deps: bump the dependencies-minor group across 1 directory with 13 updates #22
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?s=80&v=4){kind=small}
…dates Bumps the dependencies-minor group with 13 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@fontsource-variable/figtree](https://github.com/fontsource/font-files/tree/HEAD/fonts/variable/figtree) | `5.2.9` | `5.2.10` | | [@fontsource/ibm-plex-mono](https://github.com/fontsource/font-files/tree/HEAD/fonts/google/ibm-plex-mono) | `5.2.6` | `5.2.7` | | [@oddbird/css-anchor-positioning](https://github.com/oddbird/css-anchor-positioning) | `0.6.1` | `0.7.0` | | [next](https://github.com/vercel/next.js) | `15.5.3` | `15.5.4` | | [react](https://github.com/facebook/react/tree/HEAD/packages/react) | `19.1.1` | `19.2.0` | | [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.1.13` | `19.2.2` | | [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) | `19.1.1` | `19.2.0` | | [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.1.9` | `19.2.1` | | [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.62.0` | `7.64.0` | | [zod](https://github.com/colinhacks/zod) | `4.1.8` | `4.1.12` | | [@playwright/test](https://github.com/microsoft/playwright) | `1.55.0` | `1.56.0` | | [sass](https://github.com/sass/dart-sass) | `1.92.1` | `1.93.2` | | [typescript](https://github.com/microsoft/TypeScript) | `5.9.2` | `5.9.3` | Updates `@fontsource-variable/figtree` from 5.2.9 to 5.2.10 - [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md) - [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/variable/figtree) Updates `@fontsource/ibm-plex-mono` from 5.2.6 to 5.2.7 - [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md) - [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/google/ibm-plex-mono) Updates `@oddbird/css-anchor-positioning` from 0.6.1 to 0.7.0 - [Release notes](https://github.com/oddbird/css-anchor-positioning/releases) - [Changelog](https://github.com/oddbird/css-anchor-positioning/blob/main/CHANGELOG.md) - [Commits](oddbird/css-anchor-positioning@v0.6.1...v0.7.0) Updates `next` from 15.5.3 to 15.5.4 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v15.5.3...v15.5.4) Updates `react` from 19.1.1 to 19.2.0 - [Release notes](https://github.com/facebook/react/releases) - [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/react/commits/v19.2.0/packages/react) Updates `@types/react` from 19.1.13 to 19.2.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `react-dom` from 19.1.1 to 19.2.0 - [Release notes](https://github.com/facebook/react/releases) - [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/react/commits/v19.2.0/packages/react-dom) Updates `@types/react-dom` from 19.1.9 to 19.2.1 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom) Updates `react-hook-form` from 7.62.0 to 7.64.0 - [Release notes](https://github.com/react-hook-form/react-hook-form/releases) - [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md) - [Commits](react-hook-form/react-hook-form@v7.62.0...v7.64.0) Updates `zod` from 4.1.8 to 4.1.12 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.1.8...v4.1.12) Updates `@playwright/test` from 1.55.0 to 1.56.0 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.55.0...v1.56.0) Updates `@types/react` from 19.1.13 to 19.2.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `@types/react-dom` from 19.1.9 to 19.2.1 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom) Updates `sass` from 1.92.1 to 1.93.2 - [Release notes](https://github.com/sass/dart-sass/releases) - [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md) - [Commits](sass/dart-sass@1.92.1...1.93.2) Updates `typescript` from 5.9.2 to 5.9.3 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Changelog](https://github.com/microsoft/TypeScript/blob/main/azure-pipelines.release-publish.yml) - [Commits](microsoft/TypeScript@v5.9.2...v5.9.3) --- updated-dependencies: - dependency-name: "@fontsource-variable/figtree" dependency-version: 5.2.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies-minor - dependency-name: "@fontsource/ibm-plex-mono" dependency-version: 5.2.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies-minor - dependency-name: "@oddbird/css-anchor-positioning" dependency-version: 0.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies-minor - dependency-name: next dependency-version: 15.5.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies-minor - dependency-name: react dependency-version: 19.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies-minor - dependency-name: "@types/react" dependency-version: 19.2.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies-minor - dependency-name: react-dom dependency-version: 19.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies-minor - dependency-name: "@types/react-dom" dependency-version: 19.2.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies-minor - dependency-name: react-hook-form dependency-version: 7.64.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies-minor - dependency-name: zod dependency-version: 4.1.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies-minor - dependency-name: "@playwright/test" dependency-version: 1.56.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies-minor - dependency-name: "@types/react" dependency-version: 19.2.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies-minor - dependency-name: "@types/react-dom" dependency-version: 19.2.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies-minor - dependency-name: sass dependency-version: 1.93.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies-minor - dependency-name: typescript dependency-version: 5.9.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
dependencies
|
|
Needs ReviewI recommend reviewing this upgrade before merging because it includes a critical security vulnerability fix and potential breaking changes. The upgrade addresses CVE-2025-29927 (authorization bypass in Next.js middleware) and updates React to version 19.2.0 which changes the useId prefix format and requires Node.js 18+. While the project already meets the Node.js 18 requirement (specified as >=20 in package.json line 18), and the codebase doesn't appear to use deprecated React APIs or the useId hook, the middleware implementation should be reviewed to ensure it properly handles the security fix and the upgrade should be tested thoroughly to verify compatibility with Next.js 15.5.4 and React 19.2.0. What we checked
Dependency Usage
View 44 more usages
Other Usages (46)These usages were analyzed but no breaking changes were detected: next
react
react-hook-form zod @playwright/test ChangesReact and React DOM upgraded with breaking changes requiring Node.js 18+ and migrating from legacy to flat ESLint config, while introducing new APIs including
View 170 more changes
References (7)[1]: Next.js upgraded to 15.5.4 which includes a fix for CVE-2025-29927, a critical authorization bypass vulnerability where attackers could skip middleware using the x-middleware-subrequest header example-nextjs-c24a0/package.json Line 39 in c86a6af [2]: Middleware implementation uses nosecone.createMiddleware which may be affected by the Next.js security fix - requires testing to ensure middleware continues to properly protect routes example-nextjs-c24a0/middleware.ts Line 40 in c86a6af [3]: React upgraded to 19.2.0 which changes useId prefix from :r: to r for View Transitions and XML compliance - may affect component hydration if useId is used example-nextjs-c24a0/package.json Line 42 in c86a6af [4]: Project requires Node.js >=20 which satisfies React 19.2.0's requirement of Node.js 18+, avoiding breaking change impact example-nextjs-c24a0/package.json Line 18 in c86a6af [5]: Dockerfile uses Node 24 which is compatible with the upgraded dependencies example-nextjs-c24a0/Dockerfile Line 1 in c86a6af [6]: React 19 migration guide documents removal of propTypes, defaultProps, Legacy Context, and string refs - codebase review shows no usage of these deprecated APIs (source link) [7]: React 19.2.0 release notes document useId prefix change which could affect server-side rendering hydration if useId is used in the codebase (source link) fossabot analyzed this PR using static analysis and dependency research. |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Bumps the dependencies-minor group with 13 updates in the / directory:
5.2.95.2.105.2.65.2.70.6.10.7.015.5.315.5.419.1.119.2.019.1.1319.2.219.1.119.2.019.1.919.2.17.62.07.64.04.1.84.1.121.55.01.56.01.92.11.93.25.9.25.9.3Updates
@fontsource-variable/figtreefrom 5.2.9 to 5.2.10Commits
Updates
@fontsource/ibm-plex-monofrom 5.2.6 to 5.2.7Commits
Updates
@oddbird/css-anchor-positioningfrom 0.6.1 to 0.7.0Release notes
Sourced from
@oddbird/css-anchor-positioning's releases.Commits
40f3a89v0.7.0db16313Work with anchor and target inside same shadow root (#353)b18b8edMerge pull request #352 from oddbird/dependabot/npm_and_yarn/dev-9d451710aaea505c5Merge pull request #351 from oddbird/dependabot/npm_and_yarn/prod-8404f4c51fd4bbb67chore(deps-dev): Bump the dev group with 13 updatesae3512fchore(deps): Bump the prod group with 2 updates2f9b4c5Merge pull request #348 from oddbird/dependabot/npm_and_yarn/npm_and_yarn-f5c...98ccee3chore(deps-dev): Bump vite in the npm_and_yarn group across 1 directory15ebcc0Merge pull request #346 from oddbird/dependabot/github_actions/actions/setup-...2cc99a6Merge pull request #347 from oddbird/dependabot/github_actions/actions/setup-...Updates
nextfrom 15.5.3 to 15.5.4Release notes
Sourced from next's releases.
Commits
40f1d78v15.5.4cb30f0a[backport] docs: september improvements and fixes (#83997)b6a32bb[backport] [CNA] use linter preference (#83194) (#84087)26d61f1[backport] Turbopack: flush Node.js worker IPC on error (#84079)e11e87a[backport] fix: error overlay not closing when backdrop clicked (#83981) (#83...0a29888[backport] fix: devtools initial position should be from next config (#83571)...7a53950[backport] Turbopack: don't treat metadata routes as RSC (#83804)050bdf1[backport] Turbopack: throw large static metadata error earlier (#83816)1f6ea09[backport] Turbopack: Improve handling of symlink resolution errors (#83805)c7d1855[backport] CI: use KV for test timing data (#83860)Updates
reactfrom 19.1.1 to 19.2.0Release notes
Sourced from react's releases.
... (truncated)
Changelog
Sourced from react's changelog.
... (truncated)
Commits
5667a41Bump next prerelease version numbers (#34639)8bb7241Bump useEffectEvent to Canary (#34610)e3c9656Ensure Performance Track are Clamped and Don't overlap (#34509)68f00c9Release Activity in Canary (#34374)0e10ee9[Reconciler] Set ProfileMode for Host Root Fiber by default in dev (#34432)3bf8ab4Add missing Activity export to development mode (#34439)1549bda[Flight] Only assign_storein dev mode when creating lazy types (#34354)bb6f0c8[Flight] Fix wrong missing key warning when static child is blocked (#34350)05addfcUpdate Flow to 0.266 (#34271)ec5dd0aUpdate Flow to 0.257 (#34253)Updates
@types/reactfrom 19.1.13 to 19.2.2Commits
Updates
react-domfrom 19.1.1 to 19.2.0Release notes
Sourced from react-dom's releases.
... (truncated)
Changelog
Sourced from react-dom's changelog.
... (truncated)
Commits
8618113Bump scheduler version (#34671)1bd1f01Ship partial-prerendering APIs to Canary (#34633)2f0649a[Fizz] Removenonceoption from resume-and-prerender APIs (#34664)5667a41Bump next prerelease version numbers (#34639)e08f53bMatchreact-dom/statictest entrypoints and published entrypoints (#34599)8bb7241Bump useEffectEvent to Canary (#34610)83c88adHandle fabric root level fragment with compareDocumentPosition (#34533)68f00c9Release Activity in Canary (#34374)3168e08[flags] enable opt-in for enableDefaultTransitionIndicator (#34373)3434ff4Add scrollIntoView to fragment instances (#32814)Updates
@types/react-domfrom 19.1.9 to 19.2.1Commits
Updates
react-hook-formfrom 7.62.0 to 7.64.0Release notes
Sourced from react-hook-form's releases.
Commits
87d8b777.64.06c3b8f7🥃 chore: upgrade dev deps (#13076)23c699a✂ chore: remove unused field ids ref in useFieldArray (#13066)37f51ac🐞 fix: preserve Controller's defaultValue with shouldUnregister prop (#13063)8d61561🚏 Support optional array fields in PathValueImpl type (#13057)b5b73297.63.086a7fb3🐞 fix: only excuse trigger function when deps has a valid array (#13056)4bfd420🏔️ chore: major dev deps upgrade (#13053)66b7daf🔩 chore: lib dev deps upgrade (#13051)62b26d8🐿️ chore: remove duplicated function isMessage (#13050)Updates
zodfrom 4.1.8 to 4.1.12Release notes
Sourced from zod's releases.
Commits
3b94610v4.1.1277c3c9fExport bg.tsaf44738Fix lintfda4c7cMake docs work without token3fcb20fAdd frrm to ecosystem (#5292)4b1922adocs(content/v4/index): fix zod version (#5289)02a5840refac(errors): Unify code structure and improve types (#5278)62bf4e4fix(ZodError): prevent flatten() from crashing on 'toString' key (#5266)a0abcc0docs(metadata.mdx): fix a mistake in an example output (#5248)c56a4f6docs(ecosystem): addeslint-plugin-zod-x(#5261)Updates
@playwright/testfrom 1.55.0 to 1.56.0Release notes
Sourced from
@playwright/test's releases.... (truncated)
Commits
b6af258cherry-pick(#37727): devops: fix NPM release step (#37728)d2ef7bbchore: mark v1.56.0 (#37722)1621d0bcherry-pick(#37715): chore: disable RenderDocument feature (#37718)ffbf82bcherry-pick(#37687): docs: v1.56 release notes (#37687) (#37720)2c5e33dcherry-pick(#37703): docs: pageErrors should return strings in Java and C#0a91ecfcherry-pick(#37694): chore: move best practices into the journala5c4437cherry-pick(#37693): docs: use VS Code images for test agents6d13fbecherry-pick(#37690): Revert "fix(trace): survive sw restart"d2c267ccherry-pick(#37689): Revert "fix(trace): should survive ping as the first com...d1fdd81fix(snapshot): draw a minimum size browser window for small snapshots (#37640)Maintainer changes
This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for
@playwright/testsince your current version.Updates
@types/reactfrom 19.1.13 to 19.2.2Commits
Updates
@types/react-domfrom 19.1.9 to 19.2.1Commits
Updates
sassfrom 1.92.1 to 1.93.2Release notes
Sourced from sass's releases.