite	8.0.14	8.0.16
@vercel/blob	2.4.0	2.4.1

Updates @hono/node-server from 2.0.4 to 2.0.5

Release notes

Sourced from @​hono/node-server's releases.

v2.0.5

Security Fix

Fixed a security issue in Serve Static Middleware where prefix-mounted middleware could be bypassed on Windows. This only affects applications running on Windows that use Serve Static Middleware. Affected users are encouraged to upgrade to this version.

See GHSA-frvp-7c67-39w9 for details.

Commits

• 9d56900 2.0.5
• cd076e1 Merge commit from fork
• See full diff in compare view

Updates @radix-ui/react-alert-dialog from 1.1.15 to 1.1.17

Changelog

Sourced from @​radix-ui/react-alert-dialog's changelog.

1.1.17

• Removed dev-only warnings for dialogs when title and/or description is not rendered.
• Updated dependencies: @radix-ui/react-dialog@1.1.17, @radix-ui/react-primitive@2.1.6

1.1.16

• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/react-dialog@1.1.16, @radix-ui/react-slot@1.2.5, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-primitive@2.1.5

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-alert-dialog since your current version.

Updates @radix-ui/react-checkbox from 1.3.3 to 1.3.5

Changelog

Sourced from @​radix-ui/react-checkbox's changelog.

1.3.5

• Updated dependencies: @radix-ui/react-primitive@2.1.6

1.3.4

• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/react-presence@1.1.6, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-controllable-state@1.2.3, @radix-ui/react-use-previous@1.1.2, @radix-ui/react-use-size@1.1.2

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-checkbox since your current version.

Updates @radix-ui/react-collapsible from 1.1.12 to 1.1.14

Changelog

Sourced from @​radix-ui/react-collapsible's changelog.

1.1.14

• Updated dependencies: @radix-ui/react-primitive@2.1.6

1.1.13

• Fixed triggers referencing a non-existent element via aria-controls when their content is removed from the DOM (credit to @​dodomorandi for the original PR)
• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/react-presence@1.1.6, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-id@1.1.2, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-controllable-state@1.2.3, @radix-ui/react-use-layout-effect@1.1.2

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-collapsible since your current version.

Updates @radix-ui/react-dialog from 1.1.15 to 1.1.17

Changelog

Sourced from @​radix-ui/react-dialog's changelog.

1.1.17

• Removed dev-only warnings for dialogs when title and/or description is not rendered.
• Fixed Dismissable Layer so outside interactions stopped by extension UI overlays do not dismiss dialogs or popovers.
• Updated dependencies: @radix-ui/react-slot@1.3.0, @radix-ui/react-dismissable-layer@1.1.13, @radix-ui/react-primitive@2.1.6, @radix-ui/react-focus-scope@1.1.10, @radix-ui/react-portal@1.1.12

1.1.16

• Fixed disabled pointer events in closed dialogs
• Fixed a bug where iOS text selection and editing on HTML inputs within react-dialog were broken
• Fixed triggers referencing a non-existent element via aria-controls when their content is removed from the DOM (credit to @​dodomorandi for the original PR)
• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/react-presence@1.1.6, @radix-ui/react-slot@1.2.5, @radix-ui/react-focus-guards@1.1.4, @radix-ui/react-dismissable-layer@1.1.12, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-focus-scope@1.1.9, @radix-ui/react-id@1.1.2, @radix-ui/react-portal@1.1.11, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-controllable-state@1.2.3

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-dialog since your current version.

Updates @radix-ui/react-dropdown-menu from 2.1.16 to 2.1.18

Changelog

Sourced from @​radix-ui/react-dropdown-menu's changelog.

2.1.18

• Fixed a bug where menus and submenus remained open after a window loses focus.
• Updated dependencies: @radix-ui/react-menu@2.1.18, @radix-ui/react-primitive@2.1.6

2.1.17

• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/react-menu@2.1.17, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-id@1.1.2, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-controllable-state@1.2.3

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-dropdown-menu since your current version.

Updates @radix-ui/react-hover-card from 1.1.15 to 1.1.17

Changelog

Sourced from @​radix-ui/react-hover-card's changelog.

1.1.17

• Updated dependencies: @radix-ui/react-popper@1.3.1, @radix-ui/react-dismissable-layer@1.1.13, @radix-ui/react-primitive@2.1.6, @radix-ui/react-portal@1.1.12

1.1.16

• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/react-presence@1.1.6, @radix-ui/react-popper@1.3.0, @radix-ui/react-dismissable-layer@1.1.12, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-portal@1.1.11, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-controllable-state@1.2.3

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-hover-card since your current version.

Updates @radix-ui/react-label from 2.1.8 to 2.1.10

Changelog

Sourced from @​radix-ui/react-label's changelog.

2.1.10

• Updated dependencies: @radix-ui/react-primitive@2.1.6

2.1.9

• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/react-primitive@2.1.5

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-label since your current version.

Updates @radix-ui/react-popover from 1.1.15 to 1.1.17

Changelog

Sourced from @​radix-ui/react-popover's changelog.

1.1.17

• Fixed Dismissable Layer so outside interactions stopped by extension UI overlays do not dismiss dialogs or popovers.
• Updated dependencies: @radix-ui/react-slot@1.3.0, @radix-ui/react-popper@1.3.1, @radix-ui/react-dismissable-layer@1.1.13, @radix-ui/react-primitive@2.1.6, @radix-ui/react-focus-scope@1.1.10, @radix-ui/react-portal@1.1.12

1.1.16

• Fixed a bug where iOS text selection and editing on HTML inputs within react-dialog were broken
• Fixed triggers referencing a non-existent element via aria-controls when their content is removed from the DOM (credit to @​dodomorandi for the original PR)
• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/react-presence@1.1.6, @radix-ui/react-popper@1.3.0, @radix-ui/react-slot@1.2.5, @radix-ui/react-focus-guards@1.1.4, @radix-ui/react-dismissable-layer@1.1.12, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-focus-scope@1.1.9, @radix-ui/react-id@1.1.2, @radix-ui/react-portal@1.1.11, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-controllable-state@1.2.3

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-popover since your current version.

Updates @radix-ui/react-scroll-area from 1.2.10 to 1.2.12

Changelog

Sourced from @​radix-ui/react-scroll-area's changelog.

1.2.12

• Stabilized the viewport style tag unless the nonce changes.
• Fixed Duplicate index signature errors that surfaced when consuming multiple packages together.
• Updated dependencies: @radix-ui/react-primitive@2.1.6

1.2.11

• Fixed missing data-state attribute for Scroll Area scrollbars
• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/react-presence@1.1.6, @radix-ui/react-direction@1.1.2, @radix-ui/number@1.1.2, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-callback-ref@1.1.2, @radix-ui/react-use-layout-effect@1.1.2

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-scroll-area since your current version.

Updates @radix-ui/react-separator from 1.1.8 to 1.1.10

Changelog

Sourced from @​radix-ui/react-separator's changelog.

1.1.10

• Updated dependencies: @radix-ui/react-primitive@2.1.6

1.1.9

• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/react-primitive@2.1.5

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-separator since your current version.

Updates @radix-ui/react-slot from 1.2.4 to 1.3.0

Changelog

Sourced from @​radix-ui/react-slot's changelog.

1.3.0

Added generic type arguments for SlotProps and createSlot

SlotProps and createSlot now accept generic type arguments to specify the type of element a slot should render, as well as its props.

const Slot = createSlot<HTMLButtonElement, MyCustomButtonProps>("Slot");

1.2.5

• Fixed infinite re-render loop in React 19 caused by Slot creating a new ref callback on every render
• Added support for nested Slottable via a render prop, so a slotted element can be wrapped while still merging Slot props and refs onto it
• Added repository.directory to all package.json files
• Improved error messages for invalid slot children
• Updated dependencies: @radix-ui/react-compose-refs@1.1.3

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-slot since your current version.

Updates @radix-ui/react-switch from 1.2.6 to 1.3.1

Changelog

Sourced from @​radix-ui/react-switch's changelog.

1.3.1

• Updated dependencies: @radix-ui/react-primitive@2.1.6

1.3.0

• Added unstable Provider, Trigger and BubbleInput parts to Switch. These expose the previously internal composition (context provider, the interactive control, and the hidden form input) so consumers can directly access and recompose them. The Switch component continues to render them by default.
• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-controllable-state@1.2.3, @radix-ui/react-use-previous@1.1.2, @radix-ui/react-use-size@1.1.2

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-switch since your current version.

Updates @radix-ui/react-toggle from 1.1.10 to 1.1.12

Changelog

Sourced from @​radix-ui/react-toggle's changelog.

1.1.12

• Updated dependencies: @radix-ui/react-primitive@2.1.6

1.1.11

• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/primitive@1.1.4, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-controllable-state@1.2.3

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-toggle since your current version.

Updates @radix-ui/react-toggle-group from 1.1.11 to 1.1.13

Changelog

Sourced from @​radix-ui/react-toggle-group's changelog.

1.1.13

• Updated single-select and multi-select toggle groups to use the radiogroup and toolbar roles, respectively.
• Updated dependencies: @radix-ui/react-primitive@2.1.6, @radix-ui/react-roving-focus@1.1.13, @radix-ui/react-toggle@1.1.12

1.1.12

• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/react-direction@1.1.2, @radix-ui/primitive@1.1.4, @radix-ui/react-context@1.1.4, @radix-ui/react-primitive@2.1.5, @radix-ui/react-roving-focus@1.1.12, @radix-ui/react-toggle@1.1.11, @radix-ui/react-use-controllable-state@1.2.3

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-toggle-group since your current version.

Updates @radix-ui/react-tooltip from 1.2.8 to 1.2.10

Changelog

Sourced from @​radix-ui/react-tooltip's changelog.

1.2.10

• Updated dependencies: @radix-ui/react-slot@1.3.0, @radix-ui/react-popper@1.3.1, @radix-ui/react-dismissable-layer@1.1.13, @radix-ui/react-primitive@2.1.6, @radix-ui/react-portal@1.1.12, @radix-ui/react-visually-hidden@1.2.6

1.2.9

• Fixed runtime error when event target is non-Node
• Fixed a Tooltip bug so that skipDelayDuration={0} works as expected. Previously, the open delay could still be skipped when moving between triggers.
• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/react-presence@1.1.6, @radix-ui/react-popper@1.3.0, @radix-ui/react-slot@1.2.5, @radix-ui/react-dismissable-layer@1.1.12, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-id@1.1.2, @radix-ui/react-portal@1.1.11, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-controllable-state@1.2.3, @radix-ui/react-visually-hidden@1.2.5

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-tooltip since your current version.

Updates @tanstack/react-virtual from 3.13.25 to 3.14.3

Release notes

Sourced from @​tanstack/react-virtual's releases.

@​tanstack/react-virtual@​3.14.3

Patch Changes

• #1201 2ba5eb6 - Make directDomUpdates a no-op for direct DOM writes when containerRef is omitted. Previously the virtualizer still wrote item positions while never sizing the container (a broken half-state). Now omitting containerRef skips all direct writes while still skipping re-renders, letting consumers own the DOM updates themselves (e.g. in onChange).

• Updated dependencies [ef69ea3]:

  • @​tanstack/virtual-core@​3.17.1

@​tanstack/react-virtual@​3.14.2

Patch Changes

• Updated dependencies [c0b84c8, fbf3bdb]:
  • @​tanstack/virtual-core@​3.17.0

@​tanstack/react-virtual@​3.14.1

Patch Changes

• Updated dependencies [c746841]:
  • @​tanstack/virtual-core@​3.16.1

@​tanstack/react-virtual@​3.14.0

Minor Changes

• Add opt-in direct DOM updates for scroll positioning with directDomUpdates, directDomUpdatesMode, and containerRef. (#1180)

@​tanstack/react-virtual@​3.13.26

Patch Changes

• Updated dependencies [fc992ab]:
  • @​tanstack/virtual-core@​3.16.0

Changelog

Sourced from @​tanstack/react-virtual's changelog.

