Skip to content

build(deps): bump the frontend-deps group across 1 directory with 27 updates - #118

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/frontend/frontend-deps-b2fec619b8
Closed

build(deps): bump the frontend-deps group across 1 directory with 27 updates#118
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/frontend/frontend-deps-b2fec619b8

Conversation

@dependabot

@dependabotdependabotBot commented on behalf of githubSep 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the frontend-deps group with 26 updates in the /frontend directory:

PackageFromTo
@radix-ui/react-dialog1.1.191.1.23
@radix-ui/react-dropdown-menu2.1.202.1.24
@radix-ui/react-label2.1.112.1.15
@radix-ui/react-select2.3.32.3.7
@tanstack/react-query5.101.25.102.6
@tanstack/react-virtual3.14.63.14.10
@tiptap/extension-link3.28.03.30.5
@tiptap/extension-placeholder3.28.03.30.5
@tiptap/react3.28.03.30.5
@tiptap/starter-kit3.28.03.30.5
axios1.18.11.20.0
dompurify3.4.123.4.14
i18next26.3.626.4.0
lucide-react1.25.01.34.0
react19.2.719.2.8
@types/react19.2.1719.2.18
react-dom19.2.719.2.8
@types/react-dom19.2.319.2.5
react-grid-layout2.2.32.2.4
react-i18next17.0.1017.0.12
react-router-dom7.18.17.18.2
recharts3.9.23.10.1
zustand5.0.145.0.15
@types/node26.1.126.4.0
@vitejs/plugin-react6.0.36.1.0
vite8.1.58.2.2

Updates @radix-ui/react-dialog from 1.1.19 to 1.1.23

Changelog

Sourced from @​radix-ui/react-dialog's changelog.

1.1.23

  • Reverted breaking changes that caused compatibility issues with React Server Components.
  • Updated dependencies: @radix-ui/react-compose-refs@1.1.5, @radix-ui/react-context@1.2.2, @radix-ui/react-dismissable-layer@1.1.19, @radix-ui/react-focus-guards@1.1.6, @radix-ui/react-focus-scope@1.1.16, @radix-ui/react-id@1.1.4, @radix-ui/react-portal@1.1.17, @radix-ui/react-presence@1.1.10, @radix-ui/react-primitive@2.1.10, @radix-ui/react-slot@1.3.3, @radix-ui/react-use-controllable-state@1.2.6, @radix-ui/react-use-layout-effect@1.1.4

1.1.22

  • Updated dependencies: @radix-ui/react-slot@1.3.2, @radix-ui/react-primitive@2.1.9, @radix-ui/react-dismissable-layer@1.1.18, @radix-ui/react-focus-scope@1.1.15, @radix-ui/react-portal@1.1.16

1.1.21

  • Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation.
  • Updated dependencies: @radix-ui/primitive@1.1.7, @radix-ui/react-compose-refs@1.1.4, @radix-ui/react-context@1.2.1, @radix-ui/react-dismissable-layer@1.1.17, @radix-ui/react-focus-guards@1.1.5, @radix-ui/react-focus-scope@1.1.14, @radix-ui/react-id@1.1.3, @radix-ui/react-portal@1.1.15, @radix-ui/react-presence@1.1.9, @radix-ui/react-primitive@2.1.8, @radix-ui/react-slot@1.3.1, @radix-ui/react-use-controllable-state@1.2.5, @radix-ui/react-use-layout-effect@1.1.3

1.1.20

  • Fixed broken ARIA references in Dialogs where a title or description elements are not rendered.
  • Improved tree-shaking so bundlers can drop unused components. Component parts are now marked /* @__PURE__ */ and use named render functions instead of Component.displayName = ... assignments, which previously prevented dead-code elimination with some bundlers.
  • Updated dependencies: @radix-ui/react-dismissable-layer@1.1.16, @radix-ui/react-focus-scope@1.1.13, @radix-ui/react-portal@1.1.14, @radix-ui/react-presence@1.1.8, @radix-ui/react-use-controllable-state@1.2.4, @radix-ui/primitive@1.1.6, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.2.0, @radix-ui/react-focus-guards@1.1.4, @radix-ui/react-id@1.1.2, @radix-ui/react-primitive@2.1.7, @radix-ui/react-slot@1.3.0, @radix-ui/react-use-layout-effect@1.1.2
Commits

Updates @radix-ui/react-dropdown-menu from 2.1.20 to 2.1.24

Changelog

Sourced from @​radix-ui/react-dropdown-menu's changelog.

2.1.24

  • Reverted breaking changes that caused compatibility issues with React Server Components.
  • Updated dependencies: @radix-ui/react-compose-refs@1.1.5, @radix-ui/react-context@1.2.2, @radix-ui/react-id@1.1.4, @radix-ui/react-menu@2.1.24, @radix-ui/react-primitive@2.1.10, @radix-ui/react-use-controllable-state@1.2.6

2.1.23

  • Updated dependencies: @radix-ui/react-menu@2.1.23, @radix-ui/react-primitive@2.1.9

2.1.22

  • Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation.
  • Updated dependencies: @radix-ui/primitive@1.1.7, @radix-ui/react-compose-refs@1.1.4, @radix-ui/react-context@1.2.1, @radix-ui/react-id@1.1.3, @radix-ui/react-menu@2.1.22, @radix-ui/react-primitive@2.1.8, @radix-ui/react-use-controllable-state@1.2.5

2.1.21

  • Improved tree-shaking so bundlers can drop unused components. Component parts are now marked /* @__PURE__ */ and use named render functions instead of Component.displayName = ... assignments, which previously prevented dead-code elimination with some bundlers.
  • Updated dependencies: @radix-ui/react-menu@2.1.21, @radix-ui/react-use-controllable-state@1.2.4, @radix-ui/primitive@1.1.6, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.2.0, @radix-ui/react-id@1.1.2, @radix-ui/react-primitive@2.1.7
Commits

Updates @radix-ui/react-label from 2.1.11 to 2.1.15

Changelog

Sourced from @​radix-ui/react-label's changelog.

2.1.15

  • Reverted breaking changes that caused compatibility issues with React Server Components.
  • Updated dependencies: @radix-ui/react-primitive@2.1.10

2.1.14

  • Updated dependencies: @radix-ui/react-primitive@2.1.9

2.1.13

  • Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation.
  • Updated dependencies: @radix-ui/react-primitive@2.1.8

2.1.12

  • Improved tree-shaking so bundlers can drop unused components. Component parts are now marked /* @__PURE__ */ and use named render functions instead of Component.displayName = ... assignments, which previously prevented dead-code elimination with some bundlers.
  • Updated dependencies: @radix-ui/react-primitive@2.1.7
Commits

Updates @radix-ui/react-select from 2.3.3 to 2.3.7

Changelog

Sourced from @​radix-ui/react-select's changelog.

2.3.7

  • Reverted breaking changes that caused compatibility issues with React Server Components.
  • Updated dependencies: @radix-ui/react-collection@1.1.15, @radix-ui/react-compose-refs@1.1.5, @radix-ui/react-context@1.2.2, @radix-ui/react-direction@1.1.4, @radix-ui/react-dismissable-layer@1.1.19, @radix-ui/react-focus-guards@1.1.6, @radix-ui/react-focus-scope@1.1.16, @radix-ui/react-id@1.1.4, @radix-ui/react-popper@1.3.7, @radix-ui/react-portal@1.1.17, @radix-ui/react-presence@1.1.10, @radix-ui/react-primitive@2.1.10, @radix-ui/react-slot@1.3.3, @radix-ui/react-use-callback-ref@1.1.4, @radix-ui/react-use-controllable-state@1.2.6, @radix-ui/react-use-layout-effect@1.1.4, @radix-ui/react-use-previous@1.1.4, @radix-ui/react-visually-hidden@1.2.11

2.3.6

  • Updated dependencies: @radix-ui/react-slot@1.3.2, @radix-ui/react-collection@1.1.14, @radix-ui/react-primitive@2.1.9, @radix-ui/react-dismissable-layer@1.1.18, @radix-ui/react-focus-scope@1.1.15, @radix-ui/react-popper@1.3.6, @radix-ui/react-portal@1.1.16, @radix-ui/react-visually-hidden@1.2.10

2.3.5

  • Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation.
  • Updated dependencies: @radix-ui/number@1.1.3, @radix-ui/primitive@1.1.7, @radix-ui/react-collection@1.1.13, @radix-ui/react-compose-refs@1.1.4, @radix-ui/react-context@1.2.1, @radix-ui/react-direction@1.1.3, @radix-ui/react-dismissable-layer@1.1.17, @radix-ui/react-focus-guards@1.1.5, @radix-ui/react-focus-scope@1.1.14, @radix-ui/react-id@1.1.3, @radix-ui/react-popper@1.3.5, @radix-ui/react-portal@1.1.15, @radix-ui/react-presence@1.1.9, @radix-ui/react-primitive@2.1.8, @radix-ui/react-slot@1.3.1, @radix-ui/react-use-callback-ref@1.1.3, @radix-ui/react-use-controllable-state@1.2.5, @radix-ui/react-use-layout-effect@1.1.3, @radix-ui/react-use-previous@1.1.3, @radix-ui/react-visually-hidden@1.2.9

2.3.4

  • Improved tree-shaking so bundlers can drop unused components. Component parts are now marked /* @__PURE__ */ and use named render functions instead of Component.displayName = ... assignments, which previously prevented dead-code elimination with some bundlers.
  • Updated dependencies: @radix-ui/react-popper@1.3.4, @radix-ui/react-dismissable-layer@1.1.16, @radix-ui/react-focus-scope@1.1.13, @radix-ui/react-portal@1.1.14, @radix-ui/react-presence@1.1.8, @radix-ui/react-visually-hidden@1.2.8, @radix-ui/react-use-controllable-state@1.2.4, @radix-ui/primitive@1.1.6, @radix-ui/number@1.1.2, @radix-ui/react-collection@1.1.12, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.2.0, @radix-ui/react-direction@1.1.2, @radix-ui/react-focus-guards@1.1.4, @radix-ui/react-id@1.1.2, @radix-ui/react-primitive@2.1.7, @radix-ui/react-slot@1.3.0, @radix-ui/react-use-callback-ref@1.1.2, @radix-ui/react-use-layout-effect@1.1.2, @radix-ui/react-use-previous@1.1.2
Commits

Updates @radix-ui/react-slot from 1.3.0 to 1.3.3

Changelog

Sourced from @​radix-ui/react-slot's changelog.

1.3.2, 1.3.3

  • Reverted breaking changes that caused compatibility issues with React Server Components.

1.3.1

  • Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation.
  • Updated dependencies: @radix-ui/primitive@1.1.7, @radix-ui/react-compose-refs@1.1.4
Commits

Updates @tanstack/react-query from 5.101.2 to 5.102.6

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.102.6

Patch Changes

  • Updated dependencies [ac2b612]:
    • @​tanstack/react-query@​5.102.6
    • @​tanstack/query-devtools@​5.102.6

@​tanstack/react-query-next-experimental@​5.102.6

Patch Changes

  • Updated dependencies [ac2b612]:
    • @​tanstack/react-query@​5.102.6

@​tanstack/react-query-persist-client@​5.102.6

Patch Changes

  • Updated dependencies [ac2b612]:
    • @​tanstack/react-query@​5.102.6
    • @​tanstack/query-persist-client-core@​5.102.6

@​tanstack/react-query@​5.102.6

Patch Changes

  • #11305ac2b612 - fix(react-query): throw falsy errors from useQueries and useSuspenseQueries to the error boundary

  • Updated dependencies []:

    • @​tanstack/query-core@​5.102.6

@​tanstack/react-query-devtools@​5.102.5

Patch Changes

  • Updated dependencies [ef1eff1]:
    • @​tanstack/query-devtools@​5.102.5
    • @​tanstack/react-query@​5.102.5

@​tanstack/react-query-next-experimental@​5.102.5

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.102.5

@​tanstack/react-query-persist-client@​5.102.5

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-persist-client-core@​5.102.5
    • @​tanstack/react-query@​5.102.5

@​tanstack/react-query@​5.102.5

Patch Changes

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.102.6

Patch Changes

  • #11305ac2b612 - fix(react-query): throw falsy errors from useQueries and useSuspenseQueries to the error boundary

  • Updated dependencies []:

    • @​tanstack/query-core@​5.102.6

5.102.5

Patch Changes

  • Updated dependencies [578e5c2]:
    • @​tanstack/query-core@​5.102.5

5.102.4

Patch Changes

  • Updated dependencies [a05df6a]:
    • @​tanstack/query-core@​5.102.4

5.102.3

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.102.3

5.102.2

Patch Changes

  • Updated dependencies [80fbf73]:
    • @​tanstack/query-core@​5.102.2

5.102.1

Patch Changes

  • Updated dependencies [134890d]:
    • @​tanstack/query-core@​5.102.1

5.102.0

Minor Changes

  • #10668e674826 - react-query: update usePrefetchQuery and usePrefetchInfiniteQuery to use queryClient.query and queryClient.infiniteQuery

... (truncated)

Commits

Updates @tanstack/react-virtual from 3.14.6 to 3.14.10

Release notes

Sourced from @​tanstack/react-virtual's releases.

@​tanstack/react-virtual@​3.14.10

Patch Changes

@​tanstack/react-virtual@​3.14.9

Patch Changes

  • Updated dependencies [a5417b4]:
    • @​tanstack/virtual-core@​3.17.7

@​tanstack/react-virtual@​3.14.8

Patch Changes

  • #1237aa536e7 - Fix a gap at the top of the list after an end-anchored prepend in directDomUpdates mode. The prepend grows the total size and bumps scrollOffset to the new bottom in the same pass, but the size container's height was written after_willUpdate synced the scroll position — so the browser clamped the scrollTop write to the stale (shorter) scrollHeight, leaving whitespace at the top until the next scroll. The container is now grown before the scroll sync. Only affected directDomUpdates mode (React-rendered sizers receive their height during render).

  • Updated dependencies [7ae32b5]:

    • @​tanstack/virtual-core@​3.17.6

@​tanstack/react-virtual@​3.14.7

Patch Changes

Changelog

Sourced from @​tanstack/react-virtual's changelog.

3.14.10

Patch Changes

3.14.9

Patch Changes

  • Updated dependencies [a5417b4]:
    • @​tanstack/virtual-core@​3.17.7

3.14.8

Patch Changes

  • #1237aa536e7 - Fix a gap at the top of the list after an end-anchored prepend in directDomUpdates mode. The prepend grows the total size and bumps scrollOffset to the new bottom in the same pass, but the size container's height was written after_willUpdate synced the scroll position — so the browser clamped the scrollTop write to the stale (shorter) scrollHeight, leaving whitespace at the top until the next scroll. The container is now grown before the scroll sync. Only affected directDomUpdates mode (React-rendered sizers receive their height during render).

  • Updated dependencies [7ae32b5]:

    • @​tanstack/virtual-core@​3.17.6

3.14.7

Patch Changes

Commits

Updates @tiptap/extension-link from 3.28.0 to 3.30.5

Release notes

Sourced from @​tiptap/extension-link's releases.

v3.30.5

@​tiptap/core

Patch Changes

  • Fix a denial-of-service risk where crafted block or inline Markdown attributes could consume excessive CPU and block the browser or server event loop.

v3.30.4

@​tiptap/core

Patch Changes

  • Prevent untrusted HTML attributes from changing an object's prototype when merged with mergeAttributes.

v3.30.3

@​tiptap/extension-text-style

Patch Changes

  • Unsetting one text style inside a blockquote no longer removes the other text styles in it.

@​tiptap/extension-youtube

Patch Changes

  • YouTube live URLs (/live/<id>) now embed the video.

@​tiptap/core

Patch Changes

  • Fix JSX runtime to properly render nested sibling elements by spreading children arrays into DOMOutputSpec

@​tiptap/react

Patch Changes

  • Fix ReactNodeViewRenderer crash when contentComponent is not available

@​tiptap/ai-toolkit

Minor Changes

  • Add the AiInsertReveal extension (@tiptap/ai-toolkit/streaming-reveal) to fade in text as the AI streams it into a collaborative document.

v3.30.2

@​tiptap/core

Patch Changes

... (truncated)

Changelog

Sourced from @​tiptap/extension-link's changelog.

3.30.5

Patch Changes

  • Updated dependencies [d0d499b]

3.30.4

Patch Changes

  • Updated dependencies [01d7af8]

3.30.3

Patch Changes

  • Updated dependencies [965a880]

3.30.2

Patch Changes

  • Updated dependencies [3dffed5]
  • Updated dependencies [214a140]

3.30.1

Patch Changes

  • Updated dependencies [abc8828]

3.30.0

Patch Changes

  • Updated dependencies [0247d39]
  • Updated dependencies [58a8953]
  • Updated dependencies [51909d3]
  • Updated dependencies [3099eef]
    • @​tiptap/core@​3.30.0

... (truncated)

Commits
  • b0c188b chore(release): release new stable release (#8261)
  • 55f59e4 chore(release): release new stable release (#8260)
  • db790a7 chore(release): release new stable release (#8216)
  • f434577 chore: migrate over to vite+ for tooling (#8151)
  • cef2c9a chore(release): release new stable release (#8190)
  • 4c4933d chore(release): release new stable release (#8181)
  • 7901bc2 chore(release): release new stable release (#8142)
  • 2036090 test(extension-link): guard non-link click selection with enableClickSelectio...
  • 5158212 chore(release): release new stable release (#8132)
  • 896564a chore(release): release new stable release (#8128)
  • Additional commits viewable in compare view

Updates @tiptap/extension-placeholder from 3.28.0 to 3.30.5

Release notes

Sourced from @​tiptap/extension-placeholder's releases.

v3.30.5

@​tiptap/core

Patch Changes

  • Fix a denial-of-service risk where crafted block or inline Markdown attributes could consume excessive CPU and block the browser or server event loop.

v3.30.4

@​tiptap/core

Patch Changes

  • Prevent untrusted HTML attributes from changing an object's prototype when merged with mergeAttributes.

v3.30.3

@​tiptap/extension-text-style

Patch Changes

  • Unsetting one text style inside a blockquote no longer removes the other text styles in it.

@​tiptap/extension-youtube

Patch Changes

  • YouTube live URLs (/live/<id>) now embed the video.

@​tiptap/core

Patch Changes

  • Fix JSX runtime to properly render nested sibling elements by spreading children arrays into DOMOutputSpec

@​tiptap/react

Patch Changes

  • Fix ReactNodeViewRenderer crash when contentComponent is not available

@​tiptap/ai-toolkit

Minor Changes

  • Add the AiInsertReveal extension (@tiptap/ai-toolkit/streaming-reveal) to fade in text as the AI streams it into a collaborative document.

v3.30.2

@​tiptap/core

Patch Changes

... (truncated)

Changelog

Sourced from @​tiptap/extension-placeholder's changelog.

3.30.5

Patch Changes

  • @​tiptap/extensions@​3.30.5

3.30.4

Patch Changes

  • @​tiptap/extensions@​3.30.4

3.30.3

Patch Changes

  • @​tiptap/extensions@​3.30.3

3.30.2

Patch Changes

  • @​tiptap/extensions@​3.30.2

3.30.1

Patch Changes

  • @​tiptap/extensions@​3.30.1

3.30.0

Patch Changes

  • @​tiptap/extensions@​3.30.0

3.29.2

Patch Changes

  • @​tiptap/extensions@​3.29.2

3.29.1

Patch Changes

  • @​tiptap/extensions@​3.29.1

3.29.0

... (truncated)

Commits

Updates @tiptap/react from 3.28.0 to 3.30.5

Release notes

Sourced from @​tiptap/react's releases.

v3.30.5

@​tiptap/core

Patch Changes

  • Fix a denial-of-service risk where crafted block or inline Markdown attributes could consume excessive CPU and block the browser or server event loop.

v3.30.4

@​tiptap/core

Patch Changes

  • Prevent untrusted HTML attributes from changing an object's prototype when merged with mergeAttributes.

v3.30.3

@​tiptap/extension-text-style

Patch Changes

  • Unsetting one text style inside a blockquote no longer removes the other text styles in it.

@​tiptap/extension-youtube

Patch Changes

  • YouTube live URLs (/live/<id>) now embed the video.

@​tiptap/core

Patch Changes

  • Fix JSX runtime to properly render nested sibling elements by spreading children arrays into DOMOutputSpec

@​tiptap/react

Patch Changes

  • Fix ReactNodeViewRenderer crash when contentComponent is not available

@​tiptap/ai-toolkit

Minor Changes

  • Add the AiInsertReveal extension (@tiptap/ai-toolkit/streaming-reveal) to fade in text as the AI streams it into a collaborative document.

v3.30.2

@​tiptap/core

Patch Changes

... (truncated)

Changelog

Sourced from @​tiptap/react's changelog.

3.30.5

Patch Changes

  • Updated dependencies [d0d499b]

3.30.4

Patch Changes

  • Updated dependencies [01d7af8]

3.30.3

Patch Changes

  • 1cb7ad3: Fix ReactNodeViewRenderer crash when contentComponent is not available
  • Updated dependencies [965a880]

3.30.2

Patch Changes

  • Updated dependencies [3dffed5]
  • Updated dependencies [214a140]

3.30.1

Patch Changes

  • Updated dependencies [abc8828]

3.30.0

Minor Changes

  • 3099eef: New Decorations API

    Finally the decorations API is here! Even though Decorations itself are nothing new in ProseMirror, the new API makes it much easier to use them in Tiptap without leaving your extensions.

... (truncated)

Commits
  • b0c188b chore(release): release new stable release (#8261)
  • 55f59e4 chore(release): release new stable release (#8260)
  • db790a7 chore(release): release new stable release (#8216)
  • f434577 chore: migrate over to vite+ for tooling (#8151)
  • 1cb7ad3 fix(react): prevent crash when ReactNodeViewRenderer returns early (#7670)
  • cef2c9a chore(release): release new stable release (#8190)
  • 4c4933d chore(release): release new stable release (#8181)
  • 7901bc2 chore(release): release new stable release (#8142)
  • 3099eef feat(core): add Decorations API with framework widget renderers (#7902)
  • 31e176c fix(react): avoid stale position when syncing node view selection (#8165)
  • Additional commits viewable in compare view

Updates @tiptap/starter-kit from 3.28.0 to 3.30.5

Release notes

Sourced from @​tiptap/starter-kit's releases.

v3.30.5

@​tiptap/core

Patch Changes

  • Fix a denial-of-service risk where crafted block or inline Markdown attributes could consume excessive CPU and block the browser or server event loop.

v3.30.4

@​tiptap/core

Patch Changes

  • Prevent untrusted HTML attributes from changing an object's prototype when merged with mergeAttributes.

v3.30.3

@​tiptap/extension-text-style

Patch Changes

  • Unsetting one text style inside a blockquote no longer removes the other text styles in it.

@​tiptap/extension-youtube

Patch Changes

  • YouTube live URLs (/live/<id>) now embed the video.

@​tiptap/core

Patch Changes

  • Fix JSX runtime to properly render nested sibling elements by spreading children arrays into DOMOutputSpec

@​tiptap/react

Patch Changes

  • Fix ReactNodeViewRenderer crash when contentComponent is not available

@​tiptap/ai-toolkit

Minor Changes

  • Add the AiInsertReveal extension (@tiptap/ai-toolkit/streaming-reveal) to fade in text as the AI streams it into a collaborative document.

v3.30.2

@​tiptap/core

Patch Changes

... (truncated)

Changelog

Sourced from @​tiptap/starter-kit's changelog.

3.30.5

Patch Changes

  • Updated dependencies [d0d499b]
    • @​tiptap/core@​3.30.5
    • @​tiptap/extension-blockquote@​3.30.5
    • @​tiptap/extension-bold@​3.30.5
    • @​tiptap/extension-code@​3.30.5
    • @​tiptap/extension-code-block@​3.30.5
    • @​tiptap/extension-document@​3.30.5
    • @​tiptap/extension-hard-break@​3.30.5
    • @​tiptap/extension-heading@​3.30.5
    • @​tiptap/extension-horizontal-rule@​3.30.5
    • @​tiptap/extension-italic@​3.30.5
    • @​tiptap/extension-link@​3.30.5
    • @​tiptap/extension-list@​3.30.5
    • @​tiptap/extension-paragraph@​3.30.5
    • @​tiptap/extension-strike@​3.30.5
    • @​tiptap/extension-text@​3.30.5
    • @​tiptap/extension-underline@​3.30.5
    • @​tiptap/extensions@​3.30.5
    • @​tiptap/extension-list-item@​3.30.5
    • @​tiptap/extension-list-keymap@​3.30.5
    • @​tiptap/extension-bullet-list@​3.30.5
    • @​tiptap/extension-ordered-list@​3.30.5
    • @​tiptap/extension-dropcursor@​3.30.5
    • @​tiptap/extension-gapcursor@​3.30.5
    • @​tiptap/pm@​3.30.5

3.30.4

Patch Changes

  • Updated dependencies [01d7af8]
    • @​tiptap/core@​3.30.4
    • @​tiptap/extension-blockquote@​3.30.4
    • @​tiptap/extension-bold@​3.30.4
    • @​tiptap/extension-code@​3.30.4
    • @​tiptap/extension-code-block@​3.30.4
    • @​tiptap/extension-document@​3.30.4
    • @​tiptap/extension-hard-break@​3.30.4
    • @​tiptap/extension-heading@​3.30.4
    • @​tiptap/extension-horizontal-rule@​3.30.4
    • @​tiptap/extension-italic@​3.30.4
    • @​tiptap/extension-link@​3.30.4
    • @​tiptap/extension-list@​3.30.4
    • @​tiptap/extension-paragraph@​3.30.4
    • @​tiptap/extension-strike@​3.30.4
    • @​tiptap/extension-text@​3.30.4

... (truncated)

Commits

Updates axios from 1.18.1 to 1.20.0

Release notes

Sourced from axios's releases.

v1.20.0 — August 19, 2026

This release hardens runtime option handling, adds RFC 9110 status-code aliases, fixes Node.js and XHR reliability issues, and refreshes project tooling and documentation.

⚠️ Breaking Changes & Deprecations

  • HTTP Status Naming: Added ContentTooLarge (413) and UnprocessableContent (422), while retaining PayloadTooLarge and UnprocessableEntity as backward-compatible deprecated aliases. (#11082)

🔒 Security Fixes

  • Runtime Option Handling: Hardened behavioral configuration reads against shared and foreign prototype pollution and normalized unsafe interceptor replacement objects. This also clarifies Fetch redirect and custom implementation behavior, HTTP/2 DNS and proxy handling, CIDR-based NO_PROXY matching, and malformed data URI rejection; see the PR for documented compatibility effects. (#11141)

🐛 Bug Fixes

  • Interceptor Lifecycle: Prevented unbounded handler-array growth by trimming trailing ejected interceptors without changing iteration semantics, and kept interceptor operations safe when the public handlers field is nullish. (#11087, #11118)
  • Request Error Preservation: Prevented custom Error.prepareStackTrace implementations that return non-string values from replacing the original request failure with an unrelated TypeError. (#11109)
  • XHR Reliability: Navigation-canceled requests now reject with ECONNABORTED instead of resolving with status 0, while successful downloads flush their final progress callback during the live loadend dispatch. (#11094, #11121)
  • Node.js Socket Memory: Removed request-context retention from per-socket error listeners, preventing completed response data from being pinned for the lifetime of pooled keep-alive sockets. (#11091)
  • Core Methods and HTTP Errors: Prevented structural method-header buckets from leaking into outgoing headers, standardized invalid DNS lookup and httpVersion failures as AxiosError.ERR_BAD_OPTION_VALUE, and corrected the timeoutErrorMessage merge strategy. (#11096)

🔧 Maintenance & Chores

  • Dependencies: Updated fast-uri, postcss, js-yaml, mocha, development-tooling groups, and GitHub Actions dependencies. (#11092, #11098, #11099,

…updates
Bumps the frontend-deps group with 26 updates in the /frontend directory:
| Package | From | To |
| --- | --- | --- |
| [@radix-ui/react-dialog](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/dialog) | `1.1.19` | `1.1.23` |
| [@radix-ui/react-dropdown-menu](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/dropdown-menu) | `2.1.20` | `2.1.24` |
| [@radix-ui/react-label](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/label) | `2.1.11` | `2.1.15` |
| [@radix-ui/react-select](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/select) | `2.3.3` | `2.3.7` |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.101.2` | `5.102.6` |
| [@tanstack/react-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual) | `3.14.6` | `3.14.10` |
| [@tiptap/extension-link](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-link) | `3.28.0` | `3.30.5` |
| [@tiptap/extension-placeholder](https://github.com/ueberdosis/tiptap/tree/HEAD/packages-deprecated/extension-placeholder) | `3.28.0` | `3.30.5` |
| [@tiptap/react](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/react) | `3.28.0` | `3.30.5` |
| [@tiptap/starter-kit](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/starter-kit) | `3.28.0` | `3.30.5` |
| [axios](https://github.com/axios/axios) | `1.18.1` | `1.20.0` |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.4.12` | `3.4.14` |
| [i18next](https://github.com/i18next/i18next) | `26.3.6` | `26.4.0` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.25.0` | `1.34.0` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.7` | `19.2.8` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.17` | `19.2.18` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.7` | `19.2.8` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.3` | `19.2.5` |
| [react-grid-layout](https://github.com/STRML/react-grid-layout) | `2.2.3` | `2.2.4` |
| [react-i18next](https://github.com/i18next/react-i18next) | `17.0.10` | `17.0.12` |
| [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `7.18.1` | `7.18.2` |
| [recharts](https://github.com/recharts/recharts) | `3.9.2` | `3.10.1` |
| [zustand](https://github.com/pmndrs/zustand) | `5.0.14` | `5.0.15` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.1` | `26.4.0` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.3` | `6.1.0` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.1.5` | `8.2.2` |
Updates `@radix-ui/react-dialog` from 1.1.19 to 1.1.23
- [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/dialog/CHANGELOG.md)
- [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/dialog)
Updates `@radix-ui/react-dropdown-menu` from 2.1.20 to 2.1.24
- [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/dropdown-menu/CHANGELOG.md)
- [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/dropdown-menu)
Updates `@radix-ui/react-label` from 2.1.11 to 2.1.15
- [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/label/CHANGELOG.md)
- [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/label)
Updates `@radix-ui/react-select` from 2.3.3 to 2.3.7
- [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/select/CHANGELOG.md)
- [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/select)
Updates `@radix-ui/react-slot` from 1.3.0 to 1.3.3
- [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/slot/CHANGELOG.md)
- [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/slot)
Updates `@tanstack/react-query` from 5.101.2 to 5.102.6
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.102.6/packages/react-query)
Updates `@tanstack/react-virtual` from 3.14.6 to 3.14.10
- [Release notes](https://github.com/TanStack/virtual/releases)
- [Changelog](https://github.com/TanStack/virtual/blob/main/packages/react-virtual/CHANGELOG.md)
- [Commits](https://github.com/TanStack/virtual/commits/@tanstack/react-virtual@3.14.10/packages/react-virtual)
Updates `@tiptap/extension-link` from 3.28.0 to 3.30.5
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.30.5/packages/extension-link/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.30.5/packages/extension-link)
Updates `@tiptap/extension-placeholder` from 3.28.0 to 3.30.5
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.30.5/packages-deprecated/extension-placeholder/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.30.5/packages-deprecated/extension-placeholder)
Updates `@tiptap/react` from 3.28.0 to 3.30.5
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.30.5/packages/react/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.30.5/packages/react)
Updates `@tiptap/starter-kit` from 3.28.0 to 3.30.5
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.30.5/packages/starter-kit/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.30.5/packages/starter-kit)
Updates `axios` from 1.18.1 to 1.20.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.18.1...v1.20.0)
Updates `dompurify` from 3.4.12 to 3.4.14
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.12...3.4.14)
Updates `i18next` from 26.3.6 to 26.4.0
- [Release notes](https://github.com/i18next/i18next/releases)
- [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/i18next@v26.3.6...v26.4.0)
Updates `lucide-react` from 1.25.0 to 1.34.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.34.0/packages/lucide-react)
Updates `react` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react)
Updates `@types/react` from 19.2.17 to 19.2.18
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)
Updates `react-dom` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom)
Updates `@types/react-dom` from 19.2.3 to 19.2.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)
Updates `react-grid-layout` from 2.2.3 to 2.2.4
- [Release notes](https://github.com/STRML/react-grid-layout/releases)
- [Changelog](https://github.com/react-grid-layout/react-grid-layout/blob/master/CHANGELOG.md)
- [Commits](react-grid-layout/react-grid-layout@2.2.3...v2.2.4)
Updates `react-i18next` from 17.0.10 to 17.0.12
- [Changelog](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/react-i18next@v17.0.10...v17.0.12)
Updates `react-router-dom` from 7.18.1 to 7.18.2
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/react-router-dom@7.18.2/packages/react-router-dom/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.18.2/packages/react-router-dom)
Updates `recharts` from 3.9.2 to 3.10.1
- [Release notes](https://github.com/recharts/recharts/releases)
- [Changelog](https://github.com/recharts/recharts/blob/main/CHANGELOG.md)
- [Commits](recharts/recharts@v3.9.2...v3.10.1)
Updates `zustand` from 5.0.14 to 5.0.15
- [Release notes](https://github.com/pmndrs/zustand/releases)
- [Commits](pmndrs/zustand@v5.0.14...v5.0.15)
Updates `@types/node` from 26.1.1 to 26.4.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)
Updates `@types/react` from 19.2.17 to 19.2.18
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)
Updates `@types/react-dom` from 19.2.3 to 19.2.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)
Updates `@vitejs/plugin-react` from 6.0.3 to 6.1.0
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.0/packages/plugin-react)
Updates `vite` from 8.1.5 to 8.2.2
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.2.2/packages/vite)
---
updated-dependencies:
- dependency-name: "@radix-ui/react-dialog"
dependency-version: 1.1.23
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: frontend-deps
- dependency-name: "@radix-ui/react-dropdown-menu"
dependency-version: 2.1.24
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: frontend-deps
- dependency-name: "@radix-ui/react-label"
dependency-version: 2.1.15
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: frontend-deps
- dependency-name: "@radix-ui/react-select"
dependency-version: 2.3.7
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: frontend-deps
- dependency-name: "@radix-ui/react-slot"
dependency-version: 1.3.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: frontend-deps
- dependency-name: "@tanstack/react-query"
dependency-version: 5.102.6
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: frontend-deps
- dependency-name: "@tanstack/react-virtual"
dependency-version: 3.14.10
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: frontend-deps
- dependency-name: "@tiptap/extension-link"
dependency-version: 3.30.5
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: frontend-deps
- dependency-name: "@tiptap/extension-placeholder"
dependency-version: 3.30.5
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: frontend-deps
- dependency-name: "@tiptap/react"
dependency-version: 3.30.5
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: frontend-deps
- dependency-name: "@tiptap/starter-kit"
dependency-version: 3.30.5
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: frontend-deps
- dependency-name: axios
dependency-version: 1.20.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: frontend-deps
- dependency-name: dompurify
dependency-version: 3.4.14
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: frontend-deps
- dependency-name: i18next
dependency-version: 26.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: frontend-deps
- dependency-name: lucide-react
dependency-version: 1.34.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: frontend-deps
- dependency-name: react
dependency-version: 19.2.8
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: frontend-deps
- dependency-name: "@types/react"
dependency-version: 19.2.18
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: frontend-deps
- dependency-name: react-dom
dependency-version: 19.2.8
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: frontend-deps
- dependency-name: "@types/react-dom"
dependency-version: 19.2.5
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: frontend-deps
- dependency-name: react-grid-layout
dependency-version: 2.2.4
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: frontend-deps
- dependency-name: react-i18next
dependency-version: 17.0.12
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: frontend-deps
- dependency-name: react-router-dom
dependency-version: 7.18.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: frontend-deps
- dependency-name: recharts
dependency-version: 3.10.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: frontend-deps
- dependency-name: zustand
dependency-version: 5.0.15
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: frontend-deps
- dependency-name: "@types/node"
dependency-version: 26.4.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: frontend-deps
- dependency-name: "@types/react"
dependency-version: 19.2.18
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: frontend-deps
- dependency-name: "@types/react-dom"
dependency-version: 19.2.5
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: frontend-deps
- dependency-name: "@vitejs/plugin-react"
dependency-version: 6.1.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: frontend-deps
- dependency-name: vite
dependency-version: 8.2.2
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: frontend-deps
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 1, 2026
WolfTasks pushed a commit that referenced this pull request Sep 6, 2026
…26-14456)
The backend-docker Trivy gate blocks on CVE-2026-14456 (HIGH) in openssl
and libssl3 3.5.7-r0, shipped by the eclipse-temurin Alpine base layer.
Alpine already ships the patched 3.5.8-r0, so extend the existing
`apk upgrade` line rather than chasing a new base-image digest.
Verified by building the image locally:
before: openssl-3.5.7-r0 / libssl3-3.5.7-r0
after: openssl-3.5.8-r0 / libssl3-3.5.8-r0
Pre-existing failure, not introduced by the tomcat bump — backend-docker
was already red on PRs #118 and #120.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
WolfTasks pushed a commit that referenced this pull request Sep 6, 2026
…GH CVEs)
The frontend-docker Trivy gate blocks on nine HIGH CVEs in the nginx
Alpine base layer:
libuuid 2.42.1-r0 -> 2.42.3-r1 CVE-2026-78408/78409/78410, -76642,
CVE-2026-53612/53613/53614
libssl3 3.5.7-r0 -> 3.5.8-r0 CVE-2026-14456
libcrypto3 3.5.7-r0 -> 3.5.8-r0 CVE-2026-14456CVE-2026-14456 is the same openssl flaw already patched in
backend/Dockerfile; Alpine names the packages differently in the nginx
image (libcrypto3 rather than openssl).
Extends the existing `apk upgrade` line, consistent with the libexpat /
c-ares / curl entries already there.
This gate was previously masked: frontend-docker depends on
frontend-build, which was failing on the nanoid advisory, so the job was
skipped rather than run. It was already red on PR #118.
Verified by running the exact apk upgrade line against the pinned base
image digest — all targets reached (libuuid resolves to 2.42.3-r1, newer
than the 2.42.3-r0 named in the advisories).
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
WolfTasks added a commit that referenced this pull request Sep 6, 2026
…locks nightly + CI) (#123)
* fix(security): bump tomcat-embed 10.1.55 -> 10.1.59 (3 CRITICAL CVEs)
Nightly Trivy scan has been failing since 2026-09-03 on three CRITICAL
auth-bypass CVEs in org.apache.tomcat.embed:tomcat-embed-core 10.1.55:
CVE-2026-68525 FORM authentication bypass -> unauthorized resource access
CVE-2026-65905 DIGEST authenticator replay -> authentication bypass
CVE-2026-65182 security constraint bypass (improper access control)
tomcat-embed-core is transitive-only (Spring Boot BOM -> starter-tomcat),
so Dependabot's direct-only security update could not patch it and failed
with security_update_dependency_not_found. Spring Boot 3.5.16 is already
the latest 3.5.x and still pins 10.1.55, so a BOM property override is the
fix -- same pattern as the existing jackson/logback/postgresql overrides.
The advisories name 10.1.58 as the fixed version, but that release was
never published to Maven Central (404); 10.1.59 is the first available
release carrying the fixes.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix(ci): upgrade openssl/libssl3 to 3.5.8-r0 in backend image (CVE-2026-14456)
The backend-docker Trivy gate blocks on CVE-2026-14456 (HIGH) in openssl
and libssl3 3.5.7-r0, shipped by the eclipse-temurin Alpine base layer.
Alpine already ships the patched 3.5.8-r0, so extend the existing
`apk upgrade` line rather than chasing a new base-image digest.
Verified by building the image locally:
before: openssl-3.5.7-r0 / libssl3-3.5.7-r0
after: openssl-3.5.8-r0 / libssl3-3.5.8-r0
Pre-existing failure, not introduced by the tomcat bump — backend-docker
was already red on PRs #118 and #120.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix(ci): bump nanoid 3.3.16 -> 3.3.18 (GHSA-2v37-7h3g-55p8)
The frontend npm-audit gate blocks on GHSA-2v37-7h3g-55p8 (high): custom
generators can loop indefinitely when size is zero. nanoid is a dev-only
transitive of postcss (`^3.3.12`), so the 3.3.18 patch fits the existing
range — no postcss major bump needed.
`node .github/scripts/audit-gate.mjs` passes locally and `npm run build`
is green.
Also normalises a pre-existing drift: package-lock.json still carried
project version 1.0.13 while package.json is at 1.0.15 (the v1.0.15
release bumped package.json only). package.json itself is untouched.
Pre-existing failure, not introduced by the tomcat bump — frontend-build
was already red on PR #120.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix(ci): upgrade libssl3/libcrypto3 + libuuid in frontend image (9 HIGH CVEs)
The frontend-docker Trivy gate blocks on nine HIGH CVEs in the nginx
Alpine base layer:
libuuid 2.42.1-r0 -> 2.42.3-r1 CVE-2026-78408/78409/78410, -76642,
CVE-2026-53612/53613/53614
libssl3 3.5.7-r0 -> 3.5.8-r0 CVE-2026-14456
libcrypto3 3.5.7-r0 -> 3.5.8-r0 CVE-2026-14456CVE-2026-14456 is the same openssl flaw already patched in
backend/Dockerfile; Alpine names the packages differently in the nginx
image (libcrypto3 rather than openssl).
Extends the existing `apk upgrade` line, consistent with the libexpat /
c-ares / curl entries already there.
This gate was previously masked: frontend-docker depends on
frontend-build, which was failing on the nanoid advisory, so the job was
skipped rather than run. It was already red on PR #118.
Verified by running the exact apk upgrade line against the pinned base
image digest — all targets reached (libuuid resolves to 2.42.3-r1, newer
than the 2.42.3-r0 named in the advisories).
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---------
Co-authored-by: Wolfgang Kozian <kozian.wolfgang@gmail.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
@dependabot@github

dependabotBot commented on behalf of githubSep 6, 2026

Copy link
Copy Markdown
ContributorAuthor

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabotdependabotBot closed this Sep 6, 2026
@dependabot
dependabotBot deleted the dependabot/npm_and_yarn/frontend/frontend-deps-b2fec619b8 branch September 6, 2026 01:30
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependenciesPull requests that update a dependency filejavascriptPull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants