Skip to content

chore: bump the npm group across 1 directory with 30 updates - #50

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-a40818b649
Open

chore: bump the npm group across 1 directory with 30 updates#50
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-a40818b649

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 28, 2026

Copy link
Copy Markdown

Bumps the npm group with 30 updates in the / directory:

Package From To
turbo 2.11.4 2.11.10
@sentry/node 11.0.0 11.9.0
lucide-react 1.48.0 1.61.0
posthog-js 1.434.15 1.438.21
@modelcontextprotocol/sdk 1.32.1 1.32.2
@posthog/react 1.11.2 1.11.3
@sentry/tanstackstart-react 11.0.0 11.9.0
motion 14.0.0 14.6.0
satori 0.35.0 0.63.2
@tanstack/react-query-devtools 5.104.0 5.104.5
@types/pdfkit 0.17.6 0.17.7
@react-three/fiber 9.8.1 9.8.2
@tanstack/react-virtual 3.14.17 3.14.22
@astryxdesign/core 0.7.1 0.7.4
@astryxdesign/theme-neutral 0.7.1 0.7.4
@aws-sdk/client-s3 3.1141.0 3.1156.0
@axe-core/playwright 4.13.0 4.14.0
@electric-sql/pglite 0.5.8 0.5.11
@playwright/test 1.63.0 1.64.1
@tanstack/react-query 5.104.0 5.104.5
@types/node 24.13.6 24.19.2
@vitejs/plugin-react 6.1.1 6.1.2
@vitest/coverage-v8 5.0.1 5.0.5
drizzle-orm 0.45.3 0.45.4
oxlint 1.85.0 1.89.0
pg-boss 12.35.0 12.38.0
pg 8.23.0 8.23.1
react-dom 19.3.0 19.3.1
react 19.3.0 19.3.1
vitest 5.0.1 5.0.5

Updates turbo from 2.11.4 to 2.11.10

Release notes

Sourced from turbo's releases.

Turborepo v2.11.10

What's Changed

Changelog

Full Changelog: vercel/turborepo@v2.11.9...v2.11.10

Turborepo v2.11.9

What's Changed

Changelog

... (truncated)

Commits
  • e521641 publish 2.11.10 to registry
  • aaf5a3a fix: Distrust compromised eMudhra intermediate certificates (#14876)
  • 9816503 fix: Exit quietly when turbo ls output is piped to a closed reader (#14868)
  • af866e5 feat: Enable WebMCP for Turborepo docs (#14828)
  • b42cc68 chore: Remove CODEOWNERS file (#14810)
  • 921155f fix: Restore cached symlinks when outputs are already on disk (#14807)
  • 9330903 docs: Generate the sitemap from Geistdocs sources (#14865)
  • 6048038 fix: Keep task env vars in the hash when globalEnv excludes inferred vars (#1...
  • 57ecce3 fix: Parse pnpm 8 single-project lockfiles (#14806)
  • d926d6a fix: Match package configuration files and directory inputs in task-level aff...
  • Additional commits viewable in compare view

Updates @sentry/node from 11.0.0 to 11.9.0

Release notes

Sourced from @​sentry/node's releases.

11.9.0

Important Changes

  • feat: Rename diagnostic_channel, fetch and gRPC span origins (#25601)

    Some span origins changed their names to match the other v11 origins:

    • auto.graphql.diagnostic_channel is now auto.graphql.graphql.
    • auto.db.redis.diagnostic_channel, auto.db.mysql2.diagnostic_channel and auto.db.mongoose.diagnostic_channel now end in .native_channel.
    • auto.http.wintercg_fetch is now auto.http.fetch, as on Bun, Deno and Cloudflare.
    • auto.grpc.serverless is now auto.grpc.google_cloud.

    If you have ignoreSpans rules, queries or alerts on the old origins, change them to use the new origins.

  • feat(deno): Add incoming request options to denoServeIntegration (#25493)

    denoServeIntegration now accepts ignoreRequestBody, ignoreIncomingRequests, ignoreStaticAssets, spans, onSpanCreated and onSpanEnd, with the same meaning as in denoHttpIntegration. The callbacks receive the web Request.

    ignoreStaticAssets defaults to true, so Deno.serve no longer creates spans for GET requests to common static assets such as favicon.ico, robots.txt or *.js files. To keep these spans, set denoServeIntegration({ ignoreStaticAssets: false }). Deno.serve spans also follow the client's tracing configuration by default, so the integration does not start spans when tracing is disabled.

