Skip to content

chore(deps)(deps): bump the production-deps group with 13 updates - #187

Merged
ihabkhaled merged 1 commit into
mainfrom
dependabot/npm_and_yarn/production-deps-5c0228fdc5
Aug 31, 2026
Merged

chore(deps)(deps): bump the production-deps group with 13 updates#187
ihabkhaled merged 1 commit into
mainfrom
dependabot/npm_and_yarn/production-deps-5c0228fdc5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 31, 2026

Copy link
Copy Markdown
Contributor

Bumps the production-deps group with 13 updates:

Package From To
lint-staged 17.3.0 17.4.1
axios 1.19.0 1.20.0
nodemailer 9.0.5 9.0.6
@types/node 26.2.0 26.4.0
picomatch 4.0.5 4.0.7
markdown-it 15.0.0 15.0.1
pdfkit 0.19.1 0.20.1
isomorphic-dompurify 3.22.0 3.23.0
@tanstack/react-query 5.102.5 5.102.8
sharp 0.35.3 0.35.4
@testing-library/react 16.3.2 16.3.3
@types/react-dom 19.2.4 19.2.5
@vitejs/plugin-react 6.1.0 6.1.1

Updates lint-staged from 17.3.0 to 17.4.1

Release notes

Sourced from lint-staged's releases.

v17.4.1

17.4.1

Patch Changes

  • #1840 efe5b63 - This is a version-bump-only release because the previous version 17.4.0 was not published to npmjs.com due to problems with GitHub Actions and Changesets.

17.4.0

Minor Changes

  • #1836 90ec282 - Added a new defineConfig helper for type-checking the lint-staged configuration:

    // lint-staged.config.ts
import { defineConfig } from 'lint-staged/config'
export default defineConfig({
'*.js': ['prettier --check', 'eslint'],
})

  • #1832 510a27c - Added a new flag --all to make lint-staged include all files tracked by Git, instead of only staged.

    By default lint-staged only runs tasks on files that include staged changes (hence the name). Use this flag to include all files tracked in Git version control (standard exclusions apply). Using this flag implies the --no-stash flag, disabling the automatic backup, and the --allow-empty flag so that lint-staged doesn't fail when there are no changes after running. This makes it easier to run npx lint-staged --all on a clean state, for example in CI.

Patch Changes

  • #1838 69bec99 - The behavior of the automatic backup stash has been improved when running lint-staged in multiple worktrees in parallel. You should still avoid running multiple instances of lint-staged in parallel in the same tree, because some of the Git operations are locking and might lead to data loss.

  • #1839 5e5bdd2 - Parsing of lint-staged CLI flags and Node.js API options has been rewritten to avoid inconsistent behavior between the two.

Changelog

Sourced from lint-staged's changelog.

17.4.1

Patch Changes

  • #1840 efe5b63 - This is a version-bump-only release because the previous version 17.4.0 was not published to npmjs.com due to problems with GitHub Actions and Changesets.

17.4.0

Minor Changes

  • #1836 90ec282 - Added a new defineConfig helper for type-checking the lint-staged configuration:

    // lint-staged.config.ts
import { defineConfig } from 'lint-staged/config'
export default defineConfig({
'*.js': ['prettier --check', 'eslint'],
})

  • #1832 510a27c - Added a new flag --all to make lint-staged include all files tracked by Git, instead of only staged.

    By default lint-staged only runs tasks on files that include staged changes (hence the name). Use this flag to include all files tracked in Git version control (standard exclusions apply). Using this flag implies the --no-stash flag, disabling the automatic backup, and the --allow-empty flag so that lint-staged doesn't fail when there are no changes after running. This makes it easier to run npx lint-staged --all on a clean state, for example in CI.

Patch Changes

  • #1838 69bec99 - The behavior of the automatic backup stash has been improved when running lint-staged in multiple worktrees in parallel. You should still avoid running multiple instances of lint-staged in parallel in the same tree, because some of the Git operations are locking and might lead to data loss.

  • #1839 5e5bdd2 - Parsing of lint-staged CLI flags and Node.js API options has been rewritten to avoid inconsistent behavior between the two.

Commits
  • d0c1517 Merge pull request #1841 from lint-staged/changeset-release/main
  • f061335 chore(changeset): release
  • d2721af Merge pull request #1840 from lint-staged/updates
  • efe5b63 ci: update Changesets action because it failed to publish
  • cd76ce3 build: update dependencies
  • ea195e1 Merge pull request #1837 from lint-staged/changeset-release/main
  • a6a0d61 chore(changeset): release
  • 0a09098 Merge pull request #1832 from lint-staged/add-all-flag
  • 7fd685b fix: further fix parsing options logic
  • 510a27c feat: add --all flag for including all files tracked by Git instead of just...
  • Additional commits viewable in compare view

Updates axios from 1.19.0 to 1.20.0

Release notes

Sourced from axios's releases.

v1.20.0 — August 19, 2026

This release hardens runtime option handling, adds RFC 9110 status-code aliases, fixes Node.js and XHR reliability issues, and refreshes project tooling and documentation.

⚠️ Breaking Changes & Deprecations

  • HTTP Status Naming: Added ContentTooLarge (413) and UnprocessableContent (422), while retaining PayloadTooLarge and UnprocessableEntity as backward-compatible deprecated aliases. (#11082)

🔒 Security Fixes

  • Runtime Option Handling: Hardened behavioral configuration reads against shared and foreign prototype pollution and normalized unsafe interceptor replacement objects. This also clarifies Fetch redirect and custom implementation behavior, HTTP/2 DNS and proxy handling, CIDR-based NO_PROXY matching, and malformed data URI rejection; see the PR for documented compatibility effects. (#11141)

🐛 Bug Fixes

  • Interceptor Lifecycle: Prevented unbounded handler-array growth by trimming trailing ejected interceptors without changing iteration semantics, and kept interceptor operations safe when the public handlers field is nullish. (#11087, #11118)
  • Request Error Preservation: Prevented custom Error.prepareStackTrace implementations that return non-string values from replacing the original request failure with an unrelated TypeError. (#11109)
  • XHR Reliability: Navigation-canceled requests now reject with ECONNABORTED instead of resolving with status 0, while successful downloads flush their final progress callback during the live loadend dispatch. (#11094, #11121)
  • Node.js Socket Memory: Removed request-context retention from per-socket error listeners, preventing completed response data from being pinned for the lifetime of pooled keep-alive sockets. (#11091)
  • Core Methods and HTTP Errors: Prevented structural method-header buckets from leaking into outgoing headers, standardized invalid DNS lookup and httpVersion failures as AxiosError.ERR_BAD_OPTION_VALUE, and corrected the timeoutErrorMessage merge strategy. (#11096)

🔧 Maintenance & Chores

  • Dependencies: Updated fast-uri, postcss, js-yaml, mocha, development-tooling groups, and GitHub Actions dependencies. (#11092, #11098, #11099, #11106, #11107, #11122, #11123, #11126, #11127, #11133, #11140, #11143, #11144)
  • Documentation: Applied the v1.19.0 documentation updates, added the missing fs import to the README stream example, introduced localized global search, and repaired the interceptor test link. (#11101, #11113, #11097, #11119)
  • Sponsorship: Updated sponsorship links and data and added ScrapingBee as a sponsor. (#11124, #11136, #11137)
  • CI and Release: Switched ESM smoke tests to locked dependencies and synchronized package and runtime version metadata for v1.20.0. (#11128, #11152)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog (axios/axios@v1.19.0...v1.20.0)

Changelog

Sourced from axios's changelog.

Changelog

Commits
  • 84a9f3b chore(release): prepare release 1.20.0 (#11152)
  • e6824ee fix: core methodList, HTTP adapter errors, and add tests (#11096)
  • d8a919f fix(xhr): flush final progress during the live loadend dispatch (#11121)
  • 2d2a21a fix(interceptors): tolerate nullish handlers in syncHandlerEntries (#11118)
  • d19040b fix: harden runtime option handling (#11141)
  • e0a02dd chore(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 in the github-...
  • d10cb3a chore(deps-dev): bump the development_dependencies group with 4 updates (#11143)
  • 2c94646 chore(deps): bump js-yaml and mocha in /tests/smoke/cjs (#11133)
  • 76c12bc chore(deps-dev): bump js-yaml from 4.3.0 to 4.3.1 (#11140)
  • ba98559 docs: add ScrapingBee sponsor (#11137)
  • Additional commits viewable in compare view

Updates nodemailer from 9.0.5 to 9.0.6

Release notes

Sourced from nodemailer's releases.

v9.0.6

9.0.6 (2026-08-27)

Bug Fixes

  • addressparser: recover the addr-spec from an angle-addr holding whitespace (e989a22)
  • harden copies of user supplied keys and URL fetching (2f667f4)
Changelog

Sourced from nodemailer's changelog.

9.0.6 (2026-08-27)

Bug Fixes

  • addressparser: recover the addr-spec from an angle-addr holding whitespace (e989a22)
  • harden copies of user supplied keys and URL fetching (2f667f4)
Commits
  • 4e467a8 chore(master): release 9.0.6 (#1844)
  • e989a22 fix(addressparser): recover the addr-spec from an angle-addr holding whitespace
  • 7237b91 chore(deps): update dev dependencies
  • 34bc3d8 docs: reframe the EmailEngine README mentions
  • 2f667f4 fix: harden copies of user supplied keys and URL fetching
  • See full diff in compare view

Updates @types/node from 26.2.0 to 26.4.0

Commits

Updates picomatch from 4.0.5 to 4.0.7

Release notes

Sourced from picomatch's releases.

4.0.7

What's Changed

Full Changelog: micromatch/picomatch@4.0.6...4.0.7

4.0.6

What's Changed

Full Changelog: micromatch/picomatch@4.0.5...4.0.6

Changelog

Sourced from picomatch's changelog.

4.0.7 (2026-08-24)

Fixed

  • Fixed terminal globstars in parenthesized patterns (#142, e279bd7).

4.0.6 (2026-08-24)

Fixed

  • scan() now scans the full pattern when tokens are requested, instead of merging the remaining path segments into the final token (#62, 5f5819d).
  • scan() now returns complete pattern parts, including leading and trailing empty segments, and handles nested and escaped parentheses correctly (#58, f201165).
Commits
  • 6bb4067 4.0.7
  • fdfb155 Merge pull request #198 from micromatch/issue-142
  • 38c6b7a 4.0.6
  • ada9d3f Merge pull request #199 from micromatch/issue-58
  • 9b74f6f Merge pull request #197 from micromatch/issue-62
  • f201165 fix: return complete pattern parts from scan
  • e279bd7 fix: handle terminal globstars in parenthesized patterns
  • 5f5819d fix: scan full pattern when tokens are requested
  • See full diff in compare view

Updates markdown-it from 15.0.0 to 15.0.1

Changelog

Sourced from markdown-it's changelog.

[15.0.1] - 2026-08-27

Changed

  • doc: replace oxide theme with custom one.

Fixed

  • Fixed code span parsing after lookaheads for unclosed link and image labels, #1201.
  • Preserve spaces in code spans whose content consists only of spaces, #1180.
  • Preserve brackets around IPv6 address literals when normalizing links, #1204.

Security

  • Fixed quadratic complexity when replacing fuzzy links.
  • Fixed quadratic complexity in scheme backscan (inline linkify rule).
Commits
  • 924b203 15.0.1 released
  • 25c3895 Changelog update
  • aaadcfa Fix quadratic complexity in scheme backscan (inline linkify rule)
  • 09fa071 Fix quadratic complexity when replacing fuzzy links
  • 988c82b fix: don't strip spaces from all-space code spans
  • 26b9a7b Polish previous commit
  • e8c6688 fix: preserve IPv6 brackets in normalizeLink (#1204)
  • 5e9b1cc Rework backticks cache to remove side effects, close #1201
  • 7b9a6a3 doc: fix source link style for methods
  • 1e8ab89 doc: add changelog to menu
  • Additional commits viewable in compare view

Updates pdfkit from 0.19.1 to 0.20.1

Release notes

Sourced from pdfkit's releases.

v0.20.1

  • Add a Node ESM build so import 'pdfkit' in Node resolves to the Node build (real file system, native zlib, Node streams, self-registering standard fonts) instead of the browser bundle

v0.20.0

Highlights

TLDR: "A PDF generation library for Node.js" -> "A JavaScript PDF generation library"

Standard Font Support rewritten

Standard font support has been rewritten to use pre-parsed font metrics instead of parsing raw AFM definitions at runtime. The new approach is more efficient (less runtime overhead and memory usage) and reduces the size of the browser bundle significantly. Standalone build which bundles all standard fonts is down to 1.3MB from 2.3MB.

In Node, font metrics are loaded lazily as before, while in browser builds, except the standalone one, each font must be imported from pdfkit/standard-fonts/* and registered with registerStdFonts(). Previously, to use a standard font in browser was necessary to use a bundler.

See usage example in output helpers section below.

Removal of Node specific dependencies

Buffer is no longer used internally. Uint8Array is now the minimum denominator for binary data in both Node and browsers. Since Buffer is a Uint8Array subclass, this change is fully backward compatible.

Native fs, zlib and ReadableStream are conditionally imported only in Node. Browser builds use minimal implementations. This approach gives us the best of both worlds: Node builds still use the native modules, while browser ones are portable.

Many thanks to @​diegomura for his help in removing the Node specific dependencies.

registerFile API

The new registerFile(path, data) API allows registering in-memory files globally. The data argument must be a Uint8Array. Passing undefined as data unregisters the path.

In browsers, it can be used as a simplified virtual file system. In Node, this is useful for registering fonts, images and other resources that are not available on disk. The native file system is still used when the path is not registered.

import { PDFDocument, registerFile } from 'pdfkit';
const response = await fetch('/fonts/Roboto-Regular.ttf');
const fontData = new Uint8Array(await response.arrayBuffer());
registerFile('fonts/Roboto-Regular.ttf', fontData);
const doc = new PDFDocument();
// register an alias for the font path
doc.registerFont('Roboto', 'fonts/Roboto-Regular.ttf');
// or use the path directly
doc.font('fonts/Roboto-Regular.ttf');
// Optionally unregister the path when it is no longer needed.
registerFile('fonts/Roboto-Regular.ttf', undefined);

toBytes and toBlob output helpers

... (truncated)

Changelog

Sourced from pdfkit's changelog.

[v0.20.1] - 2026-08-23

  • Add a Node ESM build so import 'pdfkit' in Node resolves to the Node build (real file system, native zlib, Node streams, self-registering standard fonts) instead of the browser bundle

[v0.20.0] - 2026-08-23

  • [BREAKING CHANGE] Remove the virtual file system (pdfkit/virtual-fs). Browser builds no longer depend on fs: use registerFile to register Uint8Array data under a path, pass a Uint8Array or ArrayBuffer directly to registerFont, image and file, or pass a data URL directly to image and file
  • Add registerFile(path, data, options) to globally register in-memory files in Node and browsers, with optional birthtime and ctime metadata. Passing undefined as data unregisters the path
  • [BREAKING CHANGE] Export PDFDocument, LineWrapper and registerFile as named exports from the main Node and browser entry points while preserving the default PDFDocument export
  • Add experimental toBlob(document) and toBytes(document) output helpers under pdfkit/output
  • Accept already-parsed fontkit Font instances in doc.font() and registerFont
  • Load the PDF/A ICC profile from disk only when needed in Node, while continuing to bundle it in browser builds
  • Add tools to convert raw AFM standard-font definitions into parsed or compact runtime JavaScript modules
  • [BREAKING CHANGE] Use generated standard-font data instead of parsing raw AFM definitions at runtime. Node loads font metrics lazily; browser applications must import each font they use from pdfkit/standard-fonts/* and register it with registerStdFonts()
  • [BREAKING CHANGE] Restrict AcroForm options to documented mappings and explicit escape hatches.
  • [BREAKING CHANGE] Stop automatically uppercasing annotation option keys.
  • [BREAKING CHANGE] Throw from addNamedEmbeddedFile when no ref is given, instead of writing an unparseable undefined token into the /EmbeddedFiles name tree
  • Do not mutate options passed to doc.annotate() and its convenience methods (link, note, strike, lineAnnotation, rectAnnotation, ellipseAnnotation, textAnnotation, fileAnnotation)
  • Persist font options when adding a new page. Fixes #1739
  • Use Uint8Array instead of Node's Buffer internally
  • Fix date text field formatting emitting invalid JavaScript, so the format was never applied. Fixes #1546
  • Fix indentAllLines applying the indent again on every paragraph and every page break, and keep it applied across continued text. Fixes #1606
  • Fix a hole in a sparse array being skipped entirely, which shifted every later entry down one
  • Encrypt strings inside name trees. Fixes #1513
Commits
  • f048bdd v0.20.1
  • 910c86a Add Node ESM build: route the node import condition to a real Node bundle (#1...
  • 34f6da0 v0.20.0
  • 71690eb Add afm font handling changelog entry
  • 255fc6d Export PDFDocument and helpers as named exports
  • 0f92500 Import @​noble/hashes without extension (avoid duplicate identifiers in build ...
  • cd4e882 Make generate website docs portable (remove magick dependency)
  • d24b383 Update babel
  • f0863a6 Accept pre-parsed fontkit Font instances in doc.font() (#1776)
  • f79e551 Fix CI after dev dependency update (#1777)
  • Additional commits viewable in compare view

Updates isomorphic-dompurify from 3.22.0 to 3.23.0

Release notes

Sourced from isomorphic-dompurify's releases.

