Skip to content

chore(deps): bump the minor-patch group across 1 directory with 22 updates#538

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-patch-4d3d9a1c12
Open

chore(deps): bump the minor-patch group across 1 directory with 22 updates#538
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-patch-4d3d9a1c12

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 17, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-patch group with 22 updates in the / directory:

Package From To
@biomejs/biome 2.4.16 2.5.4
@swc/core 1.15.40 1.15.43
browserslist 4.28.2 4.28.6
classnames 2.3.2 2.5.1
core-js 3.21.1 3.49.0
html-to-react 1.5.0 1.7.0
lerna-audit 1.2.0 1.3.3
lodash 4.17.21 4.18.1
npm-check-updates 22.2.3 22.2.9
react 19.1.0 19.2.7
react-dom 19.1.0 19.2.7
react-redux 9.2.0 9.3.0
sass 1.100.0 1.101.0
tsdown 0.22.1 0.22.9
markdown-it-front-matter 0.1.2 0.2.4
@vitejs/plugin-react 6.0.2 6.0.3
vite 8.0.16 8.1.5
use-sync-external-store 1.5.0 1.6.0
@types/use-sync-external-store 0.0.6 1.5.0
pureimage 0.1.6 0.4.20
uglify-js 3.15.1 3.19.3
@playwright/test 1.60.0 1.61.1

Updates @biomejs/biome from 2.4.16 to 2.5.4

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.4

2.5.4

Patch Changes

  • #10665 55ff995 Thanks @​dyc3! - Improved the performance of the HTML parser slightly in our synthetic benchmarks.

  • #10894 f4fb10e Thanks @​ematipico! - Fixed #6392: On-type formatting no longer moves comments before an if statement into its body.

  • #10939 f2799db Thanks @​Netail! - Fixed #10930: noLabelWithoutControl now correctly detects text interpolation in Astro, Svelte & Vue as valid accessible content.

  • #10945 ae15d98 Thanks @​Netail! - Fixed #10942: Svelte directives don't throw an accidental debug log anymore.

  • #10842 5e1abfe Thanks @​JamBalaya56562! - Fixed #9196: biome check --write --unsafe no longer hangs forever when applying the noCommentText code fix.

    The rule's fix now wraps the comment in a real JSX expression container ({/* comment */}) instead of re-inserting the braces as plain JSX text, so the fixed code is no longer reported again by the same rule.

  • #10891 ecca79e Thanks @​ematipico! - Fixed [#10885](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/10885): prevented a module-inference regression introduced by a housekeeping change.

  • #10886 60c8043 Thanks @​dyc3! - Fixed #10727: Biome now breaks the arguments of curried test.each, it.each, describe.each, and test.for calls when they exceed the configured line width.

    - test.each([[1, 2]])("a description that is long enough to push the hugged opening line beyond the print width", (a, b) => {
-   expect(a).toBe(b);
- });
+ test.each([[1, 2]])(
+   "a description that is long enough to push the hugged opening line beyond the print width",
+   (a, b) => {
+     expect(a).toBe(b);
+   },
+ );

  • #10895 01a85f0 Thanks @​ematipico! - Biome will now remove stale Unix daemon sockets from older Biome versions when starting a newer daemon.

What's Changed

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.4

Patch Changes

  • #10665 55ff995 Thanks @​dyc3! - Improved the performance of the HTML parser slightly in our synthetic benchmarks.

  • #10894 f4fb10e Thanks @​ematipico! - Fixed #6392: On-type formatting no longer moves comments before an if statement into its body.

  • #10939 f2799db Thanks @​Netail! - Fixed #10930: noLabelWithoutControl now correctly detects text interpolation in Astro, Svelte & Vue as valid accessible content.

  • #10945 ae15d98 Thanks @​Netail! - Fixed #10942: Svelte directives don't throw an accidental debug log anymore.

  • #10842 5e1abfe Thanks @​JamBalaya56562! - Fixed #9196: biome check --write --unsafe no longer hangs forever when applying the noCommentText code fix.

    The rule's fix now wraps the comment in a real JSX expression container ({/* comment */}) instead of re-inserting the braces as plain JSX text, so the fixed code is no longer reported again by the same rule.

  • #10891 ecca79e Thanks @​ematipico! - Fixed [#10885](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/10885): prevented a module-inference regression introduced by a housekeeping change.

  • #10886 60c8043 Thanks @​dyc3! - Fixed #10727: Biome now breaks the arguments of curried test.each, it.each, describe.each, and test.for calls when they exceed the configured line width.

    - test.each([[1, 2]])("a description that is long enough to push the hugged opening line beyond the print width", (a, b) => {
-   expect(a).toBe(b);
- });
+ test.each([[1, 2]])(
+   "a description that is long enough to push the hugged opening line beyond the print width",
+   (a, b) => {
+     expect(a).toBe(b);
+   },
+ );

  • #10895 01a85f0 Thanks @​ematipico! - Biome will now remove stale Unix daemon sockets from older Biome versions when starting a newer daemon.

2.5.3

Patch Changes

  • #10815 86613d5 Thanks @​WaterWhisperer! - Fixed a parser panic reported in #10708: Biome now recovers when unsupported CSS Modules @value rules or scoped @keyframes names end at EOF.

  • #10534 da9b403 Thanks @​Mokto! - Fixed noUnusedVariables false positives in Svelte files: Svelte store subscriptions ($store references in templates now keep the underlying store binding from being flagged), and $bindable() props that are only written to in the script block (write-only is intentional for bindable props) are no longer reported as unused.

  • #10827 098ba41 Thanks @​Aqu1bp! - Fixed #10698: The noUnsafeOptionalChaining rule now reports unsafe optional chains wrapped in TypeScript as, satisfies, type assertion, and instantiation expressions, such as new (value?.constructor as Constructor)().

  • #10773 3c6513d Thanks @​otkrickey! - Fixed #10772: useVueValidVOn no longer reports a missing handler for v-on directives using a verb modifier (.stop / .prevent) without an expression, e.g. <div @click.stop></div>. The rule also accepts the arg-less object syntax <div v-on="$listeners"></div> instead of reporting a missing event name.

  • #10721 d83c66b Thanks @​minseong0324! - Improved type-aware lint rule inference for built-in globals and indexed function calls. Biome now resolves Error(...), new Error(...), optional Error#stack, and calls through indexed function values such as handlers[0](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/0) more accurately.

  • #10865 6450276 Thanks @​ematipico! - Fixed #10845. Biome Language Server no longer goes in deadlock when the scanner is enabled.

... (truncated)

Commits

Updates @swc/core from 1.15.40 to 1.15.43

Changelog

Sourced from @​swc/core's changelog.

[1.15.43] - 2026-06-22

Bug Fixes

  • (es/es2022) Correct scope for private property brand checks (#11953) (fb5afa2)

  • (es/minifier) Preserve cooked when concatenating template literals (#11939) (a7244a6)

  • (es/minifier) Gate Number(x) -> +x on unsafe flag (#11944) (#11949) (6176019)

  • (es/parser) Parse Flow bare renders types (#11929) (a71c8eb)

  • (es/parser) Allow no-default builds (#11956) (baab240)

  • (es/react-compiler) Skip TypeScript this pseudo-params in scope collector (#11940) (9066c43)

  • (es/react-compiler) Scope ClassStaticBlock and TsModuleBlock as var boundaries (#11943) (1ee74a0)

  • (react-compiler) Avoid reporting non-fatal success errors as diagnostics (#11951) (cb4cb23)

  • (react-compiler) React compiler AST conversion for wrapped assignment targets (#11952) (fc9b453)

  • (react-compiler) Disable parser default features (#11957) (75ddb28)

Documentation

Features

... (truncated)

Commits
  • 73f0f38 chore: Publish 1.15.43 with swc_core v71.0.3
  • 550e539 chore: Publish 1.15.43-nightly-20260622.1 with swc_core v71.0.3
  • 1523823 chore: Publish 1.15.42-nightly-20260622.1 with swc_core v71.0.2
  • 0dffdc4 refactor: Remove production tracing hooks (#11945)
  • b182fbd feat(es/react-compiler): Add React Compiler (#11917)
  • 7a72340 chore: Publish 1.15.41 with swc_core v68.0.6
  • 82ae083 chore: Publish 1.15.41-nightly-20260609.1 with swc_core v68.0.6
  • b6dfa74 fix(bindings/node): Preserve source context for AST transforms (#11920)
  • See full diff in compare view

Updates browserslist from 4.28.2 to 4.28.6

Release notes

Sourced from browserslist's releases.

4.28.6

4.28.5

4.28.4

  • Fixed SyntaxError regression of 4.28.3.

4.28.3

  • Fixed baseline query case-insensitivity (by @​swwind).
Changelog

Sourced from browserslist's changelog.

4.28.6

4.28.5

4.28.4

  • Fixed SyntaxError regression of 4.28.3.

4.28.3

  • Fixed baseline query case-insensitivity (by @​swwind).
Commits
  • 49b3d72 Release 4.28.6 version
  • 0f90a94 Update dependencies
  • e04414e Merge pull request #938 from spokodev/fix/electron-range-semver
  • a2168f7 fix: compare Electron range bounds as semver
  • 28bbe6b Release 4.28.5 version
  • f012581 Merge pull request #937 from spokodev/fix/gt-upper-bound-version-range
  • 47f8fc2 Update dependencies
  • 73d926e fix: exclude joined range when querying above its upper bound
  • 03ba4e2 Remove duplicate
  • 1163800 Unify
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.


Updates classnames from 2.3.2 to 2.5.1

Changelog

Sourced from classnames's changelog.

v2.5.1 / 2023-12-29

  • Remove workspaces field from package (#350)

v2.5.0 / 2023-12-27

  • Restore ability to pass a TypeScript interface (#341)
  • Add exports field to package (#342)

v2.4.0 / 2023-12-26

  • Use string concatenation to increase performance thanks Jon Koops (#336)

v2.3.3 / 2023-12-21

Commits

Updates core-js from 3.21.1 to 3.49.0

Changelog

Sourced from core-js's changelog.

3.49.0 - 2026.03.16

  • Changes v3.48.0...v3.49.0 (373 commits)
  • Iterator.range updated following the actual spec version
    • Throw a RangeError on NaN start / end / step
    • Allow null as optionOrStep
  • Improved accuracy of Math.{ asinh, atanh } polyfills with big and small values
  • Improved accuracy of Number.prototype.toExponential polyfills with big and small values
  • Improved performance of atob, btoa, Uint8Array.fromHex, Uint8Array.prototype.setFromHex, and Uint8Array.prototype.toHex, #1503, #1464, #1510, thanks @​johnzhou721
  • Minor performance optimization polyfills of methods from Map upsert proposal
  • Polyfills of methods from Map upsert proposal from the pure version made generic to make it work with polyfilled and native collections
  • Wrap Symbol.for in Symbol.prototype.description polyfill for correct handling of empty string descriptions
  • Fixed a modern Safari bug in Array.prototype.includes with sparse arrays and fromIndex
  • Fixed one more case (Iterator.prototype.take) of a V8 ~ Chromium < 126 bug
  • Forced replacement of Iterator.{ concat, zip, zipKeyed } in the pure version for ensuring proper wrapped Iterator instances as the result
  • Fixed proxying .return() on exhausted iterator from some methods of iterator helpers polyfill to the underlying iterator
  • Fixed double .return() calling in case of throwing error in this method in the internal iterate helper that affected some polyfills
  • Fixed closing iterator on IteratorValue errors in the internal iterate helper that affected some polyfills
  • Fixed iterator closing in Array.from polyfill on failure to create array property
  • Fixed order of arguments validation in Array.fromAsync polyfill
  • Fixed a lack of counter validation on MAX_SAFE_INTEGER in Array.fromAsync polyfill
  • Fixed order of arguments validation in Array.prototype.flat polyfill
  • Fixed handling strings as iterables in Iterator.{ zip, zipKeyed } polyfills
  • Fixed some cases of iterators closing in Iterator.{ zip, zipKeyed } polyfills
  • Fixed validation of iterators .next() results an objects in Iterator.{ zip, zipKeyed } polyfills
  • Fixed a lack of early error in Iterator.concat polyfill on primitive as an iterator
  • Fixed buffer mutation exposure in Iterator.prototype.windows polyfill
  • Fixed iterator closing in Set.prototype.{ isDisjointFrom, isSupersetOf } polyfill
  • Fixed (updated following the final spec) one more case Set.prototype.difference polyfill with updating this
  • Fixed DataView.prototype.setFloat16 polyfill in (0, 1) range
  • Fixed order of arguments validation in String.prototype.{ padStart, padEnd } polyfills
  • Fixed order of arguments validation in String.prototype.{ startsWith, endsWith } polyfills
  • Fixed some cases of Infinity handling in String.prototype.substr polyfill
  • Fixed String.prototype.repeat polyfill with a counter exceeding 2 ** 32
  • Fixed some cases of chars case in escape polyfill
  • Fixed named backreferences in RegExp NCG polyfill
  • Fixed some cases of RegExp NCG polyfill in combination with other types of groups
  • Fixed some cases of RegExp NCG polyfill in combination with dotAll
  • Fixed String.prototype.replace with sticky polyfill, #810, #1514
  • Fixed RegExp sticky polyfill with alternation
  • Fixed handling of some line terminators in case of multiline + sticky mode in RegExp polyfill
  • Fixed .input slicing on result object with RegExp sticky mode polyfill
  • Fixed handling of empty groups with global and unicode modes in polyfills
  • Fixed URLSearchParam.prototype.delete polyfill with duplicate key-value pairs
  • Fixed possible removal of unnecessary entries in URLSearchParam.prototype.delete polyfill with second argument
  • Fixed an error in some cases of non-special URLs without a path in the URL polyfill
  • Fixed some percent encode cases / character sets in the URL polyfill
  • Fixed parsing of non-IPv4 hosts ends in a number in the URL polyfill
  • Fixed some cases of '' and null host handling in the URL polyfill
  • Fixed host parsing with hostname = host:port in the URL polyfill
  • Fixed host inheritance in some cases of file scheme in the URL polyfill