  • feat(deno): Record request sessions for Deno.serve (#25496)

    denoServeIntegration now records a request session for each incoming request, as denoHttpIntegration does for node:http. This gives release health and crash-free rates for Deno.serve apps. Sessions are sent only when a release is set. To turn them off, set denoServeIntegration({ sessions: false }). sessionFlushingDelayMS sets how long the SDK waits before it sends the session aggregate.

  • feat(deno): Register channel injection hooks from init() (#25546)

    Sentry.init() in @sentry/deno now registers the diagnostics-channel injection hooks, as @sentry/node does. The channel integrations now record spans without --preload=npm:@sentry/deno/import, for modules that you import after init(). To also instrument modules that load before init(), such as static imports in your entry module, keep the preload. With debug: true, the SDK logs a warning when no injection is active.

    On Node.js, tracing-hooks messages now show with debug: true instead of with DEBUG=@apm-js-collab/*.

  • feat(nextjs): Add a tunnel route handler that sends only the event payload to Sentry (#25456)

    The tunnelRoute option can now send events through a route handler in your app. The handler forwards only the event payload to Sentry, and no request headers. To use it, add this file next to your tunnelRoute option:

    // app/sentry-tunnel/route.ts (or src/app/sentry-tunnel/route.ts)
export { POST } from '@sentry/nextjs/tunnel';

    The handler accepts events for the DSN of your server SDK. To accept other DSNs, use createSentryTunnelRoute({ allowedDsns }) from the same import. Without the file, the tunnel route works as before.

    Also, the server no longer sends spans of tunnel requests when span streaming is on, because these spans only show the SDK's own traffic.

  • feat(nextjs): Never emit trace meta tags from a prerender (#25141)

    Pageloads of apps with cacheComponents enabled are connected to their server request again. Pages that Next.js prerenders no longer carry trace information, so a cached page can no longer connect visitors to a request that was not theirs. This also applies to ISR pages. The pageload waits for the trace information when it arrives with the part of the page that streams in after a cached shell.

    If you set up OpenTelemetry yourself and register SentryPropagator, register NextSentryPropagator instead and pass your tracer provider to markPrerendersOnTracerProvider, so that your prerendered pages carry no trace information either.

  • feat(nextjs): Send tunnel route requests with credentials: 'omit' (#25509)

... (truncated)

Changelog

Sourced from @​sentry/node's changelog.

11.9.0

Important Changes

  • feat: Rename diagnostic_channel, fetch and gRPC span origins (#25601)

    Some span origins changed their names to match the other v11 origins:

    • auto.graphql.diagnostic_channel is now auto.graphql.graphql.
    • auto.db.redis.diagnostic_channel, auto.db.mysql2.diagnostic_channel and auto.db.mongoose.diagnostic_channel now end in .native_channel.
    • auto.http.wintercg_fetch is now auto.http.fetch, as on Bun, Deno and Cloudflare.
    • auto.grpc.serverless is now auto.grpc.google_cloud.

    If you have ignoreSpans rules, queries or alerts on the old origins, change them to use the new origins.

  • feat(deno): Add incoming request options to denoServeIntegration (#25493)

    denoServeIntegration now accepts ignoreRequestBody, ignoreIncomingRequests, ignoreStaticAssets, spans, onSpanCreated and onSpanEnd, with the same meaning as in denoHttpIntegration. The callbacks receive the web Request.

    ignoreStaticAssets defaults to true, so Deno.serve no longer creates spans for GET requests to common static assets such as favicon.ico, robots.txt or *.js files. To keep these spans, set denoServeIntegration({ ignoreStaticAssets: false }). Deno.serve spans also follow the client's tracing configuration by default, so the integration does not start spans when tracing is disabled.

  • feat(deno): Record request sessions for Deno.serve (#25496)

    denoServeIntegration now records a request session for each incoming request, as denoHttpIntegration does for node:http. This gives release health and crash-free rates for Deno.serve apps. Sessions are sent only when a release is set. To turn them off, set denoServeIntegration({ sessions: false }). sessionFlushingDelayMS sets how long the SDK waits before it sends the session aggregate.

