chore(deps): bump the production-dependencies group across 1 directory with 24 updates by dependabot[bot] · Pull Request #254 · spiritledsoftware/caplets

dependabot · 2026-08-03T09:34:22Z

Bumps the production-dependencies group with 24 updates in the / directory:

Package	From	To
typescript	`6.0.3`	`7.0.2`
@astrojs/cloudflare	`14.1.4`	`14.1.7`
@sentry/browser	`10.67.0`	`10.69.0`
@tabler/icons	`3.45.0`	`3.46.0`
@tanstack/virtual-core	`3.17.5`	`3.17.7`
astro	`7.1.3`	`7.1.6`
posthog-js	`1.405.3`	`1.409.2`
tailwind-variants	`3.2.2`	`3.3.0`
@astrojs/react	`6.0.1`	`6.0.2`
@tanstack/react-virtual	`3.14.7`	`3.14.9`
lucide-react	`1.25.0`	`1.28.0`
react	`19.2.7`	`19.2.8`
react-dom	`19.2.7`	`19.2.8`
shadcn	`4.13.1`	`4.16.0`
@astrojs/starlight	`0.41.3`	`0.41.5`
@modelcontextprotocol/sdk	`1.29.0`	`1.30.0`
@aws-sdk/client-s3	`3.1091.0`	`3.1100.0`
@hono/node-server	`2.0.11`	`2.0.12`
@sentry/bun	`10.67.0`	`10.69.0`
@sentry/node	`10.67.0`	`10.69.0`
add-mcp	`1.13.0`	`2.0.0`
hono	`4.12.31`	`4.12.32`
posthog-node	`5.46.0`	`5.47.0`
@astrojs/language-server	`2.16.12`	`2.16.13`

Updates typescript from 6.0.3 to 7.0.2

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Updates @astrojs/cloudflare from 14.1.4 to 14.1.7

Release notes

Sourced from @astrojs/cloudflare's releases.

@astrojs/cloudflare@14.1.7

Patch Changes

#17543 bbc1ec9 Thanks @ematipico! - Fixes a bug where Cloudflare couldn't load chunked collections via experimental.collectionStorage: 'chunked'.

Updated dependencies []:

@astrojs/underscore-redirects@1.0.3

@astrojs/cloudflare@14.1.6

Patch Changes

Updated dependencies [c895b12]:

@astrojs/internal-helpers@0.10.2

@astrojs/underscore-redirects@1.0.3

@astrojs/cloudflare@14.1.5

Patch Changes

#17376 0216368 Thanks @astrobot-houston! - Fixes a bug where an explicit cache: { enabled: false } in your wrangler config was overridden and forced to true when a Workers cache provider was configured

Updated dependencies []:

@astrojs/underscore-redirects@1.0.3

Changelog

Sourced from @astrojs/cloudflare's changelog.

14.1.7

Patch Changes

#17543 bbc1ec9 Thanks @ematipico! - Fixes a bug where Cloudflare couldn't load chunked collections via experimental.collectionStorage: 'chunked'.

Updated dependencies []:

@astrojs/underscore-redirects@1.0.3

14.1.6

Patch Changes

Updated dependencies [c895b12]:

@astrojs/internal-helpers@0.10.2

@astrojs/underscore-redirects@1.0.3

14.1.5

Patch Changes

#17376 0216368 Thanks @astrobot-houston! - Fixes a bug where an explicit cache: { enabled: false } in your wrangler config was overridden and forced to true when a Workers cache provider was configured

Updated dependencies []:

@astrojs/underscore-redirects@1.0.3

Commits

9865d1c [ci] release (#17539)
bbc1ec9 fix: chuncked content collections (#17543)
b0535ca [ci] release (#17528)
112d3ea [ci] release (#17469)
2e83040 [ci] format
0216368 fix(cloudflare): respect explicit cache.enabled: false in wrangler config (...
fbffc96 Fix Container API build errors when using the Cloudflare adapter's workerd pr...
See full diff in compare view

Updates @sentry/browser from 10.67.0 to 10.69.0

Release notes

Sourced from @sentry/browser's releases.

10.69.0

Important Changes

feat(v10/cloudflare): Add instrumentAgentWithSentry for Cloudflare Agents (#22786)

The Cloudflare SDK adds a new instrumentAgentWithSentry API for Cloudflare Agents. It works like instrumentDurableObjectWithSentry for Agent classes from the agents SDK and additionally creates spans for @callable RPC methods and automatically sets the conversationId based on the agent's name. When building with the Sentry Vite plugin, Agents are instrumented automatically (#22788).

Other Changes

feat(v10/cloudflare): Add Spotlight integration for local dev event forwarding (#22796)

feat(v10/cloudflare): Add wranglerConfigPath to Vite options (#22803)

feat(v10/cloudflare): Filter framework-internal Durable Object storage spans (#22770)

feat(v10/cloudflare): Instrument Agents automatically (#22788)

feat(v10/cloudflare): Rotate agent conversation id on chat clear (#22787)

fix(v10/cloudflare): Also skip cf: prefixed DOs (#22802)

fix(v10/cloudflare): Filter CREATE INDEX spans on cf_-prefixed tables (#22767)

fix(v10/cloudflare): Prevent AI provider skips (#22771)

fix(v10/core): Summarize SQLite upserts so Durable Object cf_ spans stay filtered (#22766)

fix(v10/effect): Set sentry.origin on logs from SentryEffectLogger (#22806)

fix(v10/gatsby): Add React 19 to peer dependency range (#22675)

fix(v10/node): Unpin @apm-js-collab/code-transformer-bundler-plugins (#22678)

fix(v10/server-utils): Do not inject dc into client bundle (#22765)

test(v10/cloudflare): Pin mcp as agent depends on it (#22769)

Bundle size 📦

Path Size

@sentry/browser 27.11 KB

@sentry/browser - with treeshaking flags 25.59 KB

@sentry/browser (incl. Tracing) 45.51 KB

@sentry/browser (incl. Tracing + Span Streaming) 47.25 KB

@sentry/browser (incl. Tracing, Profiling) 50.15 KB

@sentry/browser (incl. Tracing, Replay) 83.84 KB

@sentry/browser (incl. Tracing, Replay) - with treeshaking flags 73.71 KB

@sentry/browser (incl. Tracing, Replay with Canvas) 88.44 KB

@sentry/browser (incl. Tracing, Replay, Feedback) 100.79 KB

@sentry/browser (incl. Feedback) 43.88 KB

@sentry/browser (incl. sendFeedback) 31.79 KB

@sentry/browser (incl. FeedbackAsync) 36.8 KB

@sentry/browser (incl. Metrics) 28.17 KB

@sentry/browser (incl. Logs) 28.39 KB

@sentry/browser (incl. Metrics & Logs) 29.07 KB

@sentry/react 28.87 KB

... (truncated)

Changelog

Sourced from @sentry/browser's changelog.

10.69.0

Important Changes

feat(v10/cloudflare): Add instrumentAgentWithSentry for Cloudflare Agents (#22786)

The Cloudflare SDK adds a new instrumentAgentWithSentry API for Cloudflare Agents. It works like instrumentDurableObjectWithSentry for Agent classes from the agents SDK and additionally creates spans for @callable RPC methods and automatically sets the conversationId based on the agent's name. When building with the Sentry Vite plugin, Agents are instrumented automatically (#22788).

Other Changes

feat(v10/cloudflare): Add Spotlight integration for local dev event forwarding (#22796)

feat(v10/cloudflare): Add wranglerConfigPath to Vite options (#22803)

feat(v10/cloudflare): Filter framework-internal Durable Object storage spans (#22770)

feat(v10/cloudflare): Instrument Agents automatically (#22788)

feat(v10/cloudflare): Rotate agent conversation id on chat clear (#22787)

fix(v10/cloudflare): Also skip cf: prefixed DOs (#22802)

fix(v10/cloudflare): Filter CREATE INDEX spans on cf_-prefixed tables (#22767)

fix(v10/cloudflare): Prevent AI provider skips (#22771)

fix(v10/core): Summarize SQLite upserts so Durable Object cf_ spans stay filtered (#22766)

fix(v10/effect): Set sentry.origin on logs from SentryEffectLogger (#22806)

fix(v10/gatsby): Add React 19 to peer dependency range (#22675)

fix(v10/node): Unpin @apm-js-collab/code-transformer-bundler-plugins (#22678)

fix(v10/server-utils): Do not inject dc into client bundle (#22765)

test(v10/cloudflare): Pin mcp as agent depends on it (#22769)

10.68.0

feat(cloudflare): Add @sentry/cloudflare/vite orchestrion plugin (#21967)

feat(nestjs): Support WebSocket errors in SentryGlobalFilter (#22224)

feat(node,server-utils): Set cache.key on dataloader spans and capture redis delete operations as cache.remove (#22389)

feat(server-utils): Allow integrations to be part of marker (#22094)

feat(server-utils): Migrate FirebaseInstrumentation to orchestrion (#22141)

feat(server-utils): Warn when bundler config has instrumented module in external (#22379)

feat(v10): Add http.route attribute to http.server spans with parameterized routes (#22564)

feat(v10): Add url.full and url.path to http.server spans (#22533)

feat(v10/cloudflare): Auto-instrument Durable Object classes (#22541)

feat(v10/cloudflare): Auto-instrument the worker entry with withSentry (#22540)

feat(v10/cloudflare): Auto-instrument WorkerEntrypoint classes (#22543)

feat(v10/cloudflare): Auto-instrument Workflow classes (#22542)

feat(v10/cloudflare): Read wrangler config and resolve the Sentry options module (#22538)

feat(v10/core): Add instrumentStateGraph API (#22491)

feat(v10/core): Add url.full attribute to core fetch instrumentation (#22436)

feat(v10/core): Support filtering stackFrameVariables by variable name (#22526)

feat(v10/react-router): Make instrumentation API the default (#22525)

... (truncated)

Commits

417af5d release: 10.69.0
e7cf605 meta(changelog): Update changelog for 10.69.0 (#22807)
7c5a00e fix(v10/effect): Set sentry.origin on logs from SentryEffectLogger (#22806)
df53214 feat(v10/cloudflare): Add wranglerConfigPath to Vite options (#22803)
e96e15e feat(v10/cloudflare): Add Spotlight integration for local dev event forwardin...
ea4a322 fix(v10/cloudflare): Also skip cf: prefixed DOs (#22802)
6a84103 feat(v10/cloudflare): Instrument Agents automatically (#22788)
f0c3569 feat(v10/cloudflare): Rotate agent conversation id on chat clear (#22787)
0516355 feat(v10/cloudflare): Add instrumentAgentWithSentry for Cloudflare Agents (#2...
d3a6e52 fix(v10/cloudflare): Filter CREATE INDEX spans on cf_-prefixed tables (#2...
Additional commits viewable in compare view

Updates @tabler/icons from 3.45.0 to 3.46.0

Release notes

Sourced from @tabler/icons's releases.

Release 3.46.0

18 new icons:

outline/play-bug

outline/play-bugs

outline/remote-control

outline/rocking-chair

outline/run-sprint

outline/sparkles-2-off

outline/tabs

outline/tags-chevron-down

outline/tags-chevron-left

outline/tags-chevron-right

outline/tags-chevron-up

outline/thinking-high

outline/thinking-low

outline/thinking-medium

outline/treasure-chest

outline/twig

outline/vault

outline/yarn

Fixed icons: outline/credits, outline/currency-tether, outline/device-3d-camera, outline/device-screen, outline/home-lock, outline/map-lock, outline/notdef, outline/queue-pop-in, outline/server-bolt, outline/server, outline/sparkles-2, outline/transform-point-bottom-left, outline/transform-point-bottom-right, outline/transform-point-top-left, outline/transform-point-top-right

Commits

8ac7d81 Release 3.46.0
2727ba9 Enhance release process in package.json: add GitHub authentication check and ...
4ff4802 Add npm login check before release-it initialization in package.json
74a7690 Merge branch 'main' of https://github.com/tabler/tabler-icons
f828849 Update dependencies in package.json and pnpm-lock.yaml: remove @release-it-pl...
1a39582 Fix rect width/height swap in optimize script (#1570)
54bac86 Secure PR validation: run fork code without privileges (#1569)
eaaf32d Update Turbo package to version 2.10.7 and adjust schema reference in turbo.json
2cfcde7 Remove unused AI tag generation script and related package dependency from pr...
be0e5a8 Refactor SVG paths for several icons to improve structure and consistency: `o...
Additional commits viewable in compare view

Updates @tanstack/virtual-core from 3.17.5 to 3.17.7

Release notes

Sourced from @tanstack/virtual-core's releases.

@tanstack/virtual-core@3.17.7

Patch Changes

#1239 a5417b4 - Fix a one-frame viewport jump when above-viewport rows resize while scrolling up (#1227). resizeItem writes scrollTop synchronously inside the ResizeObserver callback to compensate for the size change, but then notified asynchronously — so the browser could paint a frame with the new scrollTop and the old item transforms, making the content jerk by the resize delta and snap back. When a compensation actually moves the scroll position, resizeItem now notifies synchronously so the transform commit lands in the same paint as the scroll write. Resizes that don't move the scroll position (below-fold measurements, iOS-deferred adjustments) keep the cheaper async notify.

@tanstack/virtual-core@3.17.6

Patch Changes

#1236 7ae32b5 - Stop the default scroll-adjustment heuristic from drifting the viewport when a viewport-spanning item grows. Previously any item whose top sat above the fold (itemStart < scrollOffset) had its size delta compensated on every re-measure — including a streaming chat message that spans the fold and grows at its bottom, dragging scrollTop downward token by token (#1218). Re-measurements now only compensate items that are entirely above the fold (itemStart + itemSize <= scrollOffset); growth below the anchor point leaves the scroll position untouched. First measurements (estimate→actual) still compensate any above-fold item, and a custom shouldAdjustScrollPositionOnItemSizeChange still overrides the default.

Changelog

Sourced from @tanstack/virtual-core's changelog.

3.17.7

Patch Changes

#1239 a5417b4 - Fix a one-frame viewport jump when above-viewport rows resize while scrolling up (#1227). resizeItem writes scrollTop synchronously inside the ResizeObserver callback to compensate for the size change, but then notified asynchronously — so the browser could paint a frame with the new scrollTop and the old item transforms, making the content jerk by the resize delta and snap back. When a compensation actually moves the scroll position, resizeItem now notifies synchronously so the transform commit lands in the same paint as the scroll write. Resizes that don't move the scroll position (below-fold measurements, iOS-deferred adjustments) keep the cheaper async notify.

3.17.6

Patch Changes

#1236 7ae32b5 - Stop the default scroll-adjustment heuristic from drifting the viewport when a viewport-spanning item grows. Previously any item whose top sat above the fold (itemStart < scrollOffset) had its size delta compensated on every re-measure — including a streaming chat message that spans the fold and grows at its bottom, dragging scrollTop downward token by token (#1218). Re-measurements now only compensate items that are entirely above the fold (itemStart + itemSize <= scrollOffset); growth below the anchor point leaves the scroll position untouched. First measurements (estimate→actual) still compensate any above-fold item, and a custom shouldAdjustScrollPositionOnItemSizeChange still overrides the default.

Commits

deca524 ci: Version Packages (#1240)
a5417b4 fix(virtual-core): notify synchronously after above-viewport resize compensat...
32b2f2b ci: Version Packages (#1238)
ef6e92a docs(virtual-core): clarify shouldAdjustScrollPositionOnItemSizeChange usage ...
7ae32b5 fix(virtual-core): stop viewport-spanning item growth from drifting scroll (#...
See full diff in compare view

Updates astro from 7.1.3 to 7.1.6

Release notes

Sourced from astro's releases.

astro@7.1.6

Patch Changes
#17536 ff97b86 Thanks @dmgawel! - Fixes concurrent static builds failing to generate i18n rewrite fallbacks for dynamic routes

#17383 296e1b0 Thanks @thelazylamaGit! - Fixes stale dev CSS after editing component style blocks and CSS files in dev
#17543 bbc1ec9 Thanks @ematipico! - Adds a feature to experimental.collectionStorage that allows to change the size of chunks.

For example, you can reduce the size of chunks to 1MB:
// astro.config.mjs
import { defineConfig } from 'astro/config';
export default defineConfig({
experimental: {
collectionStorage: {
type: 'chunked',
chunkSize: 1024 * 1024,
},
},
});
#17545 5214663 Thanks @ematipico! - Bumps the Astro compiler to the latest version. Changelog.
astro@7.1.5

Patch Changes

#17524 7613030 Thanks @matthewp! - Fixes a bug where an error while finalizing a request could prevent a response from being sent

#17480 f61ba9c Thanks @florian-lefebvre! - Fixes a case where a custom logger.entrypoint failed to load at runtime in a built server bundle.

#17525 e614b7b Thanks @matthewp! - Fixes action path resolution so that properties of a resolved action function are not treated as routable path segments

#17284 c775c1f Thanks @matthewp! - Fixes a bug where the custom 404 (or 500) page was not rendered when a middleware rewrite targeted a route that returned an empty 404/500 response, and a blank page was returned instead

#17474 c895b12 Thanks @nicksnyder! - Updates dependency js-yaml to v4.3.0

Updated dependencies [c895b12]:

@astrojs/internal-helpers@0.10.2

@astrojs/markdown-remark@7.2.2

@astrojs/markdown-satteri@0.3.5

astro@7.1.4

Patch Changes

#17488 d4f266d Thanks @emerson-d-lopes! - Fixes duplicate CSS files being emitted in server output when a prerendered page and a server-rendered page share the same styles (e.g. a shared layout importing Tailwind). The prerender and SSR environments each emitted their own copy of the same stylesheet (index.X.css and _..Y.css); the SSR build now reuses the CSS asset filename from the prerender build when the stylesheet is backed by the same CSS source modules, so only a single file is emitted.

... (truncated)

Changelog

Sourced from astro's changelog.

7.1.6

Patch Changes
#17536 ff97b86 Thanks @dmgawel! - Fixes concurrent static builds failing to generate i18n rewrite fallbacks for dynamic routes

#17383 296e1b0 Thanks @thelazylamaGit! - Fixes stale dev CSS after editing component style blocks and CSS files in dev
#17543 bbc1ec9 Thanks @ematipico! - Adds a feature to experimental.collectionStorage that allows to change the size of chunks.

For example, you can reduce the size of chunks to 1MB:
// astro.config.mjs
import { defineConfig } from 'astro/config';
export default defineConfig({
experimental: {
collectionStorage: {
type: 'chunked',
chunkSize: 1024 * 1024,
},
},
});
#17545 5214663 Thanks @ematipico! - Bumps the Astro compiler to the latest version. Changelog.
7.1.5

Patch Changes

#17524 7613030 Thanks @matthewp! - Fixes a bug where an error while finalizing a request could prevent a response from being sent

#17480 f61ba9c Thanks @florian-lefebvre! - Fixes a case where a custom logger.entrypoint failed to load at runtime in a built server bundle.

#17525 e614b7b Thanks @matthewp! - Fixes action path resolution so that properties of a resolved action function are not treated as routable path segments

#17284 c775c1f Thanks @matthewp! - Fixes a bug where the custom 404 (or 500) page was not rendered when a middleware rewrite targeted a route that returned an empty 404/500 response, and a blank page was returned instead

#17474 c895b12 Thanks @nicksnyder! - Updates dependency js-yaml to v4.3.0

Updated dependencies [c895b12]:

@astrojs/internal-helpers@0.10.2

@astrojs/markdown-remark@7.2.2

@astrojs/markdown-satteri@0.3.5

7.1.4

Patch Changes

... (truncated)

Commits

9865d1c [ci] release (#17539)
5214663 fix: bump compiler (#17545)
bbc1ec9 fix: chuncked content collections (#17543)
296e1b0 fix(dev): refresh stale CSS for component \<style> block HMR (#17383)
ff97b86 fix(build): introduce two-staged build to prevent race condition with concurr...
b0535ca [ci] release (#17528)
c895b12 Update js-yaml to 4.3.0 (#17474)
f61ba9c fix(logger): loading at runtime when entrypoint is a URL (#17480)
e614b7b fix(astro): do not resolve action function properties as path segments (#17525)
7613030 Return a response when request finalization fails (#17524)
Additional commits viewable in compare view

Updates posthog-js from 1.405.3 to 1.409.2

Release notes

Sourced from posthog-js's releases.

posthog-js@1.409.2

1.409.2

Patch Changes

#4340 4b8867c Thanks @marandaneto! - Avoid redacting session replay network bodies when timestamps or UUID fragments resemble social security or credit card numbers. (2026-07-31)

Updated dependencies [4b8867c]:

@posthog/browser-common@0.3.1

posthog-js@1.409.1

1.409.1

Patch Changes

#4301 4b36c44 Thanks @dustinbyrne! - Add the browser-v1 client adapter for shared extensions, including analytics, request, persistence, replayed remote-config outcomes, and synchronous best-effort cleanup. (2026-07-31)

Updated dependencies [6b48a59]:

@posthog/browser-common@0.3.0

posthog-js@1.409.0

1.409.0

Minor Changes

#4308 6e7f3ae Thanks @ablaszkiewicz! - Emit the release id that posthog-cli injects into your bundle as $release_id on $exception events, so PostHog can attach exceptions to a release without joining through symbol sets. Adds getInjectedReleaseId() to @posthog/core. The property is only attached when an injected release id can be read. (2026-07-30)

Patch Changes

Updated dependencies [6e7f3ae]:

@posthog/core@1.46.0

posthog-js@1.408.3

1.408.3

Patch Changes

#4327 232b06a Thanks @github-actions! - Refresh campaign parameters after SPA URL changes. (2026-07-30)

#4328 95a3d02 Thanks @marandaneto! - Fix identify() creating a person profile when the supplied ID already matches an anonymously persisted distinct ID. (2026-07-30)

posthog-js@1.408.2

1.408.2

Patch Changes

#4325 3bd8a2d Thanks @marandaneto! - Fix dead-click false positives on WebKit when the SDK uses an iframe-sourced MutationObserver fallback.

... (truncated)

Commits

46ea0a3 chore: update versions and lockfile [version bump]
4b8867c fix(replay): avoid false-positive network body redaction (#4340)
3b90833 chore: update versions and lockfile [version bump]
4b36c44 feat(browser): add shared extension client adapter (#4301)
6b48a59 feat(browser-common): stream remote config outcomes (#4300)
2aae788 chore: update versions and lockfile [version bump]
1eb04c1 fix(ai): name langchain spans from the bare runName string (#4336)
9a453b9 fix(ai): map openai-agents groupId to $ai_session_id (#4335)
4ef8a41 chore: update versions and lockfile [version bump]
6e7f3ae feat: emit $release_id from the injected release id (#4308)
Additional commits viewable in compare view

Updates tailwind-variants from 3.2.2 to 3.3.0

Release notes

Sourced from tailwind-variants's releases.

v3.3.0

No significant changes

View changes on GitHub

Changelog

Sourced from tailwind-variants's changelog.

3.3.0 (2026-07-26)

Commits

9bf4fde chore: release v3.3.0
66f1a49 refactor: typescript (#301)
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for tailwind-variants since your current version.

Updates @astrojs/react from 6.0.1 to 6.0.2

Release notes

Sourced from @astrojs/react's releases.

@astrojs/react@6.0.2

Patch Changes

Updated dependencies [c895b12]:

@astrojs/internal-helpers@0.10.2

Changelog

Sourced from @astrojs/react's changelog.

6.0.2

Patch Changes

Updated dependencies [c895b12]:

@astrojs/internal-helpers@0.10.2

Commits

b0535ca [ci] release (#17528)
See full diff in compare view

Updates @tanstack/react-virtual from 3.14.7 to 3.14.9

Release notes

Sourced from @tanstack/react-virtual's releases.

@tanstack/react-virtual@3.14.9

Patch Changes

Updated dependencies [a5417b4]:

@tanstack/virtual-core@3.17.7

@tanstack/react-virtual@3.14.8

Patch Changes

#1237 aa536e7 - Fix a gap at the top of the list after an end-anchored prepend in directDomUpdates mode. The prepend grows the total size and bumps scrollOffset to the new bottom in the same pass, but the size container's height was written after _willUpdate synced the scroll position — so the browser clamped the scrollTop write to the stale (shorter) scrollHeight, leaving whitespace at the top until the next scroll. The container is now grown before the scroll sync. Only affected directDomUpdates mode (React-rendered sizers receive their height during render).

Updated dependencies [7ae32b5]:

@tanstack/virtual-core@3.17.6

Changelog

Sourced from @tanstack/react-virtual's changelog.

3.14.9

Patch Changes

Updated dependencies [a5417b4]:

@tanstack/virtual-core@3.17.7

3.14.8

Patch Changes

#1237 aa536e7 - Fix a gap at the top of the list after an end-anchored prepend in directDomUpdates mode. The prepend grows the total size and bumps scrollOffset to the new bottom in the same pass, but the size container's height was written after _willUpdate synced the scroll position — so the browser clamped the scrollTop write to the stale (shorter) scrollHeight, leaving whitespace at the top until the next scroll. The container is now grown before the scroll sync. Only affected directDomUpdates mode (React-rendered sizers receive their height during render).

Updated dependencies [7ae32b5]:

@tanstack/virtual-core@3.17.6

Commits

b4a76ca fix(marko-virtual): consolidate Marko e2e into one in-package app, fix test (...
deca524 ci: Version Packages (#1240)
32b2f2b ci: Version Packages (#1238)
aa536e7 fix(react-virtual): grow size container before scroll sync on end-anchored pr...
See full diff in compare view

Updates lucide-react from 1.25.0 to 1.28.0

Release notes

Sourced from lucide-react's releases.

Version 1.28.0

What's Changed

feat(icons): improve calendar icons centre of gravity by @karsa-mistmere in lucide-icons/lucide#4614

Full Changelog: lucide-icons/lucide@1.27.0...1.28.0

Version 1.27.0

What's Changed

feat(icons): removed brand names from tags & revised brand stopwords by @karsa-mistmere in lucide-icons/lucide#4575

fix(docs): Fix site build by @ericfennis in lucide-icons/lucide#4582

fix(icons): optimised square-scissors icons by @karsa-mistmere in lucide-icons/lucide#4581

fix(packages/angular): add more supported attributes for SVG nodes by @karsa-mistmere in lucide-icons/lucide#4570

feat(icons): added pending-cw icon by @NielsLazaroms in lucide-icons/lucide#4439

fix(icons): changed zap and zap-off icons by @kapowaz in lucide-icons/lucide#4536

feat(icons): add square-off icon by @october-learns in lucide-icons/lucide#4496

chore(deps-dev): bump astro from 6.4.8 to 7.1.0 by @dependabot[bot] in lucide-icons/lucide#4572

fix(icons): changed toolbox icon by @karsa-mistmere in lucide-icons/lucide#4571

feat(icons): add scan-square by @samuelalake in lucide-icons/lucide#4550

feat(icons): added user-shield icon by @MArtytraM99... Description has been truncated

…y with 24 updates Bumps the production-dependencies group with 24 updates in the / directory: | Package | From | To | | --- | --- | --- | | [typescript](https://github.com/microsoft/TypeScript) | `6.0.3` | `7.0.2` | | [@astrojs/cloudflare](https://github.com/withastro/astro/tree/HEAD/packages/integrations/cloudflare) | `14.1.4` | `14.1.7` | | [@sentry/browser](https://github.com/getsentry/sentry-javascript) | `10.67.0` | `10.69.0` | | [@tabler/icons](https://github.com/tabler/tabler-icons) | `3.45.0` | `3.46.0` | | [@tanstack/virtual-core](https://github.com/TanStack/virtual/tree/HEAD/packages/virtual-core) | `3.17.5` | `3.17.7` | | [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.1.3` | `7.1.6` | | [posthog-js](https://github.com/PostHog/posthog-js) | `1.405.3` | `1.409.2` | | [tailwind-variants](https://github.com/heroui-inc/tailwind-variants) | `3.2.2` | `3.3.0` | | [@astrojs/react](https://github.com/withastro/astro/tree/HEAD/packages/integrations/react) | `6.0.1` | `6.0.2` | | [@tanstack/react-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual) | `3.14.7` | `3.14.9` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.25.0` | `1.28.0` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.7` | `19.2.8` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.7` | `19.2.8` | | [shadcn](https://github.com/shadcn-ui/ui/tree/HEAD/packages/shadcn) | `4.13.1` | `4.16.0` | | [@astrojs/starlight](https://github.com/withastro/starlight/tree/HEAD/packages/starlight) | `0.41.3` | `0.41.5` | | [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.29.0` | `1.30.0` | | [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1091.0` | `3.1100.0` | | [@hono/node-server](https://github.com/honojs/node-server) | `2.0.11` | `2.0.12` | | [@sentry/bun](https://github.com/getsentry/sentry-javascript) | `10.67.0` | `10.69.0` | | [@sentry/node](https://github.com/getsentry/sentry-javascript) | `10.67.0` | `10.69.0` | | [add-mcp](https://github.com/neon-solutions/add-mcp) | `1.13.0` | `2.0.0` | | [hono](https://github.com/honojs/hono) | `4.12.31` | `4.12.32` | | [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.46.0` | `5.47.0` | | [@astrojs/language-server](https://github.com/withastro/astro/tree/HEAD/packages/language-tools/language-server) | `2.16.12` | `2.16.13` | Updates `typescript` from 6.0.3 to 7.0.2 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](https://github.com/microsoft/TypeScript/commits) Updates `@astrojs/cloudflare` from 14.1.4 to 14.1.7 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/cloudflare/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/cloudflare@14.1.7/packages/integrations/cloudflare) Updates `@sentry/browser` from 10.67.0 to 10.69.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.69.0/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@10.67.0...10.69.0) Updates `@tabler/icons` from 3.45.0 to 3.46.0 - [Release notes](https://github.com/tabler/tabler-icons/releases) - [Commits](tabler/tabler-icons@v3.45.0...v3.46.0) Updates `@tanstack/virtual-core` from 3.17.5 to 3.17.7 - [Release notes](https://github.com/TanStack/virtual/releases) - [Changelog](https://github.com/TanStack/virtual/blob/main/packages/virtual-core/CHANGELOG.md) - [Commits](https://github.com/TanStack/virtual/commits/@tanstack/virtual-core@3.17.7/packages/virtual-core) Updates `astro` from 7.1.3 to 7.1.6 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@7.1.6/packages/astro) Updates `posthog-js` from 1.405.3 to 1.409.2 - [Release notes](https://github.com/PostHog/posthog-js/releases) - [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md) - [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.405.3...posthog-js@1.409.2) Updates `tailwind-variants` from 3.2.2 to 3.3.0 - [Release notes](https://github.com/heroui-inc/tailwind-variants/releases) - [Changelog](https://github.com/heroui-inc/tailwind-variants/blob/main/CHANGELOG.md) - [Commits](heroui-inc/tailwind-variants@v3.2.2...v3.3.0) Updates `@astrojs/react` from 6.0.1 to 6.0.2 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/react/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/react@6.0.2/packages/integrations/react) Updates `@tanstack/react-virtual` from 3.14.7 to 3.14.9 - [Release notes](https://github.com/TanStack/virtual/releases) - [Changelog](https://github.com/TanStack/virtual/blob/main/packages/react-virtual/CHANGELOG.md) - [Commits](https://github.com/TanStack/virtual/commits/@tanstack/react-virtual@3.14.9/packages/react-virtual) Updates `lucide-react` from 1.25.0 to 1.28.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.28.0/packages/lucide-react) Updates `react` from 19.2.7 to 19.2.8 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react) Updates `react-dom` from 19.2.7 to 19.2.8 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom) Updates `shadcn` from 4.13.1 to 4.16.0 - [Release notes](https://github.com/shadcn-ui/ui/releases) - [Changelog](https://github.com/shadcn-ui/ui/blob/main/packages/shadcn/CHANGELOG.md) - [Commits](https://github.com/shadcn-ui/ui/commits/shadcn@4.16.0/packages/shadcn) Updates `@astrojs/starlight` from 0.41.3 to 0.41.5 - [Release notes](https://github.com/withastro/starlight/releases) - [Changelog](https://github.com/withastro/starlight/blob/main/packages/starlight/CHANGELOG.md) - [Commits](https://github.com/withastro/starlight/commits/@astrojs/starlight@0.41.5/packages/starlight) Updates `@modelcontextprotocol/sdk` from 1.29.0 to 1.30.0 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0) Updates `@aws-sdk/client-s3` from 3.1091.0 to 3.1100.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1100.0/clients/client-s3) Updates `@hono/node-server` from 2.0.11 to 2.0.12 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v2.0.11...v2.0.12) Updates `@sentry/bun` from 10.67.0 to 10.69.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.69.0/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@10.67.0...10.69.0) Updates `@sentry/node` from 10.67.0 to 10.69.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.69.0/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@10.67.0...10.69.0) Updates `add-mcp` from 1.13.0 to 2.0.0 - [Release notes](https://github.com/neon-solutions/add-mcp/releases) - [Changelog](https://github.com/neon-solutions/add-mcp/blob/main/CHANGELOG.md) - [Commits](neon-solutions/add-mcp@v1.13.0...v2.0.0) Updates `hono` from 4.12.31 to 4.12.32 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.31...v4.12.32) Updates `posthog-node` from 5.46.0 to 5.47.0 - [Release notes](https://github.com/PostHog/posthog-js/releases) - [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md) - [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.47.0/packages/node) Updates `@astrojs/language-server` from 2.16.12 to 2.16.13 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/language-tools/language-server/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/language-server@2.16.13/packages/language-tools/language-server) --- updated-dependencies: - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: "@astrojs/cloudflare" dependency-version: 14.1.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: "@sentry/browser" dependency-version: 10.69.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@tabler/icons" dependency-version: 3.46.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@tanstack/virtual-core" dependency-version: 3.17.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: astro dependency-version: 7.1.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: posthog-js dependency-version: 1.409.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: tailwind-variants dependency-version: 3.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@astrojs/react" dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: "@tanstack/react-virtual" dependency-version: 3.14.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: lucide-react dependency-version: 1.28.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: react dependency-version: 19.2.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: react-dom dependency-version: 19.2.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: shadcn dependency-version: 4.16.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@astrojs/starlight" dependency-version: 0.41.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.30.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@aws-sdk/client-s3" dependency-version: 3.1100.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@hono/node-server" dependency-version: 2.0.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: "@sentry/bun" dependency-version: 10.69.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@sentry/node" dependency-version: 10.69.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: add-mcp dependency-version: 2.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: hono dependency-version: 4.12.32 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: posthog-node dependency-version: 5.47.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@astrojs/language-server" dependency-version: 2.16.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-08-03T09:35:19Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	posthog-js@1.409.2
	@tanstack/react-virtual@3.14.9
	@tanstack/virtual-core@3.17.7
	@types/react-dom@19.2.4
	add-mcp@2.0.0
	posthog-node@5.47.0
	@sentry/browser@10.69.0
	@types/react@19.2.18
	@astrojs/language-server@2.16.13
	lucide-react@1.28.0
	@astrojs/react@6.0.2
	@astrojs/cloudflare@14.1.7
	react@19.2.8
	@astrojs/starlight@0.41.5
	astro@7.1.6
	@sentry/bun@10.69.0
	tailwind-variants@3.3.0
	shadcn@4.16.0
	react-dom@19.2.8
	@tabler/icons@3.46.0
	@sentry/node@10.69.0
	@hono/node-server@2.0.12
	hono@4.12.33
	@aws-sdk/client-s3@3.1100.0

View full report

socket-security · 2026-08-03T09:35:20Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `@sentry/node-core` is 60.0% likely obfuscated Confidence: 0.60 Location: Package overview From: pnpm-lock.yaml → `npm/@sentry/node@10.69.0` → `npm/@sentry/node-core@10.69.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@sentry/node-core@10.69.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `astro` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: apps/catalog/package.json → `npm/astro@7.1.6` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/astro@7.1.6`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 3, 2026

Navigation Menu

Uh oh!

Uh oh!

chore(deps): bump the production-dependencies group across 1 directory with 24 updates - #254

chore(deps): bump the production-dependencies group across 1 directory with 24 updates#254
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-e719643199

dependabot Bot commented on behalf of github Aug 3, 2026

Uh oh!

socket-security Bot commented Aug 3, 2026

Uh oh!

socket-security Bot commented Aug 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Path	Size
`@sentry/browser`	27.11 KB
`@sentry/browser` - with treeshaking flags	25.59 KB
`@sentry/browser` (incl. Tracing)	45.51 KB
`@sentry/browser` (incl. Tracing + Span Streaming)	47.25 KB
`@sentry/browser` (incl. Tracing, Profiling)	50.15 KB
`@sentry/browser` (incl. Tracing, Replay)	83.84 KB
`@sentry/browser` (incl. Tracing, Replay) - with treeshaking flags	73.71 KB
`@sentry/browser` (incl. Tracing, Replay with Canvas)	88.44 KB
`@sentry/browser` (incl. Tracing, Replay, Feedback)	100.79 KB
`@sentry/browser` (incl. Feedback)	43.88 KB
`@sentry/browser` (incl. sendFeedback)	31.79 KB
`@sentry/browser` (incl. FeedbackAsync)	36.8 KB
`@sentry/browser` (incl. Metrics)	28.17 KB
`@sentry/browser` (incl. Logs)	28.39 KB
`@sentry/browser` (incl. Metrics & Logs)	29.07 KB
`@sentry/react`	28.87 KB

Uh oh!

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 3, 2026

@​astrojs/cloudflare@​14.1.7

Patch Changes

@​astrojs/cloudflare@​14.1.6

Patch Changes

@​astrojs/cloudflare@​14.1.5

Patch Changes

14.1.7

Patch Changes

14.1.6

Patch Changes

14.1.5

Patch Changes

10.69.0

Important Changes

Other Changes

Bundle size 📦

10.69.0

Important Changes

Other Changes

10.68.0

Release 3.46.0

18 new icons:

@​tanstack/virtual-core@​3.17.7

Patch Changes

@​tanstack/virtual-core@​3.17.6

Patch Changes

3.17.7

Patch Changes

3.17.6

Patch Changes

astro@7.1.6

Patch Changes

astro@7.1.5

Patch Changes

astro@7.1.4

Patch Changes

7.1.6

Patch Changes

7.1.5

Patch Changes

7.1.4

Patch Changes

posthog-js@1.409.2

1.409.2

Patch Changes

posthog-js@1.409.1

1.409.1

Patch Changes

posthog-js@1.409.0

1.409.0

Minor Changes

Patch Changes

posthog-js@1.408.3

1.408.3

Patch Changes

posthog-js@1.408.2

1.408.2

Patch Changes

v3.3.0

View changes on GitHub

3.3.0 (2026-07-26)

@​astrojs/react@​6.0.2

Patch Changes

6.0.2

Patch Changes

@​tanstack/react-virtual@​3.14.9

Patch Changes

@​tanstack/react-virtual@​3.14.8

Patch Changes

3.14.9

Patch Changes

3.14.8

Patch Changes

Version 1.28.0

What's Changed

Version 1.27.0

`@astrojs/cloudflare@14`.1.7

`@astrojs/cloudflare@14`.1.6

`@astrojs/cloudflare@14`.1.5

`@tanstack/virtual-core@3`.17.7

`@tanstack/virtual-core@3`.17.6

`@astrojs/react@6`.0.2

`@tanstack/react-virtual@3`.14.9

`@tanstack/react-virtual@3`.14.8