3.14.3

Patch Changes

• #1201 2ba5eb6 - Make directDomUpdates a no-op for direct DOM writes when containerRef is omitted. Previously the virtualizer still wrote item positions while never sizing the container (a broken half-state). Now omitting containerRef skips all direct writes while still skipping re-renders, letting consumers own the DOM updates themselves (e.g. in onChange).

• Updated dependencies [ef69ea3]:

  • @​tanstack/virtual-core@​3.17.1

3.14.2

Patch Changes

• Updated dependencies [c0b84c8, fbf3bdb]:
  • @​tanstack/virtual-core@​3.17.0

3.14.1

Patch Changes

• Updated dependencies [c746841]:
  • @​tanstack/virtual-core@​3.16.1

3.14.0

Minor Changes

• Add opt-in direct DOM updates for scroll positioning with directDomUpdates, directDomUpdatesMode, and containerRef. (#1180)

3.13.26

Patch Changes

• Updated dependencies [fc992ab]:
  • @​tanstack/virtual-core@​3.16.0

Commits

• 75ae896 ci: Version Packages (#1202)
• 2ba5eb6 fix(react-virtual): make directDomUpdates a no-op without containerRef (#1201)
• ef69ea3 fix(virtual-core): adjust scroll on first measurement during backward scroll ...
• 932c358 test(react-virtual): add e2e test for React Compiler with directDomUpdates, b...
• b983b21 ci: Version Packages (#1184)
• fbf3bdb feat(virtual-core): add useCachedMeasurements option to preserve sizes when...
• 13dec39 docs: add directDomUpdates and directDomUpdatesMode options (#1185)
• c33902f ci: Version Packages (#1182)
• d789c6e ci: Version Packages (#1181)
• 73e115d feat(react-virtual): add directDomUpdates for re-render-free scroll positioni...
• Additional commits viewable in compare view

Updates defuddle from 0.18.1 to 0.19.0

Release notes

Sourced from defuddle's releases.

0.19.0

• Bilibili: video subtitle/transcript extraction (#271)
• ChatGPT: preserve citation footnotes (#311), fix content after Thought sections (#302)
• CLI: --frontmatter flag for YAML metadata output (#313), --user-agent flag for fetched URLs, read HTML from stdin (#192)
• Math: reconstruct MathML from MathJax CHTML render tree (#250), fix Markdown conversion for complex and aligned math (#301), flatten tagged single-equation tables so they render horizontally
• Tables: preserve trailing columns in ragged tables (#299)
• X/Twitter: prefer async extraction in Node for X articles (#318), fix non-English aria-label reply extraction (#290), fix FxTwitter facet indices for surrogate-pair emoji (#281)
• YouTube: fetch videoData from a more reliable source (#211)
• Fix: don't mutate the live document in parse()
• Fix: don't strip sections with delimiter-less anchor ids (#303)
• Fix: author/date byline heuristic no longer matches day-of-week as a date (#291)
• Markdown: encapsulate links with spaces (#278)
• Remove subhead (#316); remove <style> from SVGs for security
• Add CI; dependency upgrades (esbuild, mathml-to-latex, temml)

Commits

• 19520ad Bump version
• c012fc7 Preserve ChatGPT citation footnotes (#311)
• 853c240 Add Bilibili video subtitle/transcript extraction (#271)
• aa349b6 ci: fix matrix — drop Node 18 (toolchain needs 20+) and jsdom (fixtures are l...
• a1132f9 Add CI
• 96532f5 CLI: add --frontmatter flag for YAML metadata output (#313)
• a432eae fix: don't mutate the live document in parse()
• ec06322 Remove subhead #316
• ef4c85e fix: reconstruct MathML from MathJax CHTML render tree (#250)
• 7c287cb Merge branch 'fix/303-pascalcase-anchor-ids'
• Additional commits viewable in compare view

Updates dexie from 4.4.2 to 4.4.4

Release notes

Sourced from dexie's releases.