  • feat(deno): Register channel injection hooks from init() (#25546)

    Sentry.init() in @sentry/deno now registers the diagnostics-channel injection hooks, as @sentry/node does. The channel integrations now record spans without --preload=npm:@sentry/deno/import, for modules that you import after init(). To also instrument modules that load before init(), such as static imports in your entry module, keep the preload. With debug: true, the SDK logs a warning when no injection is active.

    On Node.js, tracing-hooks messages now show with debug: true instead of with DEBUG=@apm-js-collab/*.

  • feat(nextjs): Add a tunnel route handler that sends only the event payload to Sentry (#25456)

    The tunnelRoute option can now send events through a route handler in your app. The handler forwards only the event payload to Sentry, and no request headers. To use it, add this file next to your tunnelRoute option:

    // app/sentry-tunnel/route.ts (or src/app/sentry-tunnel/route.ts)
export { POST } from '@sentry/nextjs/tunnel';

    The handler accepts events for the DSN of your server SDK. To accept other DSNs, use createSentryTunnelRoute({ allowedDsns }) from the same import. Without the file, the tunnel route works as before.

    Also, the server no longer sends spans of tunnel requests when span streaming is on, because these spans only show the SDK's own traffic.

  • feat(nextjs): Never emit trace meta tags from a prerender (#25141)

    Pageloads of apps with cacheComponents enabled are connected to their server request again. Pages that Next.js prerenders no longer carry trace information, so a cached page can no longer connect visitors to a request that was not theirs. This also applies to ISR pages. The pageload waits for the trace information when it arrives with the part of the page that streams in after a cached shell.

    If you set up OpenTelemetry yourself and register SentryPropagator, register NextSentryPropagator instead and pass your tracer provider to markPrerendersOnTracerProvider, so that your prerendered pages carry no trace information either.

  • feat(nextjs): Send tunnel route requests with credentials: 'omit' (#25509)

... (truncated)

Commits
  • 7b8ce4f meta(changelog): Add cherry-picked PRs to 11.9.0 changelog
  • 487097d ci: Stop uploading duplicate tarballs to the release artifact (#25688)
  • 1276d41 fix(deps): Allow @opentelemetry/api 1.9 again (#25684)
  • c74f77f test(nextjs): Bump nextjs-16 E2E app to Next.js 16.4.2 (#25686)
  • 47dec2a release: 11.9.0
  • cc40f95 Merge pull request #25628 from getsentry/prepare-release/11.9.0
  • 4689484 meta(changelog): Update changelog for 11.9.0
  • b94aeb0 fix(hono): Read connection info from the runtime instead of Hono helpers (#25...
  • ded8524 test(e2e): Retry tests in all dev-mode variants (#25640)
  • 24186f0 feat: Rename diagnostic_channel, fetch and gRPC span origins (#25601)
  • Additional commits viewable in compare view

Updates lucide-react from 1.48.0 to 1.61.0

Release notes

Sourced from lucide-react's releases.

Version 1.61.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.60.0...1.61.0

Version 1.60.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.59.0...1.60.0

Version 1.59.0

What's Changed

Full Changelog: lucide-icons/lucide@1.58.0...1.59.0

Version 1.58.0

What's Changed

... (truncated)

Commits
  • fa238cf chore(deps): bump the react-deps group across 1 directory with 2 updates (#5026)
  • 3f1255e chore(deps-dev): bump @​vitejs/plugin-react (#4995)
  • 949bc6d test(lucide-react): add tests for DynamicIcon fallback and ref forwarding (#4...
  • 98331e2 chore(deps): bump the react-deps group across 1 directory with 3 updates (#4951)
  • 09aa9c5 chore(deps): Upgrade to vite 8 (#4950)
  • e042fec fix(packages): declare @types/react as an optional peer dependency (#4892)
  • See full diff in compare view

Updates posthog-js from 1.434.15 to 1.438.21

Release notes

Sourced from posthog-js's releases.

posthog-js@1.438.21

1.438.21

Patch Changes

  • #5346 f91145d Thanks @​sebxt! - Reject a prefilled survey rating of 0 on rating scales that start at 1. (2026-10-23)

  • #5399 02616e1 Thanks @​ARXHHHH! - Ship the IE11 Math.trunc and Number.isInteger polyfills only in array.full.es5.js, so the modern bundles no longer trigger Lighthouse's "Legacy JavaScript" audit. (2026-10-23)

  • Updated dependencies [f827137, f91145d, 02616e1]:

    • @​posthog/core@​1.60.1
    • @​posthog/browser-common@​0.9.11

posthog-js@1.438.20

1.438.20

Patch Changes

  • #5292 d73e6c7 Thanks @​sarmah-rup! - Read query params with form-encoding rules: an encoded plus (%2B) is kept as + instead of becoming a space, and values that contain = are no longer cut off. This fixes UTM, click ID and search keyword properties such as utm_term=c%2B%2B. (2026-10-23)
  • Updated dependencies [d73e6c7]:
    • @​posthog/browser-common@​0.9.10

posthog-js@1.438.19

1.438.19

Patch Changes

  • #4994 bcd33ce Thanks @​dustinbyrne! - Share autocapture across browser SDKs while preserving existing event capture behavior. (2026-10-22)
  • Updated dependencies [bcd33ce]:
    • @​posthog/browser-common@​0.9.9

posthog-js@1.438.18

1.438.18

Patch Changes

  • #5189 2aacdcb Thanks @​posthog! - Log why capture() dropped an event (capturing disabled or a bot user agent) when debug: true is set (2026-10-22)

  • #5383 0faf643 Thanks @​sarankumar1325! - Conversations: the widget now comes back after reset(), and after a cookieless (on_reject) visitor calls opt_in_capturing(), instead of staying unavailable until the next page load. (2026-10-22)

posthog-js@1.438.17

1.438.17

Patch Changes

... (truncated)

Commits
  • a0b18d4 chore: update versions and lockfile [version bump]
  • f827137 fix(flags): fall back for incompatible local regex matching (#5354)
  • faacff0 fix(aio): keep content out of ai events in privacy mode (#5385)
  • 02616e1 fix(browser): ship uuidv7 polyfills only in the es5 bundle (#5399)
  • d778694 fix(examples): use gpt-image-2.5-flare in the OpenAI image generation example...
  • c481b82 ci(release): name excluded approvers in the Slack approval request (#5379)
  • 997d4ff feat(react-native): attach $recording_status and $sdk_debug_* to captured eve...
  • f91145d fix(surveys): reject a prefilled rating of 0 on scales that start at 1 (#5346)
  • e291b87 chore: update versions and lockfile [version bump]
  • 13c21ae docs: require signed commits in contributor docs (#5394)
  • Additional commits viewable in compare view

Updates @modelcontextprotocol/sdk from 1.32.1 to 1.32.2

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.32.2

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@1.32.1...1.32.2

Commits
  • 3b73021 chore: bump version to 1.32.2 (#3089)
  • fa56d81 [v1.x] fix: allow registering after connect() when the capability was declare...
  • 6919e95 fix: add explicit | undefined to Transport optional properties (v1.x backport...
  • See full diff in compare view

Updates @posthog/react from 1.11.2 to 1.11.3

Changelog

Sourced from @​posthog/react's changelog.

1.11.3

Patch Changes

  • #5120 5929eab Thanks @​breken-ai! - PostHogFeature without match shows the fallback when the flag evaluates to false. (2026-09-29)
  • Updated dependencies [5929eab]:
    • posthog-js@1.435.1
Commits
  • 666d109 chore: update versions and lockfile [version bump]
  • 5929eab fix(react): show PostHogFeature fallback when the flag evaluates to false (#5...
  • 48cca33 test(browser): strengthen browser and React test coverage (#5123)
  • See full diff in compare view

Updates @sentry/tanstackstart-react from 11.0.0 to 11.9.0

Release notes

Sourced from @​sentry/tanstackstart-react's releases.

11.9.0

Important Changes

  • feat: Rename diagnostic_channel, fetch and gRPC span origins (#25601)

    Some span origins changed their names to match the other v11 origins:

    • auto.graphql.diagnostic_channel is now auto.graphql.graphql.
    • auto.db.redis.diagnostic_channel, auto.db.mysql2.diagnostic_channel and auto.db.mongoose.diagnostic_channel now end in .native_channel.
    • auto.http.wintercg_fetch is now auto.http.fetch, as on Bun, Deno and Cloudflare.
    • auto.grpc.serverless is now auto.grpc.google_cloud.