3.23.0: Updated dependencies

  • dompurify 3.4.13 -> 3.4.14
  • vitest 4.1.10 -> 4.1.11
  • @​biomejs/biome 2.5.7 -> 2.5.10
  • @​types/jsdom 28.0.3 -> 30.0.0
  • pnpm 11.20.0 -> 11.23.0
Commits
  • 7607c2f chore: bump pnpm to 11.23.0 and release 3.23.0
  • fc2cac4 chore(deps): bump dompurify from 3.4.13 to 3.4.14
  • 71187a7 chore(deps-dev): bump vitest from 4.1.10 to 4.1.11
  • 6e50665 chore(deps): bump pnpm/action-setup from 6.0.9 to 6.0.10
  • cabc381 chore(deps-dev): bump @​types/jsdom from 28.0.3 to 30.0.0
  • 783b536 chore(deps-dev): bump @​biomejs/biome from 2.5.7 to 2.5.10
  • See full diff in compare view

Updates @tanstack/react-query from 5.102.5 to 5.102.8

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.102.8

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.102.8
    • @​tanstack/react-query@​5.102.8

@​tanstack/react-query-next-experimental@​5.102.8

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.102.8

@​tanstack/react-query-persist-client@​5.102.8

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-persist-client-core@​5.102.8
    • @​tanstack/react-query@​5.102.8

@​tanstack/react-query@​5.102.8

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.102.8

@​tanstack/react-query-devtools@​5.102.7

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.102.7
    • @​tanstack/react-query@​5.102.7

@​tanstack/react-query-next-experimental@​5.102.7

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.102.7

@​tanstack/react-query-persist-client@​5.102.7

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-persist-client-core@​5.102.7
    • @​tanstack/react-query@​5.102.7

@​tanstack/react-query@​5.102.7

Patch Changes

  • Updated dependencies []:

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.102.8

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.102.8

5.102.7

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.102.7

5.102.6

Patch Changes

  • #11305 ac2b612 - fix(react-query): throw falsy errors from useQueries and useSuspenseQueries to the error boundary

  • Updated dependencies []:

    • @​tanstack/query-core@​5.102.6
Commits

Updates sharp from 0.35.3 to 0.35.4

Release notes

Sourced from sharp's releases.

v0.35.4

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.3

v0.35.4-rc.0

Commits
  • 7f1a0a2 Release v0.35.4
  • f927818 Upgrade to sharp-libvips v1.3.3
  • e802092 Prerelease v0.35.4-rc.0
  • e13eb2f CI: Fix wasm32 build (#4589)
  • a82a0b3 Upgrade to libvips v8.18.6
  • 8044fe4 Bound resize dimensions to coordinate limit
  • 147f859 Docs: changelog entries for #4578 #4584
  • ee5bfb8 Tests: use yauzl directly rather than via extract-zip wrapper
  • 7a77889 Bump uraimo/run-on-arch-action from 3.1.0 to 3.2.0 (#4588)
  • ea5bef2 Improve support for input Streams finishing before output is requested (#4584)
  • Additional commits viewable in compare view

Updates @testing-library/react from 16.3.2 to 16.3.3

Release notes

Sourced from @​testing-library/react's releases.

v16.3.3

16.3.3 (2026-08-27)

Bug Fixes

  • Avoid act() re-entrant when dispatching events (#1468) (20ce75f)
Commits

Updates @types/react-dom from 19.2.4 to 19.2.5

Commits

Updates @vitejs/plugin-react from 6.1.0 to 6.1.1

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.1.1

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.1.1 (2026-08-28)

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

Commits
  • 04cac50 release: plugin-react@6.1.1 (#1440)
  • 82d35ab fix(react): respect environment sourcemap option when builder.sharedPlugins...
  • 397e847 fix(react): make logging diagnostics an opt-in for React Compiler (#1431)
  • 61006e6 fix(deps): update all non-major dependencies (#1433)
  • e2a649c chore: use deps.neverBundle instead of external in tsdown config (#1430)
  • fb2d6f3 fix(deps): update all non-major dependencies (#1427)
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps)(deps): bump the production-deps group with 13 updates
2be8d91 
Bumps the production-deps group with 13 updates:

| Package | From | To |
| --- | --- | --- |
| [lint-staged](https://github.com/lint-staged/lint-staged) | `17.3.0` | `17.4.1` |
| [axios](https://github.com/axios/axios) | `1.19.0` | `1.20.0` |
| [nodemailer](https://github.com/nodemailer/nodemailer) | `9.0.5` | `9.0.6` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.2.0` | `26.4.0` |
| [picomatch](https://github.com/micromatch/picomatch) | `4.0.5` | `4.0.7` |
| [markdown-it](https://github.com/markdown-it/markdown-it) | `15.0.0` | `15.0.1` |
| [pdfkit](https://github.com/foliojs/pdfkit) | `0.19.1` | `0.20.1` |
| [isomorphic-dompurify](https://github.com/kkomelin/isomorphic-dompurify) | `3.22.0` | `3.23.0` |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.102.5` | `5.102.8` |
| [sharp](https://github.com/lovell/sharp) | `0.35.3` | `0.35.4` |
| [@testing-library/react](https://github.com/testing-library/react-testing-library) | `16.3.2` | `16.3.3` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.4` | `19.2.5` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.1.0` | `6.1.1` |


Updates `lint-staged` from 17.3.0 to 17.4.1
- [Release notes](https://github.com/lint-staged/lint-staged/releases)
- [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md)
- [Commits](lint-staged/lint-staged@v17.3.0...v17.4.1)

Updates `axios` from 1.19.0 to 1.20.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.19.0...v1.20.0)

Updates `nodemailer` from 9.0.5 to 9.0.6
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v9.0.5...v9.0.6)

Updates `@types/node` from 26.2.0 to 26.4.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `picomatch` from 4.0.5 to 4.0.7
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@4.0.5...4.0.7)

Updates `markdown-it` from 15.0.0 to 15.0.1
- [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md)
- [Commits](markdown-it/markdown-it@15.0.0...15.0.1)

Updates `pdfkit` from 0.19.1 to 0.20.1
- [Release notes](https://github.com/foliojs/pdfkit/releases)
- [Changelog](https://github.com/foliojs/pdfkit/blob/master/CHANGELOG.md)
- [Commits](foliojs/pdfkit@v0.19.1...v0.20.1)

Updates `isomorphic-dompurify` from 3.22.0 to 3.23.0
- [Release notes](https://github.com/kkomelin/isomorphic-dompurify/releases)
- [Commits](kkomelin/isomorphic-dompurify@3.22.0...3.23.0)

Updates `@tanstack/react-query` from 5.102.5 to 5.102.8
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.102.8/packages/react-query)

Updates `sharp` from 0.35.3 to 0.35.4
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.35.3...v0.35.4)

Updates `@testing-library/react` from 16.3.2 to 16.3.3
- [Release notes](https://github.com/testing-library/react-testing-library/releases)
- [Changelog](https://github.com/testing-library/react-testing-library/blob/main/CHANGELOG.md)
- [Commits](testing-library/react-testing-library@v16.3.2...v16.3.3)

Updates `@types/react-dom` from 19.2.4 to 19.2.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `@vitejs/plugin-react` from 6.1.0 to 6.1.1
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.1/packages/plugin-react)

---
updated-dependencies:
- dependency-name: lint-staged
  dependency-version: 17.4.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: axios
  dependency-version: 1.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: nodemailer
  dependency-version: 9.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-deps
- dependency-name: "@types/node"
  dependency-version: 26.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: picomatch
  dependency-version: 4.0.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-deps
- dependency-name: markdown-it
  dependency-version: 15.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-deps
- dependency-name: pdfkit
  dependency-version: 0.20.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: isomorphic-dompurify
  dependency-version: 3.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.102.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-deps
- dependency-name: sharp
  dependency-version: 0.35.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-deps
- dependency-name: "@testing-library/react"
  dependency-version: 16.3.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: production-deps
- dependency-name: "@types/react-dom"
  dependency-version: 19.2.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: production-deps
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.1.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: production-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Aug 31, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: npm. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 31, 2026
@ihabkhaled
ihabkhaled merged commit c61ab0d into main Aug 31, 2026
110 of 111 checks passed
@ihabkhaled
ihabkhaled deleted the dependabot/npm_and_yarn/production-deps-5c0228fdc5 branch August 31, 2026 07:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ihabkhaled