Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 26 updates - #259

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-954899eb08
Closed

chore(deps): bump the production-dependencies group across 1 directory with 26 updates#259
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-954899eb08

Conversation

@dependabot

@dependabotdependabotBot commented on behalf of githubAug 10, 2026

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 26 updates in the / directory:

PackageFromTo
typescript6.0.37.0.2
@astrojs/cloudflare14.1.414.2.0
@sentry/browser10.67.010.69.0
@tabler/icons3.45.03.46.0
@tanstack/virtual-core3.17.53.17.7
astro7.1.37.2.0
posthog-js1.405.31.413.3
tailwind-variants3.2.23.3.1
@astrojs/react6.0.16.0.2
@base-ui/react1.6.01.7.0
@tanstack/react-virtual3.14.73.14.9
lucide-react1.25.01.29.0
react19.2.719.2.8
react-dom19.2.719.2.8
shadcn4.13.14.16.2
@astrojs/starlight0.41.30.41.7
@modelcontextprotocol/sdk1.29.01.30.0
@aws-sdk/client-s33.1091.03.1105.0
@hono/node-server2.0.112.1.0
@sentry/bun10.67.010.69.0
@sentry/node10.67.010.69.0
add-mcp1.13.02.0.0
hono4.12.314.13.1
posthog-node5.46.05.48.1
ws8.21.18.21.2
@astrojs/language-server2.16.122.16.13

Updates typescript from 6.0.3 to 7.0.2

Commits
Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.


Updates @astrojs/cloudflare from 14.1.4 to 14.2.0

Release notes

Sourced from @​astrojs/cloudflare's releases.

@​astrojs/cloudflare@​14.2.0

Minor Changes

  • #161942a59663 Thanks @​Daedalus-Icarus! - Adds opt-in build-time image optimization for the cloudflare-binding image service.

    When enabled, the Cloudflare IMAGES binding transforms static images in the workerd prerender environment, and the optimized bytes are written directly to the output directory. If the binding fails, it falls back to Sharp.

    To opt in, use the compound configuration form:

    exportdefaultdefineConfig({adapter: cloudflare({imageService: {build: 'cloudflare-binding',runtime: 'cloudflare-binding'},}),});

    The string shorthand imageService: 'cloudflare-binding' preserves the current runtime-only behavior and is unaffected.

  • #1687190c98ae Thanks @​adamchal! - When session: false is set in astro.config, the adapter no longer auto-wires the Cloudflare KV session driver. Combined with the matching astro change, this lets the session runtime tree-shake out of the Worker bundle.

  • #17084961bbe5 Thanks @​matthewp! - Supports Astro's experimental incremental static builds. When experimental.incrementalBuild is enabled, the adapter skips unchanged pages between builds.

Patch Changes

  • #175760a79753 Thanks @​alexanderniebuhr! - Fixes /_image returning 500 in dev mode when using imageService: 'custom'. Astro's default dev image endpoint imports vite and node:fs, which cannot be loaded inside workerd. The custom and fallback cases now use the generic fetch-based endpoint in dev, matching the other image service modes. A user-configured image.endpoint is left untouched.

    Additionally, a dev-time warning is now logged when imageService: 'custom' resolves to the Sharp service (including when no image.service is configured), since Sharp's native binding cannot run inside workerd in dev or production.

  • #174810c32649 Thanks @​ondraulehla! - Fixes a crash on /_image cache hits when the Cloudflare cache provider is enabled. Responses served from the Workers Cache API have immutable headers, and the request handler crashed with "Can't modify immutable headers" when applying its default Cloudflare-CDN-Cache-Control: no-store header to them. The handler now rebuilds the response with mutable headers when needed.

  • #17347ce83c39 Thanks @​astrobot-houston! - Fixes imageService: 'compile' producing unoptimized images when prerenderEnvironment is set to 'node'

  • #175942b8915a Thanks @​astrobot-houston! - Fixes a type-checking error when using app.use(cf()) from @astrojs/cloudflare/hono in projects with wrangler types-generated ExecutionContext declarations

  • Updated dependencies []:

    • @​astrojs/underscore-redirects@​1.0.3

@​astrojs/cloudflare@​14.1.7

Patch Changes

  • #17543bbc1ec9 Thanks @​ematipico! - Fixes a bug where Cloudflare couldn't load chunked collections via experimental.collectionStorage: 'chunked'.

  • Updated dependencies []:

    • @​astrojs/underscore-redirects@​1.0.3

@​astrojs/cloudflare@​14.1.6

Patch Changes

... (truncated)

Changelog

Sourced from @​astrojs/cloudflare's changelog.

14.2.0

Minor Changes

  • #161942a59663 Thanks @​Daedalus-Icarus! - Adds opt-in build-time image optimization for the cloudflare-binding image service.

    When enabled, the Cloudflare IMAGES binding transforms static images in the workerd prerender environment, and the optimized bytes are written directly to the output directory. If the binding fails, it falls back to Sharp.

    To opt in, use the compound configuration form:

    exportdefaultdefineConfig({adapter: cloudflare({imageService: {build: 'cloudflare-binding',runtime: 'cloudflare-binding'},}),});

    The string shorthand imageService: 'cloudflare-binding' preserves the current runtime-only behavior and is unaffected.

  • #1687190c98ae Thanks @​adamchal! - When session: false is set in astro.config, the adapter no longer auto-wires the Cloudflare KV session driver. Combined with the matching astro change, this lets the session runtime tree-shake out of the Worker bundle.

  • #17084961bbe5 Thanks @​matthewp! - Supports Astro's experimental incremental static builds. When experimental.incrementalBuild is enabled, the adapter skips unchanged pages between builds.

