Skip to content

build(deps): bump the production-dependencies group across 1 directory with 12 updates - #30

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-65c04ec601
Open

build(deps): bump the production-dependencies group across 1 directory with 12 updates#30
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-65c04ec601

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 14, 2026

Copy link
Copy Markdown

Bumps the production-dependencies group with 12 updates in the / directory:

Package From To
@azure/identity 4.13.1 4.13.2
@azure/monitor-opentelemetry 1.19.0 1.20.0
bullmq 5.81.3 5.81.5
jszip 3.10.1 3.10.2
lucide-react 0.441.0 0.577.0
mammoth 1.12.0 1.12.2
next 15.5.23 15.5.25
openai 7.4.0 7.15.0
react 19.2.8 19.3.0
react-dom 19.2.8 19.3.0
react-hook-form 7.84.0 7.87.0
tsx 4.23.9 4.23.13

Updates @azure/identity from 4.13.1 to 4.13.2

Changelog

Sourced from @​azure/identity's changelog.

4.13.2 (2026-08-12)

Other Changes

  • Bumped the minimum @azure/msal-node dependency to ^5.1.5 so installs no longer resolve older 5.1.x versions that pull in the vulnerable uuid@8.3.0 transitive dependency. #39569
  • Replaced shell-based developer credential commands with safe, structured process execution. #39279
  • Migrated platform-specific module resolution to #platform/* imports. #38309

4.14.0-beta.5 (2026-08-12)

Other Changes

  • Bumped the minimum @azure/msal-node dependency to ^5.1.5 so installs no longer resolve older 5.1.x versions that pull in the vulnerable uuid@8.3.0 transitive dependency. #39425
  • Replaced shell-based developer credential commands with safe, structured process execution. #39279

4.14.0-beta.4 (2026-06-08)

Bugs Fixed

  • Fixed AzureDeveloperCliCredential to correctly parse error messages from Azure Developer CLI v1.23.7 and later, which previously caused raw JSON to surface in the credential error instead of the underlying error text. #38416
  • Fixed handleMsalError to preserve the original MSAL error via cause on AuthenticationRequiredError, allowing callers to access .claims on the underlying error. #38722

4.14.0-beta.3 (2026-04-08)

Other Changes

  • Reduced bundle size by optimizing imports from @azure/msal-node, e.g. achieving a ~61kb reduction (from 851kb to 790kb) when importing ClientCertificateCredential. #36942
  • Updated @azure/msal-node to ^5.1.0 and @azure/msal-browser to ^5.5.0. #37836
Commits
  • ffeacaf Migrate @​azure/identity from polyfillSuffix to #platform/* imports
  • 3ec2003 [core] Add safe child process execution
  • 1f7253a Update package.json
  • 4b6cf67 Update test expectation
  • 14350c8 Format packages
  • 4fd7288 Update all missing configuration files
  • 8490453 [Identity] Bump @​azure/msal-node to ^5.1.5 to drop vulnerable uuid transitive...
  • d96ae18 Identity GA 4.13.1
  • a46a830 [ESLint] Restore no-unassigned-vars recommended rule to error (#39460)
  • 5316d04 [core] Add safe child process execution (#39279)
  • Additional commits viewable in compare view

Updates @azure/monitor-opentelemetry from 1.19.0 to 1.20.0

Changelog

Sourced from @​azure/monitor-opentelemetry's changelog.

1.20.0 (2026-09-04)

Features Added

  • instrumentationOptions.console now accepts a logSeverity value, allowing the console log severity to be configured programmatically instead of only through the APPLICATIONINSIGHTS_INSTRUMENTATION_LOGGING_LEVEL environment variable. #39483
  • Added support for the Azure Container Apps resource detector from @opentelemetry/resource-detector-azure. #39510

Bugs Fixed

  • Fixed incorrect performance-counter sampling by giving standard and normalized process CPU counters independent state and initializing the first request and exception rate intervals with the current time. #39520
  • Fixed a failed IMDS request being recorded as a dependency when running on App Service, Functions, and Container Apps. The Azure VM resource detector now runs only when no other detector has identified the platform. #39510
  • The built-in BatchSpanProcessor now respects the standard OpenTelemetry OTEL_BSP_* environment variables. #39607

Other Changes

  • Updated OpenTelemetry stable dependencies to ^2.10.0, experimental dependencies to ^0.221.0, semantic conventions to ^1.43.0, and bundled contrib instrumentations, resource detector, and Winston transport to their latest compatible versions. #39649
  • Updated to using exporter version 1.0.0-beta.45.
Commits
  • cb052a5 [monitor-opentelemetry] Release 1.20.0 distro and 1.0.0-beta.45 exporter (#39...
  • 96a244f [ESLint] Restore no-useless-assignment recommended rule to error (#39784)
  • b80bda3 [Monitor OpenTelemetry] Respect OTEL_BSP environment variables (#39718)
  • fc7fcda [monitor-opentelemetry][monitor-opentelemetry-exporter] Update OpenTelemetry ...
  • e9ffbb9 [monitor-opentelemetry] Skip the IMDS probe when the hosting platform is alre...
  • 09b74bb [monitor-opentelemetry] Scope AKS resource detector Statsbeat feature to real...
  • 993bf9e Fix performance counter sampling in monitor-opentelemetry (#39520)
  • 23dd8c1 [monitor-opentelemetry] Honor explicit console logSeverity over the environme...
  • 7170977 [EngSys] bump @opentelemetry/* dependencies' versions (#39464)
  • See full diff in compare view

Updates bullmq from 5.81.3 to 5.81.5

Release notes

Sourced from bullmq's releases.

v5.81.5

5.81.5 (2026-09-10)

Bug Fixes

  • worker: backport blocking client recovery to v5.x (#4722) (9767238)

v5.81.4

5.81.4 (2026-08-27)

Bug Fixes

  • flow-producer: add createScripts method for extension (#4641) (9884e09)
Commits
  • 9767238 fix(worker): backport blocking client recovery to v5.x (#4722)
  • cdc20e1 chore(release): 5.81.4 (#4645)
  • 9884e09 fix(flow-producer): add createScripts method for extension (#4641)
  • eb23031 ci: add support for releases in the v5 branch
  • 5dfd23a chore(release): vrs1.2.1 (#4406)
  • eb956b0 fix(deps): pin dependencies [rust] (#4402)
  • fcd8281 chore(deps): update dependency picomatch to v4.0.5 (#4398)
  • 0b820ac chore(deps): update dependency tar to v7.5.22 (#4400)
  • b73c328 chore(deps): update dependency python to v3.14.6 (#4399)
  • 4fca524 chore(deps): update actions/upload-artifact action to v7.0.1 (#4397)
  • Additional commits viewable in compare view

Updates jszip from 3.10.1 to 3.10.2

Changelog

Sourced from jszip's changelog.

v3.10.2 2026-09-09

  • Fix cross-realm binary type detection in getTypeOf. Fixes #759 (see #578)
  • Add missing types for JSZip.defaults. Fixes #690 (see #927)
  • Fix Blob support in Node.js 18 and up. Fixes #941 (see #955)
Commits
Maintainer changes

This version was pushed to npm by jkoops, a new releaser for jszip since your current version.


Updates lucide-react from 0.441.0 to 0.577.0

Release notes

Sourced from lucide-react's releases.

Version 0.577.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@0.576.0...0.577.0

Version 0.576.0

What's Changed

Full Changelog: lucide-icons/lucide@0.575.0...0.576.0

Version 0.575.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@0.573.0...0.575.0

Version 0.574.0

What's Changed

New Contributors

... (truncated)

Commits
  • f6c0d06 chore(deps): bump rollup from 4.53.3 to 4.59.0 (#4106)
  • 67c0485 feat(scripts): added helper script to automatically update OpenCollective bac...
  • b6ed43d feat(packages): Added aria-hidden fallback for decorative icons to all packag...
  • 076e0bb chore(dependencies): Update dependencies (#3809)
  • 80d6f73 fix(icons): Rename fingerprint icon to fingerprint-pattern (#3767)
  • 1cfb3ff chore(deps-dev): bump vite from 6.3.5 to 6.3.6 (#3611)
  • e71198d chore: icon alias improvements (#2861)
  • 3e644fd chore(scripts): Refactor scripts to typescript (#3316)
  • 19fa01b build(deps-dev): bump vite from 6.3.2 to 6.3.4 (#3181)
  • 03eb862 use implicit return in react package (#2325)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for lucide-react since your current version.


Updates mammoth from 1.12.0 to 1.12.2

Changelog

Sourced from mammoth's changelog.

1.12.2

  • Avoid prototype pollution when reading the styles defined in a document. This avoids an issue where a maliciously crafted document could be used to set externalFileAccess to true.

1.12.1

  • Fix: on Windows, when an image's content type includes a backslash in the subpart, files may be written outside of the directory set by --output-dir.

  • Detect and ignore numbering levels that use numStyleLink to refer to themselves.

Commits
  • 8706034 Bump version to 1.12.2
  • 2888fa1 Create objects without prototypes when used as map with arbitrary keys
  • 31f0c37 Avoid prototype pollution when reading styles
  • e3b9cec Bump version to 1.12.1
  • c69ea62 Ignore numbering levels that use numStyleLink to refer to themselves
  • fbf5e22 Check image content type for backslashes
  • 1a495a9 Add note on performance
  • ee59684 Remove donations section
  • See full diff in compare view

Updates next from 15.5.23 to 15.5.25

Release notes

Sourced from next's releases.

v15.5.25

Follow-up release to v15.5.24 re-enabling AVIF Image Optimization when newer versions of sharp are installed (#97954).

v15.5.24

This release contains security fixes for the following advisories:

Critical:

Commits
  • 013ee1d v15.5.25
  • d64c0d1 [15.5.x] Re-enable AVIF image optimization with a runtime libheif version gua...
  • 7f6b400 [test] Fix 15.5.x deploy tests (#97977)
  • 1a80896 [15.5.x][ci] Run flake detection and new deploy tests when merged and on back...
  • 6d9b5d8 [15.5.x] ci: remove pull_request_stats workflow (#97976)
  • b6c45b4 v15.5.24
  • b0f3460 [15.5.x] Fix ISR misses with backslashes in segments when deployed on Windows
  • 409772e [15.5.x] [next/image]: disable avif image optimization
  • 9c44b88 [15.x] support sharp 0.34 and 0.35
  • 144fa5d [15.5.x] Remove generated error codes (#97783)
  • Additional commits viewable in compare view

Updates openai from 7.4.0 to 7.15.0

Release notes

Sourced from openai's releases.

v7.15.0

7.15.0 (2026-09-10)

Features

v7.14.0

7.14.0 (2026-09-10)

Features

Bug Fixes

  • deps-dev: bump joi from 18.2.3 to 18.2.5 in /ecosystem-tests/vercel-edge (#2702) (029b805)
  • deps: bump next from 15.5.23 to 15.5.25 in /ecosystem-tests/vercel-edge (#2703) (e9446db)
  • deps: bump sharp from 0.35.3 to 0.35.4 in /ecosystem-tests/vercel-edge (#2704) (ca95705)
  • deps: update remaining tooling and fixture patches (#2712) (bcaabee)

v7.13.0

7.13.0 (2026-09-09)

Features

v7.12.1

7.12.1 (2026-09-09)

Includes the GPT Image 2.5 support from 7.12.0, which was not published to npm.

Features

  • api: add GPT Image 2.5 models and image options (#2705) (6500a16)

Bug Fixes

  • ci: run Cloudflare example regressions before release (#2706) (c5cc31c)

v7.12.0

7.12.0 (2026-09-08)

... (truncated)

Changelog

Sourced from openai's changelog.

7.15.0 (2026-09-10)

Features

7.14.0 (2026-09-10)

Features

Bug Fixes

  • deps-dev: bump joi from 18.2.3 to 18.2.5 in /ecosystem-tests/vercel-edge (#2702) (029b805)
  • deps: bump next from 15.5.23 to 15.5.25 in /ecosystem-tests/vercel-edge (#2703) (e9446db)
  • deps: bump sharp from 0.35.3 to 0.35.4 in /ecosystem-tests/vercel-edge (#2704) (ca95705)
  • deps: update remaining tooling and fixture patches (#2712) (bcaabee)

7.13.0 (2026-09-09)

Features

7.12.1 (2026-09-09)

Includes the GPT Image 2.5 support from 7.12.0, which was not published to npm.

Features

  • api: add GPT Image 2.5 models and image options (#2705) (6500a16)

Bug Fixes

  • ci: run Cloudflare example regressions before release (#2706) (c5cc31c)

7.12.0 (2026-09-08)

Features

  • api: add GPT Image 2.5 models and image options (#2705) (6500a16)

... (truncated)

Commits
  • 50eb4b2 release: 7.15.0 (#2720)
  • 20a47f9 feat(api): add Agents API (#2719)
  • c1f88cd release: 7.14.0 (#2711)
  • c037ba7 feat(api) Add Live API (#2718)
  • fe2d6a3 test: reduce CI subprocess and validation overhead (#2713)
  • bcaabee fix(deps): update remaining tooling and fixture patches (#2712)
  • 029b805 fix(deps-dev): bump joi from 18.2.3 to 18.2.5 in /ecosystem-tests/vercel-edge...
  • e9446db fix(deps): bump next from 15.5.23 to 15.5.25 in /ecosystem-tests/vercel-edge ...
  • ca95705 fix(deps): bump sharp from 0.35.3 to 0.35.4 in /ecosystem-tests/vercel-edge (...
  • a661a7d release: 7.13.0 (#2710)
  • Additional commits viewable in compare view

Updates react from 19.2.8 to 19.3.0

Release notes

Sourced from react's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

New React DOM Features

  • browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
    • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

All Changes

React

... (truncated)

Changelog

Sourced from react's changelog.

19.3.0 (September 9, 2026)

New React Features

@dependabot
build(deps): bump the production-dependencies group across 1 director…
ff8aae0 
…y with 12 updates

Bumps the production-dependencies group with 12 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@azure/identity](https://github.com/Azure/azure-sdk-for-js/tree/HEAD/sdk/identity/identity) | `4.13.1` | `4.13.2` |
| [@azure/monitor-opentelemetry](https://github.com/Azure/azure-sdk-for-js/tree/HEAD/sdk/monitor/monitor-opentelemetry) | `1.19.0` | `1.20.0` |
| [bullmq](https://github.com/taskforcesh/bullmq) | `5.81.3` | `5.81.5` |
| [jszip](https://github.com/Stuk/jszip) | `3.10.1` | `3.10.2` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `0.441.0` | `0.577.0` |
| [mammoth](https://github.com/mwilliamson/mammoth.js) | `1.12.0` | `1.12.2` |
| [next](https://github.com/vercel/next.js) | `15.5.23` | `15.5.25` |
| [openai](https://github.com/openai/openai-node) | `7.4.0` | `7.15.0` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.8` | `19.3.0` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.8` | `19.3.0` |
| [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.84.0` | `7.87.0` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.9` | `4.23.13` |



Updates `@azure/identity` from 4.13.1 to 4.13.2
- [Release notes](https://github.com/Azure/azure-sdk-for-js/releases)
- [Changelog](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/CHANGELOG.md)
- [Commits](https://github.com/Azure/azure-sdk-for-js/commits/@azure/identity_4.13.2/sdk/identity/identity)

Updates `@azure/monitor-opentelemetry` from 1.19.0 to 1.20.0
- [Release notes](https://github.com/Azure/azure-sdk-for-js/releases)
- [Changelog](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/monitor/monitor-opentelemetry/CHANGELOG.md)
- [Commits](https://github.com/Azure/azure-sdk-for-js/commits/@azure/monitor-opentelemetry_1.20.0/sdk/monitor/monitor-opentelemetry)

Updates `bullmq` from 5.81.3 to 5.81.5
- [Release notes](https://github.com/taskforcesh/bullmq/releases)
- [Commits](taskforcesh/bullmq@v5.81.3...v5.81.5)

Updates `jszip` from 3.10.1 to 3.10.2
- [Changelog](https://github.com/Stuk/jszip/blob/main/CHANGES.md)
- [Commits](Stuk/jszip@v3.10.1...v3.10.2)

Updates `lucide-react` from 0.441.0 to 0.577.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/0.577.0/packages/lucide-react)

Updates `mammoth` from 1.12.0 to 1.12.2
- [Release notes](https://github.com/mwilliamson/mammoth.js/releases)
- [Changelog](https://github.com/mwilliamson/mammoth.js/blob/master/NEWS)
- [Commits](mwilliamson/mammoth.js@1.12.0...1.12.2)

Updates `next` from 15.5.23 to 15.5.25
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v15.5.23...v15.5.25)

Updates `openai` from 7.4.0 to 7.15.0
- [Release notes](https://github.com/openai/openai-node/releases)
- [Changelog](https://github.com/openai/openai-node/blob/main/CHANGELOG.md)
- [Commits](openai/openai-node@v7.4.0...v7.15.0)

Updates `react` from 19.2.8 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react)

Updates `react-dom` from 19.2.8 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react-dom)

Updates `react-hook-form` from 7.84.0 to 7.87.0
- [Release notes](https://github.com/react-hook-form/react-hook-form/releases)
- [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md)
- [Commits](react-hook-form/react-hook-form@v7.84.0...v7.87.0)

Updates `tsx` from 4.23.9 to 4.23.13
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.23.9...v4.23.13)

---
updated-dependencies:
- dependency-name: "@azure/identity"
  dependency-version: 4.13.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@azure/monitor-opentelemetry"
  dependency-version: 1.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: bullmq
  dependency-version: 5.81.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: jszip
  dependency-version: 3.10.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: lucide-react
  dependency-version: 0.577.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: mammoth
  dependency-version: 1.12.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: next
  dependency-version: 15.5.25
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: openai
  dependency-version: 7.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: react
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: react-dom
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: react-hook-form
  dependency-version: 7.87.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: tsx
  dependency-version: 4.23.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants