chore(deps): bump the npm group with 20 updates by dependabot[bot] · Pull Request #431 · efymd9/matio

dependabot · 2026-10-09T10:04:37Z

Bumps the npm group with 20 updates:

Package	From	To
@clerk/localizations	`4.21.0`	`4.22.0`
@clerk/nextjs	`7.9.8`	`7.9.11`
@mux/mux-node	`15.3.0`	`15.5.0`
@mux/mux-player-react	`3.13.4`	`3.14.0`
@mux/mux-video-react	`0.31.4`	`0.31.5`
@sentry/nextjs	`11.1.0`	`11.4.0`
@stripe/react-stripe-js	`6.12.0`	`7.0.0`
@stripe/stripe-js	`9.17.0`	`10.0.0`
@vercel/blob	`2.8.0`	`2.8.1`
lucide-react	`1.49.0`	`1.52.0`
posthog-js	`1.435.3`	`1.436.1`
posthog-node	`5.54.1`	`5.55.0`
resend	`6.31.0`	`6.32.0`
shadcn	`4.21.0`	`4.21.3`
stripe	`22.6.2`	`23.0.0`
@types/node	`24.19.0`	`24.19.1`
eslint	`10.11.0`	`10.12.0`
jsdom	`30.1.1`	`30.1.2`
@chromatic-com/storybook	`5.3.1`	`5.4.0`
vite	`8.3.1`	`8.3.3`

Updates @clerk/localizations from 4.21.0 to 4.22.0

Release notes

Sourced from @clerk/localizations's releases.

@clerk/localizations@4.22.0

Minor Changes

The self-serve SSO configuration (<OrganizationProfile /> enterprise connection page and the ConfigureSSO SAML steps) now shows every IdP signing certificate a SAML connection trusts, with its expiry, and lets an admin add certificates from a file (a PEM bundle adds several) or remove one, so an IdP key rotation no longer needs a replacement timed with the IdP. Saving sends the whole list and only when it changed. The list holds at most five certificates. New configureSSOCertificateList* and configureSSOCertificatePrimaryBadge appearance element descriptors cover the list, and new configureSSO.signingCertificates.* localization keys hold its strings. (#10012) by @mauricioabreu

Patch Changes

Updated dependencies [2654caa]:

@clerk/shared@4.39.0

@clerk/localizations@4.21.1

Patch Changes

Updated dependencies [c8eb8d5]:

@clerk/shared@4.37.1

Changelog

Sourced from @clerk/localizations's changelog.

4.22.0

Minor Changes

The self-serve SSO configuration (<OrganizationProfile /> enterprise connection page and the ConfigureSSO SAML steps) now shows every IdP signing certificate a SAML connection trusts, with its expiry, and lets an admin add certificates from a file (a PEM bundle adds several) or remove one, so an IdP key rotation no longer needs a replacement timed with the IdP. Saving sends the whole list and only when it changed. The list holds at most five certificates. New configureSSOCertificateList* and configureSSOCertificatePrimaryBadge appearance element descriptors cover the list, and new configureSSO.signingCertificates.* localization keys hold its strings. (#10012) by @mauricioabreu

Patch Changes

Updated dependencies [2654caa]:

@clerk/shared@4.39.0

4.21.2

Patch Changes

Updated dependencies [f6937c8]:

@clerk/shared@4.38.0

4.21.1

Patch Changes

Updated dependencies [c8eb8d5]:

@clerk/shared@4.37.1

Commits

2e29745 ci(repo): Version packages (#10025)
a989859 feat(ui): list and manage the IdP signing certificates of a SAML connection (...
6fd8e8d ci(repo): Version packages (#10021)
2e03a39 ci(repo): Version packages (#9977)
See full diff in compare view

Updates @clerk/nextjs from 7.9.8 to 7.9.11

Release notes

Sourced from @clerk/nextjs's releases.

@clerk/nextjs@7.9.11

Patch Changes

Remove https://images.clerkstage.dev from the default connect-src Content Security Policy directive. It is a Clerk-internal storage host that no application connects to. Organization logos are served from https://img.clerk.com, which stays in the default. (#9898) by @Grundlefleck

Updated dependencies [2302140, 2654caa, dee649c]:

@clerk/backend@3.23.0

@clerk/shared@4.39.0

@clerk/react@6.17.6

@clerk/nextjs@7.9.9

Patch Changes

Removed the period from the end of the displayed error. Agents were trying to use the URL with period at the end and getting 404s (#9985) by @royanger

Updated dependencies [0fe89c2, e34a5cc, c8eb8d5]:

@clerk/backend@3.21.1

@clerk/shared@4.37.1

@clerk/react@6.17.4

Changelog

Sourced from @clerk/nextjs's changelog.

7.9.11

Patch Changes

Remove https://images.clerkstage.dev from the default connect-src Content Security Policy directive. It is a Clerk-internal storage host that no application connects to. Organization logos are served from https://img.clerk.com, which stays in the default. (#9898) by @Grundlefleck

Updated dependencies [2302140, 2654caa, dee649c]:

@clerk/backend@3.23.0

@clerk/shared@4.39.0

@clerk/react@6.17.6

7.9.10

Patch Changes

Updated dependencies [4eac21f, f6937c8]:

@clerk/backend@3.22.0

@clerk/shared@4.38.0

@clerk/react@6.17.5

7.9.9

Patch Changes

Removed the period from the end of the displayed error. Agents were trying to use the URL with period at the end and getting 404s (#9985) by @royanger

Updated dependencies [0fe89c2, e34a5cc, c8eb8d5]:

@clerk/backend@3.21.1

@clerk/shared@4.37.1

@clerk/react@6.17.4

Commits

2e29745 ci(repo): Version packages (#10025)
46ff86f fix(nextjs): remove internal staging host from the default connect-src (#9898)
6fd8e8d ci(repo): Version packages (#10021)
2e03a39 ci(repo): Version packages (#9977)
c610ff2 fix(nextjs): removed period from error to stop 404s by agents reading the err...
See full diff in compare view

Updates @mux/mux-node from 15.3.0 to 15.5.0

Release notes

Sourced from @mux/mux-node's releases.

v15.5.0

15.5.0 (2026-10-02)

Features

video: add playback chapters endpoint and chapters text_type (797ad8d)

Bug Fixes

jwt: type nested custom claims in sign options (#14) (65ea454)

mock: validate bracket-array query params in Steady; carry MIGRATION.md whole; pin the stlc-php array_format fix (7603628)

video: expose created_at for shots (bbe0e54)

webhooks: accept the raw body as bytes in verifySignature and unwrap (#12) (bed79bf)

Chores

carry MIGRATION.md as custom code instead of regenerating it (ea4702e)

Documentation

migration: document async webhook helpers; v12 → v14 heading (77056b2)

This PR was generated with Release Please. See documentation.

v15.4.0

15.4.0 (2026-09-30)

Features

robots: New replace_existing_track APIs in Mux Robots, and explicitly flag some legacy Robots API fields as deprecated (3203632)

Bug Fixes

data: correct types and responses for heatmaps and hotspots (5151220)

Documentation

video: Replace myVideo_en and myVIdeo_en with my-video-en.srt (5471e7c)

... (truncated)

Changelog

Sourced from @mux/mux-node's changelog.

15.5.0 (2026-10-02)

Features

video: add playback chapters endpoint and chapters text_type (797ad8d)

Bug Fixes

jwt: type nested custom claims in sign options (#14) (65ea454)

mock: validate bracket-array query params in Steady; carry MIGRATION.md whole; pin the stlc-php array_format fix (7603628)

video: expose created_at for shots (bbe0e54)

webhooks: accept the raw body as bytes in verifySignature and unwrap (#12) (bed79bf)

Chores

carry MIGRATION.md as custom code instead of regenerating it (ea4702e)

Documentation

migration: document async webhook helpers; v12 → v14 heading (77056b2)

15.4.0 (2026-09-30)

Features

robots: New replace_existing_track APIs in Mux Robots, and explicitly flag some legacy Robots API fields as deprecated (3203632)

Bug Fixes

data: correct types and responses for heatmaps and hotspots (5151220)

Documentation

video: Replace myVideo_en and myVIdeo_en with my-video-en.srt (5471e7c)

Commits

e4b853e release: 15.5.0 (#643)
797ad8d feat(video): add playback chapters endpoint and chapters text_type
bbe0e54 fix(video): expose created_at for shots
7603628 fix(mock): validate bracket-array query params in Steady; carry MIGRATION.md ...
26ed9a3 Merge remote-tracking branch 'origin/main' into js/steady-brackets-and-migrat...
65ea454 fix(jwt): type nested custom claims in sign options (#14)
bed79bf fix(webhooks): accept the raw body as bytes in verifySignature and unwrap (#12)
77056b2 docs(migration): document async webhook helpers; v12 → v14 heading
ea4702e chore: carry MIGRATION.md as custom code instead of regenerating it
3f674e8 release: 15.4.0 (#642)
Additional commits viewable in compare view

Updates @mux/mux-player-react from 3.13.4 to 3.14.0

Release notes

Sourced from @mux/mux-player-react's releases.

@mux/mux-player-react: v3.14.0

3.14.0 (2026-10-02)

Miscellaneous Chores

@mux/mux-player-react: Synchronize player versions

Dependencies

The following workspace dependencies were updated

dependencies

@mux/mux-player bumped from 3.13.4 to 3.14.0

@mux/playback-core bumped from 0.35.4 to 0.36.0

Changelog

Sourced from @mux/mux-player-react's changelog.

3.14.0 (2026-10-02)

Miscellaneous Chores

@mux/mux-player-react: Synchronize player versions

Dependencies

The following workspace dependencies were updated

dependencies

@mux/mux-player bumped from 3.13.4 to 3.14.0

@mux/playback-core bumped from 0.35.4 to 0.36.0

Commits

a24167c chore: release main (#1362)
See full diff in compare view

Updates @mux/mux-video-react from 0.31.4 to 0.31.5

Release notes

Sourced from @mux/mux-video-react's releases.

@mux/mux-video-react: v0.31.5

0.31.5 (2026-10-02)

Miscellaneous Chores

@mux/mux-video-react: Synchronize video versions

Dependencies

The following workspace dependencies were updated

dependencies

@mux/playback-core bumped from 0.35.4 to 0.36.0

Changelog

Sourced from @mux/mux-video-react's changelog.

0.31.5 (2026-10-02)

Miscellaneous Chores

@mux/mux-video-react: Synchronize video versions

Dependencies

The following workspace dependencies were updated

dependencies

@mux/playback-core bumped from 0.35.4 to 0.36.0

Commits

a24167c chore: release main (#1362)
See full diff in compare view

Updates @sentry/nextjs from 11.1.0 to 11.4.0

Release notes

Sourced from @sentry/nextjs's releases.

11.4.0

feat(sveltekit): Support stable SvelteKit 3 (#25009)

fix(remix): Match the Remix 3.0.0 package versions (#25008)

Bundle size 📦

Path Size

@sentry/browser 28.82 KB

@sentry/browser - with treeshaking flags 27.03 KB

@sentry/browser - with treeshaking flags tracing without tracing 26.93 KB

@sentry/browser (incl. Tracing) 50.24 KB

@sentry/browser (incl. Tracing + Span Streaming) 50.26 KB

@sentry/browser (incl. Tracing, Profiling) 53.18 KB

@sentry/browser (incl. Tracing, Replay) 88.91 KB

@sentry/browser (incl. Tracing, Replay) - with treeshaking flags 78.15 KB

@sentry/browser (incl. Tracing, Replay with Canvas) 93.5 KB

@sentry/browser (incl. Tracing, Replay, Feedback) 106.16 KB

@sentry/browser (incl. Feedback) 45.94 KB

@sentry/browser (incl. sendFeedback) 33.76 KB

@sentry/browser (incl. FeedbackAsync) 38.75 KB

@sentry/browser (incl. Metrics) 29.82 KB

@sentry/browser (incl. Logs) 30.1 KB

@sentry/browser (incl. Metrics & Logs) 30.74 KB

@sentry/react 30.63 KB

@sentry/react (incl. Tracing) 52.54 KB

@sentry/vue 36.63 KB

@sentry/vue (incl. Tracing) 53.06 KB

@sentry/svelte 28.86 KB

@sentry/remix (Remix 3 client bundle) 54.47 KB

CDN Bundle 30.49 KB

CDN Bundle (incl. Tracing) 50.76 KB

CDN Bundle (incl. Logs, Metrics) 32.68 KB

CDN Bundle (incl. Tracing, Logs, Metrics) 52.65 KB

CDN Bundle (incl. Replay, Logs, Metrics) 72.47 KB

CDN Bundle (incl. Tracing, Replay) 87.46 KB

CDN Bundle (incl. Tracing, Replay, Logs, Metrics) 89.39 KB

CDN Bundle (incl. Tracing, Replay, Feedback) 93.48 KB

CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) 95.42 KB

CDN Bundle - uncompressed 89.98 KB

CDN Bundle (incl. Tracing) - uncompressed 150.87 KB

CDN Bundle (incl. Logs, Metrics) - uncompressed 96.4 KB

CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed 156.69 KB

CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed 222.93 KB

CDN Bundle (incl. Tracing, Replay) - uncompressed 267.8 KB

CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed 273.6 KB

CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed 281.18 KB

CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed 286.97 KB

@sentry/nextjs (client) 55 KB

@sentry/sveltekit (client) 50.65 KB

... (truncated)

Changelog

Sourced from @sentry/nextjs's changelog.

11.4.0

feat(sveltekit): Support stable SvelteKit 3 (#25009)

fix(remix): Match the Remix 3.0.0 package versions (#25008)

11.3.0

Important Changes

Remix 3 support (alpha, may break in minor releases)

feat(remix): Add Remix 3 browser SDK with a bundled client entry (#24802)

feat(remix): Add source map upload for Remix 3 (#24943)

feat(remix): Capture Remix 3 component render errors (#24873)

feat(remix): Complete Remix 3 server error handling (#24878)

feat(remix): Inject debug IDs through the Remix 3 asset server (#24761)

feat(remix): Run the orchestrion transform on Remix 3 browser modules (#24894)

feat(nextjs): Add cache_origin span links to use cache hit spans (#24821)

A cache.get span for a "use cache" hit now carries a span link (sentry.link.type: 'cache_origin') to the cache.put span of the request that filled the cache entry, connecting the trace that reads a cached value to the trace that produced it.

fix(cloudflare): Don't treat DO constructor work as incoming RPC calls (#24829)

Durable Object constructors now run in their own isolation scope. When work that the constructor starts, for example a blockConcurrencyWhile callback, calls a method of the instance, that call is no longer treated as an incoming RPC call, so an error the instance catches itself is no longer reported as unhandled. As a result, Sentry.setTag(), setUser() and setContext() in a constructor now apply only to that constructor work. They no longer reach later fetch, RPC or alarm invocations, because the scope they used to write to is shared by every Durable Object and handler in the isolate. Use initialScope for static data, and set per-instance data in each handler.

fix(effect)!: Change peerDependency to v4 and fix currentSpan (#24940)

@sentry/effect now requires a stable Effect v4 release. Effect v4 beta and release candidate versions are no longer supported. @sentry/effect is in alpha, so this ships in a minor release.

Other Changes

feat(astro): Register astro route provider (#23792)

feat(cloudflare): Trace TypeSafe Jev calls in Workers AI as evaluate spans (#24833)

feat(core): Add route provider API for parameterized route resolution (#23551)

feat(deps): bump devalue from 5.9.2 to 5.9.4 (#24964)

feat(effect): Add opt-in for external span parents and isolate root spans (#23900)

feat(nextjs): Register nextjs route provider (#23552)

feat(nuxt): Register nuxt route provider (#23794)

feat(remix): Register remix route provider (#23791)

feat(vue): Register Vue route provider (#23793)

fix(bundler-plugins): Keep debug IDs on Vite source maps after the preload rewrite (#24920)

fix(bundler-plugins): Stabilize debug IDs for Rolldown and Vite 8 builds (#24919)

fix(cloudflare): Skip binding instrumentation work when spans are not sent (#24655)

fix(core, node, bun, deno): Align server span client address with event IP (#24767)

fix(hono): Return the existing client on repeated init in Bun and Deno (#24520)

fix(nitro): Capture errors only through the Nitro error hook (#24952)

fix(profiling-node): Send profile chunks with client.sendEnvelope (#24896)

fix(react-router): Avoid duplicating Vite config arrays (#24930)

fix(react-router): Resolve the Cloudflare entry in Workers and skip trace meta tags in prerendered pages (#24866)

... (truncated)

Commits

7f13c61 release: 11.4.0
fb73adb Merge pull request #25010 from getsentry/prepare-release/11.4.0
de3fb96 meta(changelog): Update changelog for 11.4.0
4f0fd84 feat(sveltekit): Support stable SvelteKit 3 (#25009)
ba4db28 fix(remix): Match the Remix 3.0.0 package versions (#25008)
c8738fb Merge pull request #24991 from getsentry/master
5f88a0b Merge commit '1e82c8f33488bc54364d343a7c5ab33ed9056f39'
1e82c8f release: 11.3.0
481c43c Merge pull request #24987 from getsentry/prepare-release/11.3.0
1c7308d meta(changelog): Update changelog for 11.3.0
Additional commits viewable in compare view

Updates @stripe/react-stripe-js from 6.12.0 to 7.0.0

Release notes

Sourced from @stripe/react-stripe-js's releases.

v7.0.0

New features

Upgrade to React 19 (#717, #692)

Remove payment request button for Endive 👾 (#718)

Commits

3b42f3d v7.0.0
34be759 Toggle releaseCandidate + bump stripe-js for Endive release (#720)
2235dcc v7.0.0-rc.2
1506383 [breaking] Remove payment request button for new react-stripe-js version 👾 (#...
ed69397 verify GITHUB_TOKEN is authorized for stripe SSO (#719)
5e7eead v7.0.0-rc.1
98cea49 Bump stripe-js version to v10.0.0-rc.1 (#716)
cd07782 [breaking] Upgrade to React 19 (#692)
a513b5c Bump versions to support react 19 jest server component tests (#717)
d4541b4 v7.0.0-rc.0
Additional commits viewable in compare view

Updates @stripe/stripe-js from 9.17.0 to 10.0.0

Release notes

Sourced from @stripe/stripe-js's releases.

v10.0.0

New features

Removed payment request button for Endive 👾 (#982)

Add a retry to the loader (#899)

Removed Elements paymentMethodTypes from types for Endive (#975)

Fixes

Add missing confirmPayByBankPayment types (#985)

Changed

types: add BLIK setup confirmer (#983)

Commits

857e6cd v10.0.0
374a757 toggle rc to false (#988)
9eac373 types: add BLIK setup confirmer (#983)
e892961 v10.0.0-rc.4
1d9e652 toggle back to RC (#987)
1d61faa remove redundant async type (#986)
7781bb5 toggle off rc flag (#984)
9a57c86 Add confirmPayByBankPayment types (#985)
aedbe33 v10.0.0-rc.3
a9a81d5 Skip non supported TS version + update snapshot (#981)
Additional commits viewable in compare view

Updates @vercel/blob from 2.8.0 to 2.8.1

Release notes

Sourced from @vercel/blob's releases.

@vercel/blob@2.8.1

Patch Changes

59be092: Allow get() to fetch blob URLs from a VERCEL_BLOB_API_URL origin. get() only accepted URLs on *.blob.vercel-storage.com, which blocked local emulators like emulate, since they serve blob content from their own host. When VERCEL_BLOB_API_URL (or NEXT_PUBLIC_VERCEL_BLOB_API_URL) is set, URLs on that same origin are now accepted as well. With no override set the behavior is unchanged, so arbitrary hosts are still rejected in production.

Changelog

Sourced from @vercel/blob's changelog.

2.8.1

Patch Changes

59be092: Allow get() to fetch blob URLs from a VERCEL_BLOB_API_URL origin. get() only accepted URLs on *.blob.vercel-storage.com, which blocked local emulators like emulate, since they serve blob content from their own host. When VERCEL_BLOB_API_URL (or NEXT_PUBLIC_VERCEL_BLOB_API_URL) is set, URLs on that same origin are now accepted as well. With no override set the behavior is unchanged, so arbitrary hosts are still rejected in production.

Commits

d15b9b3 Version Packages (#1111)
59be092 [@vercel/blob] Allow get() to fetch from a VERCEL_BLOB_API_URL origin (#1110)
See full diff in compare view

Updates lucide-react from 1.49.0 to 1.52.0

Release notes

Sourced from lucide-react's releases.

Version 1.52.0

What's Changed

fix(icons): changed wifi-cog icon by @karsa-mistmere in lucide-icons/lucide#4952

Full Changelog: lucide-icons/lucide@1.51.0...1.52.0

Version 1.51.0

What's Changed

fix(site): persist icon customizer by @karsa-mistmere in lucide-icons/lucide#4944

chore(deps): Upgrade to vite 8 by @ericfennis in lucide-icons/lucide#4950

feat(icons): added rugby-ball icon by @dev-mralph in lucide-icons/lucide#3496

chore(deps): bump the react-deps group across 1 directory with 3 updates by @dependabot[bot] in lucide-icons/lucide#4951

fix(react-native): stop forwarding arbitrary rest props to child shape elements by @cipherprofessor in lucide-icons/lucide#4903

test(lucide-solid): add Vite and SolidStart integration fixtures by @ericfennis in lucide-icons/lucide#4884

feat(icons): add door-closed-cog icon by @ajaxjiang96 in lucide-icons/lucide#4905

feat(icons): add text-align-justify-* icons by @HectorZaGa in lucide-icons/lucide#4942

chore(deps): bump pnpm/action-setup from 6.0.10 to 6.1.0 in the github-actions group across 1 directory by @dependabot[bot] in lucide-icons/lucide#4939

chore(deps): Upgrade to vitest 5 by @ericfennis in lucide-icons/lucide#4953

feat(icons): added wind-arrow-up icon by @jamesgpearce in lucide-icons/lucide#4501

fix(github/actions): move to daily release flow by @karsa-mistmere in lucide-icons/lucide#4911

feat(@lucide/solid): Support for Solid 2.0 RC by @davedbase in lucide-icons/lucide#4751

chore(deps-dev): bump the angular-deps group across 1 directory with 10 updates by @dependabot[bot] in lucide-icons/lucide#4954

chore(deps): bump nuxt from 4.4.8 to 4.5.1 by @dependabot[bot] in lucide-icons/lucide#4949

feat(icons): added armenian-dram icon by @Elawphant in lucide-icons/lucide#4456

feat(icons): add kazakh-tenge icon by @hkayrad in lucide-icons/lucide#4925

New Contributors

@dev-mralph made their first contribution in lucide-icons/lucide#3496

@cipherprofessor made their first contribution in lucide-icons/lucide#4903

@HectorZaGa made their first contribution in lucide-icons/lucide#4942

@jamesgpearce made their first contribution in lucide-icons/lucide#4501

@davedbase made their first contribution in lucide-icons/lucide#4751

@Elawphant made their first contribution in lucide-icons/lucide#4456

@hkayrad made their first contribution in lucide-icons/lucide#4925

Full Changelog: lucide-icons/lucide@1.50.0...1.51.0

Version 1.50.0

What's Changed

fix(shared): escape attribute values in buildLucideSvg by @Saadanjum0 in lucide-icons/lucide#4940

fix(github/actions): use canonical metadata instructions for PR suggestions by @karsa-mistmere in lucide-icons/lucide#4910

fix(icons): replaced nut & nut-off with compliant designs by @karsa-mistmere in lucide-icons/lucide#4840

chore(deps-dev): bump @angular/router from 22.1.7 to 22.2.0 by @dependabot[bot] in lucide-icons/lucide#4945

chore(deps): bump next from 16.3.4 to 16.3.6 by @dependabot[bot] in lucide-icons/lucide#4946

chore(deps-dev): bump the svelte-deps group with 2 updates by @dependabot[bot] in lucide-icons/lucide#4918

test(integrations): add Vue integration fixtures for Vite, Nuxt and Vike by @ericfennis in lucide-icons/lucide#4882

feat(svelte): export context subpath by @vugarbbakhishov-hub in lucide-icons/lucide#4927

fix(lucide-preact): add Preact v11 compatibility by @JoviDeCroock in lucide-icons/lucide#4924

feat(icons): added layout-grid-circles icon by @karsa-mistmere in lucide-icons/lucide#4567

... (truncated)

Commits

98331e2 chore(deps): bump the react-deps group across 1 directory with 3 updates (#4951)
09aa9c5 chore(deps): Upgrade to vite 8 (#4950)
See full diff in compare view

Updates posthog-js from 1.435.3 to 1.436.1

Release notes

Sourced from posthog-js's releases.

posthog-js@1.436.1

1.436.1

Patch Changes

#5203 633f5b2 Thanks @marandaneto! - Restore batching for events carrying pending Meta $fbc or $fbp identifiers to reduce races with preceding identify() calls. (2026-10-05)

posthog-js@1.436.0

1.436.0

Minor Changes

#5083 d576bec Thanks @61465! - Opt-in WebView bot heuristic for #2921.

posthog-js/customizations exports a new isLikelyWebViewBot(ua) helper that flags the UA pattern described in #2921 (a Chrome/... token without the usual AppleWebKit/* + Safari/* co-markers that real Chrome always sends). Wire it into before_send to tag or drop the matching events — see isLikelyWebViewBot JSDoc for a usage example. Default SDK behaviour is unchanged; the helper is tree-shaken out unless you import it.

@posthog/core keeps isBlockedUA and DEFAULT_BLOCKED_UA_STRS byte-for-byte compatible, and gains session-level memoisation of isBlockedUA results keyed on (ua, customBlockedUserAgents), so repeat calls within the same session are O(1). (2026-10-05)

Patch Changes

Updated dependencies [d576bec]:

@posthog/core@1.56.0

posthog-js@1.435.9

1.435.9

Patch Changes

#5150 abe2924 Thanks @DeepanshuPal! - Stop a SecurityError escaping the recorder when an iframe becomes cross-origin while shadow DOM observation starts. (2026-10-05)

posthog-js@1.435.8

1.435.8

Patch Changes

#5152 2bdc8eb Thanks @rafaeelaudibert! - Use the new PostHog logo in the survey footer branding (2026-10-02)

posthog-js@1.435.7

1.435.7

Patch Changes

#5188 8a005ca Thanks @dustinbyrne! - Preserve shared identity while consent is pending and clear it after shared rejection in cookieless mode. (2026-10-02)

posthog-js@1.435.6

1.435.6

Patch Changes

... (truncated)

Commits

c4265ad chore: update versions and lockfile [version bump]
633f5b2 fix(browser): batch events with pending Meta identifiers (#5203)
af69a9c chore: update versions and lockfile [version bump]
16ee222 feat(react-native): warn when the deprecated session replay package is loaded...
a0c6dc5 chore: update versions and lockfile [version bump]
d576bec feat(core): opt-in heuristic bot detection for #2921 (#5083)
e746356 chore: update versions and lockfile [version bump]
3394548 feat(mcp): resolve argument ownership on fresh low-level instances (#5165)
6538bab chore: update versions and lockfile [version bump]
abe2924 fix(rrweb): contain cross-origin iframe shadow observation errors (#5150)
Additional commits viewable in compare view

Updates posthog-node from 5.54.1 to 5.55.0

Release notes

Sourced from posthog-node's releases.

posthog-node@5.55.0

5.55.0

...
Description has been truncated

Bumps the npm group with 20 updates: | Package | From | To | | --- | --- | --- | | [@clerk/localizations](https://github.com/clerk/javascript/tree/HEAD/packages/localizations) | `4.21.0` | `4.22.0` | | [@clerk/nextjs](https://github.com/clerk/javascript/tree/HEAD/packages/nextjs) | `7.9.8` | `7.9.11` | | [@mux/mux-node](https://github.com/muxinc/mux-ts) | `15.3.0` | `15.5.0` | | [@mux/mux-player-react](https://github.com/muxinc/elements/tree/HEAD/packages/mux-player-react) | `3.13.4` | `3.14.0` | | [@mux/mux-video-react](https://github.com/muxinc/elements/tree/HEAD/packages/mux-video-react) | `0.31.4` | `0.31.5` | | [@sentry/nextjs](https://github.com/getsentry/sentry-javascript) | `11.1.0` | `11.4.0` | | [@stripe/react-stripe-js](https://github.com/stripe/react-stripe-js) | `6.12.0` | `7.0.0` | | [@stripe/stripe-js](https://github.com/stripe/stripe-js) | `9.17.0` | `10.0.0` | | [@vercel/blob](https://github.com/vercel/storage/tree/HEAD/packages/blob) | `2.8.0` | `2.8.1` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.49.0` | `1.52.0` | | [posthog-js](https://github.com/PostHog/posthog-js) | `1.435.3` | `1.436.1` | | [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.54.1` | `5.55.0` | | [resend](https://github.com/resend/resend-node) | `6.31.0` | `6.32.0` | | [shadcn](https://github.com/shadcn-ui/ui/tree/HEAD/packages/shadcn) | `4.21.0` | `4.21.3` | | [stripe](https://github.com/stripe/stripe-node) | `22.6.2` | `23.0.0` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `24.19.0` | `24.19.1` | | [eslint](https://github.com/eslint/eslint) | `10.11.0` | `10.12.0` | | [jsdom](https://github.com/jsdom/jsdom) | `30.1.1` | `30.1.2` | | [@chromatic-com/storybook](https://github.com/chromaui/addon-visual-tests) | `5.3.1` | `5.4.0` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.3.1` | `8.3.3` | Updates `@clerk/localizations` from 4.21.0 to 4.22.0 - [Release notes](https://github.com/clerk/javascript/releases) - [Changelog](https://github.com/clerk/javascript/blob/main/packages/localizations/CHANGELOG.md) - [Commits](https://github.com/clerk/javascript/commits/@clerk/localizations@4.22.0/packages/localizations) Updates `@clerk/nextjs` from 7.9.8 to 7.9.11 - [Release notes](https://github.com/clerk/javascript/releases) - [Changelog](https://github.com/clerk/javascript/blob/main/packages/nextjs/CHANGELOG.md) - [Commits](https://github.com/clerk/javascript/commits/@clerk/nextjs@7.9.11/packages/nextjs) Updates `@mux/mux-node` from 15.3.0 to 15.5.0 - [Release notes](https://github.com/muxinc/mux-ts/releases) - [Changelog](https://github.com/muxinc/mux-ts/blob/main/CHANGELOG.md) - [Commits](muxinc/mux-ts@v15.3.0...v15.5.0) Updates `@mux/mux-player-react` from 3.13.4 to 3.14.0 - [Release notes](https://github.com/muxinc/elements/releases) - [Changelog](https://github.com/muxinc/elements/blob/main/packages/mux-player-react/CHANGELOG.md) - [Commits](https://github.com/muxinc/elements/commits/@mux/mux-player-react@3.14.0/packages/mux-player-react) Updates `@mux/mux-video-react` from 0.31.4 to 0.31.5 - [Release notes](https://github.com/muxinc/elements/releases) - [Changelog](https://github.com/muxinc/elements/blob/main/packages/mux-video-react/CHANGELOG.md) - [Commits](https://github.com/muxinc/elements/commits/@mux/mux-video-react@0.31.5/packages/mux-video-react) Updates `@sentry/nextjs` from 11.1.0 to 11.4.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@11.1.0...11.4.0) Updates `@stripe/react-stripe-js` from 6.12.0 to 7.0.0 - [Release notes](https://github.com/stripe/react-stripe-js/releases) - [Changelog](https://github.com/stripe/react-stripe-js/blob/master/CHANGELOG.md) - [Commits](stripe/react-stripe-js@v6.12.0...v7.0.0) Updates `@stripe/stripe-js` from 9.17.0 to 10.0.0 - [Release notes](https://github.com/stripe/stripe-js/releases) - [Commits](stripe/stripe-js@v9.17.0...v10.0.0) Updates `@vercel/blob` from 2.8.0 to 2.8.1 - [Release notes](https://github.com/vercel/storage/releases) - [Changelog](https://github.com/vercel/storage/blob/main/packages/blob/CHANGELOG.md) - [Commits](https://github.com/vercel/storage/commits/@vercel/blob@2.8.1/packages/blob) Updates `lucide-react` from 1.49.0 to 1.52.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.52.0/packages/lucide-react) Updates `posthog-js` from 1.435.3 to 1.436.1 - [Release notes](https://github.com/PostHog/posthog-js/releases) - [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md) - [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.435.3...posthog-js@1.436.1) Updates `posthog-node` from 5.54.1 to 5.55.0 - [Release notes](https://github.com/PostHog/posthog-js/releases) - [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md) - [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.55.0/packages/node) Updates `resend` from 6.31.0 to 6.32.0 - [Release notes](https://github.com/resend/resend-node/releases) - [Changelog](https://github.com/resend/resend-node/blob/canary/CHANGELOG.md) - [Commits](resend/resend-node@v6.31.0...v6.32.0) Updates `shadcn` from 4.21.0 to 4.21.3 - [Release notes](https://github.com/shadcn-ui/ui/releases) - [Changelog](https://github.com/shadcn-ui/ui/blob/main/packages/shadcn/CHANGELOG.md) - [Commits](https://github.com/shadcn-ui/ui/commits/shadcn@4.21.3/packages/shadcn) Updates `stripe` from 22.6.2 to 23.0.0 - [Release notes](https://github.com/stripe/stripe-node/releases) - [Changelog](https://github.com/stripe/stripe-node/blob/master/CHANGELOG.md) - [Commits](stripe/stripe-node@v22.6.2...v23.0.0) Updates `@types/node` from 24.19.0 to 24.19.1 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `eslint` from 10.11.0 to 10.12.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.11.0...v10.12.0) Updates `jsdom` from 30.1.1 to 30.1.2 - [Release notes](https://github.com/jsdom/jsdom/releases) - [Commits](jsdom/jsdom@v30.1.1...v30.1.2) Updates `@chromatic-com/storybook` from 5.3.1 to 5.4.0 - [Release notes](https://github.com/chromaui/addon-visual-tests/releases) - [Changelog](https://github.com/chromaui/addon-visual-tests/blob/v5.4.0/CHANGELOG.md) - [Commits](chromaui/addon-visual-tests@v5.3.1...v5.4.0) Updates `vite` from 8.3.1 to 8.3.3 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.3.3/packages/vite) --- updated-dependencies: - dependency-name: "@clerk/localizations" dependency-version: 4.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm - dependency-name: "@clerk/nextjs" dependency-version: 7.9.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@mux/mux-node" dependency-version: 15.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm - dependency-name: "@mux/mux-player-react" dependency-version: 3.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm - dependency-name: "@mux/mux-video-react" dependency-version: 0.31.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@sentry/nextjs" dependency-version: 11.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm - dependency-name: "@stripe/react-stripe-js" dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: npm - dependency-name: "@stripe/stripe-js" dependency-version: 10.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: npm - dependency-name: "@vercel/blob" dependency-version: 2.8.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm - dependency-name: lucide-react dependency-version: 1.52.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm - dependency-name: posthog-js dependency-version: 1.436.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm - dependency-name: posthog-node dependency-version: 5.55.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm - dependency-name: resend dependency-version: 6.32.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm - dependency-name: shadcn dependency-version: 4.21.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm - dependency-name: stripe dependency-version: 23.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: npm - dependency-name: "@types/node" dependency-version: 24.19.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: eslint dependency-version: 10.12.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: jsdom dependency-version: 30.1.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@chromatic-com/storybook" dependency-version: 5.4.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: vite dependency-version: 8.3.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2026-10-09T10:04:39Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
matio	Error		Oct 9, 2026 10:05am UTC
matio-staging	Error		Oct 9, 2026 10:05am UTC

github-actions · 2026-10-09T10:05:48Z

Покрытие

dependabot · 2026-10-09T10:48:29Z

Looks like these dependencies are no longer updatable, so this is no longer needed.

efymd9 · 2026-10-09T10:56:33Z

Заменён на #437 (минорные) и #433 (Stripe-мажоры)

…з Stripe-мажоров (#434) (#437) Подняты 17 пакетов до версий из #431 (лок держит ровно их, не свежее): @clerk/localizations 4.22.0, @clerk/nextjs 7.9.11, @mux/mux-node 15.5.0, @mux/mux-player-react 3.14.0, @mux/mux-video-react 0.31.5, @sentry/nextjs 11.4.0, @vercel/blob 2.8.1, lucide-react 1.52.0, posthog-js 1.436.1, posthog-node 5.55.0, resend 6.32.0, shadcn 4.21.3, @types/node 24.19.1, eslint 10.12.0 (спека "^10" как в #431), jsdom 30.1.2, @chromatic-com/storybook 5.4.0, vite 8.3.3. stripe, @stripe/stripe-js и @stripe/react-stripe-js не тронуты — #433. Карта данных: posthog-js с 1.435.6 собирает из URL click id ChatGPT Ads `?oppref` (свойство события + $initial_oppref) — дописано в обе строки PostHog, как #242 дописал $fbc/$fbp. Claude-Session: https://claude.ai/code/session_0184yUssUtNnEmKVaft78cbT Co-authored-by: matio <efymd9@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

dependabot Bot added domain:infra CI, деплой, БД, вендоры, скрипты процесса p3 Когда дойдут руки type:debt Техдолг, рефакторинг, чистка labels Oct 9, 2026

vercel Bot had a problem deploying to Preview – matio October 9, 2026 10:05 Failure

vercel Bot had a problem deploying to Preview – matio-staging October 9, 2026 10:05 Failure

dependabot Bot closed this Oct 9, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/npm-86c3aed0c8 branch October 9, 2026 10:48

efymd9 mentioned this pull request Oct 9, 2026

chore: зависимости — минорные и патч-обновления из Dependabot #431 без Stripe-мажоров (#434) #437

Merged

efymd9 mentioned this pull request Oct 9, 2026

fix(deps): Stripe — stripe 23, stripe-js 10, react-stripe-js 7, API 2026-09-30.endive (#433) #441

Merged

Navigation Menu

Repository navigation

chore(deps): bump the npm group with 20 updates - #431

chore(deps): bump the npm group with 20 updates#431
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-86c3aed0c8

dependabot Bot commented on behalf of github Oct 9, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Oct 9, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 9, 2026

Uh oh!

dependabot Bot commented on behalf of github Oct 9, 2026

Uh oh!

efymd9 commented Oct 9, 2026

Uh oh!

This branch had an error being deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Path	Size
`@sentry/browser`	28.82 KB
`@sentry/browser` - with treeshaking flags	27.03 KB
`@sentry/browser` - with treeshaking flags tracing without tracing	26.93 KB
`@sentry/browser` (incl. Tracing)	50.24 KB
`@sentry/browser` (incl. Tracing + Span Streaming)	50.26 KB
`@sentry/browser` (incl. Tracing, Profiling)	53.18 KB
`@sentry/browser` (incl. Tracing, Replay)	88.91 KB
`@sentry/browser` (incl. Tracing, Replay) - with treeshaking flags	78.15 KB
`@sentry/browser` (incl. Tracing, Replay with Canvas)	93.5 KB
`@sentry/browser` (incl. Tracing, Replay, Feedback)	106.16 KB
`@sentry/browser` (incl. Feedback)	45.94 KB
`@sentry/browser` (incl. sendFeedback)	33.76 KB
`@sentry/browser` (incl. FeedbackAsync)	38.75 KB
`@sentry/browser` (incl. Metrics)	29.82 KB
`@sentry/browser` (incl. Logs)	30.1 KB
`@sentry/browser` (incl. Metrics & Logs)	30.74 KB
`@sentry/react`	30.63 KB
`@sentry/react` (incl. Tracing)	52.54 KB
`@sentry/vue`	36.63 KB
`@sentry/vue` (incl. Tracing)	53.06 KB
`@sentry/svelte`	28.86 KB
`@sentry/remix` (Remix 3 client bundle)	54.47 KB
CDN Bundle	30.49 KB
CDN Bundle (incl. Tracing)	50.76 KB
CDN Bundle (incl. Logs, Metrics)	32.68 KB
CDN Bundle (incl. Tracing, Logs, Metrics)	52.65 KB
CDN Bundle (incl. Replay, Logs, Metrics)	72.47 KB
CDN Bundle (incl. Tracing, Replay)	87.46 KB
CDN Bundle (incl. Tracing, Replay, Logs, Metrics)	89.39 KB
CDN Bundle (incl. Tracing, Replay, Feedback)	93.48 KB
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics)	95.42 KB
CDN Bundle - uncompressed	89.98 KB
CDN Bundle (incl. Tracing) - uncompressed	150.87 KB
CDN Bundle (incl. Logs, Metrics) - uncompressed	96.4 KB
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed	156.69 KB
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed	222.93 KB
CDN Bundle (incl. Tracing, Replay) - uncompressed	267.8 KB
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed	273.6 KB
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed	281.18 KB
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed	286.97 KB
`@sentry/nextjs` (client)	55 KB
`@sentry/sveltekit` (client)	50.65 KB

Conversation

dependabot Bot commented on behalf of github Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

@​clerk/localizations@​4.22.0

Minor Changes

Patch Changes

@​clerk/localizations@​4.21.1

Patch Changes

4.22.0

Minor Changes

Patch Changes

4.21.2

Patch Changes

4.21.1

Patch Changes

@​clerk/nextjs@​7.9.11

Patch Changes

@​clerk/nextjs@​7.9.9

Patch Changes

7.9.11

Patch Changes

7.9.10

Patch Changes

7.9.9

Patch Changes

v15.5.0

15.5.0 (2026-10-02)

Features

Bug Fixes

Chores

Documentation

v15.4.0

15.4.0 (2026-09-30)

Features

Bug Fixes

Documentation

15.5.0 (2026-10-02)

Features

Bug Fixes

Chores

Documentation

15.4.0 (2026-09-30)

Features

Bug Fixes

Documentation

@​mux/mux-player-react: v3.14.0

3.14.0 (2026-10-02)

Miscellaneous Chores

Dependencies

3.14.0 (2026-10-02)

Miscellaneous Chores

Dependencies

@​mux/mux-video-react: v0.31.5

0.31.5 (2026-10-02)

Miscellaneous Chores

Dependencies

0.31.5 (2026-10-02)

Miscellaneous Chores

Dependencies

11.4.0

Bundle size 📦

11.4.0

11.3.0

Important Changes

Other Changes

v7.0.0

New features

v10.0.0

New features

Fixes

Changed

@​vercel/blob@​2.8.1

Patch Changes

2.8.1

Patch Changes

Version 1.52.0

What's Changed

Version 1.51.0

What's Changed

New Contributors

dependabot Bot commented on behalf of github Oct 9, 2026 •

edited

Loading

`@clerk/localizations@4`.22.0

`@clerk/localizations@4`.21.1

`@clerk/nextjs@7`.9.11

`@clerk/nextjs@7`.9.9

`@mux/mux-player-react`: v3.14.0

`@mux/mux-video-react`: v0.31.5

`@vercel/blob@2`.8.1

...
Description has been truncated

vercel Bot commented Oct 9, 2026 •

edited

Loading