Skip to content

chore(deps): bump the production-dependencies group with 3 updates - #5

Closed
dependabot[bot] wants to merge 130 commits into
mainfrom
dependabot/npm_and_yarn/production-dependencies-7732350a91
Closed

chore(deps): bump the production-dependencies group with 3 updates#5
dependabot[bot] wants to merge 130 commits into
mainfrom
dependabot/npm_and_yarn/production-dependencies-7732350a91

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Mar 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 3 updates: fastify, react and react-dom.

Updates fastify from 5.8.2 to 5.8.3

Release notes

Sourced from fastify's releases.

v5.8.3

⚠️ Security Release

This fixes CVE CVE-2026-3635 GHSA-444r-cwp2-x5xf.

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.8.2...v5.8.3

Commits
  • a3e77ce Bumped v5.8.3
  • 4e1db5b fix: gate host and protocol getters on proxy trust function
  • a22217f ci(lock-threads): use shared lock-threads workflow (#6592)
  • 1851f20 docs: update links (#6593)
  • 9cc5187 types: Allow port to be null in request type definition (#6589)
  • 722d83b docs: replace redirected npm.im http-errors link (#6588)
  • a1413de docs: fix incorrect code examples in Reply and Request reference (#6582)
  • d7f01b6 docs: clarify content-type parser/schema mismatch is outside threat model (#6...
  • a0649e9 docs: update syntax markdown, absolute paths and links (#6569)
  • d477915 ci(link-checker): fix root-relative links resolution (#6535)
  • Additional commits viewable in compare view

Updates react from 19.1.0 to 19.2.4

Release notes

Sourced from react's releases.

19.2.4 (January 26th, 2026)

React Server Components

19.2.3 (December 11th, 2025)

React Server Components

19.2.2 (December 11th, 2025)

React Server Components

19.2.1 (December 3rd, 2025)

React Server Components

19.2.0 (Oct 1, 2025)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.2 release post for more information.

New React Features

  • <Activity>: A new API to hide and restore the UI and internal state of its children.
  • useEffectEvent is a React Hook that lets you extract non-reactive logic into an Effect Event.
  • cacheSignal (for RSCs) lets your know when the cache() lifetime is over.
  • React Performance tracks appear on the Performance panel’s timeline in your browser developer tools

New React DOM Features

  • Added resume APIs for partial pre-rendering with Web Streams:
  • Added resume APIs for partial pre-rendering with Node Streams:
  • Updated prerender APIs to return a postponed state that can be passed to the resume APIs.

Notable changes

  • React DOM now batches suspense boundary reveals, matching the behavior of client side rendering. This change is especially noticeable when animating the reveal of Suspense boundaries e.g. with the upcoming <ViewTransition> Component. React will batch as much reveals as possible before the first paint while trying to hit popular first-contentful paint metrics.
  • Add Node Web Streams (prerender, renderToReadableStream) to server-side-rendering APIs for Node.js
  • Use underscore instead of : IDs generated by useId

All Changes

... (truncated)

Changelog

Sourced from react's changelog.

19.2.1 (Dec 3, 2025)

React Server Components

19.2.0 (October 1st, 2025)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.2 release post for more information.

New React Features

  • <Activity>: A new API to hide and restore the UI and internal state of its children.
  • useEffectEvent is a React Hook that lets you extract non-reactive logic into an Effect Event.
  • cacheSignal (for RSCs) lets your know when the cache() lifetime is over.
  • React Performance tracks appear on the Performance panel’s timeline in your browser developer tools

New React DOM Features

  • Added resume APIs for partial pre-rendering with Web Streams:
  • Added resume APIs for partial pre-rendering with Node Streams:
  • Updated prerender APIs to return a postponed state that can be passed to the resume APIs.

Notable changes

  • React DOM now batches suspense boundary reveals, matching the behavior of client side rendering. This change is especially noticeable when animating the reveal of Suspense boundaries e.g. with the upcoming <ViewTransition> Component. React will batch as much reveals as possible before the first paint while trying to hit popular first-contentful paint metrics.
  • Add Node Web Streams (prerender, renderToReadableStream) to server-side-rendering APIs for Node.js
  • Use underscore instead of : IDs generated by useId

All Changes

React

... (truncated)

Commits

Updates react-dom from 19.1.0 to 19.2.4

Release notes

Sourced from react-dom's releases.