Dexie v4.4.4

This is a maintenance release that resolves a bug in useLiveQuery caching and includes a TypeScript typing enhancement.

Related Package Releases

Package	Version
dexie	4.4.4
dexie-cloud-addon	4.4.13 (no change)
dexie-react-hooks	4.4.0 (no change)
y-dexie	4.4.0 (no change)

Bug Fixes

dexie@4.4.4

• fix: useLiveQuery fails to detect updates when mutating queried objects in-place and calling put() — In default/cloned cache mode (cache: 'cloned'), mutating queried objects in-place and subsequently calling put() on them would pollute the cache directly, preventing subsequent live-queries from detecting the change because the "before" and "after" states in the cache became identical. Live-queries now deeply clone results on read to completely isolate query results from in-place consumer mutations. (#2310). Reported in #2309 by @​laukaichung. Fixed by @​liz709 and @​dfahlander .

Other Changes

dexie@4.4.4

• fix: typescript typings - add missing table4 parameter to transaction method — Added the missing table4 parameter to the typescript type definition of Dexie.transaction(), aligning it with other table parameters. Contributed by @​renbaoshuo (#2311)

Dexie v4.4.3

This is a maintenance release with bug fixes and a configuration API improvement.

Related Package Releases

Package	Version
dexie	4.4.3
dexie-cloud-addon	4.4.13

Bug Fixes

dexie@4.4.3

• fix: delByKeyPath() creates empty intermediate objects on missing path — Dexie.delByKeyPath(obj, "foo.bar") on an object without foo would create {foo: {}} as a side effect instead of doing nothing. This caused a real-world bug in dexie-cloud-addon where clearing a dotted key from a changeSpec (e.g. claims.sub) would leave {claims: {}} in the spec, which then overwrote the inline primary key with undefined, resulting in: DataError: Evaluating the object store's key path did not yield a value. Fixed in setByKeyPath to bail out early when value is undefined and the intermediate path doesn't exist. (#2303)

• fix: Collection.sortBy() mutates frozen array in immutable cache mode — calling .sortBy() on a table when using immutable cache mode could throw TypeError: Cannot assign to read only property because Array.sort() was called on a frozen array. Fixed by sorting on a copy instead. (#2294)

dexie-cloud-addon@4.4.12

• rename: maxStringLength → largeStringThreshold — the string offloading option is renamed for clarity. The old name is kept as a backward-compatible alias. (#2290)

• fix: blob writebacks routed through BlobSavingQueue to avoid PSD context loss — after an async native fetch (blob download), Dexie's PSD zone is no longer active, causing table.mutate() to crash with Cannot read properties of undefined (reading 'table'). This surfaced as [dexie-cloud:blobResolve] Failed to resolve BlobRefs. Fixed by always routing blob writebacks through BlobSavingQueue.saveBlobs(), which opens a proper Dexie rw-transaction in a fresh JS task. Fixes lazy blob mode crash when using Dexie hooks with dexie-cloud-addon. (#2302)

• fix: eager blob downloader could starve RAM — the eager downloader triggered blobResolveMiddleware which resolved all pending blobs into memory at once. Fixed by downloading blobs in chunks with a query limit, so memory usage stays bounded regardless of how many blobs are pending. (#2302)

... (truncated)

Commits

• f151e96 chore: bump version to 4.4.4
• 0cc46ac perf(live-query): avoid redundant double deepClone on initial query cache pop...
• fb5d3b7 test(live-query): revert prettier formatting and keep only targeted test fixes
• 8c8c24d test(live-query): parameterize issue 2309 test and fix pre-existing syntax/pr...
• bb4c265 test(live-query): change actualResults to let to avoid TypeError in tests
• a6edadb fix(live-query): clone results on cache read when cache: 'cloned' is used (is...
• 9485361 Add missing table4 parameter typing to transaction method
• 30134f6 Trigger new dev build
• 9dd614d DataError after updating a user in dexie cloud when that user got an update f...
• 0919742 Trigger dev build
• Additional commits viewable in compare view

Updates dompurify from 3.4.5 to 3.4.11

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.11

• Fixed an issue with a leaky config for hooks via setConfig, thanks @​trace37labs
• Bumped vulnerable development dependencies to arrive at plain 0 with npm audit
• Updated the osv-scanner suppression list as no vulnerable dependencies are left for now
• Updated up the linting tool-chain and removed now-redundant lint directives
• Updated the documentation is several spots, README, wiki, etc.
• Bumped several dependencies where possible

DOMPurify 3.4.10

• Refactored codebase for clarity: extracted the public type declarations into types.ts
• Decomposed the three largest sanitizer functions into focused helpers
• Removed duplicated defaults and dead branches, consolidated SAFE_FOR_TEMPLATES scrubbing into single shared path
• Improved per-node performance by hoisting the mXSS probe regexes and testing textContent before innerHTML
• Added a deterministic micro-benchmark harness (npm run bench) with a --compare mode
• Reduced CI cost by running the full three-engine browser suite once per PR
• Refreshed the demos/ folder so every demo runs again, and added a SVG-via-<img> demo
• Documented the bench and test:happydom scripts in the README
• Completed the Attack Classes & Bypass History wiki page
• Bumped several dependencies where possible

DOMPurify 3.4.9

• Further improved the handling of Trusted Types config options, thanks @​offset
• Further improved the handling of IN_PLACE sanitization, thanks @​mozfreddyb
• Added more test coverage for IN_PLACE and Trusted Types related usage
• Bumped several dependencies where possible
• Updated README and wiki with more accurate documentation & attack samples

DOMPurify 3.4.8

• Cleaned up the repository root, renamed some and removed unneeded files
• Fixed an issue with handling of Trusted Types policies, thanks @​fulstadev
• Fixed the node iterator for better template scrubbing, thanks @​IamLeandrooooo
• Included formerly missing LICENSE-MPL in published npm package, thanks @​asamuzaK
• Bumped several dependencies where possible

DOMPurify 3.4.7

• Hardened the handling of Shadow Roots when using IN_PLACE, thanks @​GameZoneHacker
• Removed a problem leading to permanent hook pollution, thanks @​offset
• Refactored the test suite and expanded test coverage significantly

DOMPurify 3.4.6

• Fixed several issues with DOM Clobbering in IN_PLACE mode, thanks @​offset & @​Bankde
• Hardened the checks for cross-realm IN_PLACE and Shadow DOM sanitization, thanks @​offset & @​Bankde
• Added more test coverage for IN_PLACE and general DOM Clobbering attacks
• Bumped several dependencies where possible

Commits

• 0cae518 release: 3.4.11 (#1494)
• 6ee5716 release: 3.4.10 (#1478)
• 5210247 release: 3.4.9 (#1459)
• bcdd828 release: 3.4.8 (#1439)
• ca30f07 release: 3.4.7 (#1414)
• bb7739e release: 3.4.6 (#1394)
• See full diff in compare view

Updates hono from 4.12.23 to 4.12.26

Release notes

Sourced from hono's releases.

v4.12.26

What's Changed

• fix(lambda-edge): satisfy Deno lib types for Content-Length body encoding by @​yusukebe in honojs/hono#5013
• ci: publish to npm from CI with OIDC trusted publishing by @​yusukebe in honojs/hono#5028
• chore: remove unused devcontainer and gitpod configs by @​yusukebe in honojs/hono#5029
• chore: replace arg and glob with Bun native APIs in build script by @​yusukebe in honojs/hono#5030

Full Changelog: honojs/hono@v4.12.25...v4.12.26

v4.12.25

Security fixes

This release includes fixes for the following security issues:

CORS Middleware reflects any Origin with credentials when origin defaults to the wildcard

Affects: hono/cors. Fixes the wildcard origin reflecting the request Origin and sending Access-Control-Allow-Credentials: true when credentials: true is set without an explicit origin, where any site a logged-in user visited could make credentialed cross-origin requests and read responses from cookie-authenticated endpoints. GHSA-88fw-hqm2-52qc

Body Limit Middleware can be bypassed on AWS Lambda by understating Content-Length

Affects: hono/body-limit on AWS Lambda (hono/aws-lambda, hono/lambda-edge). Fixes the request being built with the client-declared Content-Length while the body is delivered fully buffered, where a client could declare a small Content-Length with a much larger body and slip past the configured size limit. GHSA-rv63-4mwf-qqc2

Path traversal in serve-static on Windows via encoded backslash (%5C)

Affects: serveStatic on Windows (Node, Bun, Deno adapters). Fixes the path guard allowing a lone backslash, where an encoded backslash (%5C) decoded to \ was treated as a separator by the Windows path resolver, letting a single URL segment escape into a middleware-guarded subtree. GHSA-wwfh-h76j-fc44

AWS Lambda adapter merges multiple Set-Cookie headers into one value, dropping cookies on ALB single-header and Lattice

Affects: hono/aws-lambda. Fixes multiple Set-Cookie response headers being joined into one comma-separated value for ALB single-header responses and VPC Lattice v2, where the value could not be split back into individual cookies and clients silently dropped or misparsed them. GHSA-j6c9-x7qj-28xf

Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest

Affects: hono/lambda-edge. Fixes repeated request headers being written with overwrite instead of append, where only the last value of a header such as X-Forwarded-For reached the application and the remaining values were silently dropped. GHSA-wgpf-jwqj-8h8p

v4.12.24

What's Changed

• docs(contribution): simplifyAI Usage Policy by @​yusukebe in honojs/hono#4972
• chore: remove @​types/glob by @​rtritto in honojs/hono#4978
• fix(bearer-auth): mention verifyToken in missing-options error message by @​tan7vir in honojs/hono#4987
• refactor(language): Test/improve tests on languages middleware by @​iNeoO in honojs/hono#4980
• fix(utils/ipaddr): expand "::" to eight zero groups by @​youcefzemmar in honojs/hono#4973
• fix: clean up config files trailing comma, stale excludes, typesVersions gaps, jsr paths by @​Mohammad-Faiz-Cloud-Engineer in honojs/hono#4982
• refactor(timing): Test/add test for middleware timing by @​iNeoO in honojs/hono#4991
• fix(utils/ipaddr): render the unspecified address binary as "::" by @​sarathfrancis90 in honojs/hono#4998

Full Changelog: honojs/hono@v4.12.23...v4.12.24

Commits

• 27b7992 4.12.26
• d29982c chore: replace arg and glob with Bun native APIs in build script
• 16215d5 chore: remove unused devcontainer and gitpod configs (#5029)
• c574cf1 ci: publish to npm from CI with OIDC trusted publishing (#5028)
• e50df01 fix(lambda-edge): satisfy Deno lib types for Content-Length body encoding (#5...
• fce483e 4.12.25
• 751ba41 Merge commit from fork
• f0b094d Merge commit from fork
• fa5f9bf Merge commit from fork
• 3892a6c Merge commit from fork
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hono since your current version.

Updates lucide-react from 1.16.0 to 1.21.0

Release notes

Sourced from lucide-react's releases.

Version 1.21.0

What's Changed

• ci(release.yml): Remove new-version in release flow by @​ericfennis in lucide-icons/lucide#4478
• ci(release.yml): Fix workflow and remove version scripts in package scripts by @​ericfennis in lucide-icons/lucide#4479
• fix(docs): rename navigation category label by @​Hsiii in lucide-icons/lucide#4483
• feat(icons): added broken-bone icon by @​Patolord in lucide-icons/lucide#4131

New Contributors

• @​Hsiii made their first contribution in lucide-icons/lucide#4483
• @​Patolord made their first contribution in lucide-icons/lucide#4131

Full Changelog: lucide-icons/lucide@1.20.0...1.21.0

Version 1.20.0

What's Changed

• fix(icons): decreased size of arrows inside square-arrow-* icons by @​jguddas in lucide-icons/lucide#3926
• chore(tags): Add tags to search- icons by @​jamiemlaw in lucide-icons/lucide#4099
• feat(icons): added save-...

  Description has been truncated

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
feedzero	Ready	Preview, Comment	Jun 20, 2026 2:57pm