Skip to content

chore(deps): bump the npm-dependencies group in /website with 8 updates#49

Closed
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/website/npm-dependencies-cff77d6b44
Closed

chore(deps): bump the npm-dependencies group in /website with 8 updates#49
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/website/npm-dependencies-cff77d6b44

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Apr 12, 2026

Bumps the npm-dependencies group in /website with 8 updates:

Package From To
lucide-react 0.470.0 1.8.0
next 16.2.2 16.2.3
react 19.2.4 19.2.5
react-dom 19.2.4 19.2.5
@types/node 20.19.39 25.6.0
eslint 9.39.4 10.2.0
eslint-config-next 16.2.2 16.2.3
typescript 5.9.3 6.0.2

Updates lucide-react from 0.470.0 to 1.8.0

Release notes

Sourced from lucide-react's releases.

Version 1.8.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.7.0...1.8.0

Version 1.7.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.6.0...1.7.0

Version 1.6.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.5.0...1.6.0

Version 1.5.0

What's Changed

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for lucide-react since your current version.


Updates next from 16.2.2 to 16.2.3

Release notes

Sourced from next's releases.

v16.2.3

[!NOTE] This release is backporting security and bug fixes. For more information about the fixed security vulnerability, please see https://vercel.com/changelog/summary-of-cve-2026-23869. The release does not include all pending features/changes on canary.

Core Changes

  • Ensure app-page reports stale ISR revalidation errors via onRequestError (#92282)
  • Fix [Bug]: manifest.ts breaks HMR in Next.js 16.2 (#91981 through #92273)
  • Deduplicate output assets and detect content conflicts on emit (#92292)
  • Fix styled-jsx race condition: styles lost due to concurrent rendering (#92459)
  • turbo-tasks-backend: stability fixes for task cancellation and error handling (#92254)

Credits

Huge thanks to @​icyJoseph, @​sokra, @​wbinnssmith, @​eps1lon and @​ztanner for helping!

Commits
  • d5f649b v16.2.3
  • 2873928 [16.x] Avoid consuming cyclic models multiple times (#75)
  • d7c7765 [backport]: Ensure app-page reports stale ISR revalidation errors via onReque...
  • c573e8c fix(server-hmr): metadata routes overwrite page runtime HMR handler (#92273)
  • 57b8f65 next-core: deduplicate output assets and detect content conflicts on emit (#9...
  • f158df1 Fix styled-jsx race condition: styles lost due to concurrent rendering (#92459)
  • 356d605 turbo-tasks-backend: stability fixes for task cancellation and error handling...
  • 3b77a6e Fix DashMap read-write self-deadlock in task_cache causing hangs (#92210)
  • b2f208a Backport: new view-transitions guide, update and fixes (#92264)
  • See full diff in compare view

Updates react from 19.2.4 to 19.2.5

Release notes

Sourced from react's releases.

19.2.5 (April 8th, 2026)

React Server Components

Commits

Updates react-dom from 19.2.4 to 19.2.5

Release notes

Sourced from react-dom's releases.

19.2.5 (April 8th, 2026)

React Server Components

Commits

Updates @types/node from 20.19.39 to 25.6.0

Commits

Updates eslint from 9.39.4 to 10.2.0

Release notes

Sourced from eslint's releases.

v10.2.0

Features

  • 586ec2f feat: Add meta.languages support to rules (#20571) (Copilot)
  • 14207de feat: add Temporal to no-obj-calls (#20675) (Pixel998)
  • bbb2c93 feat: add Temporal to ES2026 globals (#20672) (Pixel998)

Bug Fixes

  • 542cb3e fix: update first-party dependencies (#20714) (Francesco Trotta)

Documentation

  • a2af743 docs: add language to configuration objects (#20712) (Francesco Trotta)
  • 845f23f docs: Update README (GitHub Actions Bot)
  • 5fbcf59 docs: remove sourceType from ts playground link (#20477) (Tanuj Kanti)
  • 8702a47 docs: Update README (GitHub Actions Bot)
  • ddeaded docs: Update README (GitHub Actions Bot)
  • 2b44966 docs: add Major Releases section to Manage Releases (#20269) (Milos Djermanovic)
  • eab65c7 docs: update eslint versions in examples (#20664) (루밀LuMir)
  • 3e4a299 docs: update ESM Dependencies policies with note for own-usage packages (#20660) (Milos Djermanovic)

Chores

  • 8120e30 refactor: extract no unmodified loop condition (#20679) (kuldeep kumar)
  • 46e8469 chore: update dependency markdownlint-cli2 to ^0.22.0 (#20697) (renovate[bot])
  • 01ed3aa test: add unit tests for unicode utilities (#20622) (Manish chaudhary)
  • 811f493 ci: remove --legacy-peer-deps from types integration tests (#20667) (Milos Djermanovic)
  • 6b86fcf chore: update dependency npm-run-all2 to v8 (#20663) (renovate[bot])
  • 632c4f8 chore: add prettier update commit to .git-blame-ignore-revs (#20662) (루밀LuMir)
  • b0b0f21 chore: update dependency eslint-plugin-regexp to ^3.1.0 (#20659) (Milos Djermanovic)
  • 228a2dd chore: update dependency eslint-plugin-eslint-plugin to ^7.3.2 (#20661) (Milos Djermanovic)
  • 3ab4d7e test: Add tests for eslintrc-style keys (#20645) (kuldeep kumar)

v10.1.0

Features

  • ff4382b feat: apply fix for no-var in TSModuleBlock (#20638) (Tanuj Kanti)
  • 0916995 feat: Implement api support for bulk-suppressions (#20565) (Blake Sager)

Bug Fixes

  • 2b8824e fix: Prevent no-var autofix when a variable is used before declaration (#20464) (Amaresh S M)
  • e58b4bf fix: update eslint (#20597) (renovate[bot])

Documentation

  • b7b57fe docs: use correct JSDoc link in require-jsdoc.md (#20641) (mkemna-clb)
  • 58e4cfc docs: add deprecation notice partial (#20639) (Milos Djermanovic)
  • 7143dbf docs: update v9 migration guide for @eslint/js usage (#20540) (fnx)
  • 035fc4f docs: note that globalReturn applies only with sourceType: "script" (#20630) (Milos Djermanovic)
  • e972c88 docs: merge ESLint option descriptions into type definitions (#20608) (Francesco Trotta)
  • 7f10d84 docs: Update README (GitHub Actions Bot)
  • aeed007 docs: open playground link in new tab (#20602) (Tanuj Kanti)
  • a0d1a37 docs: Add AI Usage Policy (#20510) (Nicholas C. Zakas)

Chores

... (truncated)

Commits

Updates eslint-config-next from 16.2.2 to 16.2.3

Release notes

Sourced from eslint-config-next's releases.

v16.2.3

[!NOTE] This release is backporting security and bug fixes. For more information about the fixed security vulnerability, please see https://vercel.com/changelog/summary-of-cve-2026-23869. The release does not include all pending features/changes on canary.

Core Changes

  • Ensure app-page reports stale ISR revalidation errors via onRequestError (#92282)
  • Fix [Bug]: manifest.ts breaks HMR in Next.js 16.2 (#91981 through #92273)
  • Deduplicate output assets and detect content conflicts on emit (#92292)
  • Fix styled-jsx race condition: styles lost due to concurrent rendering (#92459)
  • turbo-tasks-backend: stability fixes for task cancellation and error handling (#92254)

Credits

Huge thanks to @​icyJoseph, @​sokra, @​wbinnssmith, @​eps1lon and @​ztanner for helping!

Commits

Updates typescript from 5.9.3 to 6.0.2

Release notes

Sourced from typescript's releases.

TypeScript 6.0

For release notes, check out the release announcement blog post.

Downloads are available on:

TypeScript 6.0 Beta

For release notes, check out the release announcement.

Downloads are available on:

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the npm-dependencies group in /website with 8 updates
c5b4d82 
Bumps the npm-dependencies group in /website with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `0.470.0` | `1.8.0` |
| [next](https://github.com/vercel/next.js) | `16.2.2` | `16.2.3` |
| [react](https://github.com/facebook/react/tree/HEAD/packages/react) | `19.2.4` | `19.2.5` |
| [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) | `19.2.4` | `19.2.5` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `20.19.39` | `25.6.0` |
| [eslint](https://github.com/eslint/eslint) | `9.39.4` | `10.2.0` |
| [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.2.2` | `16.2.3` |
| [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `6.0.2` |


Updates `lucide-react` from 0.470.0 to 1.8.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.8.0/packages/lucide-react)

Updates `next` from 16.2.2 to 16.2.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v16.2.2...v16.2.3)

Updates `react` from 19.2.4 to 19.2.5
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.5/packages/react)

Updates `react-dom` from 19.2.4 to 19.2.5
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.5/packages/react-dom)

Updates `@types/node` from 20.19.39 to 25.6.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `eslint` from 9.39.4 to 10.2.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v9.39.4...v10.2.0)

Updates `eslint-config-next` from 16.2.2 to 16.2.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](https://github.com/vercel/next.js/commits/v16.2.3/packages/eslint-config-next)

Updates `typescript` from 5.9.3 to 6.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](microsoft/TypeScript@v5.9.3...v6.0.2)

---
updated-dependencies:
- dependency-name: lucide-react
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: next
  dependency-version: 16.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: react
  dependency-version: 19.2.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: react-dom
  dependency-version: 19.2.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: "@types/node"
  dependency-version: 25.6.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: eslint
  dependency-version: 10.2.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: eslint-config-next
  dependency-version: 16.2.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: typescript
  dependency-version: 6.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file frontend Frontend/Website related changes labels Apr 12, 2026
@dependabot dependabot bot requested a review from eterna2 as a code owner April 12, 2026 01:58
@dependabot dependabot bot added dependencies Pull requests that update a dependency file frontend Frontend/Website related changes labels Apr 12, 2026
github-actions bot pushed a commit that referenced this pull request Apr 12, 2026
@dependabot
preview: update dependabot-npm-and-yarn-website-npm-dependencies-cff7…
5847f88 
…7d6b44 (PR #49) 6d9eef9
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 12, 2026

🔍 Site Preview Deployed

Deployment URL
This PR https://eterna2.github.io/kest/preview/dependabot-npm-and-yarn-website-npm-dependencies-cff77d6b44/
stable (current main) https://eterna2.github.io/kest/stable/
All versions https://eterna2.github.io/kest/
Branch dependabot/npm_and_yarn/website/npm-dependencies-cff77d6b44
Commit 6d9eef98e954d20e622693355863c96c426ff0bc

Preview updates automatically on every push to this branch. It will be removed when this PR is closed.

eterna2 added a commit that referenced this pull request Apr 12, 2026
@eterna2
chore(deps): consolidate dependabot PRs #48-#50 and switch to monthly…
14ed9db 
… schedule

Consolidates all open dependabot dependency updates into a single PR
and updates .github/dependabot.yml to use a monthly cadence for routine
bumps. GitHub's automatic security-update flow (which ignores the schedule
setting) still provides fast-path PRs for CVE-critical packages.

### Cargo (PR #48)
- pyo3: 0.24 → 0.28
- serde_jcs: 0.1 → 0.2

### npm/website (PR #49)
- next: 16.2.2 → 16 (latest patch)
- react / react-dom: 19.2.4 → 19.2.5
- lucide-react: ^0.470.0 → 1.8.0
- eslint: ^9 → 10.2.0
- eslint-config-next: 16.2.2 → 16.2.3
- typescript: ^5 → 6.0.2
- @types/node: ^20 → 25.6.0

### pip/python (PR #50)
- maturin: >=1.5,<1.13 → >=1.13.1,<1.14
- opentelemetry-sdk: >=1.31.0 → >=1.41.0
- uuid-utils: >=0.9.0 → >=0.14.1
- boto3 / aioboto3: >=1.28.0 / >=11.0.0 → >=1.42.88 / >=15.5.0
- opa-python-client: >=1.0.0 → >=2.0.4
- cedarpy: >=0.1.0 → >=4.8.0
- rfc8785: >=0.1.0 → >=0.1.4
- cryptography (dev): >=42.0.0 → >=46.0.7
- ruff (dev): >=0.3.0 → >=0.15.10
- mypy (dev): >=1.9.0 → >=1.20.0
- pyperf (dev): >=2.6.0 → >=2.10.0

### dependabot.yml
- All ecosystems: weekly → monthly schedule
- Security-critical updates still handled by GitHub's automatic security PRs
@eterna2 eterna2 mentioned this pull request Apr 12, 2026
Merged
@eterna2
Copy link
Copy Markdown
Owner

eterna2 commented Apr 12, 2026

Consolidated into #51 (chore/dependabot-consolidation). Closing in favour of the single combined PR.

@eterna2 eterna2 closed this Apr 12, 2026
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot bot commented on behalf of github Apr 12, 2026

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot dependabot bot deleted the dependabot/npm_and_yarn/website/npm-dependencies-cff77d6b44 branch April 12, 2026 02:05
github-actions bot added a commit that referenced this pull request Apr 12, 2026
@github-actions
preview(index): remove dependabot-npm-and-yarn-website-npm-dependenci…
69d44fb 
…es-cff77d6b44 (PR #49 closed)
eterna2 added a commit that referenced this pull request Apr 12, 2026
@eterna2
chore(deps): consolidate dependabot PRs #48-#50 and switch to monthly…
425e223 
… schedule (#51)

* chore(deps): consolidate dependabot PRs #48-#50 and switch to monthly schedule

Consolidates all open dependabot dependency updates into a single PR
and updates .github/dependabot.yml to use a monthly cadence for routine
bumps. GitHub's automatic security-update flow (which ignores the schedule
setting) still provides fast-path PRs for CVE-critical packages.

### Cargo (PR #48)
- pyo3: 0.24 → 0.28
- serde_jcs: 0.1 → 0.2

### npm/website (PR #49)
- next: 16.2.2 → 16 (latest patch)
- react / react-dom: 19.2.4 → 19.2.5
- lucide-react: ^0.470.0 → 1.8.0
- eslint: ^9 → 10.2.0
- eslint-config-next: 16.2.2 → 16.2.3
- typescript: ^5 → 6.0.2
- @types/node: ^20 → 25.6.0

### pip/python (PR #50)
- maturin: >=1.5,<1.13 → >=1.13.1,<1.14
- opentelemetry-sdk: >=1.31.0 → >=1.41.0
- uuid-utils: >=0.9.0 → >=0.14.1
- boto3 / aioboto3: >=1.28.0 / >=11.0.0 → >=1.42.88 / >=15.5.0
- opa-python-client: >=1.0.0 → >=2.0.4
- cedarpy: >=0.1.0 → >=4.8.0
- rfc8785: >=0.1.0 → >=0.1.4
- cryptography (dev): >=42.0.0 → >=46.0.7
- ruff (dev): >=0.3.0 → >=0.15.10
- mypy (dev): >=1.9.0 → >=1.20.0
- pyperf (dev): >=2.6.0 → >=2.10.0

### dependabot.yml
- All ecosystems: weekly → monthly schedule
- Security-critical updates still handled by GitHub's automatic security PRs

* fix(deps): fix dependency conflicts introduced by consolidation

Three issues found and fixed:

1. boto3 / aioboto3 conflict:
   - aioboto3==15.5.0 pins aiobotocore==2.25.1 which requires boto3>=1.40.46,<1.40.62
   - Our bump to boto3>=1.42.88 was outside that window, making the dep
     graph unsatisfiable for Python 3.14 splits.
   - Fix: revert boto3 floor to >=1.28.0 (letting uv resolve a compatible version).

2. maturin 1.13.1 / Rust edition2024 conflict:
   - maturin>=1.13.1 pulls base64ct v1.8.3 which uses edition2024, requiring Rust >=1.85.
   - Fix: revert maturin to >=1.5,<1.13 (matches original) until Rust toolchain is upgraded.

3. Cargo pyo3 0.28 / Rust 1.81 conflict:
   - pyo3 0.28 invalidated the maturin build cache, forcing a recompile that
     fails on Rust 1.81 (base64ct edition2024 issue above).
   - Fix: revert Cargo.toml + Cargo.lock to main state (pyo3 0.24, serde_jcs 0.1).

4. Add rust-toolchain.toml at repo root:
   - Pins Rust to 1.88.0 (matching .prototools) so cargo called by maturin
     always uses the correct toolchain, not the system default (1.81.0).
   - This is a prerequisite for re-landing pyo3>=0.28 and maturin>=1.13 in a future PR.

Result: 161 unit tests pass.

* refactor(deps): promote rfc8785 to primary dependency

rfc8785 is a tiny pure-Python library (JCS/RFC 8785 canonicalisation)
with no transitive dependencies. Keeping it as an optional extra added
unnecessary install friction for users of the core library.

- Moved rfc8785>=0.1.4 from [project.optional-dependencies.python-backend]
  into [project.dependencies]
- Removed the now-empty python-backend extra
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@eterna2 eterna2 Awaiting requested review from eterna2 eterna2 is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file frontend Frontend/Website related changes

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@eterna2