    If you have ignoreSpans rules, queries or alerts on the old origins, change them to use the new origins.

  • feat(deno): Add incoming request options to denoServeIntegration (#25493)

    denoServeIntegration now accepts ignoreRequestBody, ignoreIncomingRequests, ignoreStaticAssets, spans, onSpanCreated and onSpanEnd, with the same meaning as in denoHttpIntegration. The callbacks receive the web Request.

    ignoreStaticAssets defaults to true, so Deno.serve no longer creates spans for GET requests to common static assets such as favicon.ico, robots.txt or *.js files. To keep these spans, set denoServeIntegration({ ignoreStaticAssets: false }). Deno.serve spans also follow the client's tracing configuration by default, so the integration does not start spans when tracing is disabled.

  • feat(deno): Record request sessions for Deno.serve (#25496)

    denoServeIntegration now records a request session for each incoming request, as denoHttpIntegration does for node:http. This gives release health and crash-free rates for Deno.serve apps. Sessions are sent only when a release is set. To turn them off, set denoServeIntegration({ sessions: false }). sessionFlushingDelayMS sets how long the SDK waits before it sends the session aggregate.

  • feat(deno): Register channel injection hooks from init() (#25546)

    Sentry.init() in @sentry/deno now registers the diagnostics-channel injection hooks, as @sentry/node does. The channel integrations now record spans without --preload=npm:@sentry/deno/import, for modules that you import after init(). To also instrument modules that load before init(), such as static imports in your entry module, keep the preload. With debug: true, the SDK logs a warning when no injection is active.

    On Node.js, tracing-hooks messages now show with debug: true instead of with DEBUG=@apm-js-collab/*.

  • feat(nextjs): Add a tunnel route handler that sends only the event payload to Sentry (#25456)

    The tunnelRoute option can now send events through a route handler in your app. The handler forwards only the event payload to Sentry, and no request headers. To use it, add this file next to your tunnelRoute option:

    // app/sentry-tunnel/route.ts (or src/app/sentry-tunnel/route.ts)
export { POST } from '@sentry/nextjs/tunnel';

    The handler accepts events for the DSN of your server SDK. To accept other DSNs, use createSentryTunnelRoute({ allowedDsns }) from the same import. Without the file, the tunnel route works as before.

    Also, the server no longer sends spans of tunnel requests when span streaming is on, because these spans only show the SDK's own traffic.

  • feat(nextjs): Never emit trace meta tags from a prerender (#25141)

    Pageloads of apps with cacheComponents enabled are connected to their server request again. Pages that Next.js prerenders no longer carry trace information, so a cached page can no longer connect visitors to a request that was not theirs. This also applies to ISR pages. The pageload waits for the trace information when it arrives with the part of the page that streams in after a cached shell.

    If you set up OpenTelemetry yourself and register SentryPropagator, register NextSentryPropagator instead and pass your tracer provider to markPrerendersOnTracerProvider, so that your prerendered pages carry no trace information either.

  • feat(nextjs): Send tunnel route requests with credentials: 'omit' (#25509)

... (truncated)

Changelog

Sourced from @​sentry/tanstackstart-react's changelog.

11.9.0

Important Changes

  • feat: Rename diagnostic_channel, fetch and gRPC span origins (#25601)

    Some span origins changed their names to match the other v11 origins:

    • auto.graphql.diagnostic_channel is now auto.graphql.graphql.
    • auto.db.redis.diagnostic_channel, auto.db.mysql2.diagnostic_channel and auto.db.mongoose.diagnostic_channel now end in .native_channel.
    • auto.http.wintercg_fetch is now auto.http.fetch, as on Bun, Deno and Cloudflare.
    • auto.grpc.serverless is now auto.grpc.google_cloud.

    If you have ignoreSpans rules, queries or alerts on the old origins, change them to use the new origins.

  • feat(deno): Add incoming request options to denoServeIntegration (#25493)

    denoServeIntegration now accepts ignoreRequestBody, ignoreIncomingRequests, ignoreStaticAssets, spans, onSpanCreated and onSpanEnd, with the same meaning as in denoHttpIntegration. The callbacks receive the web Request.

    ignoreStaticAssets defaults to true, so Deno.serve no longer creates spans for GET requests to common static assets such as favicon.ico, robots.txt or *.js files. To keep these spans, set denoServeIntegration({ ignoreStaticAssets: false }). Deno.serve spans also follow the client's tracing configuration by default, so the integration does not start spans when tracing is disabled.

  • feat(deno): Record request sessions for Deno.serve (#25496)

    denoServeIntegration now records a request session for each incoming request, as denoHttpIntegration does for node:http. This gives release health and crash-free rates for Deno.serve apps. Sessions are sent only when a release is set. To turn them off, set denoServeIntegration({ sessions: false }). sessionFlushingDelayMS sets how long the SDK waits before it sends the session aggregate.

  • feat(deno): Register channel injection hooks from init() (#25546)

    Sentry.init() in @sentry/deno now registers the diagnostics-channel injection hooks, as @sentry/node does. The channel integrations now record spans without --preload=npm:@sentry/deno/import, for modules that you import after init(). To also instrument modules that load before init(), such as static imports in your entry module, keep the preload. With debug: true, the SDK logs a warning when no injection is active.

    On Node.js, tracing-hooks messages now show with debug: true instead of with DEBUG=@apm-js-collab/*.

  • feat(nextjs): Add a tunnel route handler that sends only the event payload to Sentry (#25456)

    The tunnelRoute option can now send events through a route handler in your app. The handler forwards only the event payload to Sentry, and no request headers. To use it, add this file next to your tunnelRoute option:

    // app/sentry-tunnel/route.ts (or src/app/sentry-tunnel/route.ts)
export { POST } from '@sentry/nextjs/tunnel';

    The handler accepts events for the DSN of your server SDK. To accept other DSNs, use createSentryTunnelRoute({ allowedDsns }) from the same import. Without the file, the tunnel route works as before.

    Also, the server no longer sends spans of tunnel requests when span streaming is on, because these spans only show the SDK's own traffic.

  • feat(nextjs): Never emit trace meta tags from a prerender (#25141)

    Pageloads of apps with cacheComponents enabled are connected to their server request again. Pages that Next.js prerenders no longer carry trace information, so a cached page can no longer connect visitors to a request that was not theirs. This also applies to ISR pages. The pageload waits for the trace information when it arrives with the part of the page that streams in after a cached shell.

    If you set up OpenTelemetry yourself and register SentryPropagator, register NextSentryPropagator instead and pass your tracer provider to markPrerendersOnTracerProvider, so that your prerendered pages carry no trace information either.

  • feat(nextjs): Send tunnel route requests with credentials: 'omit' (#25509)

... (truncated)

Commits
  • 7b8ce4f meta(changelog): Add cherry-picked PRs to 11.9.0 changelog
  • 487097d ci: Stop uploading duplicate tarballs to the release artifact (#25688)
  • 1276d41 fix(deps): Allow @opentelemetry/api 1.9 again (#25684)
  • c74f77f test(nextjs): Bump nextjs-16 E2E app to Next.js 16.4.2 (#25686)
  • 47dec2a release: 11.9.0
  • cc40f95 Merge pull request #25628 from getsentry/prepare-release/11.9.0
  • 4689484 meta(changelog): Update changelog for 11.9.0
  • b94aeb0 fix(hono): Read connection info from the runtime instead of Hono helpers (#25...
  • ded8524 test(e2e): Retry tests in all dev-mode variants (

