[posit-snyk-bot]

Snyk has created this PR to upgrade dayjs from 1.8.21 to 1.11.23.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 57 versions ahead of your current version.

• The recommended version was released 2 months ago.

Breaking Change Risk

Notice: This assessment is enhanced by AI.

Release notes

Package name: dayjs

• 1.11.23 - 2026-08-17
  

  1.11.23 (2026-08-17)

  Bug Fixes

  • plugin: timezone plugin prevent RangeError for invalid Day.js values (#3180) (dad46e6)
  • plugin: timezone plugin prevent RangeError for invalid Day.js values (#3180) (#3181) (2a3785f)
• 1.11.22 - 2026-08-16
  

  1.11.22 (2026-08-16)

  Bug Fixes

  • plugin: timezone compute instance .tz() offset without host DST (#3174) (e27ee80), closes #3169
• 1.11.21 - 2026-05-26
  

  1.11.21 (2026-05-26)

  Bug Fixes

  • preserve unsupported year tokens in format (#3015) (#3016) (8fda602)
• 1.11.20 - 2026-03-12
  

  1.11.20 (2026-03-12)

  Bug Fixes

  • Update locale km.js to support meridiem (#3017) (9d2b6a1)
  • update updateLocale plugin to merge nested object properties instead of replacing (#3012) (99691c5), closes #1118
• 1.11.19 - 2025-10-31
  

  1.11.19 (2025-10-31)

  Bug Fixes

  • added usage warnings for diff + updated unit tests (#2948) (269a7a9)
  • dont instantiate regexes within ar locale functions to avoid performance overhead (#2898) (af5e9f0)
  • replace italian locale "un' ora fa" with "un'ora fa", add tests for it (#2930) (9e9f76c)
  • Updated Belarusian locale with relative time (#2656) (1d8746c)
• 1.11.18 - 2025-08-30
  

  1.11.18 (2025-08-30)

  Bug Fixes

  • error semantic-release dependency (8cfb313)
• 1.11.17 - 2025-08-29
  

  1.11.17 (2025-08-29)

  Bug Fixes

  • [en-AU] locale use the same ordinal as moment (#2878) (1b95ecd)
• 1.11.16 - 2025-08-29
  

  1.11.16 (2025-08-29)

  Bug Fixes

  • test release workflow (no code changes) (c38c428)
• 1.11.15 - 2025-08-28
  

  1.11.15 (2025-08-28)

  Bug Fixes

  • Fix misspellings in Irish or Irish Gaelic [ga] (#2861) (9c14a42)
• 1.11.14 - 2025-08-27
  

  1.11.14 (2025-08-27)

  Bug Fixes

  • .utcOffset(0, true) result and its clone are different bug (#2505) (fefdcd4)
• 1.11.13 - 2024-08-20
• 1.11.12 - 2024-07-18
• 1.11.11 - 2024-04-28
• 1.11.10 - 2023-09-19
• 1.11.9 - 2023-07-01
• 1.11.8 - 2023-06-02
• 1.11.7 - 2022-12-06
• 1.11.6 - 2022-10-21
• 1.11.5 - 2022-08-12
• 1.11.4 - 2022-07-19
• 1.11.3 - 2022-06-06
• 1.11.2 - 2022-05-06
• 1.11.1 - 2022-04-15
• 1.11.0 - 2022-03-14
• 1.10.8 - 2022-02-28
• 1.10.7 - 2021-09-10
• 1.10.6 - 2021-07-06
• 1.10.5 - 2021-05-26
• 1.10.4 - 2021-01-22
• 1.10.3 - 2021-01-09
• 1.10.2 - 2021-01-05
• 1.10.1 - 2021-01-03
• 1.10.0 - 2021-01-03
• 1.9.8 - 2020-12-27
• 1.9.7 - 2020-12-05
• 1.9.6 - 2020-11-10
• 1.9.5 - 2020-11-05
• 1.9.4 - 2020-10-23
• 1.9.3 - 2020-10-13
• 1.9.2 - 2020-10-13
• 1.9.1 - 2020-09-28
• 1.9.0 - 2020-09-28
• 1.8.36 - 2020-09-17
• 1.8.35 - 2020-09-02
• 1.8.34 - 2020-08-20
• 1.8.33 - 2020-08-10
• 1.8.32 - 2020-08-04
• 1.8.31 - 2020-07-29
• 1.8.30 - 2020-07-22
• 1.8.29 - 2020-07-02
• 1.8.28 - 2020-05-28
• 1.8.27 - 2020-05-14
• 1.8.26 - 2020-04-30
• 1.8.25 - 2020-04-21
• 1.8.24 - 2020-04-10
• 1.8.23 - 2020-03-16
• 1.8.22 - 2020-03-08
• 1.8.21 - 2020-02-26

from dayjs GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[posit-snyk-bot]

This upgrade spans multiple minor versions and includes one notable behavioral breaking change that requires verification.

Key Change:

• isBetween Plugin Behavior: Starting with version 1.10.0, the behavior of the isBetween plugin has changed. The comparison, which was previously inclusive of the start and end dates, is now exclusive by default. This can lead to incorrect calculations if your code relies on the old inclusive behavior. A third parameter was added to control this inclusivity.

Example:
To restore the old inclusive behavior, you must now add a third parameter: dayjs().isBetween(start, end, null, '[]').

While most other changes in this range are bug fixes and feature enhancements, this specific change in the isBetween plugin could silently break existing logic.

Source: Day.js GitHub Releases

Recommendation: Carefully review all usages of the isBetween plugin and adjust the parameters to ensure the correct boundary inclusivity.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[posit-snyk-bot]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[cderv]

Closing in favor of #15151. This package.json belongs to the Node-runtime spike in dev-docs/runtime-migration/ — frozen, throwaway evidence tooling whose pinned versions don't flow into shipped quarto code (the real sources get these deps via src/import_map.json / packages/ojs). Merging all 8 spike PRs individually would leave 7 of them conflicted; one representative merge records the "we don't take Snyk bumps here" signal. A request has been filed to disable upgrade PRs for this Project in the Snyk UI.