19.2.4 (January 26th, 2026)

React Server Components

19.2.3 (December 11th, 2025)

React Server Components

19.2.2 (December 11th, 2025)

React Server Components

19.2.1 (December 3rd, 2025)

React Server Components

19.2.0 (Oct 1, 2025)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.2 release post for more information.

New React Features

  • <Activity>: A new API to hide and restore the UI and internal state of its children.
  • useEffectEvent is a React Hook that lets you extract non-reactive logic into an Effect Event.
  • cacheSignal (for RSCs) lets your know when the cache() lifetime is over.
  • React Performance tracks appear on the Performance panel’s timeline in your browser developer tools

New React DOM Features

  • Added resume APIs for partial pre-rendering with Web Streams:
  • Added resume APIs for partial pre-rendering with Node Streams:
  • Updated prerender APIs to return a postponed state that can be passed to the resume APIs.

Notable changes

  • React DOM now batches suspense boundary reveals, matching the behavior of client side rendering. This change is especially noticeable when animating the reveal of Suspense boundaries e.g. with the upcoming <ViewTransition> Component. React will batch as much reveals as possible before the first paint while trying to hit popular first-contentful paint metrics.
  • Add Node Web Streams (prerender, renderToReadableStream) to server-side-rendering APIs for Node.js
  • Use underscore instead of : IDs generated by useId

All Changes

... (truncated)

Changelog

Sourced from react-dom's changelog.

19.2.1 (Dec 3, 2025)

React Server Components

19.2.0 (October 1st, 2025)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.2 release post for more information.

New React Features

  • <Activity>: A new API to hide and restore the UI and internal state of its children.
  • useEffectEvent is a React Hook that lets you extract non-reactive logic into an Effect Event.
  • cacheSignal (for RSCs) lets your know when the cache() lifetime is over.
  • React Performance tracks appear on the Performance panel’s timeline in your browser developer tools

New React DOM Features

  • Added resume APIs for partial pre-rendering with Web Streams:
  • Added resume APIs for partial pre-rendering with Node Streams:
  • Updated prerender APIs to return a postponed state that can be passed to the resume APIs.

Notable changes

  • React DOM now batches suspense boundary reveals, matching the behavior of client side rendering. This change is especially noticeable when animating the reveal of Suspense boundaries e.g. with the upcoming <ViewTransition> Component. React will batch as much reveals as possible before the first paint while trying to hit popular first-contentful paint metrics.
  • Add Node Web Streams (prerender, renderToReadableStream) to server-side-rendering APIs for Node.js
  • Use underscore instead of : IDs generated by useId

All Changes

React

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

VladUZH and others added 30 commits March 21, 2026 00:52
@VladUZH @claude
Restructure into Turborepo monorepo (P0.1 scaffold)
bfd5159 
Move v0 prototype to v0-prototype/, scaffold monorepo with
apps/api, apps/dashboard, packages/sdk, packages/shared-types,
packages/db. Add docker-compose, turbo.json, and P0.2-P0.5 prompts.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@VladUZH @claude
Add ZodError handling to error handler middleware
27a52c3 
Prevents ZodError from .parse() calls in route handlers falling through
to the unhandled-error 500 block; now returns a structured 400 with
field-level validation details. Uses Zod v4 .issues API (not the v3
.errors alias which is absent in v4).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@VladUZH @claude
Implement POST /api/v1/evaluate endpoint (P1.3)
43b84c2 
Replaces stub with full implementation: loads agent, creates AuditTrace and audit events, calls PolicyEngine, handles allow/deny/approval_required outcomes in a single Prisma transaction.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@VladUZH @claude
Add integration tests for evaluate, outcome, and approval status endp…
ad46d24 
…oints

Comprehensive test coverage (30 tests) for the three P1.3 endpoints:
- POST /api/v1/evaluate: allow, approval_required, deny decisions with
  audit trace/event verification, error handling, and performance
- POST /api/v1/traces/:traceId/outcome: success/error recording with
  trace finalization and audit event creation
- GET /api/v1/approvals/:id/status: pending status polling and field validation

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@VladUZH @claude
Add SDK client, policy engine, integration tests, CI setup, and P1 pr…
372112c 
…ompts

- API: refactor server into plugins, add policy engine and approval services
- SDK: add client, middleware, and error handling
- Tests: integration tests for auth, health, policy engine
- CI: docker-compose.test.yml, lefthook.yml, vitest configs
- Docs: initial documentation
- Prompts: P0.6 (CI/testing) and P1.1–P1.6

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@VladUZH
feat(dashboard): add relativeTime utility
d18568f
@VladUZH
feat(dashboard): add approval API client methods
3172e2c
@VladUZH
feat(dashboard): add reusable SlideOverPanel component
bb85c36
@VladUZH
feat(dashboard): add ApprovalStatusBadge and DataClassificationBadge
f54f948
@VladUZH
feat(dashboard): add ApprovalQueueCard component
9c30245
@VladUZH
feat(dashboard): add ApprovalQueueFilters component
0594f21
@VladUZH
feat(dashboard): add ApprovalQueue container component
dbac657
@VladUZH
feat(dashboard): add ApprovalTraceEvents timeline component
3ae613b
@VladUZH
feat(dashboard): add ApprovalDetailSections with all 7 detail sections
6f41c7a
@VladUZH
feat(dashboard): add ApprovalReviewerAction with approve/deny and err…
40305d9 
…or handling
@VladUZH
fix(dashboard): add actor_name to trace events, explicit button types
5f2de61 
- Show actor_name in trace timeline for governance auditability
- Add type="button" to approve/deny buttons for defensive correctness
@VladUZH @claude
feat(dashboard): add ApprovalDetail slide-over panel
129fa0a 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@VladUZH @claude
feat(dashboard): add approvals page with queue, detail panel, and pol…
3e15b1d 
…ling

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@VladUZH
refactor(dashboard): simplify ApprovalDetail onComplete delegation
e10f8df 
Remove intermediate handleComplete wrapper that double-called
setSelectedId(null). Now delegates directly to onActionComplete,
which owns the close + refresh logic in the parent page.
@VladUZH @claude
chore: add resend email SDK dependency
e4f1256 
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@VladUZH @claude
feat: add email notification config (EMAIL_API_KEY, EMAIL_FROM, DASHB…
96124ad 
…OARD_URL)

Also excludes test files from typecheck configs to fix pre-existing TS errors
in untracked test files from prior sessions that were blocking commits.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@VladUZH @claude
feat: add EmailService with Resend provider and console fallback
15d3afd 
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@VladUZH @claude
feat: add NotificationService with rate limiting and tenant settings
6df0570 
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@VladUZH @claude
feat: dispatch email notification on approval_required in evaluate route
adfd15c 
Also fixes pre-existing TypeScript errors in evaluate.ts (context_snapshot null),
traces.ts (traceContext type narrowing), approval-service.ts (context_snapshot cast),
and policy-service.ts (conditions null handling with Prisma.JsonNull).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@VladUZH @claude
test: add NotificationService unit tests with mocked email provider
a6e7468 
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@VladUZH @claude
Implement Phase 2 & 3: CRUD APIs, dashboard pages, SDK wrappers, webh…
bc035d2 
…ooks, and auth

Phase 2:
- Agent and policy CRUD APIs with integration tests
- Dashboard: agents, policies, audit, architecture, overview pages
- Approval expiry jobs, risk classification service
- Enhanced approval queue UX with context snapshots

Phase 3:
- SDK framework wrappers: LangChain, CrewAI, Vercel AI, OpenAI Agents
- MCP governance middleware
- Webhook delivery service
- Auth routes and login page
- SDK packaging with tsup, README, CHANGELOG
- Brand naming research and verification reports

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@VladUZH @claude
chore: change User email constraint from tenant-scoped to globally un…
e008d3d 
…ique

Required for self-serve signup where tenant doesn't exist yet at signup time.
Also fixes pre-existing TypeScript errors and missing eslint.config.mjs in
apps/landing that were causing the pre-commit typecheck hook to fail.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@VladUZH @claude
feat: add PlanLimitError (402) and bcrypt dependency
c468fba 
PlanLimitError returns 402 with limit name, current count, and max.
bcrypt will be used for email/password signup hashing.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@VladUZH @claude
feat: add email/password, GitHub OAuth, and Google OIDC auth providers
d84be99 
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@VladUZH @claude
feat: add tenant provisioning and plan limits enforcement
9177610 
- provisionNewUser() atomically creates tenant + user + API key
- checkPlanLimit() enforces free/team/enterprise tier limits

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@dependabot dependabot Bot added javascript Pull requests that update javascript code dependencies Pull requests that update a dependency file labels Mar 23, 2026
VladUZH and others added 4 commits March 23, 2026 13:14
@VladUZH @claude
fix: broken demos, stale domain in docs, Python SDK docs, quickstart …
397699f 
…gaps, pricing consistency

Demos: Add agent cleanup to all 3 demo-session.ts files — revokes demo agents
older than 2 hours before creating new ones. Fix plan limit check to exclude
revoked agents (they were accumulating and exhausting the free plan limit).

Docs: Replace all 36 references to api.agentidentity.dev with api.sidclaw.com
across 9 MDX files. Add PydanticAI integration page. Deploy Python SDK docs
across all SDK and integration pages (installation, client, evaluate,
with-governance, errors, webhooks, langchain, crewai, openai-agents).

Quickstart: Add "Register an Agent" step (step 3) explaining how to create an
agent via dashboard or API before using the agent ID.

README: Update pricing table from 3-tier (Free/Team/Enterprise) to 4-tier
(Free/Starter/Business/Enterprise) matching the landing page, with CHF prices.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@VladUZH @claude
docs: add Python sections to record-outcome and wait-for-approval pages
42cd396 
Complete Python SDK documentation coverage across all SDK reference pages.
Adds sync and async examples for record_outcome() and wait_for_approval()
with error handling patterns.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@VladUZH @claude
feat: add LangChain integration packages (Python + JavaScript)
9bfdc5f 
- langchain-sidclaw (Python): published to PyPI, re-exports govern_tools()
  from sidclaw SDK + new GovernanceCallbackHandler for observe-only audit
- @sidclaw/langchain-governance (JavaScript): standalone npm package with
  same exports from @sidclaw/sdk/langchain + GovernanceCallbackHandler
- Both packages: 7 tests each, Apache 2.0 license
- Also includes github-action and github-app integration scaffolds

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@VladUZH @claude
feat: GitHub App integration — governance for GitHub Actions workflows
9aa110c 
Adds a GitHub App that brings SidClaw governance to CI/CD pipelines.
When an AI agent in a GitHub Action needs to deploy, merge, or perform
a sensitive operation, the workflow pauses with a Check Run showing
Approve/Deny buttons. Reviewers can decide from GitHub, the dashboard,
or Slack.

Components:
- integrations/github-app/ — App manifest and marketplace README
- integrations/github-action/ — Reusable Action (action.yml, bundled dist)
- packages/sdk/src/integrations/github-checks.ts — createApprovalCheckRun
  helper exported as @sidclaw/sdk/github
- apps/api/src/routes/integrations/github.ts — Webhook handler for
  check_run.requested_action events (fail-closed signature verification,
  no Octokit dependency, uses plain fetch + JWT for GitHub API)

Security: fail-closed webhook signature verification, 403 catch for
separation-of-duties violations, Record<string, unknown> typing.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/production-dependencies-7732350a91 branch from 56087bf to b88790f Compare March 23, 2026 14:05
VladUZH and others added 13 commits March 23, 2026 19:31
@VladUZH @claude
feat: add chat integrations — Slack, Microsoft Teams, Telegram
858cd66 
Approval notifications with Approve/Deny buttons directly in chat.
Slack uses Block Kit with interactive callbacks, Telegram uses inline
keyboards with webhook callbacks, Teams uses Adaptive Cards with
dashboard links.

- Slack/Teams/Telegram service classes with notification + test methods
- Callback routes for Slack (signing secret verification) and Telegram
- Integration settings API (GET/PATCH/test) with token masking
- Dashboard settings page with per-provider config, toggle, and test
- Notification service dispatches to all enabled channels (fire-and-forget)
- Auth middleware skips integration callback routes
- 19 integration tests with mocked external APIs
- Documentation page (enterprise/chat-integrations.mdx)
- HTML parse mode for Telegram (fixes Markdown escaping bugs)
- Test notifications clearly labeled, no actionable Approve/Deny buttons
- Dashboard form sends null for cleared fields (enables token removal)

Live-tested end-to-end: Telegram bot created, group configured,
approval notification received, Approve clicked in chat, approval
status confirmed in database.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@VladUZH @claude
chore: remove unused IntegrationConfig interface
e42c0ab 
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@VladUZH @claude
ui: add Slack, Teams, and Telegram icons to integrations settings page
9b52967 
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@VladUZH @claude
fix: use response_url for Slack message updates after approve/deny
e3b7c05 
The direct HTTP response with replace_original wasn't reliably updating
the Slack message after button clicks. Now we POST to Slack's
response_url (from the interaction payload) which is the recommended
approach for updating interactive messages.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@VladUZH @claude
feat: remove Microsoft Teams integration, focus on Slack + Telegram
1742b71 
Teams only supported outbound notifications (no in-chat approve/deny)
and Microsoft is deprecating the Incoming Webhook connector API.
Slack and Telegram both support full interactive buttons.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@VladUZH @claude
fix: use chat.update to replace Slack message in-place after approve/…
6c26982 
…deny

The response_url with replace_original was posting a new message instead
of replacing the original. Now we use the Slack chat.update API with
the channel ID and message timestamp from the callback payload to
directly replace the original Block Kit message, removing the
Approve/Deny buttons and showing the decision result.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@VladUZH @claude
docs: update CLAUDE.md with chat integrations (Slack + Telegram)
8efce20 
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@VladUZH @claude
chore: bump SDK to v0.1.3 (adds @sidclaw/sdk/github), update action t…
66f142b 
…o node22

- SDK v0.1.3 adds the @sidclaw/sdk/github export (createApprovalCheckRun)
- GitHub Action updated from node20 to node22 (node20 deprecated June 2026)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@VladUZH
fix: revert to node20 runtime (node22 is not a valid GitHub Actions r…
1233891 
…untime)
@VladUZH @claude
fix: build SDK before running tests in release workflow
e10cab2 
The MCP proxy tests require dist/ to exist. Build first, then test.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@VladUZH @claude
fix: Python version mismatch in langchain-sidclaw, add policy design …
99e01ae 
…guide

- langchain-sidclaw: fix requires-python from >=3.9 to >=3.10 (matches sidclaw dependency)
- langchain-sidclaw: bump to 0.1.1, published to PyPI
- @sidclaw/langchain-governance: fix CJS entry point (0.1.1 already published)
- .gitignore: add python-sdk/ (separate repo, not tracked in platform)
- docs: add Policy Design Guide with quickstart, industry templates, troubleshooting

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@VladUZH @claude
chore: update CLAUDE.md with correct langchain package versions (0.1.1)
88fb9dd 
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@VladUZH @claude
feat: add create-sidclaw-app interactive CLI scaffolding tool
f7dedb7 
npx create-sidclaw-app scaffolds a governed AI agent project in 60
seconds. Prompts for project name, framework, and API key, then
generates a working project with 3 demo tools demonstrating all
governance outcomes (allow, approval_required, deny).

7 framework templates: LangChain Python/JS, Vercel AI SDK, OpenAI
Agents Python, MCP Governance Proxy, Plain TypeScript, Plain Python.

Creates agent + 3 policies via the SidClaw API during setup.
Cross-platform (macOS, Linux, Windows), Node 18+.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/production-dependencies-7732350a91 branch from b88790f to abd9c88 Compare March 23, 2026 21:22
@dependabot
chore(deps): bump the production-dependencies group with 3 updates
63c9099 
Bumps the production-dependencies group with 3 updates: [fastify](https://github.com/fastify/fastify), [react](https://github.com/facebook/react/tree/HEAD/packages/react) and [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom).


Updates `fastify` from 5.8.2 to 5.8.3
- [Release notes](https://github.com/fastify/fastify/releases)
- [Commits](fastify/fastify@v5.8.2...v5.8.3)

Updates `react` from 19.1.0 to 19.2.4
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.4/packages/react)

Updates `react-dom` from 19.1.0 to 19.2.4
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.4/packages/react-dom)

---
updated-dependencies:
- dependency-name: fastify
  dependency-version: 5.8.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: react
  dependency-version: 19.2.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: react-dom
  dependency-version: 19.2.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/production-dependencies-7732350a91 branch from abd9c88 to 63c9099 Compare March 23, 2026 21:25
@VladUZH VladUZH closed this Mar 23, 2026
@VladUZH
VladUZH deleted the dependabot/npm_and_yarn/production-dependencies-7732350a91 branch March 23, 2026 22:48
@dependabot @github

dependabot Bot commented on behalf of github Mar 23, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

This was referenced Jul 29, 2026
Merged
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@VladUZH