... (truncated)

Commits
  • 80adfc4 v3.49.0
  • 0ad3e00 fix a modern Safari bug in Array.prototype.includes with sparse arrays and ...
  • 853bfa4 update some links
  • b4d723f fix a lack of counter validation on MAX_SAFE_INTEGER in Array.fromAsync p...
  • e276676 fix parsing of non-IPv4 hosts ends in a number in the URL polyfill
  • dd1cfba fix order of arguments validation in String.prototype.{ padStart, padEnd } ...
  • b952c5f add an extra protection to configurator
  • e490caf Fix for #810 (#1514)
  • 10b4e86 drop an unneeded comment
  • 28cf2e9 feat: Improve performance of Uint8Array Hex functions (#1510)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by zloirock, a new releaser for core-js since your current version.

Install script changes

This version adds postinstall script that runs during installation. Review the package contents before updating.


Updates html-to-react from 1.5.0 to 1.7.0

Changelog

Sourced from html-to-react's changelog.

v1.7.0

  • Don't process attributes for custom elements #151 (bilobom)

v1.6.0

v1.5.1

Commits

Updates lerna-audit from 1.2.0 to 1.3.3

Release notes

Sourced from lerna-audit's releases.

v1.3.3

  • Fix: No longer compatible with latest version of @​npmcli/arborist (#25)

v1.3.2

  • Fix: Avoid truncated logs by using spawnSync to inherit stdio streams (#16)

Thx to @​curvedriver for creating this fix! 🎉

v1.3.1

  • Bugfix: package.json - EOF newline removed (#15)

Many thanks to @​wiese for proposing the PR and @​brandonb927 for reviewing/testing.

v1.3.0

Changes are documented in the Changelog

Changelog

Sourced from lerna-audit's changelog.

1.3.3

  • Fix: No longer compatible with latest version of @​npmcli/arborist (#25)

1.3.2

  • Fix: Avoid truncated logs by using spawnSync to inherit stdio streams (#16)

1.3.1

  • Bugfix: package.json - EOF newline removed (#15)

1.3.0

  • Enhancement: Added optional parameter --no-fix to skip an automatic fix after an audit (#13)
Commits
  • 9e85444 1.3.3
  • 7701eff CHANGELOG.md
  • 088c2f3 Consider source json file formatting (indentation / eof) when writing audited...
  • c8d3a90 Removed arborist
  • d0575df moved lib files into dedicated folder
  • c9cc320 Merge pull request #30 from tnobody/dependabot/npm_and_yarn/path-parse-1.0.7
  • bc222f1 Merge pull request #29 from tnobody/dependabot/npm_and_yarn/npmcli/git-2.1.0
  • ed72feb Merge pull request #28 from tnobody/dependabot/npm_and_yarn/tar-6.1.5
  • 307bed8 Bump path-parse from 1.0.6 to 1.0.7
  • c40d6a4 Bump @​npmcli/git from 2.0.6 to 2.1.0
  • Additional commits viewable in compare view

Updates lodash from 4.17.21 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

  • Add security notice for _.template in threat model and API docs (#6099)
  • Document lower > upper behavior in _.random (#6115)
  • Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

Commits
  • cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
  • 75535f5 chore: prune stale advisory refs (#6170)
  • 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
  • 59be2de release(minor): bump to 4.18.0 (#6161)
  • af63457 fix: broken tests for _.template 879aaa9
  • 1073a76 fix: linting issues
  • 879aaa9 fix: validate imports keys in _.template
  • fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
  • 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
  • b819080 ci: add dist sync validation workflow (#6137)
  • Additional commits viewable in compare view

Updates npm-check-updates from 22.2.3 to 22.2.9

Release notes

Sourced from npm-check-updates's releases.

v22.2.9

What's Changed

Full Changelog: raineorshine/npm-check-updates@v22.2.8...v22.2.9

v22.2.8

What's Changed

@dependabot
chore(deps): bump the minor-patch group across 1 directory with 22 up…
67e31ab 
…dates

Bumps the minor-patch group with 22 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.4.16` | `2.5.4` |
| [@swc/core](https://github.com/swc-project/swc/tree/HEAD/packages/core) | `1.15.40` | `1.15.43` |
| [browserslist](https://github.com/browserslist/browserslist) | `4.28.2` | `4.28.6` |
| [classnames](https://github.com/JedWatson/classnames) | `2.3.2` | `2.5.1` |
| [core-js](https://github.com/zloirock/core-js/tree/HEAD/packages/core-js) | `3.21.1` | `3.49.0` |
| [html-to-react](https://github.com/aknuds1/html-to-react) | `1.5.0` | `1.7.0` |
| [lerna-audit](https://github.com/tnobody/lerna-audit) | `1.2.0` | `1.3.3` |
| [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.18.1` |
| [npm-check-updates](https://github.com/raineorshine/npm-check-updates) | `22.2.3` | `22.2.9` |
| [react](https://github.com/facebook/react/tree/HEAD/packages/react) | `19.1.0` | `19.2.7` |
| [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) | `19.1.0` | `19.2.7` |
| [react-redux](https://github.com/reduxjs/react-redux) | `9.2.0` | `9.3.0` |
| [sass](https://github.com/sass/dart-sass) | `1.100.0` | `1.101.0` |
| [tsdown](https://github.com/rolldown/tsdown) | `0.22.1` | `0.22.9` |
| [markdown-it-front-matter](https://github.com/ParkSB/markdown-it-front-matter) | `0.1.2` | `0.2.4` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.2` | `6.0.3` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.0.16` | `8.1.5` |
| [use-sync-external-store](https://github.com/facebook/react/tree/HEAD/packages/use-sync-external-store) | `1.5.0` | `1.6.0` |
| [@types/use-sync-external-store](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/use-sync-external-store) | `0.0.6` | `1.5.0` |
| [pureimage](https://github.com/joshmarinacci/node-pureimage) | `0.1.6` | `0.4.20` |
| [uglify-js](https://github.com/mishoo/UglifyJS) | `3.15.1` | `3.19.3` |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.60.0` | `1.61.1` |



Updates `@biomejs/biome` from 2.4.16 to 2.5.4
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.4/packages/@biomejs/biome)

Updates `@swc/core` from 1.15.40 to 1.15.43
- [Release notes](https://github.com/swc-project/swc/releases)
- [Changelog](https://github.com/swc-project/swc/blob/main/CHANGELOG.md)
- [Commits](https://github.com/swc-project/swc/commits/v1.15.43/packages/core)

Updates `browserslist` from 4.28.2 to 4.28.6
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](browserslist/browserslist@4.28.2...4.28.6)

Updates `classnames` from 2.3.2 to 2.5.1
- [Changelog](https://github.com/JedWatson/classnames/blob/main/HISTORY.md)
- [Commits](JedWatson/classnames@v2.3.2...v2.5.1)

Updates `core-js` from 3.21.1 to 3.49.0
- [Release notes](https://github.com/zloirock/core-js/releases)
- [Changelog](https://github.com/zloirock/core-js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/zloirock/core-js/commits/v3.49.0/packages/core-js)

Updates `html-to-react` from 1.5.0 to 1.7.0
- [Changelog](https://github.com/aknuds1/html-to-react/blob/master/CHANGELOG.md)
- [Commits](aknuds1/html-to-react@1.5.0...v1.7.0)

Updates `lerna-audit` from 1.2.0 to 1.3.3
- [Release notes](https://github.com/tnobody/lerna-audit/releases)
- [Changelog](https://github.com/tnobody/lerna-audit/blob/main/CHANGELOG.md)
- [Commits](tnobody/lerna-audit@v1.2.0...v1.3.3)

Updates `lodash` from 4.17.21 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.18.1)

Updates `npm-check-updates` from 22.2.3 to 22.2.9
- [Release notes](https://github.com/raineorshine/npm-check-updates/releases)
- [Changelog](https://github.com/raineorshine/npm-check-updates/blob/main/CHANGELOG.md)
- [Commits](raineorshine/npm-check-updates@v22.2.3...v22.2.9)

Updates `react` from 19.1.0 to 19.2.7
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react)

Updates `react-dom` from 19.1.0 to 19.2.7
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react-dom)

Updates `react-redux` from 9.2.0 to 9.3.0
- [Release notes](https://github.com/reduxjs/react-redux/releases)
- [Changelog](https://github.com/reduxjs/react-redux/blob/master/CHANGELOG.md)
- [Commits](reduxjs/react-redux@v9.2.0...v9.3.0)

Updates `sass` from 1.100.0 to 1.101.0
- [Release notes](https://github.com/sass/dart-sass/releases)
- [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md)
- [Commits](sass/dart-sass@1.100.0...1.101.0)

Updates `tsdown` from 0.22.1 to 0.22.9
- [Release notes](https://github.com/rolldown/tsdown/releases)
- [Commits](rolldown/tsdown@v0.22.1...v0.22.9)

Updates `markdown-it-front-matter` from 0.1.2 to 0.2.4
- [Commits](https://github.com/ParkSB/markdown-it-front-matter/commits/v0.2.4)

Updates `@vitejs/plugin-react` from 6.0.2 to 6.0.3
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.0.3/packages/plugin-react)

Updates `vite` from 8.0.16 to 8.1.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.1.5/packages/vite)

Updates `use-sync-external-store` from 1.5.0 to 1.6.0
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/HEAD/packages/use-sync-external-store)

Updates `@types/use-sync-external-store` from 0.0.6 to 1.5.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/use-sync-external-store)

Updates `@types/use-sync-external-store` from 0.0.6 to 1.5.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/use-sync-external-store)

Updates `pureimage` from 0.1.6 to 0.4.20
- [Release notes](https://github.com/joshmarinacci/node-pureimage/releases)
- [Changelog](https://github.com/joshmarinacci/node-pureimage/blob/master/changes.md)
- [Commits](https://github.com/joshmarinacci/node-pureimage/commits)

Updates `uglify-js` from 3.15.1 to 3.19.3
- [Release notes](https://github.com/mishoo/UglifyJS/releases)
- [Commits](mishoo/UglifyJS@v3.15.1...v3.19.3)

Updates `@playwright/test` from 1.60.0 to 1.61.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.60.0...v1.61.1)

---
updated-dependencies:
- dependency-name: "@biomejs/biome"
  dependency-version: 2.5.4
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: "@swc/core"
  dependency-version: 1.15.43
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-patch
- dependency-name: browserslist
  dependency-version: 4.28.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-patch
- dependency-name: classnames
  dependency-version: 2.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: core-js
  dependency-version: 3.49.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: html-to-react
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: lerna-audit
  dependency-version: 1.3.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: npm-check-updates
  dependency-version: 22.2.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-patch
- dependency-name: react
  dependency-version: 19.2.7
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: react-dom
  dependency-version: 19.2.7
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: react-redux
  dependency-version: 9.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: sass
  dependency-version: 1.101.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: tsdown
  dependency-version: 0.22.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-patch
- dependency-name: markdown-it-front-matter
  dependency-version: 0.2.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.0.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-patch
- dependency-name: vite
  dependency-version: 8.1.5
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: use-sync-external-store
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: "@types/use-sync-external-store"
  dependency-version: 1.5.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: minor-patch
- dependency-name: "@types/use-sync-external-store"
  dependency-version: 1.5.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: minor-patch
- dependency-name: pureimage
  dependency-version: 0.4.20
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: uglify-js
  dependency-version: 3.19.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: "@playwright/test"
  dependency-version: 1.61.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the security Pull requests that address a security vulnerability label Jul 17, 2026
@dependabot dependabot Bot mentioned this pull request Jul 17, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@msimmer msimmer

Labels

security Pull requests that address a security vulnerability

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@msimmer