Skip to content

chore(deps): update all non-major npm dependencies - #55

Merged
renovate[bot] merged 1 commit into
mainfrom
renovate/all-minor-patch-npm
Oct 16, 2026
Merged

chore(deps): update all non-major npm dependencies#55
renovate[bot] merged 1 commit into
mainfrom
renovate/all-minor-patch-npm

Conversation

@renovate

@renovate renovate Bot commented Oct 16, 2026

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@aws-sdk/client-s3 (source) 3.1148.0 → 3.1150.0 age confidence
@sentry/nextjs (source) 11.6.0 → 11.7.0 age confidence
@tanstack/react-table (source) 9.2.6 → 9.3.1 age confidence
@testcontainers/postgresql 12.2.0 → 12.2.1 age confidence
@types/node (source) 24.19.1 → 24.19.2 age confidence
@vitest/coverage-v8 (source) 5.0.3 → 5.0.4 age confidence
dotenv 18.0.6 → 18.0.7 age confidence
lucide-react (source) 1.53.0 → 1.56.0 age confidence
pnpm (source) 12.10.1 → 12.13.0 age confidence
radix-ui (source) 1.7.0 → 1.8.1 age confidence
vitest (source) 5.0.3 → 5.0.4 age confidence
zod (source) 4.6.5 → 4.6.7 age confidence

Release Notes

aws/aws-sdk-js-v3 (@​aws-sdk/client-s3)

v3.1150.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1149.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

getsentry/sentry-javascript (@​sentry/nextjs)

v11.7.0

Compare Source

Important Changes

  • feat(cloudflare): Add opt-in cron monitoring for Cron Triggers (#​25014)

    The new cronTriggersIntegration sends check-ins for Cron Triggers. Each check-in includes the schedule from controller.cron, so Sentry creates the monitor on the first run. The integration is opt-in, because monitors are billed.

    Cron Triggers have no names, so map each cron expression of your wrangler config to a monitor slug. With the Sentry Cloudflare Vite plugin, add the integration to src/instrument.server.ts:

    // src/monitorSlugs.ts
export const monitorSlugs: Record<string, string> = {
  '30 9 * * MON-FRI': 'daily-report',
};

// src/instrument.server.ts
import * as Sentry from '@sentry/cloudflare';
import { monitorSlugs } from './monitorSlugs';

export default Sentry.defineCloudflareOptions(env => ({
  dsn: env.SENTRY_DSN,
  integrations: [Sentry.cronTriggersIntegration({ monitorSlug: cron => monitorSlugs[cron] })],
}));

// src/index.ts
import { monitorSlugs } from './monitorSlugs';

export default {
  async scheduled(controller, env) {
    switch (monitorSlugs[controller.cron]) {
      case 'daily-report':
        // Your daily report job
        break;
    }
  },
};

    The monitorSlug function can also return monitor settings, for example { monitorSlug: 'daily-report', maxRuntime: 30 }, or undefined to send no check-ins for a trigger. Without monitorSlug, the SDK derives the slug from the cron expression. If you deploy with wrangler directly, pass the same integration to Sentry.withSentry.

  • feat(node): Add neonIntegration for @​neondatabase/serverless (#​25164, #​25176)

    The new neonIntegration creates db spans for queries of the @neondatabase/serverless driver: for the WebSocket Client and Pool, and for the HTTP neon() function. This includes the neon-http and neon-serverless adapters of Drizzle. The integration is on by default when tracing is enabled.

  • feat(node): Stop sending the process session once request sessions are tracked (#​24915)

    Node servers sent release health data two times: as request session aggregates, and as the process session of processSessionIntegration. An error in a request also marked the process session as errored, so the SDK counted the error two times. Now the SDK drops the process session when it tracks the first request session. Scripts, CLIs and workers that do not serve requests keep the process session, and so do servers with httpServerIntegration({ sessions: false }). This changes the release health numbers of Node servers, because they no longer send the errored or crashed update of the process session.

  • feat(server-utils): Record decide calls as gen_ai.decide spans (#​25270, #​25272, #​25274, #​25281)

    Vercel AI experimental_decide calls, Mastra classifier evaluations, TypeSafe and LangChain Jev calls, and Workers AI calls to TypeSafe Jev and Cloudflare Clef models now create decide <model> spans with the op gen_ai.decide. Before, these spans had the op gen_ai.evaluate, which is now deprecated in the Sentry conventions. If you use gen_ai.evaluate in queries, alerts or dashboards, change it to gen_ai.decide.

  • fix(browser): Apply urlQueryParams to more URLs (#​25262, #​25289)

    The dataCollection.urlQueryParams option now also filters the query parameters of these URLs:

    • the page URL in event.request.url
    • the browser.* and resource.* span names with traceLifecycle: 'static'
    • the LCP URL attributes lcp.url and browser.web_vital.lcp.url
    • the URLs in fetch, XHR and navigation breadcrumbs
    • the ui.element.url attribute of elementTimingIntegration

    Before this fix, these URLs could send sensitive query values, for example ?jwt=..., to Sentry.

  • fix(nextjs): Apply top-level bundleSizeOptimizations to webpack and Turbopack builds (#​24818)

    The top-level bundleSizeOptimizations option now removes unused SDK code in webpack and in Turbopack builds. Before, the tree-shaking options had no effect on Turbopack. The webpack.treeshake option is deprecated. It still works, but when you set both options, bundleSizeOptimizations takes precedence.

Other Changes
  • feat(nuxt): Detect the server API with @nuxt/kit 4.6 (#​25138)
  • fix(bundler-plugins): Escape JSON in generated injection code (#​25265)
  • fix(core): Don't mark http client spans as errors when the caller aborts (#​25260)
  • fix(core): Record span client report outcomes when discarding transactions (#​25006)
  • fix(core): Record client outcomes when beforeSend callbacks return invalid values (#​25049)
  • fix(core): Record span outcomes for spans dropped when building a transaction (#​25048)
  • fix(core): Report actual item count in client reports of envelope send failures (#​25185)
  • fix(core): Strip internal custom span name from streamed spans (#​25212)
  • fix(nextjs): Filter query parameters in request error context (#​25233)
  • fix(node): Don't mark fetch spans as errors when the caller aborts (#​25129)
  • fix(nuxt): Delete public source maps before Nitro lists its public assets (#​25267)
  • fix(nuxt): Keep @sentry/server-runtime-injection external on Nitro v3 (#​24901)
  • fix(nuxt): Remove @​opentelemetry/resources dev alias (#​25216)
  • fix(profiling-node): Stop the trace lifecycle profiler when spans are unsampled (#​25210)
  • fix(react-router): Respect custom default integrations (#​25259)
  • fix(remix): Respect custom default integrations (#​25258)
  • fix(server-utils): avoid quadratic SQL summary regex backtracking (#​25255)
  • fix(server-utils): End Express layer spans when the client aborts (#​25209)
  • fix(server-utils): Record amqplib consumer info before the first delivery and instrument the callback API (#​25047)
  • fix(server-utils): Stop treating previous_response_id as the OpenAI conversation id (#​25269)
  • fix(sveltekit): Read load event pathname untracked (#​25235)
  • fix(sveltekit): Stop adapter-node 6 output dir probe from deleting the build (#​25193)
Internal Changes
  • chore: Add external contributor to CHANGELOG.md (#​25230)
  • chore: Add external contributor to CHANGELOG.md (#​25271)
  • chore(deps-dev): Bump oxlint-tsgolint from 7.0.2001 to 7.0.2003 (#​25237)
  • chore(deps-dev): Bump rimraf from 5.0.10 to 6.1.3 (#​25241)
  • chore(deps): Bump @sentry/conventions to 0.27.0 (#​25264)
  • chore(deps): Bump next from 16.2.11 to 16.3.8 in /dev-packages/e2e-tests/test-applications/nextjs-16 (#​25179)
  • chore(deps): Bump next from 16.2.11 to 16.3.8 in /dev-packages/e2e-tests/test-applications/nextjs-16-tunnel (#​25190)
  • chore(size-limit): weekly auto-bump (#​25213)
  • ci: Install Playwright in the background during E2E app builds (#​25207)
  • ci: Run lint steps in parallel (#​25187)
  • ci(bun): Test the oldest supported Bun version and the newest 1.4 (#​25203)
  • docs: Scope pre-PR tests to affected suites (#​25198)
  • feat(deps): Bump @​aws-sdk/client-kinesis from 3.1068.0 to 3.1146.0 (#​25240)
  • feat(deps): Bump handlebars from 4.7.9 to 4.7.10 (#​25206)
  • feat(deps): Bump pino from 9.10.0 to 10.4.0 (#​25238)
  • feat(deps): Bump reflect-metadata from 0.2.1 to 0.2.2 (#​25239)
  • ref(core): Simplify transport item loss recording (#​25224)
  • ref(server-utils): Export the pg query span helpers (#​25163)
  • ref(server-utils): Share Orchestrion channel context (#​25208)
  • test(browser): migrate trace lifecycle and span API tests to streaming (#​24881)
  • test(browser): port browser tracing suites to span streaming (#​24888)
  • test(browser): port requests and web vitals to span streaming (#​24886)
  • test(browser): Register the LCP handlers in the bundle of the SDK (#​25263)
  • test(bun): Run the Node suites that need Bun 1.4 on the Bun 1.4 job (#​25204)
  • test(cloudflare): Add LangChain TypeSafeClassifier integration test (#​25234)
  • test(core): Fix flaky span end timestamp test (#​25211)
  • test(deno): Type-check Deno unit tests (#​25227)
  • test(nextjs): Add vinext e2e tests (#​25001)
  • test(node-integration): Replace conditionalTest with a supports helper (#​25202)
  • test(node-integration): Stop exporting NODE_VERSION and RUNTIME from the test utils (#​25292)
  • test(node): Add integration tests for the Neon serverless driver (#​25177)
  • test(node): Port baggage and metadata tests to span streaming (#​25220)
  • test(node): Port basic and nested startSpan tests to streaming (#​25214)
  • test(node): Port fetch request suites to span streaming (#​25189)
  • test(node): Port HTTP options and hooks to span streaming (#​25195)
  • test(node): Port HTTP propagation and transport suites to streaming (#​25197)
  • test(node): Port HTTP request suites to span streaming (#​25191)
  • test(node): Port incoming HTTP behavior to span streaming (#​25194)
  • test(node): Port MongoDB integration tests to span streaming (#​25150)
  • test(node): Port Mongoose integration tests to span streaming (#​25151)
  • test(node): Port outgoing HTTP client spans to streaming (#​25192)
  • test(node): Port parallel span and naming tests to streaming (#​25217)
  • test(node): Port Postgres integration tests to span streaming (#​25140)
  • test(node): Port Prisma integration tests to span streaming (#​25152)
  • test(node): Port Redis integration tests to span streaming (#​25153)
  • test(node): Port span linking and raw OTel tests to streaming (#​25219)
  • test(node): Port trace context tests to span streaming (#​25218)
  • test(node): Run sampling propagation tests with default streaming (#​25221)
  • test(node): Use default streaming in scope and span suites (#​25222)
  • test(nuxt): Test imports from nuxt/server in the nuxt-5 E2E app (#​25232)

Work in this release was contributed by @​Philip-Nwabuwa and @​4ktLuffy. Thank you for your contributions!

TanStack/table (@​tanstack/react-table)

v9.3.1

Compare Source

Patch Changes
  • #​6631 3d3648f - Refresh the AppTable context when the useAppTable owner renders with new options or state, so useTableContext() consumers no longer show stale rows after data is replaced under a cached (React Compiler, useMemo, memo) AppTable element.
  • Updated dependencies [2d5f5b6, 87c6bcc]:

v9.2.8

Compare Source

Patch Changes
testcontainers/testcontainers-node (@​testcontainers/postgresql)

v12.2.1

Compare Source

Changes

🐛 Bug Fixes

🧹 Maintenance

📦 Dependency Updates

vitest-dev/vitest (@​vitest/coverage-v8)

v5.0.4

Compare Source

   🚀 Features
   🐞 Bug Fixes
   🏎 Performance
    View changes on GitHub
motdotla/dotenv (dotenv)

v18.0.7

Compare Source

Changed
  • Treat undefined settings like quiet: true as null rather than falsey (#​1070)
  • CLI should honor DOTENV_QUIET setting in .env file (#​1071)
lucide-icons/lucide (lucide-react)

v1.56.0: Version 1.56.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.55.0...1.56.0

v1.55.0: Version 1.55.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.54.0...1.55.0

v1.54.0: Version 1.54.0

Compare Source

What's Changed

Full Changelog: lucide-icons/lucide@1.53.0...1.54.0

pnpm/pnpm (pnpm)

v12.13.0: pnpm 12.13.0

Compare Source

This release adds the pnpm profile and pnpm token commands, the storeIndexFormat: files setting for stores shared over a network filesystem, and faster Python dependency resolution.

Minor Changes

  • Added the pnpm profile command to view and update registry user profile settings.

  • Added pnpm token to list, create, and revoke authentication tokens on the registry.

  • Added the storeIndexFormat setting. Set it to files to keep a store's package index as one file per package instead of the SQLite index.db, for a store on a network filesystem that several machines use at once. SQLite's locking does not work across machines, so concurrent installs on such a store could corrupt index.db.

  • Added the nodePackageMap setting, which groups the package-map settings. nodePackageMap.mode: write-only writes node_modules/.package-map.json for other tools without making Node.js load it. mode: load also makes Node.js load the map, like nodeExperimentalPackageMap: true. nodePackageMap.type replaces nodePackageMapType. The old settings still work #​14937.

    nodePackageMap:
  mode: write-only
  type: loose
Patch Changes
Setting up pnpm

  • pnpm setup now works when pnpm was installed with npm on macOS. It installed pnpm from npm's bin directory and left a $PNPM_HOME/bin/pnpm that could not run #​16855.

  • pnpm runs again after pnpm setup when globalShims enables pnpm. Every command failed with "the global target of the pnpm shim points back at the shim" #​16874.

  • A pnpm built for the MinGW target on Windows, such as the MSYS2 package, now installs the MinGW Rust toolchain that rust-toolchain.toml names. It used to install the MSVC toolchain.

Installing packages

  • On macOS, pnpm install no longer fails with ERR_PNPM_LOCKFILE_WRITE_FILE when the project is on a virtiofs or SMB share. pnpm now falls back to a regular fsync when the file system rejects a full sync #​16846.

  • On macOS, pnpm install, pnpm patch-commit, and other commands that load a pnpmfile no longer hang at random.

  • pnpm install now puts the executables of a Python build backend's requirements on the PATH while the backend runs. Projects built with uv_build now install. Before, they failed with "uv-build was not properly installed".

  • Removing a link: dependency now also removes its symlink from node_modules when nodeLinker is hoisted #​16884.

  • pnpm-lock.yaml no longer records the tarball URL of a package installed from a scoped registry, such as one set by @types:registry=, when pnpm can rebuild the URL from that registry #​16866.

Packing, auditing, and pipelines

  • pnpm pack and pnpm publish now pack only package.json, the README, the license, and the files named in main and bin when files is an empty array. They used to pack every file in the package #​16889.

  • pnpm audit and pnpm audit signatures no longer check runtimes installed through devEngines.runtime, such as node@runtime:24.21.0, against the npm package of the same name. pnpm audit signatures reported these runtimes as having an invalid registry signature #​16869.

  • pnpm pipeline now runs the root's tasks when pnpm-workspace.yaml lists only the root in packages or omits packages, as pnpm -r run does. A change to a root file in such a workspace no longer triggers a full-run warning. When a full run has no projects to run, pnpm pipeline now reports that no projects are selected [#​16849](https://redirect.github

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Budapest)

  • Branch creation
    • Between 06:00 PM and 11:59 PM, only on Friday (* 18-23 * * 5)
    • Between 12:00 AM and 07:59 AM, only on Saturday (* 0-7 * * 6)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added dependencies Updates a dependency javascript Updates npm packages labels Oct 16, 2026
@renovate
renovate Bot enabled auto-merge (squash) October 16, 2026 18:33
@renovate
renovate Bot requested a review from KOliver94 as a code owner October 16, 2026 18:33
@codecov

codecov Bot commented Oct 16, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (bfbfb59) to head (a31b031).
✅ All tests successful. No failed tests found.

Additional details and impacted files 
@@            Coverage Diff            @@
##              main       #55   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           89        89           
  Lines         1960      1960           
  Branches       500       500           
=========================================
  Hits          1960      1960

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@renovate
renovate Bot merged commit 2f5dea4 into main Oct 16, 2026
10 checks passed
@renovate
renovate Bot deleted the renovate/all-minor-patch-npm branch October 16, 2026 22:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@KOliver94 KOliver94 KOliver94 approved these changes

Assignees

No one assigned

Labels

dependencies Updates a dependency javascript Updates npm packages

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@KOliver94