Skip to content

fix(deps): bump the prod-minor-patch group across 1 directory with 15 updates - #441

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/prod-minor-patch-1c3cd5ef75
Open

fix(deps): bump the prod-minor-patch group across 1 directory with 15 updates#441
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/prod-minor-patch-1c3cd5ef75

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 17, 2026

Copy link
Copy Markdown
Contributor

Bumps the prod-minor-patch group with 15 updates in the / directory:

Package From To
@ably/chat 1.3.1 1.4.0
@inquirer/prompts 8.4.2 8.5.2
@oclif/core 4.11.1 4.13.3
@oclif/plugin-autocomplete 3.2.48 3.2.56
@oclif/plugin-warn-if-update-available 3.1.63 3.1.73
ably 2.21.0 2.27.0
open 11.0.0 11.0.1
ora 9.4.0 9.4.1
react 19.2.6 19.2.8
react-dom 19.2.6 19.2.8
smol-toml 1.6.1 1.8.0
tar 7.5.21 7.5.22
ws 8.20.0 8.21.3
lucide-react 1.14.0 1.31.0
tailwind-merge 3.5.0 3.6.0

Updates @ably/chat from 1.3.1 to 1.4.0

Release notes

Sourced from @​ably/chat's releases.

V1.4.0

What's Changed

New Contributors

Full Changelog: ably/ably-chat-js@1.3.1...1.4.0

Changelog

Sourced from @​ably/chat's changelog.

1.4.0 (2026-05-28)

New Features

  • Message Version History: Added room.messages.getVersions(serial) to retrieve the full version history of a message — the original create followed by any updates and deletes — in oldest-first order. #730
  • Idempotent REST Publishing: Added an opt-in idempotentRestPublishing flag on ChatClientOptions (default false). When enabled, the SDK attaches an idempotencyKey to send, update, and delete message requests so the server can deduplicate retried publish attempts. #726

Bug Fixes

  • Package Exports: Reordered the "types" condition to appear first in package.json exports so type resolution works correctly across bundlers. #725
  • Security: Bumped ws to 8.20.1 to resolve GHSA-58qx-3vcg-4xpx. #727
Commits
  • 1c9b068 Merge pull request #729 from ably/release/1.4.0
  • 89e560c chore: release 1.4.0
  • 47e4211 chore: release 1.4.0
  • 85b0e35 Merge pull request #730 from ably/feat/message-versions
  • 7770e52 docs: fix getVersions JSDoc and restore eslint ignores for local files
  • 3234f73 test: replace fixed sleep with vi.waitFor in versions integration test
  • b94dfd9 feat: add getVersions() to retrieve full message version history
  • b740b63 Merge pull request #726 from ably/feat/add-idempotent-rest-publish-support
  • f999a29 review: make idempotentRestPublishing required on ChatApi
  • 6592172 review: address PR #726 feedback
  • Additional commits viewable in compare view

Updates @inquirer/prompts from 8.4.2 to 8.5.2

Release notes

Sourced from @​inquirer/prompts's releases.

@​inquirer/prompts@​8.5.2

  • Fix security warnings in external-editor

@​inquirer/prompts@​8.5.1

  • Rolled back mute-stream dependency from v4 to v3 to undo breaking compatible engines.
  • Added tooling to prevent regression of the above in the future. This surfaced our min engines already enforced a higher limit, so adjusted the explicit limits to match the current state.

@​inquirer/prompts@​8.5.0

  • Feat: Read env variable INQUIRER_KEYBINDINGS to enable vim or emacs keybindings; making this a user preference instead of a library author preference. One caveat is doing so disable the search feature in the select prompt. Syntax: INQUIRER_KEYBINDINGS=vim,emacs.
  • Fix: Line wraps would sometime cause the cursor to be mispositioned relative to the input.
  • Chore: Bump dependencies.

@​inquirer/prompts@​8.4.3

  • Fix: Windows rendering bug
  • Fix: Preserve exact literal types in choices array (Typescript only)
  • Fix: Allow input default value to be of type undefined (Typescript only)
  • Bump dependencies
Commits
  • bfd8710 chore: Publish new release
  • 55cc5f3 feat: add reusable package lint CLI
  • 3af9ed0 test(inquirer): capture prompt runner output
  • 4381857 fix(@​inquirer/input): remove stale lint suppression
  • 45df331 fix(@​inquirer/external-editor): harden editor temp files
  • adef323 chore: limit CI token permissions
  • b43359d chore: Publish new release
  • 24ecae2 chore: fix yarn.lock
  • b078d97 fix: validate package engine compatibility
  • 3a49f9f chore(deps-dev): Bump oxfmt in the formatting group (#2143)
  • Additional commits viewable in compare view

Updates @oclif/core from 4.11.1 to 4.13.3

Release notes

Sourced from @​oclif/core's releases.

4.13.3

Bug Fixes

  • deps: bump ip-address from 10.2.0 to 10.4.0 (e13240b)

4.13.2

Bug Fixes

  • deps: bump postcss from 8.5.10 to 8.5.23 (169b09a)

4.13.1

Bug Fixes

  • deps: bump tar from 7.5.16 to 7.5.22 (bc0d2d2)

4.13.0

Features

  • expose root help formatter (644c4aa)

4.12.0

Features

  • add Args.option() for typed arg options (93139f7)

4.11.14

Bug Fixes

  • deps: bump @​sigstore/core from 3.2.0 to 3.2.1 (b45271f)

4.11.13

Bug Fixes

  • deps: bump sigstore from 4.1.0 to 4.1.1 (5d7fe54)

4.11.12

Bug Fixes

  • deps: bump @​sigstore/verify from 3.1.0 to 3.1.1 (e00068f)

4.11.11

Bug Fixes

  • deps: bump undici from 6.25.0 to 6.27.0 (319945a)

4.11.10

Bug Fixes

  • deps: bump tinyglobby from 0.2.16 to 0.2.17 (f941872)

... (truncated)

Changelog

Sourced from @​oclif/core's changelog.

4.13.3 (2026-08-04)

Bug Fixes

  • deps: bump ip-address from 10.2.0 to 10.4.0 (e13240b)

4.13.2 (2026-07-27)

Bug Fixes

  • deps: bump postcss from 8.5.10 to 8.5.23 (169b09a)

4.13.1 (2026-07-27)

Bug Fixes

  • deps: bump tar from 7.5.16 to 7.5.22 (bc0d2d2)

4.13.0 (2026-07-23)

Features

  • expose root help formatter (644c4aa)
Commits
  • 617b3cd chore(release): 4.13.3 [skip ci]
  • b143cdc Merge pull request #1633 from oclif/dependabot-npm_and_yarn-ip-address-10.4.0
  • e13240b fix(deps): bump ip-address from 10.2.0 to 10.4.0
  • f70eb7a chore(release): 4.13.2 [skip ci]
  • fa7f31a Merge pull request #1632 from oclif/dependabot-npm_and_yarn-postcss-8.5.23
  • 169b09a fix(deps): bump postcss from 8.5.10 to 8.5.23
  • 84e84e9 chore(release): 4.13.1 [skip ci]
  • 77e3c43 Merge pull request #1631 from oclif/dependabot-npm_and_yarn-tar-7.5.22
  • bc0d2d2 fix(deps): bump tar from 7.5.16 to 7.5.22
  • 2ba8f2f chore(release): 4.13.0 [skip ci]
  • Additional commits viewable in compare view

Updates @oclif/plugin-autocomplete from 3.2.48 to 3.2.56

Release notes

Sourced from @​oclif/plugin-autocomplete's releases.

3.2.56

Bug Fixes

  • deps: bump @​oclif/core from 4.13.2 to 4.13.3 (#1190) (7fda1ce)

3.2.55

Bug Fixes

  • deps: bump @​oclif/core from 4.13.0 to 4.13.2 (#1186) (a4c731a)

3.2.54

Bug Fixes

  • deps: bump @​oclif/core from 4.11.14 to 4.13.0 (#1182) (b7e1eea)

3.2.53

Bug Fixes

  • deps: bump @​oclif/core from 4.11.8 to 4.11.11 (#1171) (330eecd)

3.2.52

Bug Fixes

  • deps: bump @​oclif/core from 4.11.4 to 4.11.8 (#1163) (f31fb99)

3.2.51

Bug Fixes

  • deps: bump @​babel/core from 7.10.3 to 7.29.7 (#1166) (9c9fc57)

3.2.50

Bug Fixes

  • deps: bump @​oclif/core from 4.11.3 to 4.11.4 (#1151) (f25d073)

3.2.49

Bug Fixes

  • deps: bump @​oclif/core from 4.11.0 to 4.11.2 (#1146) (4127ce2)
Changelog

Sourced from @​oclif/plugin-autocomplete's changelog.

3.2.56 (2026-08-09)

Bug Fixes

  • deps: bump @​oclif/core from 4.13.2 to 4.13.3 (#1190) (7fda1ce)

3.2.55 (2026-08-02)

Bug Fixes

  • deps: bump @​oclif/core from 4.13.0 to 4.13.2 (#1186) (a4c731a)

3.2.54 (2026-07-26)

Bug Fixes

  • deps: bump @​oclif/core from 4.11.14 to 4.13.0 (#1182) (b7e1eea)

3.2.53 (2026-06-28)

Bug Fixes

  • deps: bump @​oclif/core from 4.11.8 to 4.11.11 (#1171) (330eecd)

3.2.52 (2026-06-22)

Bug Fixes

  • deps: bump @​oclif/core from 4.11.4 to 4.11.8 (#1163) (f31fb99)

3.2.51 (2026-06-21)

Bug Fixes

  • deps: bump @​babel/core from 7.10.3 to 7.29.7 (#1166) (9c9fc57)

3.2.50 (2026-05-24)

Bug Fixes

  • deps: bump @​oclif/core from 4.11.3 to 4.11.4 (#1151) (f25d073)

3.2.49 (2026-05-10)

Bug Fixes

  • deps: bump @​oclif/core from 4.11.0 to 4.11.2 (#1146) (4127ce2)
Commits
  • 18d8942 chore(release): 3.2.56 [skip ci]
  • 7fda1ce fix(deps): bump @​oclif/core from 4.13.2 to 4.13.3 (#1190)
  • 4936ec9 chore(dev-deps): bump @​oclif/plugin-help from 6.2.55 to 6.2.56 (#1191)
  • 55cc2f8 chore(release): 3.2.55 [skip ci]
  • a4c731a fix(deps): bump @​oclif/core from 4.13.0 to 4.13.2 (#1186)
  • 5a29c02 chore(dev-deps): bump @​oclif/test from 4.1.20 to 4.1.21 (#1187)
  • 36f50ef chore(dev-deps): bump eslint-config-oclif from 6.0.177 to 6.0.179 (#1188)
  • 833d193 chore(dev-deps): bump @​oclif/plugin-help from 6.2.53 to 6.2.55 (#1189)
  • 374ac06 chore(release): 3.2.54 [skip ci]
  • b7e1eea fix(deps): bump @​oclif/core from 4.11.14 to 4.13.0 (#1182)
  • Additional commits viewable in compare view

Updates @oclif/plugin-warn-if-update-available from 3.1.63 to 3.1.73

Release notes

Sourced from @​oclif/plugin-warn-if-update-available's releases.

3.1.73

Bug Fixes

  • deps: bump @​oclif/core from 4.13.2 to 4.13.3 (#1051) (f164051)

3.1.72

Bug Fixes

3.1.71

Bug Fixes

  • deps: bump @​oclif/core from 4.13.0 to 4.13.2 (#1050) (e5f6dd6)

3.1.70

Bug Fixes

  • deps: bump @​oclif/core from 4.11.14 to 4.13.0 (#1047) (4ae169a)

3.1.69

Bug Fixes

3.1.68

Bug Fixes

  • deps: bump @​oclif/core from 4.11.9 to 4.11.11 (#1034) (3a73be0)

3.1.67

Bug Fixes

  • deps: bump @​oclif/core from 4.11.4 to 4.11.9 (#1030) (35fb8be)

3.1.66

Bug Fixes

3.1.65

Bug Fixes

  • deps: bump @​oclif/core from 4.11.2 to 4.11.3 (#1019) (8a5e833)

3.1.64

Bug Fixes

  • deps: bump @​oclif/core from 4.11.0 to 4.11.2 (#1016) (6aa16a8)
Changelog

Sourced from @​oclif/plugin-warn-if-update-available's changelog.

3.1.73 (2026-08-09)

Bug Fixes

  • deps: bump @​oclif/core from 4.13.2 to 4.13.3 (#1051) (f164051)

3.1.72 (2026-08-09)

Bug Fixes

3.1.71 (2026-08-02)

Bug Fixes

  • deps: bump @​oclif/core from 4.13.0 to 4.13.2 (#1050) (e5f6dd6)

3.1.70 (2026-07-26)

Bug Fixes

  • deps: bump @​oclif/core from 4.11.14 to 4.13.0 (#1047) (4ae169a)

3.1.69 (2026-07-26)

Bug Fixes

3.1.68 (2026-06-28)

Bug Fixes

  • deps: bump @​oclif/core from 4.11.9 to 4.11.11 (#1034) (3a73be0)

3.1.67 (2026-06-21)

Bug Fixes

  • deps: bump @​oclif/core from 4.11.4 to 4.11.9 (#1030) (35fb8be)

3.1.66 (2026-06-21)

Bug Fixes

3.1.65 (2026-05-17)

... (truncated)

Commits
  • 1a76251 chore(release): 3.1.73 [skip ci]
  • f164051 fix(deps): bump @​oclif/core from 4.13.2 to 4.13.3 (#1051)
  • 22c6f1f chore(release): 3.1.72 [skip ci]
  • a2c8359 fix(deps): bump js-yaml from 4.3.0 to 4.3.1 (#1053)
  • b801fb1 chore(dev-deps): bump @​types/lodash from 4.17.24 to 4.17.25 (#1052)
  • 19f5f73 chore(release): 3.1.71 [skip ci]
  • e5f6dd6 fix(deps): bump @​oclif/core from 4.13.0 to 4.13.2 (#1050)
  • 85b7618 chore(dev-deps): bump eslint-config-oclif from 6.0.176 to 6.0.179 (#1045)
  • c0e2cda chore(dev-deps): bump prettier from 3.9.5 to 3.9.6 (#1046)
  • 821a007 chore(release): 3.1.70 [skip ci]
  • Additional commits viewable in compare view

Updates ably from 2.21.0 to 2.27.0

Release notes

Sourced from ably's releases.

v2.27.0

Full Changelog: ably/ably-js@2.26.0...2.27.0

What's Changed

  • Fall back to the base transport when a proxy rejects the WebSocket handshake outright, rather than reporting disconnected after exhausting every host #2285
  • Move connection resumability decisions from the client to the server: Connection#id, Connection#key and a channel's channelSerial are retained through SUSPENDED, and reconnection always attempts a resume. Connection#createRecoveryKey() consequently returns a recovery key in SUSPENDED, where it previously returned null #2273
  • Fix a resumed attach advancing the channel's attach serial, which broke the contiguity of untilAttach history with the realtime message stream #2276
  • Fix stale presence members surviving when a new presence sync replaces one still in progress #2261
  • Expand the docstrings on Auth, RealtimeChannel, RealtimePresence, RealtimeAnnotations and RestAnnotations to cover prerequisites, side effects and failure modes, and link the REST Channel and Presence members to their reference pages #2242 #2243 #2244 #2245 #2282

v2.26.0

Full Changelog

What's Changed

  • Add push.updateToken() to update the device's push token on React Native after the underlying push platform rotates it, keeping the device registration in sync with Ably #2267
  • Add a useObject React hook for subscribing to LiveObjects state #2259
  • PathObject.instance() method now returns undefined only if nothing exists at that path. It wraps whatever value resolves there: a LiveMap, a LiveCounter, or a primitive value. A primitive-backed Instance is read-only: it has no id and exposes the primitive via value().

v2.25.0

Full Changelog

What's Changed

  • Add push notification support for React Native via the new ably/react-native-push plugin. Adds an asynchronous client.getDevice() and deprecates the synchronous client.device() #2262
  • Surface previously silent failures when channel modes are missing: presence.get() without the presence_subscribe mode and channel.subscribe() without the subscribe mode now log an error, or throw when the new strictMode client option is enabled #2236

v2.24.0

What's Changed

  • Add iOS Live Activity support via APNs broadcast channels: push.admin.createApnsBroadcast and push.admin.liveActivity (start/update/end) #2253
  • Fix: use error code 40106 for missing credentials #2254

v2.23.0

Full Changelog: ably/ably-js@2.22.1...2.23.0

What's Changed

  • Allow omitting channelName in the React channel hooks to use the nearest ChannelProvider #2248
  • Fix presence auto-reenter causing "Unable to perform operation on channel" NACKs after reconnecting from a transient disconnect; presence operations are now queued at the channel level until the channel next re-attaches #2241

v2.22.1

Full Changelog: ably/ably-js@2.22.0...2.22.1

What's Changed

  • Fix v1-callback deprecated overloads breaking mock assignment by changing return type from never to void #2239

v2.22.0

... (truncated)

Changelog

Sourced from ably's changelog.

2.27.0 (2026-08-10)

Full Changelog

What's Changed

  • Fall back to the base transport when a proxy rejects the WebSocket handshake outright, rather than reporting disconnected after exhausting every host #2285
  • Move connection resumability decisions from the client to the server: Connection#id, Connection#key and a channel's channelSerial are retained through SUSPENDED, and reconnection always attempts a resume. Connection#createRecoveryKey() consequently returns a recovery key in SUSPENDED, where it previously returned null #2273
  • Fix a resumed attach advancing the channel's attach serial, which broke the contiguity of untilAttach history with the realtime message stream #2276
  • Fix stale presence members surviving when a new presence sync replaces one still in progress #2261
  • Expand the docstrings on Auth, RealtimeChannel, RealtimePresence, RealtimeAnnotations and RestAnnotations to cover prerequisites, side effects and failure modes, and link the REST Channel and Presence members to their reference pages #2242 #2243 #2244 #2245 #2282

2.26.0 (2026-07-22)

Full Changelog

What's Changed

  • Add push.updateToken() to update the device's push token on React Native after the underlying push platform rotates it, keeping the device registration in sync with Ably #2267
  • Add a useObject React hook for subscribing to LiveObjects state #2259
  • PathObject.instance() method now returns undefined only if nothing exists at that path. It wraps whatever value resolves there: a LiveMap, a LiveCounter, or a primitive value. A primitive-backed Instance is read-only: it has no id and exposes the primitive via value().

2.25.0 (2026-07-17)

Full Changelog

What's Changed

  • Add push notification support for React Native via the new ably/react-native-push plugin. Adds an asynchronous client.getDevice() and deprecates the synchronous client.device() #2262
  • Surface previously silent failures when channel modes are missing: presence.get() without the presence_subscribe mode and channel.subscribe() without the subscribe mode now log an error, or throw when the new strictMode client option is enabled #2236

2.24.0 (2026-07-08)

Full Changelog

What's Changed

  • Add iOS Live Activity support via APNs broadcast channels: push.admin.createApnsBroadcast and push.admin.liveActivity (start/update/end) #2253
  • Fix: use error code 40106 for missing credentials #2254

2.23.0 (2026-06-19)

Full Changelog

What's Changed

  • Allow omitting channelName in the React channel hooks to use the nearest ChannelProvider #2248
  • Fix presence auto-reenter causing "Unable to perform operation on channel" NACKs after reconnecting from a transient disconnect; presence operations are now queued at the channel level until the channel next re-attaches #2241

2.22.1 (2026-06-08)

... (truncated)

Commits
  • c3d0605 Merge pull request #2287 from ably/release/2.27.0
  • 6fec972 chore: release/2.27.0
  • 4bbcc1a Merge pull request #2285 from ably/fix-ws-fast-fail-base-transport-fallback
  • 2f34fdb fix: fall back to the base transport when websockets are rejected outright
  • 7fa7dc5 Merge pull request #2282 from ably/DX-1211/rest-see-links
  • 4a24f0a DX-1211: link the REST Channel and Presence members to their reference pages
  • 26054ca Merge pull request #2245 from ably/DX-1211/annotations-docstrings
  • 1b65ca1 DX-1211: address m-hulbert's review of the annotation docstrings
  • fb6dbaa DX-1211: align the annotation docstrings with the merged Auth, RealtimeChanne...
  • 0ae68bc DX-1211: single @​see on annotation members with the concept page inlined at t...
  • Additional commits viewable in compare view

Updates open from 11.0.0 to 11.0.1

Release notes

Sourced from open's releases.

v11.0.1

  • Fix WSL failure when the working directory is unreachable from Windows 6ac3fe4

sindresorhus/open@v11.0.0...v11.0.1

Commits

Updates ora from 9.4.0 to 9.4.1

Release notes

Sourced from ora's releases.

v9.4.1

  • Fix type definitions (#257) 431ebc4
  • Fix failText type to accept unknown instead of Error, matching the actual promise rejection value bc3a283

sindresorhus/ora@v9.4.0...v9.4.1

Commits

Updates react from 19.2.6 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

19.2.7 (June 1st, 2026)

React Server Components

Changelog

Sourced from react's changelog.

19.2.7 (June 1, 2026)

React Server Components

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react since your current version.


Updates react-dom from 19.2.6 to 19.2.8

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

19.2.7 (June 1st, 2026)

React Server Components

Changelog

Sourced from react-dom's changelog.

19.2.7 (June 1, 2026)

React Server Components

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react-dom since your current version.


Updates smol-toml from 1.6.1 to 1.8.0

Release notes

Sourced from smol-toml's releases.

v1.8.0

What's Changed

Full Changelog: squirrelchat/smol-toml@v1.7.2...v1.8.0

v1.7.2

What's Changed

Full Changelog: squirrelchat/smol-toml@v1.7.1...v1.7.2

v1.7.1

This release includes flagging internal functions as @internal to strip them from the emitted type declarations.

⚠️ Includes a fix for GHSA-7w5x-hrqm-74c2

Full Changelog: squirrelchat/smol-toml@v1.7.0...v1.7.1

v1.7.0

This version slightly changes the behaviour of stringify: integers beyond the safe range are always emitted as float numbers.

String decode logic has been rewritten, it is a bit faster now and uses a single-pass approach instead of a dual-pass approach as it did previously. The code should be a bit smaller too, though I didn't actually measure that.

The package is now published with source-maps, declaration-maps, and a copy of the original TypeScript source files. This will improve your DX if you're like me and like Ctrl+Click'ing things a lot. ;)

What's Changed

New Contributors

Full Changelog: squirrelchat/smol-toml@v1.6.1...v1.7.0

Commits
  • 6d0f477 chore: bump version
  • 97e9713 docs: mention temporal api
  • 7a3068d perf: ubench opt for instanceof Date
  • 7e8c09a feat: stringify temporal
  • 19239d0 chore: bump version
  • 5f55c3a chore: revert sourcemap publishing
  • 5c26f1b chore: update benchmarks
  • 92832d2 refactor: better logic orchestration in structs
  • 2fb9ab8 refactor: ctx object instead of pointer arg + tuple returns
  • e6017c4 ci: use staged publish
  • Additional commits viewable in compare view

Updates tar from 7.5.21 to 7.5.22

Commits

Updates ws from 8.20.0 to 8.21.3

Release notes

Sourced from ws's releases.

8.21.3

Bug fixes

  • The server now correctly rejects permessage-deflate offers if the incoming client_max_window_bits parameter value is smaller than its configured clientMaxWindowBits (e97a20ea).

8.21.2

Bug fixes

  • Fixed a test for CITGM (2eb3be0b).

8.21.1

Bug fixes

  • Empty fragments are now counted toward the limit (a2f4e7c0).
  • The default values of the maxBufferedChunks and maxFragments options have been reduced (f197ac65).

8.21.0

Features

  • Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

  • Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = ne...
Description has been truncated

… updates

Bumps the prod-minor-patch group with 15 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@ably/chat](https://github.com/ably/ably-chat-js) | `1.3.1` | `1.4.0` |
| [@inquirer/prompts](https://github.com/SBoudrias/Inquirer.js) | `8.4.2` | `8.5.2` |
| [@oclif/core](https://github.com/oclif/core) | `4.11.1` | `4.13.3` |
| [@oclif/plugin-autocomplete](https://github.com/oclif/plugin-autocomplete) | `3.2.48` | `3.2.56` |
| [@oclif/plugin-warn-if-update-available](https://github.com/oclif/plugin-warn-if-update-available) | `3.1.63` | `3.1.73` |
| [ably](https://github.com/ably/ably-js) | `2.21.0` | `2.27.0` |
| [open](https://github.com/sindresorhus/open) | `11.0.0` | `11.0.1` |
| [ora](https://github.com/sindresorhus/ora) | `9.4.0` | `9.4.1` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.6` | `19.2.8` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.6` | `19.2.8` |
| [smol-toml](https://github.com/squirrelchat/smol-toml) | `1.6.1` | `1.8.0` |
| [tar](https://github.com/isaacs/node-tar) | `7.5.21` | `7.5.22` |
| [ws](https://github.com/websockets/ws) | `8.20.0` | `8.21.3` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.14.0` | `1.31.0` |
| [tailwind-merge](https://github.com/dcastil/tailwind-merge) | `3.5.0` | `3.6.0` |



Updates `@ably/chat` from 1.3.1 to 1.4.0
- [Release notes](https://github.com/ably/ably-chat-js/releases)
- [Changelog](https://github.com/ably/ably-chat-js/blob/main/CHANGELOG.md)
- [Commits](ably/ably-chat-js@1.3.1...1.4.0)

Updates `@inquirer/prompts` from 8.4.2 to 8.5.2
- [Release notes](https://github.com/SBoudrias/Inquirer.js/releases)
- [Commits](https://github.com/SBoudrias/Inquirer.js/compare/@inquirer/prompts@8.4.2...@inquirer/prompts@8.5.2)

Updates `@oclif/core` from 4.11.1 to 4.13.3
- [Release notes](https://github.com/oclif/core/releases)
- [Changelog](https://github.com/oclif/core/blob/main/CHANGELOG.md)
- [Commits](oclif/core@4.11.1...4.13.3)

Updates `@oclif/plugin-autocomplete` from 3.2.48 to 3.2.56
- [Release notes](https://github.com/oclif/plugin-autocomplete/releases)
- [Changelog](https://github.com/oclif/plugin-autocomplete/blob/main/CHANGELOG.md)
- [Commits](oclif/plugin-autocomplete@3.2.48...3.2.56)

Updates `@oclif/plugin-warn-if-update-available` from 3.1.63 to 3.1.73
- [Release notes](https://github.com/oclif/plugin-warn-if-update-available/releases)
- [Changelog](https://github.com/oclif/plugin-warn-if-update-available/blob/main/CHANGELOG.md)
- [Commits](oclif/plugin-warn-if-update-available@3.1.63...3.1.73)

Updates `ably` from 2.21.0 to 2.27.0
- [Release notes](https://github.com/ably/ably-js/releases)
- [Changelog](https://github.com/ably/ably-js/blob/main/CHANGELOG.md)
- [Commits](ably/ably-js@2.21.0...2.27.0)

Updates `open` from 11.0.0 to 11.0.1
- [Release notes](https://github.com/sindresorhus/open/releases)
- [Commits](sindresorhus/open@v11.0.0...v11.0.1)

Updates `ora` from 9.4.0 to 9.4.1
- [Release notes](https://github.com/sindresorhus/ora/releases)
- [Commits](sindresorhus/ora@v9.4.0...v9.4.1)

Updates `react` from 19.2.6 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react)

Updates `react-dom` from 19.2.6 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom)

Updates `smol-toml` from 1.6.1 to 1.8.0
- [Release notes](https://github.com/squirrelchat/smol-toml/releases)
- [Commits](squirrelchat/smol-toml@v1.6.1...v1.8.0)

Updates `tar` from 7.5.21 to 7.5.22
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-tar@v7.5.21...v7.5.22)

Updates `ws` from 8.20.0 to 8.21.3
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.20.0...8.21.3)

Updates `lucide-react` from 1.14.0 to 1.31.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.31.0/packages/lucide-react)

Updates `tailwind-merge` from 3.5.0 to 3.6.0
- [Release notes](https://github.com/dcastil/tailwind-merge/releases)
- [Commits](dcastil/tailwind-merge@v3.5.0...v3.6.0)

---
updated-dependencies:
- dependency-name: "@ably/chat"
  dependency-version: 1.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-patch
- dependency-name: "@inquirer/prompts"
  dependency-version: 8.5.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-patch
- dependency-name: "@oclif/core"
  dependency-version: 4.13.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-patch
- dependency-name: "@oclif/plugin-autocomplete"
  dependency-version: 3.2.56
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-minor-patch
- dependency-name: "@oclif/plugin-warn-if-update-available"
  dependency-version: 3.1.73
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-minor-patch
- dependency-name: ably
  dependency-version: 2.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-patch
- dependency-name: open
  dependency-version: 11.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-minor-patch
- dependency-name: ora
  dependency-version: 9.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-minor-patch
- dependency-name: react
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-minor-patch
- dependency-name: react-dom
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-minor-patch
- dependency-name: smol-toml
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-patch
- dependency-name: tar
  dependency-version: 7.5.22
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-minor-patch
- dependency-name: ws
  dependency-version: 8.21.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-patch
- dependency-name: lucide-react
  dependency-version: 1.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-patch
- dependency-name: tailwind-merge
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 17, 2026
@vercel

vercel Bot commented Aug 17, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
cli-web-cli Ready Ready Preview Aug 17, 2026 9:22am

Request Review

@ci-lockfile-regen

Copy link
Copy Markdown

Dependabot Fix Assessment

Package: 15-package group bump (prod-minor-patch)
Scope: runtime dependencies
Workspace: root

Package From To
@ably/chat 1.3.1 1.4.0
@inquirer/prompts 8.4.2 8.5.2
@oclif/core 4.11.1 4.13.3
@oclif/plugin-autocomplete 3.2.48 3.2.56
@oclif/plugin-warn-if-update-available 3.1.63 3.1.73
ably 2.21.0 2.27.0
open 11.0.0 11.0.1
ora 9.4.0 9.4.1
react / react-dom 19.2.6 19.2.8
smol-toml 1.6.1 1.8.0
tar 7.5.21 7.5.22
ws 8.20.0 8.21.3
lucide-react 1.14.0 1.31.0
tailwind-merge 3.5.0 3.6.0

What changed upstream

  • @oclif/core 4.12.0: Added Args.option() method (non-breaking addition). 4.13.x: maintenance, security fix for PowerShell path handling, dynamic import replacement. No breaking changes to Args.string(), Flags.boolean(), or this.parse().
  • ably 2.21.0→2.27.0: Connection resumability improvements, deprecated client.device() in favour of async client.getDevice(). No breaking changes affecting Control API HTTP requests.
  • smol-toml 1.7.1: Security fix (GHSA-7w5x-hrqm-74c2) — DoS via infinite loop on malformed TOML input. The fix only makes previously-hanging parses throw TomlError instead; valid TOML parses identically. No behaviour change for well-formed config files.
  • All other bumps are patch/minor with no relevant breaking changes.

Migration concerns checked

  • Peer dependencies: OK — no conflicts introduced
  • Type changes: OK — @ably/chat 1.4.0 fixed the "types" condition ordering in exports (non-breaking); all other type shapes unchanged
  • Config files: OK — smol-toml security fix doesn't change valid-TOML parsing
  • Module format: OK — no ESM/CJS shifts
  • React compatibility: OK — minor patch only
  • Monorepo impact: Web CLI E2E Tests passed on this PR ✅

What broke

The E2E CLI Tests failure is a pre-existing infrastructure issue, NOT caused by this dep bump.

Evidence:

All three PRs fail with identical errors:

API request failed (422 Unprocessable Entity): Invalid resource
 ❯ ControlApi.request src/services/control-api.ts:713:13

Error code 40022 when calling POST /accounts/{accountId}/apps to create a test app.

The node-fetch library (3.3.2, unchanged), the request body ({"name":"...","tlsOnly":false}), the Ably-Agent header, and all related source files are identical to the code that passed E2E tests when PR #433 merged on Aug 14. None of the 15 bumped packages interact with the Control API HTTP layer.

Root cause: the Ably Control API started returning 422 Invalid resource (error code 40022) for app creation requests sometime between Aug 14 and Aug 17. This is a server-side regression or quota/limit issue affecting the CI test account, unrelated to this PR.

What was fixed

No code changes — the dep bump itself is clean. The E2E failure requires human investigation of the test environment.

Verification

  • Build: ✅ (type check passes in CI)
  • Lint: ✅ (lint check passes in CI)
  • Unit tests: ✅ (not run in this PR's CI, but no source changes were made)
  • Web CLI tests: ✅ (passed on this PR)

Notes for reviewer

A human needs to investigate why POST /accounts/{accountId}/apps has been returning 422 Invalid resource (code 40022) for all Dependabot PRs since Aug 14. Possible causes:

  1. Account app limit reached: The CI test account may have hit the Ably free-tier app limit due to orphaned test apps from previous failed runs. Check the test account's app count and delete stale apps.
  2. CI secret expired: If E2E_ABLY_ACCESS_TOKEN or related credentials rotated, the request may be failing auth validation in a way that returns 422 instead of 401.
  3. Ably Control API change: Ably may have added a new required field or stricter validation to POST /accounts/{id}/apps on their server side.

Once the infrastructure issue is resolved, re-run the E2E Tests — the dep bump itself requires no code changes and should be safe to merge.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Development

Successfully merging this pull request may close these issues.

0 participants