@dependabot
chore: bump the npm group across 1 directory with 30 updates
a1464ec 
Bumps the npm group with 30 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [turbo](https://github.com/vercel/turborepo) | `2.11.4` | `2.11.10` |
| [@sentry/node](https://github.com/getsentry/sentry-javascript) | `11.0.0` | `11.9.0` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.48.0` | `1.61.0` |
| [posthog-js](https://github.com/PostHog/posthog-js) | `1.434.15` | `1.438.21` |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.32.1` | `1.32.2` |
| [@posthog/react](https://github.com/PostHog/posthog-js/tree/HEAD/packages/react) | `1.11.2` | `1.11.3` |
| [@sentry/tanstackstart-react](https://github.com/getsentry/sentry-javascript) | `11.0.0` | `11.9.0` |
| [motion](https://github.com/motiondivision/motion) | `14.0.0` | `14.6.0` |
| [satori](https://github.com/vercel/satori) | `0.35.0` | `0.63.2` |
| [@tanstack/react-query-devtools](https://github.com/TanStack/query/tree/HEAD/packages/react-query-devtools) | `5.104.0` | `5.104.5` |
| [@types/pdfkit](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/pdfkit) | `0.17.6` | `0.17.7` |
| [@react-three/fiber](https://github.com/pmndrs/react-three-fiber) | `9.8.1` | `9.8.2` |
| [@tanstack/react-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual) | `3.14.17` | `3.14.22` |
| [@astryxdesign/core](https://github.com/facebook/astryx/tree/HEAD/packages/core) | `0.7.1` | `0.7.4` |
| [@astryxdesign/theme-neutral](https://github.com/facebook/astryx/tree/HEAD/packages/themes/neutral) | `0.7.1` | `0.7.4` |
| [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1141.0` | `3.1156.0` |
| [@axe-core/playwright](https://github.com/dequelabs/axe-core-npm) | `4.13.0` | `4.14.0` |
| [@electric-sql/pglite](https://github.com/electric-sql/pglite/tree/HEAD/packages/pglite) | `0.5.8` | `0.5.11` |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.63.0` | `1.64.1` |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.104.0` | `5.104.5` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `24.13.6` | `24.19.2` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.1.1` | `6.1.2` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `5.0.1` | `5.0.5` |
| [drizzle-orm](https://github.com/drizzle-team/drizzle-orm) | `0.45.3` | `0.45.4` |
| [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.85.0` | `1.89.0` |
| [pg-boss](https://github.com/timgit/pg-boss) | `12.35.0` | `12.38.0` |
| [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.23.0` | `8.23.1` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.3.0` | `19.3.1` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.3.0` | `19.3.1` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.1` | `5.0.5` |



Updates `turbo` from 2.11.4 to 2.11.10
- [Release notes](https://github.com/vercel/turborepo/releases)
- [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md)
- [Commits](vercel/turborepo@v2.11.4...v2.11.10)

Updates `@sentry/node` from 11.0.0 to 11.9.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@11.0.0...11.9.0)

Updates `lucide-react` from 1.48.0 to 1.61.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.61.0/packages/lucide-react)

Updates `posthog-js` from 1.434.15 to 1.438.21
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.434.15...posthog-js@1.438.21)

Updates `@modelcontextprotocol/sdk` from 1.32.1 to 1.32.2
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@1.32.1...1.32.2)

Updates `@posthog/react` from 1.11.2 to 1.11.3
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/react/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/commits/@posthog/react@1.11.3/packages/react)

Updates `@sentry/tanstackstart-react` from 11.0.0 to 11.9.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@11.0.0...11.9.0)

Updates `motion` from 14.0.0 to 14.6.0
- [Changelog](https://github.com/motiondivision/motion/blob/main/CHANGELOG.md)
- [Commits](motiondivision/motion@v14.0.0...v14.6.0)

Updates `satori` from 0.35.0 to 0.63.2
- [Release notes](https://github.com/vercel/satori/releases)
- [Commits](vercel/satori@0.35.0...0.63.2)

Updates `@tanstack/react-query-devtools` from 5.104.0 to 5.104.5
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query-devtools/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query-devtools@5.104.5/packages/react-query-devtools)

Updates `@types/pdfkit` from 0.17.6 to 0.17.7
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/pdfkit)

Updates `@react-three/fiber` from 9.8.1 to 9.8.2
- [Release notes](https://github.com/pmndrs/react-three-fiber/releases)
- [Commits](pmndrs/react-three-fiber@v9.8.1...v9.8.2)

Updates `@tanstack/react-virtual` from 3.14.17 to 3.14.22
- [Release notes](https://github.com/TanStack/virtual/releases)
- [Changelog](https://github.com/TanStack/virtual/blob/main/packages/react-virtual/CHANGELOG.md)
- [Commits](https://github.com/TanStack/virtual/commits/@tanstack/react-virtual@3.14.22/packages/react-virtual)

Updates `@astryxdesign/core` from 0.7.1 to 0.7.4
- [Release notes](https://github.com/facebook/astryx/releases)
- [Changelog](https://github.com/facebook/astryx/blob/main/packages/core/CHANGELOG.md)
- [Commits](https://github.com/facebook/astryx/commits/v0.7.4/packages/core)

Updates `@astryxdesign/theme-neutral` from 0.7.1 to 0.7.4
- [Release notes](https://github.com/facebook/astryx/releases)
- [Changelog](https://github.com/facebook/astryx/blob/main/packages/themes/neutral/CHANGELOG.md)
- [Commits](https://github.com/facebook/astryx/commits/v0.7.4/packages/themes/neutral)

Updates `@aws-sdk/client-s3` from 3.1141.0 to 3.1156.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1156.0/clients/client-s3)

Updates `@axe-core/playwright` from 4.13.0 to 4.14.0
- [Release notes](https://github.com/dequelabs/axe-core-npm/releases)
- [Changelog](https://github.com/dequelabs/axe-core-npm/blob/develop/CHANGELOG.md)
- [Commits](dequelabs/axe-core-npm@v4.13.0...v4.14.0)

Updates `@electric-sql/pglite` from 0.5.8 to 0.5.11
- [Release notes](https://github.com/electric-sql/pglite/releases)
- [Changelog](https://github.com/electric-sql/pglite/blob/main/packages/pglite/CHANGELOG.md)
- [Commits](https://github.com/electric-sql/pglite/commits/@electric-sql/pglite@0.5.11/packages/pglite)

Updates `@playwright/test` from 1.63.0 to 1.64.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.63.0...v1.64.1)

Updates `@tanstack/react-query` from 5.104.0 to 5.104.5
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.104.5/packages/react-query)

Updates `@types/node` from 24.13.6 to 24.19.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@vitejs/plugin-react` from 6.1.1 to 6.1.2
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.2/packages/plugin-react)

Updates `@vitest/coverage-v8` from 5.0.1 to 5.0.5
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/coverage-v8)

Updates `drizzle-orm` from 0.45.3 to 0.45.4
- [Release notes](https://github.com/drizzle-team/drizzle-orm/releases)
- [Commits](drizzle-team/drizzle-orm@0.45.3...0.45.4)

Updates `oxlint` from 1.85.0 to 1.89.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.89.0/npm/oxlint)

Updates `pg-boss` from 12.35.0 to 12.38.0
- [Release notes](https://github.com/timgit/pg-boss/releases)
- [Commits](timgit/pg-boss@12.35.0...12.38.0)

Updates `pg` from 8.23.0 to 8.23.1
- [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md)
- [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.1/packages/pg)

Updates `react-dom` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom)

Updates `react` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react)

Updates `vitest` from 5.0.1 to 5.0.5
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/vitest)

---
updated-dependencies:
- dependency-name: turbo
  dependency-version: 2.11.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@sentry/node"
  dependency-version: 11.9.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: lucide-react
  dependency-version: 1.61.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: posthog-js
  dependency-version: 1.438.21
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.32.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@posthog/react"
  dependency-version: 1.11.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@sentry/tanstackstart-react"
  dependency-version: 11.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: motion
  dependency-version: 14.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: satori
  dependency-version: 0.63.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@tanstack/react-query-devtools"
  dependency-version: 5.104.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@types/pdfkit"
  dependency-version: 0.17.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@react-three/fiber"
  dependency-version: 9.8.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@tanstack/react-virtual"
  dependency-version: 3.14.22
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@astryxdesign/core"
  dependency-version: 0.7.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@astryxdesign/theme-neutral"
  dependency-version: 0.7.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@aws-sdk/client-s3"
  dependency-version: 3.1156.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@axe-core/playwright"
  dependency-version: 4.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@electric-sql/pglite"
  dependency-version: 0.5.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@playwright/test"
  dependency-version: 1.64.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.104.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@types/node"
  dependency-version: 24.19.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 5.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: drizzle-orm
  dependency-version: 0.45.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: oxlint
  dependency-version: 1.89.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: pg-boss
  dependency-version: 12.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: pg
  dependency-version: 8.23.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: react-dom
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: react
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: vitest
  dependency-version: 5.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants