Skip to content

build(deps): bump the production-dependencies group across 1 directory with 8 updates - #23

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-fa3a498eeb
Open

build(deps): bump the production-dependencies group across 1 directory with 8 updates#23
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-fa3a498eeb

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 31, 2026

Copy link
Copy Markdown

Bumps the production-dependencies group with 8 updates in the / directory:

Package From To
@azure/identity 4.13.1 4.13.2
bullmq 5.81.3 5.81.4
lucide-react 0.441.0 0.577.0
mammoth 1.12.0 1.12.2
next 15.5.23 15.5.24
openai 7.4.0 7.8.0
react-hook-form 7.84.0 7.86.0
tsx 4.23.9 4.23.12

Updates @azure/identity from 4.13.1 to 4.13.2

Changelog

Sourced from @​azure/identity's changelog.

4.13.2 (2026-08-12)

Other Changes

  • Bumped the minimum @azure/msal-node dependency to ^5.1.5 so installs no longer resolve older 5.1.x versions that pull in the vulnerable uuid@8.3.0 transitive dependency. #39569
  • Replaced shell-based developer credential commands with safe, structured process execution. #39279
  • Migrated platform-specific module resolution to #platform/* imports. #38309
Commits
  • ffeacaf Migrate @​azure/identity from polyfillSuffix to #platform/* imports
  • 3ec2003 [core] Add safe child process execution
  • 1f7253a Update package.json
  • 4b6cf67 Update test expectation
  • 14350c8 Format packages
  • 4fd7288 Update all missing configuration files
  • 8490453 [Identity] Bump @​azure/msal-node to ^5.1.5 to drop vulnerable uuid transitive...
  • d96ae18 Identity GA 4.13.1
  • a46a830 [ESLint] Restore no-unassigned-vars recommended rule to error (#39460)
  • 5316d04 [core] Add safe child process execution (#39279)
  • Additional commits viewable in compare view

Updates bullmq from 5.81.3 to 5.81.4

Release notes

Sourced from bullmq's releases.

v5.81.4

5.81.4 (2026-08-27)

Bug Fixes

  • flow-producer: add createScripts method for extension (#4641) (9884e09)
Commits
  • 9884e09 fix(flow-producer): add createScripts method for extension (#4641)
  • eb23031 ci: add support for releases in the v5 branch
  • 5dfd23a chore(release): vrs1.2.1 (#4406)
  • eb956b0 fix(deps): pin dependencies [rust] (#4402)
  • fcd8281 chore(deps): update dependency picomatch to v4.0.5 (#4398)
  • 0b820ac chore(deps): update dependency tar to v7.5.22 (#4400)
  • b73c328 chore(deps): update dependency python to v3.14.6 (#4399)
  • 4fca524 chore(deps): update actions/upload-artifact action to v7.0.1 (#4397)
  • f268708 chore(deps): update peaceiris/actions-gh-pages digest to 84c30a8 (#4396)
  • f4d7d1a chore(deps): update google/osv-scanner-action digest to 9a49870 (#4395)
  • Additional commits viewable in compare view

Updates lucide-react from 0.441.0 to 0.577.0

Release notes

Sourced from lucide-react's releases.

Version 0.577.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@0.576.0...0.577.0

Version 0.576.0

What's Changed

Full Changelog: lucide-icons/lucide@0.575.0...0.576.0

Version 0.575.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@0.573.0...0.575.0

Version 0.574.0

What's Changed

New Contributors

... (truncated)

Commits
  • f6c0d06 chore(deps): bump rollup from 4.53.3 to 4.59.0 (#4106)
  • 67c0485 feat(scripts): added helper script to automatically update OpenCollective bac...
  • b6ed43d feat(packages): Added aria-hidden fallback for decorative icons to all packag...
  • 076e0bb chore(dependencies): Update dependencies (#3809)
  • 80d6f73 fix(icons): Rename fingerprint icon to fingerprint-pattern (#3767)
  • 1cfb3ff chore(deps-dev): bump vite from 6.3.5 to 6.3.6 (#3611)
  • e71198d chore: icon alias improvements (#2861)
  • 3e644fd chore(scripts): Refactor scripts to typescript (#3316)
  • 19fa01b build(deps-dev): bump vite from 6.3.2 to 6.3.4 (#3181)
  • 03eb862 use implicit return in react package (#2325)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for lucide-react since your current version.


Updates mammoth from 1.12.0 to 1.12.2

Changelog

Sourced from mammoth's changelog.

1.12.2

  • Avoid prototype pollution when reading the styles defined in a document. This avoids an issue where a maliciously crafted document could be used to set externalFileAccess to true.

1.12.1

  • Fix: on Windows, when an image's content type includes a backslash in the subpart, files may be written outside of the directory set by --output-dir.

  • Detect and ignore numbering levels that use numStyleLink to refer to themselves.

Commits
  • 8706034 Bump version to 1.12.2
  • 2888fa1 Create objects without prototypes when used as map with arbitrary keys
  • 31f0c37 Avoid prototype pollution when reading styles
  • e3b9cec Bump version to 1.12.1
  • c69ea62 Ignore numbering levels that use numStyleLink to refer to themselves
  • fbf5e22 Check image content type for backslashes
  • 1a495a9 Add note on performance
  • ee59684 Remove donations section
  • See full diff in compare view

Updates next from 15.5.23 to 15.5.24

Release notes

Sourced from next's releases.

v15.5.24

This release contains security fixes for the following advisories:

Critical:

Commits
  • b6c45b4 v15.5.24
  • b0f3460 [15.5.x] Fix ISR misses with backslashes in segments when deployed on Windows
  • 409772e [15.5.x] [next/image]: disable avif image optimization
  • 9c44b88 [15.x] support sharp 0.34 and 0.35
  • 144fa5d [15.5.x] Remove generated error codes (#97783)
  • ddd94f0 [15.5.x] Authenticate Turborepo remote caching with OIDC instead of a static ...
  • 1da7a0a [15.5] [ci] Use OIDC tokens to read private preview builds (#97259)
  • 70ab0fe [15.x] Default deploy e2e tests to the repo next version (#96899)
  • e57d564 v15.5.23
  • c4914aa [15.x] Port ReplyServer traversal guards to FlightClient (#96405)
  • Additional commits viewable in compare view

Updates openai from 7.4.0 to 7.8.0

Release notes

Sourced from openai's releases.

v7.8.0

7.8.0 (2026-08-27)

Features

  • api: add compute_units to Responses and Chat Completions usage (#2505) (f9b1313)
  • api: add default WebSocket User-Agent and audit log events (#2504) (9b2f089)

Bug Fixes

  • auth: clamp the workload-identity refresh buffer to the token lifetime (#2490) (76b73a9)
  • auth: secure first-class X.509 workload credentials (#2479) (1b36c19)
  • deps: harden dependency and release boundaries (#2484) (b21ff45)
  • events: settle WebSocket waiters when listeners throw (#2491) (b5a13a7)
  • restore native browser ESM imports (#2495) (c8cab1e)
  • uploads: detect multipart bodies from own properties only (#2492) (559ffc8)

v7.7.0

7.7.0 (2026-08-26)

Features

  • api: make function call output call IDs optional (#2488) (b932ae6)

Bug Fixes

  • streaming: honor cancellation while decoding SSE responses (#2487) (ababe12)

v7.6.0

7.6.0 (2026-08-26)

Features

  • api: Add obfuscation field to ChatCompletionChunk (#2423) (39afa3a)
  • api: Add project residency and usage quantity_unit fields (#2461) (26d8158)
  • api: support backend-mediated Realtime WebRTC calls (#2469) (0d12ca8)
  • auth: add pinned X.509 workload token exchange (#2470) (9dd8648)
  • auth: attest cross-module X.509 transport capabilities (#2471) (c6769fa)
  • auth: harden X.509 token lifecycle and tenant isolation (#2473) (6992683)
  • auth: integrate attested X.509 workload identity into clients (#2472) (ee5229b)
  • support named data-residency endpoints (#2393) (62d98dd)

Bug Fixes

... (truncated)

Changelog

Sourced from openai's changelog.

7.8.0 (2026-08-27)

Features

  • api: add compute_units to Responses and Chat Completions usage (#2505) (f9b1313)
  • api: add default WebSocket User-Agent and audit log events (#2504) (9b2f089)

Bug Fixes

  • auth: clamp the workload-identity refresh buffer to the token lifetime (#2490) (76b73a9)
  • auth: secure first-class X.509 workload credentials (#2479) (1b36c19)
  • deps: harden dependency and release boundaries (#2484) (b21ff45)
  • events: settle WebSocket waiters when listeners throw (#2491) (b5a13a7)
  • restore native browser ESM imports (#2495) (c8cab1e)
  • uploads: detect multipart bodies from own properties only (#2492) (559ffc8)

7.7.0 (2026-08-26)

Features

  • api: make function call output call IDs optional (#2488) (b932ae6)

Bug Fixes

  • streaming: honor cancellation while decoding SSE responses (#2487) (ababe12)

7.6.0 (2026-08-26)

Features

  • api: Add obfuscation field to ChatCompletionChunk (#2423) (39afa3a)
  • api: Add project residency and usage quantity_unit fields (#2461) (26d8158)
  • api: support backend-mediated Realtime WebRTC calls (#2469) (0d12ca8)
  • auth: add pinned X.509 workload token exchange (#2470) (9dd8648)
  • auth: attest cross-module X.509 transport capabilities (#2471) (c6769fa)
  • auth: harden X.509 token lifecycle and tenant isolation (#2473) (6992683)
  • auth: integrate attested X.509 workload identity into clients (#2472) (ee5229b)
  • support named data-residency endpoints (#2393) (62d98dd)

Bug Fixes

  • [responses] Avoid quadratic comparisons when accumulating long text (#2434) (95628ce)
  • assistants: reject run-step identity hijacking before tool callbacks (#2476) (63b1c75)
  • audio: preserve recording outcomes during cancellation and cleanup (#2482) (dafcac4)

... (truncated)

Commits
  • 31fae53 release: 7.8.0 (#2493)
  • f9b1313 feat(api): add compute_units to Responses and Chat Completions usage (#2505)
  • b21ff45 fix(deps): harden dependency and release boundaries (#2484)
  • a4a80eb test: exercise direct browser imports without credentials (#2501)
  • c8cab1e fix: restore native browser ESM imports (#2495)
  • d691a10 test: execute webpack browser bundle without live credentials (#2498)
  • 7ef99c4 test: verify packed browser bundles target ES2020 (#2496)
  • b86efac ci: require keyless ecosystem checks on release PRs (#2497)
  • 08f201c ci: gate npm publication on browser-compatible imports (#2500)
  • 44af438 test: cover webpack ESM and CommonJS package entrypoints (#2499)
  • Additional commits viewable in compare view

Updates react-hook-form from 7.84.0 to 7.86.0

Release notes

Sourced from react-hook-form's releases.

Version 7.86.0

✨ Features

🐞 Fixes

  • Fix useWatch returning stale values when the watched name changes to null. (#13668)
  • Fix unregister keepDirty behavior. (#13669)
  • Fix setValues for fields registered under object or array values. (#13667)
  • Fix Controller notifications for field array item roots. (#13665)
  • Fix validation state checks. (#13661)
  • Fix setCustomValidity with criteriaMode: 'all'. (#13655)
  • Fix File, Blob, and FileList handling in flatten. (#13652)
  • Fix stale errors and touched state after updating a field array item. (#13650)
  • Fix stale field names leaking into persisted formState. (#13649)

🚀 Performance

  • Improve createFormControl performance. (#13648)
  • Improve cloneObject performance.
  • Avoid unnecessary value cloning in unregister. (#13662)
  • Improve performance in onChange-heavy workloads.

🧹 Chores & Refactoring

  • Remove unnecessary any usage. (#13660)
  • Improve TypeScript handling around checkbox values. (#13659)
  • Improve UUID generation. (#13658)
  • Clean up repository structure and APIs. (#13657)
  • Remove unreachable revalidation logic in useFieldArray. (#13654)

Thanks to @​dfedoryshchev, @​zigzagdev, @​official-burak, @​Jaybhade, @​candymask0712, and @​bluebill1049 for their contributions! 🎉

Version 7.85.0

✨ Improvements

  • support React <Activity /> (#13633)

🐞 Fixes

  • fix min/max validation being skipped for valueAsDate fields (#13646)
  • fix field array root errors being lost during append, prepend, insert, and remove (#13645)
  • fix stale renders recreating field array paths after field array actions (#13644)
  • fix useWatch preferring form defaultValues over the hook's own defaultValue (#13635)
  • fix setValue emitting duplicate values state notifications (#13637)
  • fix TypeScript getFieldState error resolution for field paths (#13632)

🏗️ Chores

... (truncated)

Changelog

Sourced from react-hook-form's changelog.

[7.86.0] - 2026-08-22

Added

  • Type-safe getErrors method

Performance

  • Improve createFormControl
  • Improve clone object check
  • Avoid cloning values in unregister without subscribers

Fixed

  • Field array update leaving stale errors and touched state at the updated index
  • flatten discarding File and Blob values instead of treating them as leaf nodes
  • validateField not passing the field error to setCustomValidity when criteriaMode is all
  • hasValidation treating falsy but valid values (min: 0, max: 0, minLength: 0, maxLength: 0, required: '') as no validation
  • setValue targeting a nested leaf not notifying a Controller registered on a field array item root
  • setValues not updating fields registered under an object or array value
  • useWatch returning a stale value on name change when the new value is null
  • unregister inverting keepDirty when broadcasting isDirty

[7.85.0] - 2026-08-08

Added

  • Support <Activity />

Fixed

  • getFieldState error resolution from a field path
  • useWatch discarding useForm({ defaultValues }) in favor of its own defaultValue before the form mounts
  • setValue emitting a duplicate values state notification for fields without a native input ref
  • Stale render re-creating a field array path vacated by an array action
  • useFieldArray root-level error (errors.name.root) being lost on append/prepend/insert/remove
  • min/max validation being skipped for valueAsDate fields
Commits
  • 33860b4 7.86.0
  • e5b117b 🐞 fix(unregister): keepDirty inverted when broadcasting isDirty (#13669)
  • 64ec9bc 🐞 fix: useWatch returns stale value on name change when new value is null (#1...
  • dead471 🦌 fix(setValues): update fields registered under an object or array value (#1...
  • 1ca83d2 🪖 close #13664 notify a Controller registered on a field array item root when...
  • 06e4efd 🚚 perf: avoid cloning values in unregister without subscribers (#13662)
  • 9b7af71 🐞 fix has validation check issue (#13661)
  • 51e3309 🗜️ chore: remove any (#13660)
  • 1c5ff08 🤖 fix ts error ignore on getCheckboxValues (#13659)
  • 7223514 🧛 improve uuid function (#13658)
  • Additional commits viewable in compare view

Updates tsx from 4.23.9 to 4.23.12

Release notes

Sourced from tsx's releases.

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

  • shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

This release is also available on:

v4.23.11

4.23.11 (2026-08-07)

Bug Fixes

  • preserve async ESM require fallback (55cbece)

This release is also available on:

v4.23.10

4.23.10 (2026-08-07)

Bug Fixes


This release is also available on:

Commits
  • ed9d330 fix: shim import.meta when tokens are split by comments or newlines (#829)
  • 651f5be test: cover CommonJS TypeScript import.meta paths
  • bd3bc64 test: cover CommonJS loader source fallback
  • 55cbece fix: preserve async ESM require fallback
  • 6c5ba85 docs: document CommonJS default interop
  • ec1bcd5 fix: support nyc coverage discovery (#710)
  • b6e5b48 docs: clarify CommonJS default imports
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…y with 8 updates

Bumps the production-dependencies group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@azure/identity](https://github.com/Azure/azure-sdk-for-js/tree/HEAD/sdk/identity/identity) | `4.13.1` | `4.13.2` |
| [bullmq](https://github.com/taskforcesh/bullmq) | `5.81.3` | `5.81.4` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `0.441.0` | `0.577.0` |
| [mammoth](https://github.com/mwilliamson/mammoth.js) | `1.12.0` | `1.12.2` |
| [next](https://github.com/vercel/next.js) | `15.5.23` | `15.5.24` |
| [openai](https://github.com/openai/openai-node) | `7.4.0` | `7.8.0` |
| [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.84.0` | `7.86.0` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.9` | `4.23.12` |



Updates `@azure/identity` from 4.13.1 to 4.13.2
- [Release notes](https://github.com/Azure/azure-sdk-for-js/releases)
- [Changelog](https://github.com/Azure/azure-sdk-for-js/blob/@azure/identity_4.13.2/sdk/identity/identity/CHANGELOG.md)
- [Commits](https://github.com/Azure/azure-sdk-for-js/commits/@azure/identity_4.13.2/sdk/identity/identity)

Updates `bullmq` from 5.81.3 to 5.81.4
- [Release notes](https://github.com/taskforcesh/bullmq/releases)
- [Commits](taskforcesh/bullmq@v5.81.3...v5.81.4)

Updates `lucide-react` from 0.441.0 to 0.577.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/0.577.0/packages/lucide-react)

Updates `mammoth` from 1.12.0 to 1.12.2
- [Release notes](https://github.com/mwilliamson/mammoth.js/releases)
- [Changelog](https://github.com/mwilliamson/mammoth.js/blob/master/NEWS)
- [Commits](mwilliamson/mammoth.js@1.12.0...1.12.2)

Updates `next` from 15.5.23 to 15.5.24
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v15.5.23...v15.5.24)

Updates `openai` from 7.4.0 to 7.8.0
- [Release notes](https://github.com/openai/openai-node/releases)
- [Changelog](https://github.com/openai/openai-node/blob/main/CHANGELOG.md)
- [Commits](openai/openai-node@v7.4.0...v7.8.0)

Updates `react-hook-form` from 7.84.0 to 7.86.0
- [Release notes](https://github.com/react-hook-form/react-hook-form/releases)
- [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md)
- [Commits](react-hook-form/react-hook-form@v7.84.0...v7.86.0)

Updates `tsx` from 4.23.9 to 4.23.12
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.23.9...v4.23.12)

---
updated-dependencies:
- dependency-name: "@azure/identity"
  dependency-version: 4.13.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: bullmq
  dependency-version: 5.81.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: lucide-react
  dependency-version: 0.577.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: mammoth
  dependency-version: 1.12.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: next
  dependency-version: 15.5.24
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: openai
  dependency-version: 7.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: react-hook-form
  dependency-version: 7.86.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: tsx
  dependency-version: 4.23.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 31, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants