Gaurav Yadav
b0fa84e84d
fix: add Vercel deploy config and workflow for docs site ( #1739 )
...
## Description
The Vercel docs site at headroom-docs.vercel.app had no automated
deployment pipeline, so newly added pages (persistent-installs, savings)
return 404 despite existing in the repo and building correctly locally.
Closes #1730
## Type of Change
- [x] Bug fix (non-breaking change that fixes an issue)
- [ ] New feature (non-breaking function added)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
- [ ] Performance improvement
- [ ] Code refactoring (no functional changes)
## Changes Made
- Add docs/vercel.json with explicit Next.js project config (framework,
build/install commands)
- Add deploy-vercel job to .github/workflows/docs.yml to auto-deploy on
pushes to main touching docs/**
## Testing
- [x] Unit tests pass (pytest)
- [ ] Linting passes (ruff check .)
- [ ] Type checking passes (mypy headroom)
- [x] New tests added for new functionality
- [x] Manual testing performed
### Test Output
```
Local build verification:
cd docs && npm ci && npm run build
Build succeeded - persistent-installs and savings pages
generated at .next/server/app/docs/persistent-installs.html
and .next/server/app/docs/savings.html
```
## Real Behavior Proof
- Environment: Linux x86_64, Node.js 20
- Exact command / steps:
1. cd docs && npm ci && npm run build
2. Checked .next/server/app/docs/ for generated HTML artifacts
3. Verified source.getPage(["persistent-installs"]) returns page object
- Observed result: Both pages build and render correctly locally
- Not tested: Live Vercel deployment requires maintainer secrets
(VERCEL_TOKEN, VERCEL_ORG_ID, VERCEL_PROJECT_ID)
## Review Readiness
- [x] I have performed a self-review
- [x] This PR is ready for human review
## Additional Notes
Requires three repo secrets: VERCEL_TOKEN, VERCEL_ORG_ID,
VERCEL_PROJECT_ID.
2026-07-14 13:25:18 -04:00
dependabot[bot]
75fff43eca
deps: bump @types/node from 25.5.2 to 26.1.1 in /docs ( #1683 )
...
Bumps
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node )
from 25.5.2 to 26.1.1.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node ">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-09 17:02:59 -05:00
dependabot[bot]
e8b66a27e1
deps: bump fumadocs-typescript from 4.0.14 to 5.3.0 in /docs ( #1684 )
...
Bumps [fumadocs-typescript](https://github.com/fuma-nama/fumadocs ) from
4.0.14 to 5.3.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/fuma-nama/fumadocs/releases ">fumadocs-typescript's
releases</a>.</em></p>
<blockquote>
<h2>fumadocs-typescript@5.3.0</h2>
<h3>Default to Base UI</h3>
<p>Internal packages & templates now use Base UI rather than Radix
UI.</p>
<h2>fumadocs-typescript@5.2.7</h2>
<h3>Migrate to <code>cnfast</code></h3>
<p>Drop <code>tailwind-merge</code>.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="9a269030df3e33f4362f3597c9d1e60f389cf3de4611f97d49d0953007600297e2547702c242b0da3d80b8b2420ec19af868https://github.com/fuma-nama/fumadocs/compare/fumadocs-typescript@4.0.14...fumadocs-typescript@5.3.0 ">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-09 17:02:44 -05:00
dependabot[bot]
8872bbc6a2
deps: bump the npm-minor-patch group across 4 directories with 18 updates ( #1907 )
...
Bumps the npm-minor-patch group with 12 updates in the /docs directory:
| Package | From | To |
| --- | --- | --- |
| [fumadocs-core](https://github.com/fuma-nama/fumadocs ) | `16.10.3` |
`16.11.1` |
| [fumadocs-mdx](https://github.com/fuma-nama/fumadocs ) | `15.0.12` |
`15.1.0` |
| [fumadocs-twoslash](https://github.com/fuma-nama/fumadocs ) | `3.1.15`
| `3.3.0` |
| [fumadocs-ui](https://github.com/fuma-nama/fumadocs ) | `16.10.3` |
`16.11.1` |
| [next](https://github.com/vercel/next.js ) | `16.2.6` | `16.2.10` |
| [react](https://github.com/facebook/react/tree/HEAD/packages/react ) |
`19.2.4` | `19.2.7` |
|
[@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react )
| `19.2.14` | `19.2.17` |
|
[react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom )
| `19.2.4` | `19.2.7` |
| [recharts](https://github.com/recharts/recharts ) | `3.8.1` | `3.9.2` |
|
[@tailwindcss/postcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss )
| `4.2.2` | `4.3.2` |
|
[@types/mdx](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/mdx )
| `2.0.13` | `2.0.14` |
| [postcss](https://github.com/postcss/postcss ) | `8.5.15` | `8.5.16` |
Bumps the npm-minor-patch group with 1 update in the /plugins/openclaw
directory:
[vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest ).
Bumps the npm-minor-patch group with 2 updates in the /plugins/opencode
directory:
[vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest )
and @opencode-ai/plugin.
Bumps the npm-minor-patch group with 3 updates in the /sdk/typescript
directory:
[vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest ),
[@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript )
and [dotenv](https://github.com/motdotla/dotenv ).
Updates `fumadocs-core` from 16.10.3 to 16.11.1
<details>
<summary>Commits</summary>
<ul>
<li><a
href="ab09f500cbhttps://redirect.github.com/fuma-nama/fumadocs/issues/3405 ">#3405</a>)</li>
<li><a
href="889a296d06a5c081d0c69a269030df3e33f4362f3597c9d1e60f389cf3de4611f97d49d0953007600297e25477https://github.com/fuma-nama/fumadocs/compare/fumadocs-core@16.10.3...fumadocs@16.11.1 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `fumadocs-mdx` from 15.0.12 to 15.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/fuma-nama/fumadocs/releases ">fumadocs-mdx's
releases</a>.</em></p>
<blockquote>
<h2>fumadocs-mdx@15.1.0</h2>
<h3>Default to Base UI</h3>
<p>Internal packages & templates now use Base UI rather than Radix
UI.</p>
<h2>fumadocs-mdx@15.0.13</h2>
<h3>Require <code>collection</code> query param at regex matching</h3>
<p>Instead of passing through all JSON/YAML files, the meta loader now
requires <code>collection</code> query param to be triggered.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="9a269030df3e33f4362f3597c9d1e60f389cf3de4611f97d49d0953007600297e2547702c242b0da3d80b8b2420ec19af868https://github.com/fuma-nama/fumadocs/compare/fumadocs-mdx@15.0.12...fumadocs-mdx@15.1.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `fumadocs-twoslash` from 3.1.15 to 3.3.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/fuma-nama/fumadocs/releases ">fumadocs-twoslash's
releases</a>.</em></p>
<blockquote>
<h2>fumadocs-twoslash@3.3.0</h2>
<h3>Default to Base UI</h3>
<p>Internal packages & templates now use Base UI rather than Radix
UI.</p>
<h2>fumadocs-twoslash@3.2.1</h2>
<h3>Migrate to <code>cnfast</code></h3>
<p>Drop <code>tailwind-merge</code>.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="9a269030df3e33f4362f3597c9d1e60f389cf3de4611f97d49d0953007600297e2547702c242b0da3d80b8b2420ec19af868https://github.com/fuma-nama/fumadocs/compare/fumadocs-twoslash@3.1.15...fumadocs-twoslash@3.3.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `fumadocs-ui` from 16.10.3 to 16.11.1
<details>
<summary>Commits</summary>
<ul>
<li><a
href="ab09f500cbhttps://redirect.github.com/fuma-nama/fumadocs/issues/3405 ">#3405</a>)</li>
<li><a
href="889a296d06a5c081d0c69a269030df3e33f4362f3597c9d1e60f389cf3de4611f97d49d0953007600297e25477https://github.com/fuma-nama/fumadocs/compare/fumadocs-ui@16.10.3...fumadocs@16.11.1 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `lucide-react` from 1.20.0 to 1.23.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/lucide-icons/lucide/releases ">lucide-react's
releases</a>.</em></p>
<blockquote>
<h2>Version 1.23.0</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(docs): prevent scrollbar layout shift on icons page by <a
href="https://github.com/g30r93g "><code>@g30r93g</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4500 ">lucide-icons/lucide#4500</a></li>
<li>chore(docs): Remove certificates banner by <a
href="https://github.com/ericfennis "><code>@ericfennis</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4504 ">lucide-icons/lucide#4504</a></li>
<li>ci(repo-journal.yml): GH copilot repo summary by <a
href="https://github.com/ericfennis "><code>@ericfennis</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4505 ">lucide-icons/lucide#4505</a></li>
<li>ci(repo-journal.yml): Small fix in the workflow by <a
href="https://github.com/ericfennis "><code>@ericfennis</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4508 ">lucide-icons/lucide#4508</a></li>
<li>ci(repo-journal.yml): Switch to token by <a
href="https://github.com/ericfennis "><code>@ericfennis</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4509 ">lucide-icons/lucide#4509</a></li>
<li>feat(icons): added <code>paper-bag</code> icon by <a
href="https://github.com/dkast "><code>@dkast</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4023 ">lucide-icons/lucide#4023</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/g30r93g "><code>@g30r93g</code></a> made
their first contribution in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4500 ">lucide-icons/lucide#4500</a></li>
<li><a href="https://github.com/dkast "><code>@dkast</code></a> made
their first contribution in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4023 ">lucide-icons/lucide#4023</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/lucide-icons/lucide/compare/1.22.0...1.23.0 ">https://github.com/lucide-icons/lucide/compare/1.22.0...1.23.0 </a></p>
<h2>Version 1.22.0</h2>
<h2>What's Changed</h2>
<ul>
<li>feat(icons): add 6 database variant icons by <a
href="https://github.com/Barakudum "><code>@Barakudum</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4336 ">lucide-icons/lucide#4336</a></li>
<li>ci(release.yml): Remove concurrency field to prevent release mess by
<a href="https://github.com/ericfennis "><code>@ericfennis</code></a> in
<a
href="https://redirect.github.com/lucide-icons/lucide/pull/4485 ">lucide-icons/lucide#4485</a></li>
<li>fix(docs): fix color input clipping by <a
href="https://github.com/Hsiii "><code>@Hsiii</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4488 ">lucide-icons/lucide#4488</a></li>
<li>docs(site): add Deno to installation instructions by <a
href="https://github.com/bartlomieju "><code>@bartlomieju</code></a> in
<a
href="https://redirect.github.com/lucide-icons/lucide/pull/4486 ">lucide-icons/lucide#4486</a></li>
<li>chore(deps): bump esbuild from 0.25.12 to 0.28.1 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4459 ">lucide-icons/lucide#4459</a></li>
<li>fix(docs): prevent private analytics token from blocking local dev
by <a href="https://github.com/Hsiii "><code>@Hsiii</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4481 ">lucide-icons/lucide#4481</a></li>
<li>docs(installation.md): Remove outdate next tag in installation by <a
href="https://github.com/ericfennis "><code>@ericfennis</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4495 ">lucide-icons/lucide#4495</a></li>
<li>fix(lucide-react-native): Fix context provider export by <a
href="https://github.com/ericfennis "><code>@ericfennis</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4497 ">lucide-icons/lucide#4497</a></li>
<li>fix(astro): add Astro v7 compatibility by <a
href="https://github.com/iseraph-dev "><code>@iseraph-dev</code></a> in
<a
href="https://redirect.github.com/lucide-icons/lucide/pull/4491 ">lucide-icons/lucide#4491</a></li>
<li>fix(icons): changed <code>carrot</code> icon by <a
href="https://github.com/jguddas "><code>@jguddas</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4010 ">lucide-icons/lucide#4010</a></li>
<li>fix(icons): changed <code>ungroup</code> icon by <a
href="https://github.com/jguddas "><code>@jguddas</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/3969 ">lucide-icons/lucide#3969</a></li>
<li>feat(icons): added <code>phi</code> icon also used as
<code>golden-ratio</code> by <a
href="https://github.com/whoisBugsbunny "><code>@whoisBugsbunny</code></a>
in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4218 ">lucide-icons/lucide#4218</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/bartlomieju "><code>@bartlomieju</code></a>
made their first contribution in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4486 ">lucide-icons/lucide#4486</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/lucide-icons/lucide/compare/1.21.0...1.22.0 ">https://github.com/lucide-icons/lucide/compare/1.21.0...1.22.0 </a></p>
<h2>Version 1.21.0</h2>
<h2>What's Changed</h2>
<ul>
<li>ci(release.yml): Remove new-version in release flow by <a
href="https://github.com/ericfennis "><code>@ericfennis</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4478 ">lucide-icons/lucide#4478</a></li>
<li>ci(release.yml): Fix workflow and remove <code>version</code>
scripts in package scripts by <a
href="https://github.com/ericfennis "><code>@ericfennis</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4479 ">lucide-icons/lucide#4479</a></li>
<li>fix(docs): rename navigation category label by <a
href="https://github.com/Hsiii "><code>@Hsiii</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4483 ">lucide-icons/lucide#4483</a></li>
<li>feat(icons): added <code>broken-bone</code> icon by <a
href="https://github.com/Patolord "><code>@Patolord</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4131 ">lucide-icons/lucide#4131</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Hsiii "><code>@Hsiii</code></a> made
their first contribution in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4483 ">lucide-icons/lucide#4483</a></li>
<li><a href="https://github.com/Patolord "><code>@Patolord</code></a>
made their first contribution in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4131 ">lucide-icons/lucide#4131</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/lucide-icons/lucide/compare/1.20.0...1.21.0 ">https://github.com/lucide-icons/lucide/compare/1.20.0...1.21.0 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="5ff536e139https://github.com/lucide-icons/lucide/commits/1.23.0/packages/lucide-react ">compare
view</a></li>
</ul>
</details>
<br />
Updates `next` from 16.2.6 to 16.2.10
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/next.js/releases ">next's
releases</a>.</em></p>
<blockquote>
<h2>v16.2.10</h2>
<p>Contains no changes except publishing <code>@next/swc-wasm-web</code>
which was accidentally not published since 16.2.4.</p>
<h2>v16.2.9</h2>
<p>Empty release to ensure <code>next@latest</code> points at a stable
release. Next.js only allows publishing with Trusted Publishing enabled.
In order to fix NPM dist-tags, we have to release a new version.
Updating dist-tags is not possible with Trusted Publishing.</p>
<h2>v16.2.8</h2>
<p>Release with no changes in an attempt to fix <code>next@latest</code>
pointing at a prerelease version.</p>
<h2>v16.2.7</h2>
<blockquote>
<p>[!NOTE]
This release is backporting bug fixes. It does <strong>not</strong>
include all pending features/changes on canary.</p>
</blockquote>
<h3>Core Changes</h3>
<ul>
<li>Backport documentation fixes for v16.2 (<a
href="https://redirect.github.com/vercel/next.js/issues/93804 ">#93804</a>)</li>
<li>[backport] Patch <code>playwright-core</code> to resolve
<code>_finishedPromise</code> on <code>requestFailed</code> (<a
href="https://redirect.github.com/vercel/next.js/issues/93920 ">#93920</a>)</li>
<li>[backport] Fix dev mode hydration failure when page is served from
HTTP cache (<a
href="https://redirect.github.com/vercel/next.js/issues/93492 ">#93492</a>)</li>
<li>[backport] Fix catch-all <code>router.query</code> corruption with
<code>basePath</code> + <code>rewrites</code> (<a
href="https://redirect.github.com/vercel/next.js/issues/93917 ">#93917</a>)</li>
<li>[backport] Encode non-ASCII characters in cache tags at construction
(<a
href="https://redirect.github.com/vercel/next.js/issues/93918 ">#93918</a>)</li>
<li>[backport] Fix server action forwarding loop with middleware
rewrites (<a
href="https://redirect.github.com/vercel/next.js/issues/93919 ">#93919</a>)</li>
<li>[backport] Turbopack: switch from base40 to base38 hash encoding (<a
href="https://redirect.github.com/vercel/next.js/issues/93932 ">#93932</a>)</li>
<li>[ci] Disable hanging node 24 typescript tests on 16.2 backport
branch (<a
href="https://redirect.github.com/vercel/next.js/issues/94164 ">#94164</a>)</li>
<li>[backport] Fix "type: module" in project dir when using
standalone or adapters (<a
href="https://redirect.github.com/vercel/next.js/issues/94050 ">#94050</a>)</li>
<li>[backport] Propagate adapter preferred regions (<a
href="https://redirect.github.com/vercel/next.js/issues/94200 ">#94200</a>)</li>
<li>[16.2.x] Don't drop <code>FormData</code> entries (<a
href="https://redirect.github.com/vercel/next.js/issues/94240 ">#94240</a>)</li>
<li>[backport] feat(turbopack): add LocalPathOrProjectPath PostCSS
config resolution (<a
href="https://redirect.github.com/vercel/next.js/issues/94284 ">#94284</a>)</li>
</ul>
<h3>Credits</h3>
<p>Huge thanks to <a
href="https://github.com/eps1lon "><code>@eps1lon</code></a>, <a
href="https://github.com/icyJoseph "><code>@icyJoseph</code></a>, <a
href="https://github.com/unstubbable "><code>@unstubbable</code></a>, <a
href="https://github.com/mischnic "><code>@mischnic</code></a>, <a
href="https://github.com/bgw "><code>@bgw</code></a>, <a
href="https://github.com/timneutkens "><code>@timneutkens</code></a>,
and <a
href="https://github.com/lukesandberg "><code>@lukesandberg</code></a>
for helping!</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="9dadfd693c534d9c144chttps://redirect.github.com/vercel/next.js/issues/95160 ">#95160</a>)</li>
<li><a
href="98941fc427https://redirect.github.com/vercel/next.js/issues/94935 ">#94935</a>)</li>
<li><a
href="6e1a94de7chttps://redirect.github.com/vercel/next.js/issues/94640 ">#94640</a>)</li>
<li><a
href="f37fad9405d9aaaedfd8https://redirect.github.com/vercel/next.js/issues/94627 ">#94627</a>)</li>
<li><a
href="6f1680448c0dbc1d5c86https://redirect.github.com/vercel/next.js/issues/94598 ">#94598</a>)</li>
<li><a
href="90e3c811e7https://redirect.github.com/vercel/next.js/issues/94339 ">#94339</a>)</li>
<li><a
href="83f402c69dhttps://redirect.github.com/vercel/next.js/issues/94334 ">#94334</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/next.js/compare/v16.2.6...v16.2.10 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `react` from 19.2.4 to 19.2.7
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/facebook/react/releases ">react's
releases</a>.</em></p>
<blockquote>
<h2>19.2.7 (June 1st, 2026)</h2>
<h2>React Server Components</h2>
<ul>
<li>Fixed missing <code>FormData</code> entries in Server Actions which
regressed in 19.2.6
(<a
href="https://redirect.github.com/facebook/react/pull/36566 ">#36566</a>
by <a
href="https://github.com/unstubbable "><code>@unstubbable</code></a>)</li>
</ul>
<h2>19.2.6 (May 6th, 2026)</h2>
<h2>React Server Components</h2>
<ul>
<li>Type hardening and performance improvements
(<a
href="https://redirect.github.com/facebook/react/pull/36425 ">#36425</a>
by <a href="https://github.com/eps1lon "><code>@eps1lon</code></a> and
<a
href="https://github.com/unstubbable "><code>@unstubbable</code></a>)</li>
</ul>
<h2>19.2.5 (April 8th, 2026)</h2>
<h2>React Server Components</h2>
<ul>
<li>Add more cycle protections (<a
href="https://redirect.github.com/facebook/react/pull/36236 ">#36236</a>
by <a href="https://github.com/eps1lon "><code>@eps1lon</code></a> and
<a
href="https://github.com/unstubbable "><code>@unstubbable</code></a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/react/react/blob/main/CHANGELOG.md ">react's
changelog</a>.</em></p>
<blockquote>
<h2>19.2.7 (June 1, 2026)</h2>
<h3>React Server Components</h3>
<ul>
<li>Fixed missing <code>FormData</code> entries in Server Actions which
regressed in 19.2.6 (<a
href="https://github.com/unstubbable "><code>@unstubbable</code></a> <a
href="https://redirect.github.com/facebook/react/pull/36566 ">#36566</a>)</li>
</ul>
<h2>19.2.6 (May 6, 2026)</h2>
<h3>React Server Components</h3>
<ul>
<li>Type hardening and performance improvements (<a
href="https://github.com/eps1lon "><code>@eps1lon</code></a>, <a
href="https://github.com/unstubbable "><code>@unstubbable</code></a> <a
href="https://redirect.github.com/facebook/react/pull/36425 ">#36425</a>)</li>
</ul>
<h2>19.2.5 (March 18, 2026)</h2>
<h3>React Server Components</h3>
<ul>
<li>Add more cycle protections (<a
href="https://github.com/eps1lon "><code>@eps1lon</code></a>, <a
href="https://github.com/unstubbable "><code>@unstubbable</code></a> <a
href="https://redirect.github.com/facebook/react/pull/36236 ">#36236</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="6117d7cca4https://github.com/facebook/react/tree/HEAD/packages/react/issues/36591 ">#36591</a>)</li>
<li><a
href="eaf3e95ca923f4f9f30dhttps://github.com/facebook/react/commits/v19.2.7/packages/react ">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions ">GitHub Actions</a>, a new
releaser for react since your current version.</p>
</details>
<br />
Updates `@types/react` from 19.2.14 to 19.2.17
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react ">compare
view</a></li>
</ul>
</details>
<br />
Updates `react-dom` from 19.2.4 to 19.2.7
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/facebook/react/releases ">react-dom's
releases</a>.</em></p>
<blockquote>
<h2>19.2.7 (June 1st, 2026)</h2>
<h2>React Server Components</h2>
<ul>
<li>Fixed missing <code>FormData</code> entries in Server Actions which
regressed in 19.2.6
(<a
href="https://redirect.github.com/facebook/react/pull/36566 ">#36566</a>
by <a
href="https://github.com/unstubbable "><code>@unstubbable</code></a>)</li>
</ul>
<h2>19.2.6 (May 6th, 2026)</h2>
<h2>React Server Components</h2>
<ul>
<li>Type hardening and performance improvements
(<a
href="https://redirect.github.com/facebook/react/pull/36425 ">#36425</a>
by <a href="https://github.com/eps1lon "><code>@eps1lon</code></a> and
<a
href="https://github.com/unstubbable "><code>@unstubbable</code></a>)</li>
</ul>
<h2>19.2.5 (April 8th, 2026)</h2>
<h2>React Server Components</h2>
<ul>
<li>Add more cycle protections (<a
href="https://redirect.github.com/facebook/react/pull/36236 ">#36236</a>
by <a href="https://github.com/eps1lon "><code>@eps1lon</code></a> and
<a
href="https://github.com/unstubbable "><code>@unstubbable</code></a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/react/react/blob/main/CHANGELOG.md ">react-dom's
changelog</a>.</em></p>
<blockquote>
<h2>19.2.7 (June 1, 2026)</h2>
<h3>React Server Components</h3>
<ul>
<li>Fixed missing <code>FormData</code> entries in Server Actions which
regressed in 19.2.6 (<a
href="https://github.com/unstubbable "><code>@unstubbable</code></a> <a
href="https://redirect.github.com/facebook/react/pull/36566 ">#36566</a>)</li>
</ul>
<h2>19.2.6 (May 6, 2026)</h2>
<h3>React Server Components</h3>
<ul>
<li>Type hardening and performance improvements (<a
href="https://github.com/eps1lon "><code>@eps1lon</code></a>, <a
href="https://github.com/unstubbable "><code>@unstubbable</code></a> <a
href="https://redirect.github.com/facebook/react/pull/36425 ">#36425</a>)</li>
</ul>
<h2>19.2.5 (March 18, 2026)</h2>
<h3>React Server Components</h3>
<ul>
<li>Add more cycle protections (<a
href="https://github.com/eps1lon "><code>@eps1lon</code></a>, <a
href="https://github.com/unstubbable "><code>@unstubbable</code></a> <a
href="https://redirect.github.com/facebook/react/pull/36236 ">#36236</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="6117d7cca4https://github.com/facebook/react/tree/HEAD/packages/react-dom/issues/36591 ">#36591</a>)</li>
<li><a
href="eaf3e95ca923f4f9f30dhttps://github.com/facebook/react/commits/v19.2.7/packages/react-dom ">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions ">GitHub Actions</a>, a new
releaser for react-dom since your current version.</p>
</details>
<br />
Updates `recharts` from 3.8.1 to 3.9.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/recharts/recharts/releases ">recharts's
releases</a>.</em></p>
<blockquote>
<h2>v3.9.2</h2>
<h2>What's Changed</h2>
<ul>
<li>docs: clarify custom labels and ticks need SVG elements by <a
href="https://github.com/ishaanlabs-gg "><code>@ishaanlabs-gg</code></a>
in <a
href="https://redirect.github.com/recharts/recharts/pull/7524 ">recharts/recharts#7524</a></li>
<li>chore(deps): bump immer from 11.1.8 to 11.1.9 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/recharts/recharts/pull/7526 ">recharts/recharts#7526</a></li>
<li>fix(Sankey): avoid exponential depth traversal on dense graphs by <a
href="https://github.com/dm-gthb "><code>@dm-gthb</code></a> in <a
href="https://redirect.github.com/recharts/recharts/pull/7479 ">recharts/recharts#7479</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/ishaanlabs-gg "><code>@ishaanlabs-gg</code></a>
made their first contribution in <a
href="https://redirect.github.com/recharts/recharts/pull/7524 ">recharts/recharts#7524</a></li>
<li><a href="https://github.com/dm-gthb "><code>@dm-gthb</code></a> made
their first contribution in <a
href="https://redirect.github.com/recharts/recharts/pull/7479 ">recharts/recharts#7479</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/recharts/recharts/compare/v3.9.1...v3.9.2 ">https://github.com/recharts/recharts/compare/v3.9.1...v3.9.2 </a></p>
<h2>v3.9.1</h2>
<h2>What's Changed</h2>
<ul>
<li>perf: optimize ScatterChart hover by reducing re-renders from O(n)
to O(1) by <a href="https://github.com/roy7 "><code>@roy7</code></a> in
<a
href="https://redirect.github.com/recharts/recharts/pull/7133 ">recharts/recharts#7133</a></li>
<li>fix(YAxis): render explicit ticks when a non-literal domain can't
resolve on empty data (<a
href="https://redirect.github.com/recharts/recharts/issues/7362 ">#7362</a>)
by <a href="https://github.com/nlenepveu "><code>@nlenepveu</code></a>
in <a
href="https://redirect.github.com/recharts/recharts/pull/7393 ">recharts/recharts#7393</a></li>
<li>fix: avoid Sankey nodes overlapping skipped-depth links by <a
href="https://github.com/pupuking723 "><code>@pupuking723</code></a> in
<a
href="https://redirect.github.com/recharts/recharts/pull/7471 ">recharts/recharts#7471</a></li>
<li>Add stacked bar chart with horizontal threshold line example by <a
href="https://github.com/nijuse "><code>@nijuse</code></a> in <a
href="https://redirect.github.com/recharts/recharts/pull/7495 ">recharts/recharts#7495</a></li>
<li>fix(DefaultLegendContent): omit empty value from legend icon
aria-label by <a
href="https://github.com/greymoth-jp "><code>@greymoth-jp</code></a> in
<a
href="https://redirect.github.com/recharts/recharts/pull/7501 ">recharts/recharts#7501</a></li>
<li>chore(deps): bump immer from 10.2.0 to 11.1.8 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/recharts/recharts/pull/7452 ">recharts/recharts#7452</a></li>
<li>fix(getNiceTickValues): remove trailing duplicate tick when
allowDecimals=false by <a
href="https://github.com/JSap0914 "><code>@JSap0914</code></a> in <a
href="https://redirect.github.com/recharts/recharts/pull/7482 ">recharts/recharts#7482</a></li>
<li>Fix/per graphical item formatter prop by <a
href="https://github.com/shreedharbhat98 "><code>@shreedharbhat98</code></a>
in <a
href="https://redirect.github.com/recharts/recharts/pull/7287 ">recharts/recharts#7287</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/pupuking723 "><code>@pupuking723</code></a>
made their first contribution in <a
href="https://redirect.github.com/recharts/recharts/pull/7471 ">recharts/recharts#7471</a></li>
<li><a href="https://github.com/nijuse "><code>@nijuse</code></a> made
their first contribution in <a
href="https://redirect.github.com/recharts/recharts/pull/7495 ">recharts/recharts#7495</a></li>
<li><a
href="https://github.com/greymoth-jp "><code>@greymoth-jp</code></a>
made their first contribution in <a
href="https://redirect.github.com/recharts/recharts/pull/7501 ">recharts/recharts#7501</a></li>
<li><a href="https://github.com/JSap0914 "><code>@JSap0914</code></a>
made their first contribution in <a
href="https://redirect.github.com/recharts/recharts/pull/7482 ">recharts/recharts#7482</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/recharts/recharts/compare/v3.9.0...v3.9.1 ">https://github.com/recharts/recharts/compare/v3.9.0...v3.9.1 </a></p>
<h2>v3.9.0</h2>
<h2>What's Changed</h2>
<h3>Animations</h3>
<p>3.9 comes with new animations! There are several bug fixes and what's
best, all animations are now fully customizable.</p>
<p>See the animations guide on <a
href="https://recharts.github.io/en-US/guide/animations/ ">https://recharts.github.io/en-US/guide/animations/ </a></p>
<ul>
<li>Animation guide by <a
href="https://github.com/PavelVanecek "><code>@PavelVanecek</code></a>
in <a
href="https://redirect.github.com/recharts/recharts/pull/7179 ">recharts/recharts#7179</a></li>
<li>Animation tests by <a
href="https://github.com/PavelVanecek "><code>@PavelVanecek</code></a>
in <a
href="https://redirect.github.com/recharts/recharts/pull/7255 ">recharts/recharts#7255</a></li>
<li>New animation props by <a
href="https://github.com/PavelVanecek "><code>@PavelVanecek</code></a>
in <a
href="https://redirect.github.com/recharts/recharts/pull/7215 ">recharts/recharts#7215</a></li>
<li>test: cover legacy animation length changes by <a
href="https://github.com/PavelVanecek "><code>@PavelVanecek</code></a>
in <a
href="https://redirect.github.com/recharts/recharts/pull/7283 ">recharts/recharts#7283</a></li>
<li>test: add sparse animation path tests for Line component by <a
href="https://github.com/PavelVanecek "><code>@PavelVanecek</code></a>
in <a
href="https://redirect.github.com/recharts/recharts/pull/7295 ">recharts/recharts#7295</a></li>
<li>Export and document interpolate function by <a
href="https://github.com/PavelVanecek "><code>@PavelVanecek</code></a>
in <a
href="https://redirect.github.com/recharts/recharts/pull/7293 ">recharts/recharts#7293</a></li>
<li>test: enhance line animation tests for ComposedChart and responsive
by <a
href="https://github.com/PavelVanecek "><code>@PavelVanecek</code></a>
in <a
href="https://redirect.github.com/recharts/recharts/pull/7289 ">recharts/recharts#7289</a></li>
<li>Manual animations on website by <a
href="https://github.com/PavelVanecek "><code>@PavelVanecek</code></a>
in <a
href="https://redirect.github.com/recharts/recharts/pull/7483 ">recharts/recharts#7483</a></li>
<li>Add new example where chart animates by scroll by <a
href="https://github.com/PavelVanecek "><code>@PavelVanecek</code></a>
in <a
href="https://redirect.github.com/recharts/recharts/pull/7484 ">recharts/recharts#7484</a></li>
<li>fix: preserve single-value line dash gaps during animation by <a
href="https://github.com/puneetdixit200 "><code>@puneetdixit200</code></a>
in <a
href="https://redirect.github.com/recharts/recharts/pull/7405 ">recharts/recharts#7405</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="b3451050c0f27779c04885f9369f40https://redirect.github.com/recharts/recharts/issues/7520 ">#7520</a>)</li>
<li><a
href="52a2a896cfhttps://redirect.github.com/recharts/recharts/issues/7479 ">#7479</a>)</li>
<li><a
href="8a056c1018https://redirect.github.com/recharts/recharts/issues/7527 ">#7527</a>)</li>
<li><a
href="2af6ec6f0fhttps://redirect.github.com/recharts/recharts/issues/7526 ">#7526</a>)</li>
<li><a
href="6f10d53cf6https://redirect.github.com/recharts/recharts/issues/7524 ">#7524</a>)</li>
<li><a
href="c04f1a7678https://redirect.github.com/recharts/recharts/issues/7521 ">#7521</a>)</li>
<li><a
href="69c7a9630ahttps://redirect.github.com/recharts/recharts/issues/7522 ">#7522</a>)</li>
<li><a
href="6efaf16a1ahttps://redirect.github.com/recharts/recharts/issues/7515 ">#7515</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/recharts/recharts/compare/v3.8.1...v3.9.2 ">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions ">GitHub Actions</a>, a new
releaser for recharts since your current version.</p>
</details>
<details>
<summary>Install script changes</summary>
<p>This version modifies <code>prepare</code> script that runs during
installation. Review the package contents before updating.</p>
</details>
<br />
Updates `@tailwindcss/postcss` from 4.2.2 to 4.3.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/tailwindlabs/tailwindcss/releases ">@tailwindcss/postcss's
releases</a>.</em></p>
<blockquote>
<h2>v4.3.2</h2>
<h3>Fixed</h3>
<ul>
<li>Support bare spacing values for <code>auto-rows-*</code> and
<code>auto-cols-*</code> utilities (e.g. <code>auto-rows-12</code> and
<code>auto-cols-16</code>) (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20229 ">#20229</a>)</li>
<li>Prevent <code>@tailwindcss/cli</code> in <code>--watch</code> mode
from crashing on Windows when <code>@source</code> points to a directory
that doesn't exist (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20242 ">#20242</a>)</li>
<li>Prevent <code>@tailwindcss/vite</code> from crashing in Deno v2.8.x
when <code>context.parentURL</code> is not a valid URL (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20245 ">#20245</a>)</li>
<li>Ensure <code>@tailwindcss/cli</code> in <code>--watch</code> mode
rebuilds when the input CSS file changes in an ignored directory (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20246 ">#20246</a>)</li>
<li>Allow <code>@variant</code> rules used in <code>addBase(…)</code> to
use custom variants defined later (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20247 ">#20247</a>)</li>
<li>Prevent <code>@tailwindcss/vite</code> from crashing during HMR when
scanned files or directories are deleted (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20259 ">#20259</a>)</li>
<li>Generate <code>font-size</code> instead of <code>color</code>
declarations for <code>text-[--spacing(…)]</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20260 ">#20260</a>)</li>
<li>Prevent <code>@source</code> patterns from scanning unrelated
sibling files and folders (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20263 ">#20263</a>)</li>
<li>Extract class candidates adjacent to Template Toolkit delimiters
like <code>%]…[%</code> in <code>.tt</code>, <code>.tt2</code>, and
<code>.tx</code> files (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20269 ">#20269</a>)</li>
<li>Extract class candidates from conditional Maud syntax like
<code>p.text-black[condition]</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20269 ">#20269</a>)</li>
<li>Prevent <code>@position-try</code> rules from triggering unknown
at-rule warnings when optimizing CSS (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20277 ">#20277</a>)</li>
<li>Support class suggestions for named opacity modifiers from
<code>--opacity</code> theme values (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20287 ">#20287</a>)</li>
<li>Prevent type errors in <code>@tailwindcss/postcss</code> when used
with newer PostCSS patch releases (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20289 ">#20289</a>)</li>
</ul>
<h2>v4.3.1</h2>
<h3>Added</h3>
<ul>
<li>Add <code>--silent</code> option to suppress output in
<code>@tailwindcss/cli</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20100 ">#20100</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Remove deprecation warnings by using
<code>Module#registerHooks</code> instead of
<code>Module#register</code> on Node 26+ (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20028 ">#20028</a>)</li>
<li>Canonicalization: don't crash when plugin utilities throw for
unsupported values (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20052 ">#20052</a>)</li>
<li>Allow <code>@apply</code> to be used with CSS mixins (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19427 ">#19427</a>)</li>
<li>Ensure <code>not-*</code> correctly negates <code>@container</code>
queries, including <code>style(…)</code> queries (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20059 ">#20059</a>)</li>
<li>Ensure <code>drop-shadow-*</code> color utilities work with custom
shadow values containing <code>calc(…)</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20080 ">#20080</a>)</li>
<li>Fix 'Sourcemap is likely to be incorrect' warnings when using
<code>@tailwindcss/vite</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20103 ">#20103</a>)</li>
<li>Ensure <code>@tailwindcss/webpack</code> can be installed in Rspack
projects without requiring <code>webpack</code> as a peer dependency (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20027 ">#20027</a>)</li>
<li>Canonicalization: don't suggest invalid <code>calc(…)</code>
expressions (e.g. <code>px-[calc(1rem+0px)]</code> →
<code>px-[calc(1rem+0)]</code>) (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20127 ">#20127</a>)</li>
<li>Canonicalization: avoid suggesting large spacing-scale values for
arbitrary lengths (e.g. <code>left-[99999px]</code> →
<code>left-[99999px]</code>, not <code>left-24999.75</code>) (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20130 ">#20130</a>)</li>
<li>Ensure <code>@tailwindcss/cli</code> in <code>--watch</code> mode
recovers when a tracked dependency is deleted and restored (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20137 ">#20137</a>)</li>
<li>Ensure standalone <code>@tailwindcss/cli</code> binaries are ignored
when scanning for class candidates (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20139 ">#20139</a>)</li>
<li>Ensure class candidates are extracted from Twig
<code>addClass(…)</code> and <code>removeClass(…)</code> calls (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20198 ">#20198</a>)</li>
<li>Don't crash in the Ruby or Vue preprocessors when scanning files
containing invalid UTF-8 bytes (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19588 ">#19588</a>)</li>
<li>Allow <code>@variant</code> to be used inside <code>addBase</code>
(<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19480 ">#19480</a>)</li>
<li>Ensure <code>@source</code> globs with symlinks are preserved (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20203 ">#20203</a>)</li>
<li>Ensure later <code>@source</code> rules can re-include files
excluded by earlier <code>@source not</code> rules (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20203 ">#20203</a>)</li>
<li>Upgrade: don't migrate empty class rules to invalid
<code>@utility</code> rules (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20205 ">#20205</a>)</li>
<li>Ensure transitions between <code>inset-shadow-none</code> and other
inset shadows work correctly (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20208 ">#20208</a>)</li>
<li>Ensure explicitly referenced <code>@source</code> directories are
scanned even when ignored by git (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20214 ">#20214</a>)</li>
<li>Ensure <code>@source</code> globs ending in <code>**/*</code>
preserve dynamic path segments to avoid scanning too many files (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20217 ">#20217</a>)</li>
<li>Canonicalization: don't fold <code>calc(…)</code> divisions when the
result would require high precision (e.g.
<code>w-[calc(100%/3.5)]</code> → <code>w-[calc(100%/3.5)]</code>, not
<code>w-[28.571428571428573%]</code>) (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20221 ">#20221</a>)</li>
<li>Serve ESM type declarations to ESM importers of
<code>@tailwindcss/postcss</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20228 ">#20228</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Generate <code>0</code> instead of <code>calc(var(--spacing) *
0)</code> for spacing utilities like <code>m-0</code> and
<code>left-0</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20196 ">#20196</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md ">@tailwindcss/postcss's
changelog</a>.</em></p>
<blockquote>
<h2>[4.3.2] - 2026-06-26</h2>
<h3>Fixed</h3>
<ul>
<li>Support bare spacing values for <code>auto-rows-*</code> and
<code>auto-cols-*</code> utilities (e.g. <code>auto-rows-12</code> and
<code>auto-cols-16</code>) (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20229 ">#20229</a>)</li>
<li>Prevent <code>@tailwindcss/cli</code> in <code>--watch</code> mode
from crashing on Windows when <code>@source</code> points to a directory
that doesn't exist (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20242 ">#20242</a>)</li>
<li>Prevent <code>@tailwindcss/vite</code> from crashing in Deno v2.8.x
when <code>context.parentURL</code> is not a valid URL (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20245 ">#20245</a>)</li>
<li>Ensure <code>@tailwindcss/cli</code> in <code>--watch</code> mode
rebuilds when the input CSS file changes in an ignored directory (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20246 ">#20246</a>)</li>
<li>Allow <code>@variant</code> rules used in <code>addBase(…)</code> to
use custom variants defined later (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20247 ">#20247</a>)</li>
<li>Prevent <code>@tailwindcss/vite</code> from crashing during HMR when
scanned files or directories are deleted (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20259 ">#20259</a>)</li>
<li>Generate <code>font-size</code> instead of <code>color</code>
declarations for <code>text-[--spacing(…)]</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20260 ">#20260</a>)</li>
<li>Prevent <code>@source</code> patterns from scanning unrelated
sibling files and folders (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20263 ">#20263</a>)</li>
<li>Extract class candidates adjacent to Template Toolkit delimiters
like <code>%]…[%</code> in <code>.tt</code>, <code>.tt2</code>, and
<code>.tx</code> files (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20269 ">#20269</a>)</li>
<li>Extract class candidates from conditional Maud syntax like
<code>p.text-black[condition]</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20269 ">#20269</a>)</li>
<li>Prevent <code>@position-try</code> rules from triggering unknown
at-rule warnings when optimizing CSS (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20277 ">#20277</a>)</li>
<li>Support class suggestions for named opacity modifiers from
<code>--opacity</code> theme values (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20287 ">#20287</a>)</li>
<li>Prevent type errors in <code>@tailwindcss/postcss</code> when used
with newer PostCSS patch releases (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20289 ">#20289</a>)</li>
</ul>
<h2>[4.3.1] - 2026-06-12</h2>
<h3>Added</h3>
<ul>
<li>Add <code>--silent</code> option to suppress output in
<code>@tailwindcss/cli</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20100 ">#20100</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Remove deprecation warnings by using
<code>Module#registerHooks</code> instead of
<code>Module#register</code> on Node 26+ (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20028 ">#20028</a>)</li>
<li>Canonicalization: don't crash when plugin utilities throw for
unsupported values (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20052 ">#20052</a>)</li>
<li>Allow <code>@apply</code> to be used with CSS mixins (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19427 ">#19427</a>)</li>
<li>Ensure <code>not-*</code> correctly negates <code>@container</code>
queries, including <code>style(…)</code> queries (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20059 ">#20059</a>)</li>
<li>Ensure <code>drop-shadow-*</code> color utilities work with custom
shadow values containing <code>calc(…)</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20080 ">#20080</a>)</li>
<li>Fix 'Sourcemap is likely to be incorrect' warnings when using
<code>@tailwindcss/vite</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20103 ">#20103</a>)</li>
<li>Ensure <code>@tailwindcss/webpack</code> can be installed in Rspack
projects without requiring <code>webpack</code> as a peer dependency (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20027 ">#20027</a>)</li>
<li>Canonicalization: don't suggest invalid <code>calc(…)</code>
expressions (e.g. <code>px-[calc(1rem+0px)]</code> →
<code>px-[calc(1rem+0)]</code>) (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20127 ">#20127</a>)</li>
<li>Canonicalization: avoid suggesting large spacing-scale values for
arbitrary lengths (e.g. <code>left-[99999px]</code> →
<code>left-[99999px]</code>, not <code>left-24999.75</code>) (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20130 ">#20130</a>)</li>
<li>Ensure <code>@tailwindcss/cli</code> in <code>--watch</code> mode
recovers when a tracked dependency is deleted and restored (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20137 ">#20137</a>)</li>
<li>Ensure standalone <code>@tailwindcss/cli</code> binaries are ignored
when scanning for class candidates (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20139 ">#20139</a>)</li>
<li>Ensure class candidates are extracted from Twig
<code>addClass(…)</code> and <code>removeClass(…)</code> calls (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20198 ">#20198</a>)</li>
<li>Don't crash in the Ruby or Vue preprocessors when scanning files
containing invalid UTF-8 bytes (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19588 ">#19588</a>)</li>
<li>Allow <code>@variant</code> to be used inside <code>addBase</code>
(<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19480 ">#19480</a>)</li>
<li>Ensure <code>@source</code> globs with symlinks are preserved (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20203 ">#20203</a>)</li>
<li>Ensure later <code>@source</code> rules can re-include files
excluded by earlier <code>@source not</code> rules (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20203 ">#20203</a>)</li>
<li>Upgrade: don't migrate empty class rules to invalid
<code>@utility</code> rules (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20205 ">#20205</a>)</li>
<li>Ensure transitions between <code>inset-shadow-none</code> and other
inset shadows work correctly (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20208 ">#20208</a>)</li>
<li>Ensure explicitly referenced <code>@source</code> directories are
scanned even when ignored by git (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20214 ">#20214</a>)</li>
<li>Ensure <code>@source</code> globs ending in <code>**/*</code>
preserve dynamic path segments to avoid scanning too many files (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20217 ">#20217</a>)</li>
<li>Canonicalization: don't fold <code>calc(…)</code> divisions when the
result would require high precision (e.g.
<code>w-[calc(100%/3.5)]</code> → <code>w-[calc(100%/3.5)]</code>, not
<code>w-[28.571428571428573%]</code>) (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20221 ">#20221</a>)</li>
<li>Serve ESM type declarations to ESM importers of
<code>@tailwindcss/postcss</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20228 ">#20228</a>)</li>
</ul>
<h3>Changed</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="056a155072https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/20281 ">#20281</a>)</li>
<li><a
href="8a14a71010https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/20226 ">#20226</a>)</li>
<li><a
href="522288ca08https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/20228 ">#20228</a>)</li>
<li><a
href="8dcdb66e8ahttps://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/20095 ">#20095</a>)</li>
<li><a
href="588bd7371fhttps://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/20023 ">#20023</a>)</li>
<li><a
href="12eb5ae7b6https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/20015 ">#20015</a>)</li>
<li><a
href="4255671c5fhttps://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/20013 ">#20013</a>)</li>
<li><a
href="52f94c74bbhttps://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/19999 ">#19999</a>)</li>
<li><a
href="d194d4c3e6https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/19878 ">#19878</a>)</li>
<li><a
href="bfb5732b0bhttps://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/19980 ">#19980</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/tailwindlabs/tailwindcss/commits/v4.3.2/packages/@tailwindcss-postcss ">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions ">GitHub Actions</a>, a new
releaser for <code>@tailwindcss/postcss</code> since your current
version.</p>
</details>
<br />
Updates `@types/mdx` from 2.0.13 to 2.0.14
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/mdx ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@types/react` from 19.2.14 to 19.2.17
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react ">compare
view</a></li>
</ul>
</details>
<br />
Updates `postcss` from 8.5.15 to 8.5.16
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/postcss/releases ">postcss's
releases</a>.</em></p>
<blockquote>
<h2>8.5.16</h2>
<ul>
<li>Fixed <code>Input#origin()</code> position (by <a
href="https://github.com/mizdra "><code>@mizdra</code></a>).</li>
<li>Fixed <code>raws</code> after rehydrating a JSON AST (by <a
href="https://github.com/sarathfrancis90 "><code>@sarathfrancis90</code></a>).</li>
<li>Fixed putting parent-less node in <code>nodes</code> of new node (by
<a
href="https://github.com/MahinAnowar "><code>@MahinAnowar</code></a>).</li>
<li>Fixed computing <code>offset</code> in <code>positionBy()</code> (by
<a
href="https://github.com/greymoth-jp "><code>@greymoth-jp</code></a>).</li>
<li>Fixed <code>rangeBy()</code> on <code>index: 0</code> (by <a
href="https://github.com/sarathfrancis90 "><code>@sarathfrancis90</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/postcss/blob/main/CHANGELOG.md ">postcss's
changelog</a>.</em></p>
<blockquote>
<h2>8.5.16</h2>
<ul>
<li>Fixed <code>Input#origin()</code> position (by <a
href="https://github.com/mizdra "><code>@mizdra</code></a>).</li>
<li>Fixed <code>raws</code> after rehydrating a JSON AST (by <a
href="https://github.com/sarathfrancis90 "><code>@sarathfrancis90</code></a>).</li>
<li>Fixed putting parent-less node in <code>nodes</code> of new node (by
<a
href="https://github.com/MahinAnowar "><code>@MahinAnowar</code></a>).</li>
<li>Fixed computing <code>offset</code> in <code>positionBy()</code> (by
<a
href="https://github.com/greymoth-jp "><code>@greymoth-jp</code></a>).</li>
<li>Fixed <code>rangeBy()</code> on <code>index: 0</code> (by <a
href="https://github.com/sarathfrancis90 "><code>@sarathfrancis90</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="92ccc93ff1818bdd604346e451068ehttps://redirect.github.com/postcss/postcss/issues/2036 ">#2036</a>)</li>
<li><a
href="34942ce76cd4feed6453https://redirect.github.com/postcss/postcss/issues/2097 ">#2097</a>)</li>
<li><a
href="da323fc8d388633691943828982213https://redirect.github.com/postcss/postcss/issues/2100 ">#2100</a>)</li>
<li><a
href="d1e80b8303https://redirect.github.com/postcss/postcss/issues/2091 ">#2091</a>)</li>
<li><a
href="b91e4a6390https://github.com/postcss/postcss/compare/8.5.15...8.5.16 ">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a href="https://www.npm ...
_Description has been truncated_
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-09 09:38:37 -04:00
Tejas Chopra
5771a8020e
fix(deps): remediate dependency CVEs and publish SBOM ( #1509 )
...
## Description
Supply-chain hardening: takes the **shipped** dependency surface from
**26 known CVEs to 0**. `pip install headroom-ai[all]` now resolves with
no known vulnerabilities (verified with Anchore syft + grype). Also
publishes a checked-in SBOM package (`sbom/`) so any user — especially
pilots running their own security review — can verify what's inside and
that we track it.
This addresses the Dependabot alerts on `main` (9 high / 4 moderate / 7
low at time of writing).
Closes #
## Type of Change
- [x] Bug fix (non-breaking change that fixes an issue)
- [ ] New feature (non-breaking change that adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
- [ ] Performance improvement
- [ ] Code refactoring (no functional changes)
## Changes Made
**Rust**
- `pyo3` 0.24 → 0.29 (GHSA-36hh-v3qg-5jq4 High, GHSA-chgr-c6px-7xpp
Med). Migrated `Python::allow_threads` → `Python::detach` (10 sites) and
added `from_py_object` to the `Clone`-deriving `#[pyclass]` types (both
required by the 0.25+ API).
- `pyo3-log` 0.12 → 0.13; `lru` 0.12 → 0.18 (GHSA-rhfx-m35p-ff5j).
**Python**
- `torch` → 2.12.1, `mem0ai` → 2.x.
- Floor-pinned transitive CVE deps via `[tool.uv]
constraint-dependencies`: `pygments>=2.20.0`,
`pydantic-settings>=2.14.2`, `gitpython>=3.1.50`, `langsmith>=0.9.0`.
- **Removed `benchmark` from the `[all]` aggregate** so the default
install is CVE-free. `lm-eval` is invoked as an external subprocess
(`python -m lm_eval`) and never imported, so it is not a true runtime
dep — it remains available via the opt-in `[benchmark]` extra. See
[Accepted Risks](#additional-notes).
**npm (build/test tooling — never shipped in the
wheel/container/published SDK)**
- `esbuild` override `>=0.28.1` in `sdk/typescript` + `plugins/openclaw`
(GHSA-g7r4-m6w7-qqqr).
- `docs/`: `@anthropic-ai/sdk` → `^0.106.0` (GHSA-p7fg-763f-g4gf),
`postcss` override to force Next.js's bundled copy ≥8.5.10
(GHSA-qx2v-qp2m-jg93); regenerated a stale `bun.lock` that carried a
**Critical** vitest/vite.
**CI**
- Pinned `pypa/gh-action-pypi-publish` `@release/v1` → `@v1.13.0`
(GHSA-vxmw-7h4f-hqxh) in `release.yml` + `publish.yml`.
**SBOM**
- New `sbom/` directory: CycloneDX 1.7 + SPDX 2.3 SBOMs, grype scan
evidence, 330-package license inventory, and a regeneration guide.
## Testing
- [ ] Unit tests pass (`pytest`) — N/A, no Python source changed
(deps/config only)
- [x] Linting passes — `cargo fmt --check` + `cargo clippy` clean on the
changed crate; 0 `.py` files changed so `ruff`/`mypy` scope is
unaffected
- [x] Type checking passes — `cargo check --workspace` (0 errors)
- [ ] New tests added — N/A (dependency bumps; covered by existing
suites)
- [x] Manual testing performed — see Real Behavior Proof
### Test Output
```text
# headroom-ai[all] product surface — the number that matters
$ grype sbom:sbom/headroom-sbom-all-extra.cdx.json
No vulnerabilities found
# full repo scan (universal lock incl. opt-in [benchmark] + dev)
$ grype sbom:sbom/headroom-sbom.cdx.json
NAME INSTALLED TYPE VULNERABILITY SEVERITY
sqlitedict 2.1.0 python GHSA-g4r7-86gm-pgqc High # [benchmark]-only, unpatchable, accepted
nltk 3.9.4 python GHSA-p4gq-832x-fm9v High # [benchmark]-only, unpatchable, accepted
# pyo3 0.29 migration — extension builds + imports + runs
$ cargo check --workspace
Finished `dev` profile [unoptimized + debuginfo] target(s)
$ maturin develop && python -c "from headroom._core import DiffCompressor, SmartCrusher; ..."
extension OK — detach + from_py_object paths exercised
# lru 0.18 — eviction path
$ cargo test -p headroom-proxy --lib drift
14 passed, 213 filtered out
# per-ecosystem npm audits
$ (cd sdk/typescript && npm audit) -> found 0 vulnerabilities
$ (cd plugins/openclaw && npm audit) -> found 0 vulnerabilities
$ (cd docs && npm audit && bun audit) -> found 0 vulnerabilities / No vulnerabilities found
```
## Real Behavior Proof
- Environment: macOS (darwin 25.4.0, arm64), Python 3.12 `.venv`, Rust
1.95 toolchain, syft 1.46.0, grype 0.115.0, bun 1.3.14, maturin 1.13.3.
- Exact command / steps: (1) `uv export --extra all --no-dev
--no-emit-project | syft → grype` for the product surface; (2) `cargo
check --workspace` + `maturin develop` + extension import/compress smoke
test; (3) `cargo test -p headroom-proxy --lib drift`; (4) `cargo fmt
--check` + `cargo clippy -p headroom-py`; (5) `npm audit` in
sdk/openclaw/docs + `bun audit` in docs.
- Observed result: `headroom-ai[all]` resolution scans clean — "No
vulnerabilities found" (179 pkgs); full/prod SBOM shows only the 2
documented accepted CVEs; pyo3 0.29 extension imports and runs (detach +
from_py_object paths exercised); drift tests 14/14 pass; cargo fmt +
clippy clean; all npm/bun audits report 0.
- Not tested: full `pytest` suite (no Python source changed);
release-profile wheel build (used dev-profile `maturin develop` for the
import proof — the extension is semantically identical).
## Review Readiness
- [x] I have performed a self-review
- [x] This PR is ready for human review
## Checklist
- [x] My code follows the project's style guidelines
- [x] I have performed a self-review of my code
- [x] I have commented my code, particularly in hard-to-understand areas
- [x] I have made corresponding changes to the documentation
(`sbom/README.md`)
- [x] My changes generate no new warnings
- [ ] I have added tests that prove my fix is effective — N/A
(dependency bumps; existing suites + scans cover it)
- [x] New and existing unit tests pass locally with my changes
- [ ] I have updated the CHANGELOG.md — N/A (Release Please
auto-generates from the conventional commit)
## Additional Notes
**Accepted risks (the 2 residual CVEs).** Both originate solely from the
EleutherAI `lm-evaluation-harness` under the **opt-in `[benchmark]`
extra**, which Headroom invokes as a subprocess (never imports):
- `sqlitedict` CVE-2024-35515 (High) — pickle deserialization; package
abandoned (last release 2021), **no upstream fix exists**.
- `nltk` CVE-2026-54293 (High) — path traversal in `nltk.data.load()`;
affects ≤3.9.4 (current latest), **no patched release**.
Neither is in `[all]`, the published wheel, or the container. They are
documented in `sbom/README.md` and will be picked up automatically once
upstream ships fixes.
**Release/CHANGELOG:** N/A items above are because this is a
dependency/security PR with no Python source changes; CHANGELOG is
Release-Please-managed via the conventional commit message.
2026-06-27 15:28:12 -07:00
dependabot[bot]
75f81cd19f
ci: bump the npm_and_yarn group across 3 directories with 3 updates ( #1056 )
...
[//]: # (dependabot-start)
⚠️ **Dependabot is rebasing this PR** ⚠️
Rebasing might not happen immediately, so don't worry if this takes some
time.
Note: if you make any changes to this PR yourself, they will take
precedence over the rebase.
---
[//]: # (dependabot-end)
Bumps the npm_and_yarn group with 1 update in the /docs directory:
[js-yaml](https://github.com/nodeca/js-yaml ).
Bumps the npm_and_yarn group with 1 update in the /plugins/openclaw
directory:
[vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite ).
Bumps the npm_and_yarn group with 2 updates in the /sdk/typescript
directory:
[vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite ) and
[form-data](https://github.com/form-data/form-data ).
Updates `js-yaml` from 4.1.1 to 4.2.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md ">js-yaml's
changelog</a>.</em></p>
<blockquote>
<h2>[4.2.0] - 2026-06-01</h2>
<h3>Added</h3>
<ul>
<li>Added <code>docs/safety.md</code> with notes about processing
untrusted YAML.</li>
<li>Added <code>maxDepth</code> (100) loader option. Not a problem, but
gives a better
exception instead of RangeError on stack overflow.</li>
<li>Added <code>maxMergeSeqLength</code> (20) loader option. Not a
problem after <code>merge</code> fix,
but an additional restriction for safety.</li>
<li>Added sourcemaps to <code>dist/</code> builds.</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Stop resolving numbers with underscores as numeric scalars, <a
href="https://redirect.github.com/nodeca/js-yaml/issues/627 ">#627</a>.</li>
<li>Switched dev toolchains to Vite / neostandard.</li>
<li>Updated demo.</li>
<li>Reorganized tests.</li>
<li><code>dist/</code> files are no longer kept in the repository.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix parsing of properties on the first implicit block mapping key,
<a
href="https://redirect.github.com/nodeca/js-yaml/issues/62 ">#62</a>.</li>
<li>Fix trailing whitespace handling when folding flow scalar lines, <a
href="https://redirect.github.com/nodeca/js-yaml/issues/307 ">#307</a>.</li>
<li>Reject top-level block scalars without content indentation, <a
href="https://redirect.github.com/nodeca/js-yaml/issues/280 ">#280</a>.</li>
<li>Ensure numbers survive round-trip, <a
href="https://redirect.github.com/nodeca/js-yaml/issues/737 ">#737</a>.</li>
<li>Fix test coverage for issue <a
href="https://redirect.github.com/nodeca/js-yaml/issues/221 ">#221</a>.</li>
<li>Fix flow scalar trailing whitespace folding, <a
href="https://redirect.github.com/nodeca/js-yaml/issues/307 ">#307</a>.</li>
<li>Fix digits in YAML named tag handles.</li>
</ul>
<h3>Security</h3>
<ul>
<li>Fix potential DoS via quadratic complexity in merge - deduplicate
repeated
elements (makes sense for malformed files > 10K).</li>
</ul>
<h2>[3.14.2] - 2025-11-15</h2>
<h3>Security</h3>
<ul>
<li>Backported v4.1.1 fix to v3</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/nodeca/js-yaml/commits ">compare view</a></li>
</ul>
</details>
<br />
Updates `vite` from 8.0.10 to 8.0.16
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/releases ">vite's
releases</a>.</em></p>
<blockquote>
<h2>v8.0.16</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.16/packages/vite/CHANGELOG.md ">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.15</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.15/packages/vite/CHANGELOG.md ">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.14</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.14/packages/vite/CHANGELOG.md ">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.13</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.13/packages/vite/CHANGELOG.md ">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.12</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.12/packages/vite/CHANGELOG.md ">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.11</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.11/packages/vite/CHANGELOG.md ">CHANGELOG.md</a>
for details.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md ">vite's
changelog</a>.</em></p>
<blockquote>
<h2><!-- raw HTML omitted --><a
href="https://github.com/vitejs/vite/compare/v8.0.15...v8.0.16 ">8.0.16</a>
(2026-06-01)<!-- raw HTML omitted --></h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>deps:</strong> reject UNC paths for launch-editor-middleware
(<a
href="https://redirect.github.com/vitejs/vite/issues/22571 ">#22571</a>)
(<a
href="50b951225bhttps://redirect.github.com/vitejs/vite/issues/22572 ">#22572</a>)
(<a
href="dc245c71e5https://github.com/vitejs/vite/compare/v8.0.14...v8.0.15 ">8.0.15</a>
(2026-06-01)<!-- raw HTML omitted --></h2>
<h3>Features</h3>
<ul>
<li>send 408 on request timeout (<a
href="https://redirect.github.com/vitejs/vite/issues/22476 ">#22476</a>)
(<a
href="c85c9eeb9ahttps://redirect.github.com/vitejs/vite/issues/22538 ">#22538</a>)
(<a
href="646dbedd28https://redirect.github.com/vitejs/vite/issues/22488 ">#22488</a>)
(<a
href="85a0eff1c8https://redirect.github.com/vitejs/vite/issues/22511 ">#22511</a>)
(<a
href="2686d7d0b7https://redirect.github.com/vitejs/vite/issues/21762 ">#21762</a>)
(<a
href="47c4213f13https://redirect.github.com/vitejs/vite/issues/22497 ">#22497</a>)
(<a
href="5c8e98f8b5https://redirect.github.com/vitejs/vite/issues/22528 ">#22528</a>)
(<a
href="e3cfb9deechttps://redirect.github.com/vitejs/vite/issues/22509 ">#22509</a>)
(<a
href="40985f1c09https://redirect.github.com/vitejs/vite/issues/22566 ">#22566</a>)
(<a
href="3052a67d93https://redirect.github.com/vitejs/vite/issues/22562 ">#22562</a>)
(<a
href="6978a9ceb9https://github.com/vitejs/vite/compare/v8.0.13...v8.0.14 ">8.0.14</a>
(2026-05-21)<!-- raw HTML omitted --></h2>
<h3>Features</h3>
<ul>
<li>update rolldown to 1.0.2 (<a
href="https://redirect.github.com/vitejs/vite/issues/22484 ">#22484</a>)
(<a
href="96efc88570https://redirect.github.com/vitejs/vite/issues/22471 ">#22471</a>)
(<a
href="98b8163213https://redirect.github.com/vitejs/vite/issues/22450 ">#22450</a>)
(<a
href="e8e9a34dcfhttps://redirect.github.com/vitejs/vite/issues/22480 ">#22480</a>)
(<a
href="5d94d1bffdhttps://redirect.github.com/vitejs/vite/issues/22342 ">#22342</a>)
(<a
href="b3132daceahttps://redirect.github.com/vitejs/vite/issues/22470 ">#22470</a>)
(<a
href="7cb728eb622c69495f25https://redirect.github.com/vitejs/vite/issues/22310 ">#22310</a>)
(<a
href="0ae2844ab6f94df87ff0dc245c71e5https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22572 ">#22572</a>)</li>
<li><a
href="50b951225bhttps://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22571 ">#22571</a>)</li>
<li><a
href="8d1b0195fd2686d7d0b7https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22511 ">#22511</a>)</li>
<li><a
href="3052a67d93https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22566 ">#22566</a>)</li>
<li><a
href="e3cfb9deechttps://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22528 ">#22528</a>)</li>
<li><a
href="6978a9ceb9https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22562 ">#22562</a>)</li>
<li><a
href="646dbedd28https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22538 ">#22538</a>)</li>
<li><a
href="85a0eff1c8https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22488 ">#22488</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vitejs/vite/commits/v8.0.16/packages/vite ">compare
view</a></li>
</ul>
</details>
<br />
Updates `vite` from 8.0.10 to 8.0.16
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/releases ">vite's
releases</a>.</em></p>
<blockquote>
<h2>v8.0.16</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.16/packages/vite/CHANGELOG.md ">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.15</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.15/packages/vite/CHANGELOG.md ">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.14</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.14/packages/vite/CHANGELOG.md ">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.13</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.13/packages/vite/CHANGELOG.md ">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.12</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.12/packages/vite/CHANGELOG.md ">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.11</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.11/packages/vite/CHANGELOG.md ">CHANGELOG.md</a>
for details.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md ">vite's
changelog</a>.</em></p>
<blockquote>
<h2><!-- raw HTML omitted --><a
href="https://github.com/vitejs/vite/compare/v8.0.15...v8.0.16 ">8.0.16</a>
(2026-06-01)<!-- raw HTML omitted --></h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>deps:</strong> reject UNC paths for launch-editor-middleware
(<a
href="https://redirect.github.com/vitejs/vite/issues/22571 ">#22571</a>)
(<a
href="50b951225bhttps://redirect.github.com/vitejs/vite/issues/22572 ">#22572</a>)
(<a
href="dc245c71e5https://github.com/vitejs/vite/compare/v8.0.14...v8.0.15 ">8.0.15</a>
(2026-06-01)<!-- raw HTML omitted --></h2>
<h3>Features</h3>
<ul>
<li>send 408 on request timeout (<a
href="https://redirect.github.com/vitejs/vite/issues/22476 ">#22476</a>)
(<a
href="c85c9eeb9ahttps://redirect.github.com/vitejs/vite/issues/22538 ">#22538</a>)
(<a
href="646dbedd28https://redirect.github.com/vitejs/vite/issues/22488 ">#22488</a>)
(<a
href="85a0eff1c8https://redirect.github.com/vitejs/vite/issues/22511 ">#22511</a>)
(<a
href="2686d7d0b7https://redirect.github.com/vitejs/vite/issues/21762 ">#21762</a>)
(<a
href="47c4213f13https://redirect.github.com/vitejs/vite/issues/22497 ">#22497</a>)
(<a
href="5c8e98f8b5https://redirect.github.com/vitejs/vite/issues/22528 ">#22528</a>)
(<a
href="e3cfb9deechttps://redirect.github.com/vitejs/vite/issues/22509 ">#22509</a>)
(<a
href="40985f1c09https://redirect.github.com/vitejs/vite/issues/22566 ">#22566</a>)
(<a
href="3052a67d93https://redirect.github.com/vitejs/vite/issues/22562 ">#22562</a>)
(<a
href="6978a9ceb9https://github.com/vitejs/vite/compare/v8.0.13...v8.0.14 ">8.0.14</a>
(2026-05-21)<!-- raw HTML omitted --></h2>
<h3>Features</h3>
<ul>
<li>update rolldown to 1.0.2 (<a
href="https://redirect.github.com/vitejs/vite/issues/22484 ">#22484</a>)
(<a
href="96efc88570https://redirect.github.com/vitejs/vite/issues/22471 ">#22471</a>)
(<a
href="98b8163213https://redirect.github.com/vitejs/vite/issues/22450 ">#22450</a>)
(<a
href="e8e9a34dcfhttps://redirect.github.com/vitejs/vite/issues/22480 ">#22480</a>)
(<a
href="5d94d1bffdhttps://redirect.github.com/vitejs/vite/issues/22342 ">#22342</a>)
(<a
href="b3132daceahttps://redirect.github.com/vitejs/vite/issues/22470 ">#22470</a>)
(<a
href="7cb728eb622c69495f25https://redirect.github.com/vitejs/vite/issues/22310 ">#22310</a>)
(<a
href="0ae2844ab6f94df87ff0dc245c71e5https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22572 ">#22572</a>)</li>
<li><a
href="50b951225bhttps://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22571 ">#22571</a>)</li>
<li><a
href="8d1b0195fd2686d7d0b7https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22511 ">#22511</a>)</li>
<li><a
href="3052a67d93https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22566 ">#22566</a>)</li>
<li><a
href="e3cfb9deechttps://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22528 ">#22528</a>)</li>
<li><a
href="6978a9ceb9https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22562 ">#22562</a>)</li>
<li><a
href="646dbedd28https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22538 ">#22538</a>)</li>
<li><a
href="85a0eff1c8https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22488 ">#22488</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vitejs/vite/commits/v8.0.16/packages/vite ">compare
view</a></li>
</ul>
</details>
<br />
Updates `form-data` from 4.0.5 to 4.0.6
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/form-data/form-data/blob/master/CHANGELOG.md ">form-data's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/form-data/form-data/compare/v4.0.5...v4.0.6 ">v4.0.6</a>
- 2026-06-12</h2>
<h3>Commits</h3>
<ul>
<li>[Fix] escape CR, LF, and <code>"</code> in field names and
filenames <a
href="8dff42c6daf31d21ef1092ae0eb5da67b0f65c2e64190db54892ae0eb5daf31d21ef108dff42c6da67b0f65c2ehttps://github.com/form-data/form-data/compare/v4.0.5...v4.0.6 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/chopratejas/headroom/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-16 23:07:34 -07:00
JD Davis
8cea290a15
docs(ci): add CI/CD flow diagrams ( #1062 )
...
## Description
Adds a visual CI/CD flow reference for Headroom so contributors can
quickly understand the gated PR, release, Docker, docs deploy, fork
approval, and manual validation paths. Also updates the release
documentation to match the current release-please release flow instead
of the stale push-to-main release model.
## Type of Change
- [ ] Bug fix (non-breaking change that fixes an issue)
- [ ] New feature (non-breaking change that adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
- [ ] Performance improvement
- [ ] Code refactoring (no functional changes)
## Changes Made
- Added `docs/content/docs/ci-cd-flows.mdx` with Mermaid diagrams and
decision trees for PR review, release publishing, Docker publishing,
docs deploys, fork workflow approval, and manual validation.
- Updated `docs/content/docs/releases.mdx` to describe the current
`release-please` -> GitHub Release -> `release.yml` publishing path.
- Added the CI/CD flow page and existing release page to docs
navigation.
- Added Mermaid to the docs code highlighter language list.
- Restored missing docs helper modules and aligned Fumadocs dependencies
so the docs app can install, generate sources, type-check, and build.
## Testing
- [ ] Unit tests pass (`pytest`)
- [ ] Linting passes (`ruff check .`)
- [ ] Type checking passes (`mypy headroom`)
- [ ] New tests added for new functionality
- [x] Manual testing performed
### Test Output
```text
$ npm ci
> headroom-docs@0.0.0 postinstall
> fumadocs-mdx
[MDX] generated files
added 365 packages, and audited 367 packages
$ npm run types:check
> fumadocs-mdx && next typegen && tsc --noEmit
[MDX] generated files
Generating route types...
✓ Types generated successfully
$ npm run build
> next build
✓ Compiled successfully
Running TypeScript ...
Generating static pages ...
✓ Generating static pages (122/122)
Note: next build completed successfully and emitted two existing Recharts container-size warnings during static generation.
$ git diff --check
# no output
$ act workflow_dispatch -W .github/workflows/docs.yml -n
*DRYRUN* [Deploy Documentation/deploy] 🏁 Job succeeded
```
## Real Behavior Proof
- Environment: Windows local checkout, branch `docs-ci-flow`, Node.js
v22.22.0, `act` 0.2.87.
- Exact command / steps: Ran `npm ci`, `npm run types:check`, and `npm
run build` from `docs/`; ran `git diff --check` and `act
workflow_dispatch -W .github/workflows/docs.yml -n` from the repository
root.
- Observed result: Docs dependencies install, Fumadocs source generation
includes `ci-cd-flows.mdx`, TypeScript passes, Next production build
completes, whitespace check passes, and the docs workflow dry-run
succeeds under `act`.
- Not tested: Full live GitHub Pages deploy and registry/release
publishing, because this PR only changes docs and docs build wiring.
## Review Readiness
- [x] I have performed a self-review
- [x] This PR is ready for human review
## Checklist
- [x] My code follows the project's style guidelines
- [x] I have performed a self-review of my code
- [x] I have commented my code, particularly in hard-to-understand areas
- [x] I have made corresponding changes to the documentation
- [ ] My changes generate no new warnings
- [ ] I have added tests that prove my fix is effective or that my
feature works
- [ ] New and existing unit tests pass locally with my changes
- [ ] I have updated the CHANGELOG.md if applicable
## Screenshots (if applicable)
N/A. This is documentation and build wiring; the diagrams are Mermaid
source blocks in the docs page.
## Additional Notes
- No issue is linked because this PR was not opened for a specific
tracked issue.
- `npm run build` still reports two pre-existing Recharts container-size
warnings while completing successfully.
- Python unit/lint/type checks and changelog updates are not applicable
to this docs-only change.
2026-06-16 23:05:15 -07:00
dependabot[bot]
4f59097045
ci: bump esbuild from 0.27.7 to 0.28.1 in /docs in the npm_and_yarn group across 1 directory ( #936 )
...
Bumps the npm_and_yarn group with 1 update in the /docs directory:
[esbuild](https://github.com/evanw/esbuild ).
Updates `esbuild` from 0.27.7 to 0.28.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/evanw/esbuild/releases ">esbuild's
releases</a>.</em></p>
<blockquote>
<h2>v0.28.1</h2>
<ul>
<li>
<p>Disallow <code>\</code> in local development server HTTP requests (<a
href="https://github.com/evanw/esbuild/security/advisories/GHSA-g7r4-m6w7-qqqr ">GHSA-g7r4-m6w7-qqqr</a>)</p>
<p>This release fixes a security issue where HTTP requests to esbuild's
local development server could traverse outside of the serve directory
on Windows using a <code>\</code> backslash character. It happened due
to the use of Go's <code>path.Clean()</code> function, which only
handles Unix-style <code>/</code> characters. HTTP requests with paths
containing <code>\</code> are no longer allowed.</p>
<p>Thanks to <a
href="https://github.com/dellalibera "><code>@dellalibera</code></a> for
reporting this issue.</p>
</li>
<li>
<p>Add integrity checks to the Deno API (<a
href="https://github.com/evanw/esbuild/security/advisories/GHSA-gv7w-rqvm-qjhr ">GHSA-gv7w-rqvm-qjhr</a>)</p>
<p>The previous release of esbuild added integrity checks to esbuild's
npm install script. This release also adds integrity checks to esbuild's
Deno install script. Now esbuild's Deno API will also fail with an error
if the downloaded esbuild binary contains something other than the
expected content.</p>
<p>Note that esbuild's Deno API installs from
<code>registry.npmjs.org</code> by default, but allows the
<code>NPM_CONFIG_REGISTRY</code> environment variable to override this
with a custom package registry. This change means that the esbuild
executable served by <code>NPM_CONFIG_REGISTRY</code> must now match the
expected content.</p>
<p>Thanks to <a
href="https://github.com/sondt99 "><code>@sondt99</code></a> for
reporting this issue.</p>
</li>
<li>
<p>Avoid inlining <code>using</code> and <code>await using</code>
declarations (<a
href="https://redirect.github.com/evanw/esbuild/issues/4482 ">#4482</a>)</p>
<p>Previously esbuild's minifier sometimes incorrectly inlined
<code>using</code> and <code>await using</code> declarations into
subsequent uses of that declaration, which then fails to dispose of the
resource correctly. This bug happened because inlining was done for
<code>let</code> and <code>const</code> declarations by avoiding doing
it for <code>var</code> declarations, which no longer worked when more
declaration types were added. Here's an example:</p>
<pre lang="js"><code>// Original code
{
using x = new Resource()
x.activate()
}
<p>// Old output (with --minify)<br />
new Resource().activate();</p>
<p>// New output (with --minify)<br />
{using e=new Resource;e.activate()}<br />
</code></pre></p>
</li>
<li>
<p>Fix module evaluation when an error is thrown (<a
href="https://redirect.github.com/evanw/esbuild/issues/4461 ">#4461</a>,
<a
href="https://redirect.github.com/evanw/esbuild/pull/4467 ">#4467</a>)</p>
<p>If an error is thrown during module evaluation, esbuild previously
didn't preserve the state of the module for subsequent module
references. This was observable if <code>import()</code> or
<code>require()</code> is used to import a module multiple times. The
thrown error is supposed to be thrown by every call to
<code>import()</code> or <code>require()</code>, not just the first.
With this release, esbuild will now throw the same error every time you
call <code>import()</code> or <code>require()</code> on a module that
throws during its evaluation.</p>
</li>
<li>
<p>Fix some edge cases around the <code>new</code> operator (<a
href="https://redirect.github.com/evanw/esbuild/issues/4477 ">#4477</a>)</p>
<p>Previously esbuild incorrectly printed certain edge cases involving
complex expressions inside the target of a <code>new</code> expression
(specifically an optional chain and/or a tagged template literal). The
generated code for the <code>new</code> target was not correctly wrapped
with parentheses, and either contained a syntax error or had different
semantics. These edge cases have been fixed so that they now correctly
wrap the <code>new</code> target in parentheses. Here is an example of
some affected code:</p>
<pre lang="js"><code>// Original code
new (foo()`bar`)()
new (foo()?.bar)()
<p>// Old output<br />
new foo()<code>bar</code>();<br />
new (foo())?.bar();</p>
<p></code></pre></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/evanw/esbuild/blob/main/CHANGELOG.md ">esbuild's
changelog</a>.</em></p>
<blockquote>
<h2>0.28.1</h2>
<ul>
<li>
<p>Disallow <code>\</code> in local development server HTTP requests (<a
href="https://github.com/evanw/esbuild/security/advisories/GHSA-g7r4-m6w7-qqqr ">GHSA-g7r4-m6w7-qqqr</a>)</p>
<p>This release fixes a security issue where HTTP requests to esbuild's
local development server could traverse outside of the serve directory
on Windows using a <code>\</code> backslash character. It happened due
to the use of Go's <code>path.Clean()</code> function, which only
handles Unix-style <code>/</code> characters. HTTP requests with paths
containing <code>\</code> are no longer allowed.</p>
<p>Thanks to <a
href="https://github.com/dellalibera "><code>@dellalibera</code></a> for
reporting this issue.</p>
</li>
<li>
<p>Add integrity checks to the Deno API (<a
href="https://github.com/evanw/esbuild/security/advisories/GHSA-gv7w-rqvm-qjhr ">GHSA-gv7w-rqvm-qjhr</a>)</p>
<p>The previous release of esbuild added integrity checks to esbuild's
npm install script. This release also adds integrity checks to esbuild's
Deno install script. Now esbuild's Deno API will also fail with an error
if the downloaded esbuild binary contains something other than the
expected content.</p>
<p>Note that esbuild's Deno API installs from
<code>registry.npmjs.org</code> by default, but allows the
<code>NPM_CONFIG_REGISTRY</code> environment variable to override this
with a custom package registry. This change means that the esbuild
executable served by <code>NPM_CONFIG_REGISTRY</code> must now match the
expected content.</p>
<p>Thanks to <a
href="https://github.com/sondt99 "><code>@sondt99</code></a> for
reporting this issue.</p>
</li>
<li>
<p>Avoid inlining <code>using</code> and <code>await using</code>
declarations (<a
href="https://redirect.github.com/evanw/esbuild/issues/4482 ">#4482</a>)</p>
<p>Previously esbuild's minifier sometimes incorrectly inlined
<code>using</code> and <code>await using</code> declarations into
subsequent uses of that declaration, which then fails to dispose of the
resource correctly. This bug happened because inlining was done for
<code>let</code> and <code>const</code> declarations by avoiding doing
it for <code>var</code> declarations, which no longer worked when more
declaration types were added. Here's an example:</p>
<pre lang="js"><code>// Original code
{
using x = new Resource()
x.activate()
}
<p>// Old output (with --minify)<br />
new Resource().activate();</p>
<p>// New output (with --minify)<br />
{using e=new Resource;e.activate()}<br />
</code></pre></p>
</li>
<li>
<p>Fix module evaluation when an error is thrown (<a
href="https://redirect.github.com/evanw/esbuild/issues/4461 ">#4461</a>,
<a
href="https://redirect.github.com/evanw/esbuild/pull/4467 ">#4467</a>)</p>
<p>If an error is thrown during module evaluation, esbuild previously
didn't preserve the state of the module for subsequent module
references. This was observable if <code>import()</code> or
<code>require()</code> is used to import a module multiple times. The
thrown error is supposed to be thrown by every call to
<code>import()</code> or <code>require()</code>, not just the first.
With this release, esbuild will now throw the same error every time you
call <code>import()</code> or <code>require()</code> on a module that
throws during its evaluation.</p>
</li>
<li>
<p>Fix some edge cases around the <code>new</code> operator (<a
href="https://redirect.github.com/evanw/esbuild/issues/4477 ">#4477</a>)</p>
<p>Previously esbuild incorrectly printed certain edge cases involving
complex expressions inside the target of a <code>new</code> expression
(specifically an optional chain and/or a tagged template literal). The
generated code for the <code>new</code> target was not correctly wrapped
with parentheses, and either contained a syntax error or had different
semantics. These edge cases have been fixed so that they now correctly
wrap the <code>new</code> target in parentheses. Here is an example of
some affected code:</p>
<pre lang="js"><code>// Original code
new (foo()`bar`)()
new (foo()?.bar)()
<p>// Old output<br />
new foo()<code>bar</code>();<br />
new (foo())?.bar();<br />
</code></pre></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="bb9db84c029ff053e53b0a9bf2135be2a1a7132083a2cbfc35https://redirect.github.com/evanw/esbuild/issues/4482 ">#4482</a>:
don't inline <code>using</code> declarations</li>
<li><a
href="308ad745d8https://redirect.github.com/evanw/esbuild/issues/4471 ">#4471</a>:
renaming of nested <code>var</code> declarations</li>
<li><a
href="f013f5f99aaafd6e48b1https://redirect.github.com/evanw/esbuild/issues/4462 ">#4462</a>)</li>
<li><a
href="15300c30b51bda0c31d7https://redirect.github.com/evanw/esbuild/issues/4461 ">#4461</a>,
fix <a
href="https://redirect.github.com/evanw/esbuild/issues/4467 ">#4467</a>:
esm evaluation fixes</li>
<li>Additional commits viewable in <a
href="https://github.com/evanw/esbuild/compare/v0.27.7...v0.28.1 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/chopratejas/headroom/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-12 23:16:29 -05:00
dependabot[bot]
35b46d6e84
ci: bump brace-expansion from 5.0.5 to 5.0.6 in /docs in the npm_and_yarn group across 1 directory ( #835 )
...
Bumps the npm_and_yarn group with 1 update in the /docs directory:
[brace-expansion](https://github.com/juliangruber/brace-expansion ).
Updates `brace-expansion` from 5.0.5 to 5.0.6
<details>
<summary>Commits</summary>
<ul>
<li><a
href="46317b5d87c0b095bdc5ec5602085ahttps://redirect.github.com/juliangruber/brace-expansion/issues/93 ">#93</a>)</li>
<li>See full diff in <a
href="https://github.com/juliangruber/brace-expansion/compare/v5.0.5...v5.0.6 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/chopratejas/headroom/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-10 18:32:56 -05:00
Steven Cuz Leath
db5d15f99e
Fix: Update Next.js to 16.2.6 in docs/package.json and package-lock.json to address GHSA-h64f-5h5j-jqjh (CVE-2026-44577)
2026-06-01 10:32:23 +00:00
dependabot[bot]
2f659535d2
chore(deps): bump the npm_and_yarn group across 3 directories with 4 updates
...
Bumps the npm_and_yarn group with 1 update in the /sdk/typescript directory: [esbuild](https://github.com/evanw/esbuild ).
Bumps the npm_and_yarn group with 1 update in the /plugins/openclaw directory: [esbuild](https://github.com/evanw/esbuild ).
Bumps the npm_and_yarn group with 2 updates in the /docs directory: [postcss](https://github.com/postcss/postcss ) and [next](https://github.com/vercel/next.js ).
Updates `esbuild` from 0.21.5 to 0.27.4
- [Release notes](https://github.com/evanw/esbuild/releases )
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md )
- [Commits](https://github.com/evanw/esbuild/compare/v0.21.5...v0.27.4 )
Updates `postcss` from 8.5.8 to 8.5.10
- [Release notes](https://github.com/postcss/postcss/releases )
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md )
- [Commits](https://github.com/postcss/postcss/compare/8.5.8...8.5.10 )
Updates `vite` from 5.4.21 to 8.0.10
- [Release notes](https://github.com/vitejs/vite/releases )
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md )
- [Commits](https://github.com/vitejs/vite/commits/v8.0.10/packages/vite )
Updates `esbuild` from 0.21.5 to 0.27.4
- [Release notes](https://github.com/evanw/esbuild/releases )
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md )
- [Commits](https://github.com/evanw/esbuild/compare/v0.21.5...v0.27.4 )
Updates `postcss` from 8.5.8 to 8.5.10
- [Release notes](https://github.com/postcss/postcss/releases )
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md )
- [Commits](https://github.com/postcss/postcss/compare/8.5.8...8.5.10 )
Updates `vite` from 5.4.21 to 8.0.10
- [Release notes](https://github.com/vitejs/vite/releases )
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md )
- [Commits](https://github.com/vitejs/vite/commits/v8.0.10/packages/vite )
Updates `postcss` from 8.5.8 to 8.5.10
- [Release notes](https://github.com/postcss/postcss/releases )
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md )
- [Commits](https://github.com/postcss/postcss/compare/8.5.8...8.5.10 )
Updates `next` from 16.2.2 to 16.2.4
- [Release notes](https://github.com/vercel/next.js/releases )
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js )
- [Commits](https://github.com/vercel/next.js/compare/v16.2.2...v16.2.4 )
---
updated-dependencies:
- dependency-name: esbuild
dependency-version: 0.27.4
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: postcss
dependency-version: 8.5.10
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: vite
dependency-version: 8.0.10
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: esbuild
dependency-version: 0.27.4
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: postcss
dependency-version: 8.5.10
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: vite
dependency-version: 8.0.10
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: postcss
dependency-version: 8.5.10
dependency-type: direct:development
dependency-group: npm_and_yarn
- dependency-name: next
dependency-version: 16.2.4
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-04-24 22:15:53 +00:00
Adib Mohsin
911eb85a44
new docs UI + ts doc coverage
2026-04-12 13:15:58 +06:00
Gaurav Yadav