Patch Changes

  • #175760a79753 Thanks @​alexanderniebuhr! - Fixes /_image returning 500 in dev mode when using imageService: 'custom'. Astro's default dev image endpoint imports vite and node:fs, which cannot be loaded inside workerd. The custom and fallback cases now use the generic fetch-based endpoint in dev, matching the other image service modes. A user-configured image.endpoint is left untouched.

    Additionally, a dev-time warning is now logged when imageService: 'custom' resolves to the Sharp service (including when no image.service is configured), since Sharp's native binding cannot run inside workerd in dev or production.

  • #174810c32649 Thanks @​ondraulehla! - Fixes a crash on /_image cache hits when the Cloudflare cache provider is enabled. Responses served from the Workers Cache API have immutable headers, and the request handler crashed with "Can't modify immutable headers" when applying its default Cloudflare-CDN-Cache-Control: no-store header to them. The handler now rebuilds the response with mutable headers when needed.

  • #17347ce83c39 Thanks @​astrobot-houston! - Fixes imageService: 'compile' producing unoptimized images when prerenderEnvironment is set to 'node'

  • #175942b8915a Thanks @​astrobot-houston! - Fixes a type-checking error when using app.use(cf()) from @astrojs/cloudflare/hono in projects with wrangler types-generated ExecutionContext declarations

  • Updated dependencies []:

    • @​astrojs/underscore-redirects@​1.0.3

14.1.7

Patch Changes

  • #17543bbc1ec9 Thanks @​ematipico! - Fixes a bug where Cloudflare couldn't load chunked collections via experimental.collectionStorage: 'chunked'.

  • Updated dependencies []:

    • @​astrojs/underscore-redirects@​1.0.3

14.1.6

... (truncated)

Commits
  • 60e9432 [ci] release (#17558)
  • a2240c4 fix(test): provide experimental config in Cloudflare session-false test (#17606)
  • 961bbe5 Experimental incremental static builds (#17084)
  • 90c98ae feat(session): add session: false to opt out of session support (#16871)
  • 2b8915a fix(cloudflare): inline executionCtx type in HonoCloudflareContextLike to avo...
  • 0a79753 fix(cloudflare): use workerd-safe dev image endpoint for custom image service...
  • 2a59663 Add opt-in Cloudflare binding image optimization during build (#16194)
  • 0c32649 fix(cloudflare): don't mutate immutable headers on cached responses (#17481)
  • ce83c39 fix(@​astrojs/cloudflare): fix imageService: 'compile' silent noop with `pre...
  • 9865d1c [ci] release (#17539)
  • Additional commits viewable in compare view

Updates @sentry/browser from 10.67.0 to 10.69.0

Release notes

Sourced from @​sentry/browser's releases.

10.69.0

Important Changes

  • feat(v10/cloudflare): Add instrumentAgentWithSentry for Cloudflare Agents (#22786)

The Cloudflare SDK adds a new instrumentAgentWithSentry API for Cloudflare Agents. It works like instrumentDurableObjectWithSentry for Agent classes from the agents SDK and additionally creates spans for @callable RPC methods and automatically sets the conversationId based on the agent's name. When building with the Sentry Vite plugin, Agents are instrumented automatically (#22788).

Other Changes

  • feat(v10/cloudflare): Add Spotlight integration for local dev event forwarding (#22796)
  • feat(v10/cloudflare): Add wranglerConfigPath to Vite options (#22803)
  • feat(v10/cloudflare): Filter framework-internal Durable Object storage spans (#22770)
  • feat(v10/cloudflare): Instrument Agents automatically (#22788)
  • feat(v10/cloudflare): Rotate agent conversation id on chat clear (#22787)
  • fix(v10/cloudflare): Also skip cf: prefixed DOs (#22802)
  • fix(v10/cloudflare): Filter CREATE INDEX spans on cf_-prefixed tables (#22767)
  • fix(v10/cloudflare): Prevent AI provider skips (#22771)
  • fix(v10/core): Summarize SQLite upserts so Durable Object cf_ spans stay filtered (#22766)
  • fix(v10/effect): Set sentry.origin on logs from SentryEffectLogger (#22806)
  • fix(v10/gatsby): Add React 19 to peer dependency range (#22675)
  • fix(v10/node): Unpin @apm-js-collab/code-transformer-bundler-plugins (#22678)
  • fix(v10/server-utils): Do not inject dc into client bundle (#22765)
  • test(v10/cloudflare): Pin mcp as agent depends on it (#22769)

Bundle size 📦

PathSize
@​sentry/browser27.11 KB
@​sentry/browser - with treeshaking flags25.59 KB
@​sentry/browser (incl. Tracing)45.51 KB
@​sentry/browser (incl. Tracing + Span Streaming)47.25 KB
@​sentry/browser (incl. Tracing, Profiling)50.15 KB
@​sentry/browser (incl. Tracing, Replay)83.84 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags73.71 KB
@​sentry/browser (incl. Tracing, Replay with Canvas)88.44 KB
@​sentry/browser (incl. Tracing, Replay, Feedback)100.79 KB
@​sentry/browser (incl. Feedback)43.88 KB
@​sentry/browser (incl. sendFeedback)31.79 KB
@​sentry/browser (incl. FeedbackAsync)36.8 KB
@​sentry/browser (incl. Metrics)28.17 KB
@​sentry/browser (incl. Logs)28.39 KB
@​sentry/browser (incl. Metrics & Logs)29.07 KB
@​sentry/react28.87 KB

... (truncated)

Changelog

Sourced from @​sentry/browser's changelog.

10.69.0

Important Changes

  • feat(v10/cloudflare): Add instrumentAgentWithSentry for Cloudflare Agents (#22786)

The Cloudflare SDK adds a new instrumentAgentWithSentry API for Cloudflare Agents. It works like instrumentDurableObjectWithSentry for Agent classes from the agents SDK and additionally creates spans for @callable RPC methods and automatically sets the conversationId based on the agent's name. When building with the Sentry Vite plugin, Agents are instrumented automatically (#22788).

Other Changes

  • feat(v10/cloudflare): Add Spotlight integration for local dev event forwarding (#22796)
  • feat(v10/cloudflare): Add wranglerConfigPath to Vite options (#22803)
  • feat(v10/cloudflare): Filter framework-internal Durable Object storage spans (#22770)
  • feat(v10/cloudflare): Instrument Agents automatically (#22788)
  • feat(v10/cloudflare): Rotate agent conversation id on chat clear (#22787)
  • fix(v10/cloudflare): Also skip cf: prefixed DOs (#22802)
  • fix(v10/cloudflare): Filter CREATE INDEX spans on cf_-prefixed tables (#22767)
  • fix(v10/cloudflare): Prevent AI provider skips (#22771)
  • fix(v10/core): Summarize SQLite upserts so Durable Object cf_ spans stay filtered (#22766)
  • fix(v10/effect): Set sentry.origin on logs from SentryEffectLogger (#22806)
  • fix(v10/gatsby): Add React 19 to peer dependency range (#22675)
  • fix(v10/node): Unpin @apm-js-collab/code-transformer-bundler-plugins (#22678)
  • fix(v10/server-utils): Do not inject dc into client bundle (#22765)
  • test(v10/cloudflare): Pin mcp as agent depends on it (#22769)

10.68.0

  • feat(cloudflare): Add @​sentry/cloudflare/vite orchestrion plugin (#21967)
  • feat(nestjs): Support WebSocket errors in SentryGlobalFilter (#22224)
  • feat(node,server-utils): Set cache.key on dataloader spans and capture redis delete operations as cache.remove (#22389)
  • feat(server-utils): Allow integrations to be part of marker (#22094)
  • feat(server-utils): Migrate FirebaseInstrumentation to orchestrion (#22141)
  • feat(server-utils): Warn when bundler config has instrumented module in external (#22379)
  • feat(v10): Add http.route attribute to http.server spans with parameterized routes (#22564)
  • feat(v10): Add url.full and url.path to http.server spans (#22533)
  • feat(v10/cloudflare): Auto-instrument Durable Object classes (#22541)
  • feat(v10/cloudflare): Auto-instrument the worker entry with withSentry (#22540)
  • feat(v10/cloudflare): Auto-instrument WorkerEntrypoint classes (#22543)
  • feat(v10/cloudflare): Auto-instrument Workflow classes (#22542)
  • feat(v10/cloudflare): Read wrangler config and resolve the Sentry options module (#22538)
  • feat(v10/core): Add instrumentStateGraph API (#22491)
  • feat(v10/core): Add url.full attribute to core fetch instrumentation (#22436)
  • feat(v10/core): Support filtering stackFrameVariables by variable name (#22526)
  • feat(v10/react-router): Make instrumentation API the default (#22525)

... (truncated)

Commits
  • 417af5d release: 10.69.0
  • e7cf605 meta(changelog): Update changelog for 10.69.0 (#22807)
  • 7c5a00e fix(v10/effect): Set sentry.origin on logs from SentryEffectLogger (#22806)
  • df53214 feat(v10/cloudflare): Add wranglerConfigPath to Vite options (#22803)
  • e96e15e feat(v10/cloudflare): Add Spotlight integration for local dev event forwardin...
  • ea4a322 fix(v10/cloudflare): Also skip cf: prefixed DOs (#22802)
  • 6a84103 feat(v10/cloudflare): Instrument Agents automatically (#22788)
  • f0c3569 feat(v10/cloudflare): Rotate agent conversation id on chat clear (#22787)
  • 0516355 feat(v10/cloudflare): Add instrumentAgentWithSentry for Cloudflare Agents (#2...
  • d3a6e52 fix(v10/cloudflare): Filter CREATE INDEX spans on cf_-prefixed tables (#2...
  • Additional commits viewable in compare view

Updates @tabler/icons from 3.45.0 to 3.46.0

Release notes

Sourced from @​tabler/icons's releases.

Release 3.46.0

18 new icons:

  • outline/play-bug
  • outline/play-bugs
  • outline/remote-control
  • outline/rocking-chair
  • outline/run-sprint
  • outline/sparkles-2-off
  • outline/tabs
  • outline/tags-chevron-down
  • outline/tags-chevron-left
  • outline/tags-chevron-right
  • outline/tags-chevron-up
  • outline/thinking-high
  • outline/thinking-low
  • outline/thinking-medium
  • outline/treasure-chest
  • outline/twig
  • outline/vault
  • outline/yarn

Fixed icons: outline/credits, outline/currency-tether, outline/device-3d-camera, outline/device-screen, outline/home-lock, outline/map-lock, outline/notdef, outline/queue-pop-in, outline/server-bolt, outline/server, outline/sparkles-2, outline/transform-point-bottom-left, outline/transform-point-bottom-right, outline/transform-point-top-left, outline/transform-point-top-right

Commits
  • 8ac7d81 Release 3.46.0
  • 2727ba9 Enhance release process in package.json: add GitHub authentication check and ...
  • 4ff4802 Add npm login check before release-it initialization in package.json
  • 74a7690 Merge branch 'main' of https://github.com/tabler/tabler-icons
  • f828849 Update dependencies in package.json and pnpm-lock.yaml: remove @​release-it-pl...
  • 1a39582 Fix rect width/height swap in optimize script (#1570)
  • 54bac86 Secure PR validation: run fork code without privileges (#1569)
  • eaaf32d Update Turbo package to version 2.10.7 and adjust schema reference in turbo.json
  • 2cfcde7 Remove unused AI tag generation script and related package dependency from pr...
  • be0e5a8 Refactor SVG paths for several icons to improve structure and consistency: `o...
  • Additional commits viewable in compare view

Updates @tanstack/virtual-core from 3.17.5 to 3.17.7

Release notes

Sourced from @​tanstack/virtual-core's releases.

@​tanstack/virtual-core@​3.17.7

Patch Changes

  • #1239a5417b4 - Fix a one-frame viewport jump when above-viewport rows resize while scrolling up (#1227). resizeItem writes scrollTop synchronously inside the ResizeObserver callback to compensate for the size change, but then notified asynchronously — so the browser could paint a frame with the new scrollTop and the old item transforms, making the content jerk by the resize delta and snap back. When a compensation actually moves the scroll position, resizeItem now notifies synchronously so the transform commit lands in the same paint as the scroll write. Resizes that don't move the scroll position (below-fold measurements, iOS-deferred adjustments) keep the cheaper async notify.

@​tanstack/virtual-core@​3.17.6

Patch Changes

  • #12367ae32b5 - Stop the default scroll-adjustment heuristic from drifting the viewport when a viewport-spanning item grows. Previously any item whose top sat above the fold (itemStart < scrollOffset) had its size delta compensated on every re-measure — including a streaming chat message that spans the fold and grows at its bottom, dragging scrollTop downward token by token (#1218). Re-measurements now only compensate items that are entirely above the fold (itemStart + itemSize <= scrollOffset); growth below the anchor point leaves the scroll position untouched. First measurements (estimate→actual) still compensate any above-fold item, and a custom shouldAdjustScrollPositionOnItemSizeChange still overrides the default.
Changelog

Sourced from @​tanstack/virtual-core's changelog.

3.17.7

Patch Changes

  • #1239a5417b4 - Fix a one-frame viewport jump when above-viewport rows resize while scrolling up (#1227). resizeItem writes scrollTop synchronously inside the ResizeObserver callback to compensate for the size change, but then notified asynchronously — so the browser could paint a frame with the new scrollTop and the old item transforms, making the content jerk by the resize delta and snap back. When a compensation actually moves the scroll position, resizeItem now notifies synchronously so the transform commit lands in the same paint as the scroll write. Resizes that don't move the scroll position (below-fold measurements, iOS-deferred adjustments) keep the cheaper async notify.

3.17.6

Patch Changes

  • #12367ae32b5 - Stop the default scroll-adjustment heuristic from drifting the viewport when a viewport-spanning item grows. Previously any item whose top sat above the fold (itemStart < scrollOffset) had its size delta compensated on every re-measure — including a streaming chat message that spans the fold and grows at its bottom, dragging scrollTop downward token by token (#1218). Re-measurements now only compensate items that are entirely above the fold (itemStart + itemSize <= scrollOffset); growth below the anchor point leaves the scroll position untouched. First measurements (estimate→actual) still compensate any above-fold item, and a custom shouldAdjustScrollPositionOnItemSizeChange still overrides the default.
Commits
  • deca524 ci: Version Packages (#1240)
  • a5417b4 fix(virtual-core): notify synchronously after above-viewport resize compensat...
  • 32b2f2b ci: Version Packages (#1238)
  • ef6e92a docs(virtual-core): clarify shouldAdjustScrollPositionOnItemSizeChange usage ...
  • 7ae32b5 fix(virtual-core): stop viewport-spanning item growth from drifting scroll (#...
  • See full diff in compare view

Updates astro from 7.1.3 to 7.2.0

Release notes

Sourced from astro's releases.

astro@7.2.0

Minor Changes

  • #171740224a3a Thanks @​matthewp! - Adds the astro preview --background flag to start preview servers as background processes.

    This makes preview servers easier to manage from scripts and AI coding agents because the command returns after the server is ready instead of keeping the terminal attached to the long-running process.

    astro preview --background

    When a preview server is running in the background, you can inspect or stop it with new astro preview subcommands:

    astro preview status
    astro preview logs
    astro preview logs --follow
    astro preview stop

    If Astro detects that astro preview is being run by an AI coding agent, background mode is enabled automatically. This matches the existing behavior for astro dev, allowing agents to continue working after the preview server starts while still receiving the server URL and process ID.

    To opt out of automatic background mode for preview servers, set ASTRO_PREVIEW_BACKGROUND=0 before running astro preview.

  • #175327f94895 Thanks @​florian-lefebvre! - Adds support for paths relative to your project root in logger.entrypoint

    Previously, pointing logger.entrypoint at a custom log handler living in your own project required building an absolute URL. You can now write the path directly:

    // astro.config.mjs
    import { defineConfig } from 'astro/config';
    export default defineConfig({
    logger: {
    entrypoint: new URL('./src/logger.js', import.meta.url),
    entrypoint: './src/logger.js',
    },
    });

Paths starting with ./ or ../ are resolved against your project root. Package specifiers such as @org/astro-logger, absolute paths, and URL entrypoints keep working as before.

  • #17084961bbe5 Thanks @​matthewp! - Widens the AstroPrerendererrender() return type so prerenderers can report incremental-build metadata

    A prerenderer's render() may now resolve to either a Response (as before) or a PrerenderResult object that pairs the response with the content entries and optimized-image transforms the page resolved. This lets prerenderers that render out of process (for example, in an adapter's runtime like workerd) report those dependencies back to the build, so incremental static builds can track and replay them for skipped pages.

    importtype{AstroPrerenderer,PrerenderResult}from'astro';constprerenderer: AstroPrerenderer={

  • ... (truncated)

    Changelog

    Sourced from astro's changelog.

    7.2.0

    Minor Changes

    • #171740224a3a Thanks @​matthewp! - Adds the astro preview --background flag to start preview servers as background processes.

      This makes preview servers easier to manage from scripts and AI coding agents because the command returns after the server is ready instead of keeping the terminal attached to the long-running process.

      astro preview --background

      When a preview server is running in the background, you can inspect or stop it with new astro preview subcommands:

      astro preview status
      astro preview logs
      astro preview logs --follow
      astro preview stop

      If Astro detects that astro preview is being run by an AI coding agent, background mode is enabled automatically. This matches the existing behavior for astro dev, allowing agents to continue working after the preview server starts while still receiving the server URL and process ID.

      To opt out of automatic background mode for preview servers, set ASTRO_PREVIEW_BACKGROUND=0 before running astro preview.

    • #175327f94895 Thanks @​florian-lefebvre! - Adds support for paths relative to your project root in logger.entrypoint

      Previously, pointing logger.entrypoint at a custom log handler living in your own project required building an absolute URL. You can now write the path directly:

      // astro.config.mjs
      import { defineConfig } from 'astro/config';
      export default defineConfig({
      logger: {
      entrypoint: new URL('./src/logger.js', import.meta.url),
      entrypoint: './src/logger.js',
      },
      });

    Paths starting with ./ or ../ are resolved against your project root. Package specifiers such as @org/astro-logger, absolute paths, and URL entrypoints keep working as before.

  • #17084961bbe5 Thanks @​matthewp! - Widens the AstroPrerendererrender() return type so prerenderers can report incremental-build metadata

    A prerenderer's render() may now resolve to either a Response (as before) or a PrerenderResult object that pairs the response with the content entries and optimized-image transforms the page resolved. This lets prerenderers that render out of process (for example, in an adapter's runtime like workerd) report those dependencies back to the build, so incremental static builds can track and replay them for skipped pages.

    importtype{AstroPrerenderer,PrerenderResult}from'astro';

  • ... (truncated)

    Commits

    Updates posthog-js from 1.405.3 to 1.413.3

    Release notes

    Sourced from posthog-js's releases.

    posthog-js@1.413.3

    1.413.3

    Patch Changes

    • #44141b88c2f Thanks @​marandaneto! - Clear properties registered for a session when the PostHog session rotates. (2026-08-06)

    • #4374b39b577 Thanks @​dustinbyrne! - Persist in-place object and array mutations when properties are re-registered. (2026-08-06)

    • #443475fb719 Thanks @​arnohillen! - Make the session replay attribute masking options mutually exclusive: when both maskAllElementAttributes and maskAttributeFn are set, the coarse option wins and the callback is ignored (with a console warning), so a callback can no longer accidentally unmask what maskAllElementAttributes hides. (2026-08-06)

    • Updated dependencies [64ba193, 75fb719]:

      • @​posthog/core@​1.46.9
      • @​posthog/types@​1.402.2

    posthog-js@1.413.2

    1.413.2

    Patch Changes

    • #4425ee7fab0 Thanks @​posthog! - Fix a benign network failure (e.g. TypeError: Failed to fetch) in the async native-gzip request path surfacing as an unhandled promise rejection, which exception autocapture would otherwise pick up (2026-08-05)

    posthog-js@1.413.1

    1.413.1

    Patch Changes

    • #43901160403 Thanks @​posthog! - Contain and log recorder-owned callback failures while preserving exceptions from patched native host APIs. Keep recording mutations from adopted cross-realm nodes. (2026-08-05)

    • #4286d108d66 Thanks @​posthog! - fix(replay): preserve privacy masking for initial network metadata

      Initial navigation and performance-timing entries are now passed through maskCapturedNetworkRequestFn, including when they have no method. URL rewrites are respected. When the callback returns nullish for an initial entry, replay-required timing metadata is retained without its URL, headers, or body so method-gated callbacks do not drop the metadata or expose deliberately filtered customer data. Derived server-timing entries are also suppressed when this strict fallback is used. Enforced PostHog filtering and payload cleaning still run first. (2026-08-05)

    • Updated dependencies [d108d66]:

      • @​posthog/types@​1.402.1

    posthog-js@1.413.0

    1.413.0

    Minor Changes

    • #43762da12b8 Thanks @​posthog! - Add attribute-level masking to session replay: maskAttributeFn provides per-attribute control over the final serialized value, while maskAllElementAttributes masks all source DOM string attributes (including rendering attributes and synthesized form values) at the cost of replay fidelity. (2026-08-05)

    Patch Changes

    ... (truncated)

    Commits
    • 886ef7b chore: update versions and lockfile [version bump]
    • 2831de1 fix(ai): report cache-write tokens for OpenAI-compatible providers (#4189)
    • 7322893 feat(mcp): anchor $session_id to the agent's conversation_id (#4428)
    • c514a34 fix(mcp): deliver the session handle on errors and capability gaps (#4433)
    • 955df8d feat(mcp): mirror the session handle into structuredContent (#4431)
    • e6d9295 feat(mcp): declare _mcp_instructions on tool output schemas (#4430)
    • d36a421 fix(ai): preserve Anthropic cache-write TTL breakdowns (#4236)
    • d0933e1 test(browser): snapshot enriched events and wire requests (#4437)
    • c5edaf3 fix(ci): sign the commits these workflows create (#4420)
    • 1b88c2f fix(browser): clear session properties when sessions rotate (#4414)
    • Additional commits viewable in compare view

    Updates tailwind-variants from 3.2.2 to 3.3.1

    Release notes

    Sourced from tailwind-variants's releases.

    v3.3.1

    🐞 Bug Fixes

    View changes on GitHub

    v3.3.0

    No significant changes

    View changes on GitHub
    Changelog

    Sourced from tailwind-variants's changelog.

    3.3.1 (2026-08-03)

    Bug Fixes

    3.3.0 (2026-07-26)

    Commits
    Maintainer changes

    This version was pushed to npm by GitHub Actions, a new releaser for tailwind-variants since your current version.


    Updates @astrojs/react from 6.0.1 to 6.0.2

    Release notes

    Sourced from @​astrojs/react's releases.

    Description has been truncated

    …y with 26 updates
    Bumps the production-dependencies group with 26 updates in the / directory:
    | Package | From | To |
    | --- | --- | --- |
    | [typescript](https://github.com/microsoft/TypeScript) | `6.0.3` | `7.0.2` |
    | [@astrojs/cloudflare](https://github.com/withastro/astro/tree/HEAD/packages/integrations/cloudflare) | `14.1.4` | `14.2.0` |
    | [@sentry/browser](https://github.com/getsentry/sentry-javascript) | `10.67.0` | `10.69.0` |
    | [@tabler/icons](https://github.com/tabler/tabler-icons) | `3.45.0` | `3.46.0` |
    | [@tanstack/virtual-core](https://github.com/TanStack/virtual/tree/HEAD/packages/virtual-core) | `3.17.5` | `3.17.7` |
    | [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.1.3` | `7.2.0` |
    | [posthog-js](https://github.com/PostHog/posthog-js) | `1.405.3` | `1.413.3` |
    | [tailwind-variants](https://github.com/heroui-inc/tailwind-variants) | `3.2.2` | `3.3.1` |
    | [@astrojs/react](https://github.com/withastro/astro/tree/HEAD/packages/integrations/react) | `6.0.1` | `6.0.2` |
    | [@base-ui/react](https://github.com/mui/base-ui/tree/HEAD/packages/react) | `1.6.0` | `1.7.0` |
    | [@tanstack/react-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual) | `3.14.7` | `3.14.9` |
    | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.25.0` | `1.29.0` |
    | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.7` | `19.2.8` |
    | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.7` | `19.2.8` |
    | [shadcn](https://github.com/shadcn-ui/ui/tree/HEAD/packages/shadcn) | `4.13.1` | `4.16.2` |
    | [@astrojs/starlight](https://github.com/withastro/starlight/tree/HEAD/packages/starlight) | `0.41.3` | `0.41.7` |
    | [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.29.0` | `1.30.0` |
    | [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1091.0` | `3.1105.0` |
    | [@hono/node-server](https://github.com/honojs/node-server) | `2.0.11` | `2.1.0` |
    | [@sentry/bun](https://github.com/getsentry/sentry-javascript) | `10.67.0` | `10.69.0` |
    | [@sentry/node](https://github.com/getsentry/sentry-javascript) | `10.67.0` | `10.69.0` |
    | [add-mcp](https://github.com/neon-solutions/add-mcp) | `1.13.0` | `2.0.0` |
    | [hono](https://github.com/honojs/hono) | `4.12.31` | `4.13.1` |
    | [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.46.0` | `5.48.1` |
    | [ws](https://github.com/websockets/ws) | `8.21.1` | `8.21.2` |
    | [@astrojs/language-server](https://github.com/withastro/astro/tree/HEAD/packages/language-tools/language-server) | `2.16.12` | `2.16.13` |
    Updates `typescript` from 6.0.3 to 7.0.2
    - [Release notes](https://github.com/microsoft/TypeScript/releases)
    - [Commits](https://github.com/microsoft/TypeScript/commits)
    Updates `@astrojs/cloudflare` from 14.1.4 to 14.2.0
    - [Release notes](https://github.com/withastro/astro/releases)
    - [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/cloudflare/CHANGELOG.md)
    - [Commits](https://github.com/withastro/astro/commits/@astrojs/cloudflare@14.2.0/packages/integrations/cloudflare)
    Updates `@sentry/browser` from 10.67.0 to 10.69.0
    - [Release notes](https://github.com/getsentry/sentry-javascript/releases)
    - [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.69.0/CHANGELOG.md)
    - [Commits](getsentry/sentry-javascript@10.67.0...10.69.0)
    Updates `@tabler/icons` from 3.45.0 to 3.46.0
    - [Release notes](https://github.com/tabler/tabler-icons/releases)
    - [Commits](tabler/tabler-icons@v3.45.0...v3.46.0)
    Updates `@tanstack/virtual-core` from 3.17.5 to 3.17.7
    - [Release notes](https://github.com/TanStack/virtual/releases)
    - [Changelog](https://github.com/TanStack/virtual/blob/main/packages/virtual-core/CHANGELOG.md)
    - [Commits](https://github.com/TanStack/virtual/commits/@tanstack/virtual-core@3.17.7/packages/virtual-core)
    Updates `astro` from 7.1.3 to 7.2.0
    - [Release notes](https://github.com/withastro/astro/releases)
    - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
    - [Commits](https://github.com/withastro/astro/commits/astro@7.2.0/packages/astro)
    Updates `posthog-js` from 1.405.3 to 1.413.3
    - [Release notes](https://github.com/PostHog/posthog-js/releases)
    - [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md)
    - [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.405.3...posthog-js@1.413.3)
    Updates `tailwind-variants` from 3.2.2 to 3.3.1
    - [Release notes](https://github.com/heroui-inc/tailwind-variants/releases)
    - [Changelog](https://github.com/heroui-inc/tailwind-variants/blob/main/CHANGELOG.md)
    - [Commits](heroui-inc/tailwind-variants@v3.2.2...v3.3.1)
    Updates `@astrojs/react` from 6.0.1 to 6.0.2
    - [Release notes](https://github.com/withastro/astro/releases)
    - [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/react/CHANGELOG.md)
    - [Commits](https://github.com/withastro/astro/commits/@astrojs/react@6.0.2/packages/integrations/react)
    Updates `@base-ui/react` from 1.6.0 to 1.7.0
    - [Release notes](https://github.com/mui/base-ui/releases)
    - [Changelog](https://github.com/mui/base-ui/blob/master/CHANGELOG.md)
    - [Commits](https://github.com/mui/base-ui/commits/v1.7.0/packages/react)
    Updates `@tanstack/react-virtual` from 3.14.7 to 3.14.9
    - [Release notes](https://github.com/TanStack/virtual/releases)
    - [Changelog](https://github.com/TanStack/virtual/blob/main/packages/react-virtual/CHANGELOG.md)
    - [Commits](https://github.com/TanStack/virtual/commits/@tanstack/react-virtual@3.14.9/packages/react-virtual)
    Updates `lucide-react` from 1.25.0 to 1.29.0
    - [Release notes](https://github.com/lucide-icons/lucide/releases)
    - [Commits](https://github.com/lucide-icons/lucide/commits/1.29.0/packages/lucide-react)
    Updates `react` from 19.2.7 to 19.2.8
    - [Release notes](https://github.com/react/react/releases)
    - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
    - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react)
    Updates `react-dom` from 19.2.7 to 19.2.8
    - [Release notes](https://github.com/react/react/releases)
    - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
    - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom)
    Updates `shadcn` from 4.13.1 to 4.16.2
    - [Release notes](https://github.com/shadcn-ui/ui/releases)
    - [Changelog](https://github.com/shadcn-ui/ui/blob/main/packages/shadcn/CHANGELOG.md)
    - [Commits](https://github.com/shadcn-ui/ui/commits/shadcn@4.16.2/packages/shadcn)
    Updates `@astrojs/starlight` from 0.41.3 to 0.41.7
    - [Release notes](https://github.com/withastro/starlight/releases)
    - [Changelog](https://github.com/withastro/starlight/blob/main/packages/starlight/CHANGELOG.md)
    - [Commits](https://github.com/withastro/starlight/commits/@astrojs/starlight@0.41.7/packages/starlight)
    Updates `@modelcontextprotocol/sdk` from 1.29.0 to 1.30.0
    - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
    - [Commits](modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0)
    Updates `@aws-sdk/client-s3` from 3.1091.0 to 3.1105.0
    - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
    - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md)
    - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1105.0/clients/client-s3)
    Updates `@hono/node-server` from 2.0.11 to 2.1.0
    - [Release notes](https://github.com/honojs/node-server/releases)
    - [Commits](honojs/node-server@v2.0.11...v2.1.0)
    Updates `@sentry/bun` from 10.67.0 to 10.69.0
    - [Release notes](https://github.com/getsentry/sentry-javascript/releases)
    - [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.69.0/CHANGELOG.md)
    - [Commits](getsentry/sentry-javascript@10.67.0...10.69.0)
    Updates `@sentry/node` from 10.67.0 to 10.69.0
    - [Release notes](https://github.com/getsentry/sentry-javascript/releases)
    - [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.69.0/CHANGELOG.md)
    - [Commits](getsentry/sentry-javascript@10.67.0...10.69.0)
    Updates `add-mcp` from 1.13.0 to 2.0.0
    - [Release notes](https://github.com/neon-solutions/add-mcp/releases)
    - [Changelog](https://github.com/neon-solutions/add-mcp/blob/main/CHANGELOG.md)
    - [Commits](neon-solutions/add-mcp@v1.13.0...v2.0.0)
    Updates `hono` from 4.12.31 to 4.13.1
    - [Release notes](https://github.com/honojs/hono/releases)
    - [Commits](honojs/hono@v4.12.31...v4.13.1)
    Updates `posthog-node` from 5.46.0 to 5.48.1
    - [Release notes](https://github.com/PostHog/posthog-js/releases)
    - [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md)
    - [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.48.1/packages/node)
    Updates `ws` from 8.21.1 to 8.21.2
    - [Release notes](https://github.com/websockets/ws/releases)
    - [Commits](websockets/ws@8.21.1...8.21.2)
    Updates `@astrojs/language-server` from 2.16.12 to 2.16.13
    - [Release notes](https://github.com/withastro/astro/releases)
    - [Changelog](https://github.com/withastro/astro/blob/main/packages/language-tools/language-server/CHANGELOG.md)
    - [Commits](https://github.com/withastro/astro/commits/@astrojs/language-server@2.16.13/packages/language-tools/language-server)
    ---
    updated-dependencies:
    - dependency-name: typescript
    dependency-version: 7.0.2
    dependency-type: direct:production
    update-type: version-update:semver-major
    dependency-group: production-dependencies
    - dependency-name: "@astrojs/cloudflare"
    dependency-version: 14.2.0
    dependency-type: direct:production
    update-type: version-update:semver-minor
    dependency-group: production-dependencies
    - dependency-name: "@sentry/browser"
    dependency-version: 10.69.0
    dependency-type: direct:production
    update-type: version-update:semver-minor
    dependency-group: production-dependencies
    - dependency-name: "@tabler/icons"
    dependency-version: 3.46.0
    dependency-type: direct:production
    update-type: version-update:semver-minor
    dependency-group: production-dependencies
    - dependency-name: "@tanstack/virtual-core"
    dependency-version: 3.17.7
    dependency-type: direct:production
    update-type: version-update:semver-patch
    dependency-group: production-dependencies
    - dependency-name: astro
    dependency-version: 7.2.0
    dependency-type: direct:production
    update-type: version-update:semver-minor
    dependency-group: production-dependencies
    - dependency-name: posthog-js
    dependency-version: 1.413.3
    dependency-type: direct:production
    update-type: version-update:semver-minor
    dependency-group: production-dependencies
    - dependency-name: tailwind-variants
    dependency-version: 3.3.1
    dependency-type: direct:production
    update-type: version-update:semver-minor
    dependency-group: production-dependencies
    - dependency-name: "@astrojs/react"
    dependency-version: 6.0.2
    dependency-type: direct:production
    update-type: version-update:semver-patch
    dependency-group: production-dependencies
    - dependency-name: "@base-ui/react"
    dependency-version: 1.7.0
    dependency-type: direct:production
    update-type: version-update:semver-minor
    dependency-group: production-dependencies
    - dependency-name: "@tanstack/react-virtual"
    dependency-version: 3.14.9
    dependency-type: direct:production
    update-type: version-update:semver-patch
    dependency-group: production-dependencies
    - dependency-name: lucide-react
    dependency-version: 1.29.0
    dependency-type: direct:production
    update-type: version-update:semver-minor
    dependency-group: production-dependencies
    - dependency-name: react
    dependency-version: 19.2.8
    dependency-type: direct:production
    update-type: version-update:semver-patch
    dependency-group: production-dependencies
    - dependency-name: react-dom
    dependency-version: 19.2.8
    dependency-type: direct:production
    update-type: version-update:semver-patch
    dependency-group: production-dependencies
    - dependency-name: shadcn
    dependency-version: 4.16.2
    dependency-type: direct:production
    update-type: version-update:semver-minor
    dependency-group: production-dependencies
    - dependency-name: "@astrojs/starlight"
    dependency-version: 0.41.7
    dependency-type: direct:production
    update-type: version-update:semver-patch
    dependency-group: production-dependencies
    - dependency-name: "@modelcontextprotocol/sdk"
    dependency-version: 1.30.0
    dependency-type: direct:production
    update-type: version-update:semver-minor
    dependency-group: production-dependencies
    - dependency-name: "@aws-sdk/client-s3"
    dependency-version: 3.1105.0
    dependency-type: direct:production
    update-type: version-update:semver-minor
    dependency-group: production-dependencies
    - dependency-name: "@hono/node-server"
    dependency-version: 2.1.0
    dependency-type: direct:production
    update-type: version-update:semver-minor
    dependency-group: production-dependencies
    - dependency-name: "@sentry/bun"
    dependency-version: 10.69.0
    dependency-type: direct:production
    update-type: version-update:semver-minor
    dependency-group: production-dependencies
    - dependency-name: "@sentry/node"
    dependency-version: 10.69.0
    dependency-type: direct:production
    update-type: version-update:semver-minor
    dependency-group: production-dependencies
    - dependency-name: add-mcp
    dependency-version: 2.0.0
    dependency-type: direct:production
    update-type: version-update:semver-major
    dependency-group: production-dependencies
    - dependency-name: hono
    dependency-version: 4.13.1
    dependency-type: direct:production
    update-type: version-update:semver-minor
    dependency-group: production-dependencies
    - dependency-name: posthog-node
    dependency-version: 5.48.1
    dependency-type: direct:production
    update-type: version-update:semver-minor
    dependency-group: production-dependencies
    - dependency-name: ws
    dependency-version: 8.21.2
    dependency-type: direct:production
    update-type: version-update:semver-patch
    dependency-group: production-dependencies
    - dependency-name: "@astrojs/language-server"
    dependency-version: 2.16.13
    dependency-type: direct:production
    update-type: version-update:semver-patch
    dependency-group: production-dependencies
    ...
    Signed-off-by: dependabot[bot] <support@github.com>
    @dependabotdependabotBot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 10, 2026
    @greptile-apps

    Copy link
    Copy Markdown
    Contributor

    PR author is in the excluded authors list.

    @socket-security

    Copy link
    Copy Markdown

    Warning

    Review the following alerts detected in dependencies.

    According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

    ActionSeverityAlert (click "▶" to expand/collapse)
    WarnHigh
    Obfuscated code: npm @sentry/node-core is 60.0% likely obfuscated

    Confidence: 0.60

    Location:Package overview

    From:pnpm-lock.yamlnpm/@sentry/node@10.69.0npm/@sentry/node-core@10.69.0

    ℹ Read more on: This package | This alert | What is obfuscated code?

    Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

    Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

    Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@sentry/node-core@10.69.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

    View full report

    @dependabot@github

    dependabotBot commented on behalf of githubAug 17, 2026

    Copy link
    Copy Markdown
    ContributorAuthor

    Looks like these dependencies are updatable in another way, so this is no longer needed.

    @dependabotdependabotBot closed this Aug 17, 2026
    @dependabot
    dependabotBot deleted the dependabot/npm_and_yarn/production-dependencies-954899eb08 branch August 17, 2026 09:38
    Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

    Labels

    dependenciesPull requests that update a dependency filejavascriptPull requests that update javascript code

    Projects

    None yet

    Development

    Successfully merging this pull request may close these issues.

    0 participants