Skip to content

chore(deps): bump the everything-else group across 1 directory with 17 updates - #6575

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/everything-else-0cf683664f
Open

chore(deps): bump the everything-else group across 1 directory with 17 updates#6575
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/everything-else-0cf683664f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 2, 2026 •
edited by cursor Bot
Loading

Copy link
Copy Markdown
Contributor

Bumps the everything-else group with 17 updates in the / directory:

Package From To
@rdi-ui/pipeline 0.1.35 0.1.50
@sentry/electron 7.18.0 7.20.2
@sentry/react 10.73.0 10.78.0
axios 1.20.0 1.21.0
dompurify 3.4.14 3.4.17
jszip 3.10.1 3.10.2
react-hook-form 7.87.0 7.91.0
socket.io-client 4.8.3 4.8.4
unist-util-visit 5.1.0 5.2.0
@sentry/vite-plugin 5.4.0 5.4.1
@sentry/webpack-plugin 5.4.0 5.4.1
@types/lodash 4.17.25 4.17.27
concurrently 9.2.4 9.2.5
core-js 3.50.0 3.51.0
csv-stringify 6.8.3 6.9.0
moment 2.30.1 2.31.0
tsx 4.23.13 4.23.15

Updates @rdi-ui/pipeline from 0.1.35 to 0.1.50

Updates @sentry/electron from 7.18.0 to 7.20.2

Release notes

Sourced from @​sentry/electron's releases.

7.20.2

Bug Fixes 🐛

V7

  • Only add main process context lines to renderer frames in the app directory by @​timfish in #1475
  • Allow removal of message listeners on utility processes by @​timfish in #1474
  • Stop re-running event processors on every main process scope change by @​timfish in #1470

7.20.1

Bug Fixes 🐛

  • Handle v1 standalone span envelopes from renderers (v7) by @​timfish in #1451
  • Keep framework SDK default integrations in renderer init (v7) by @​timfish in #1454

Internal Changes 🔧

7.20.0

New Features ✨

Bug Fixes 🐛

  • Honour enabled: false for envelopes forwarded from renderers and utility processes by @​timfish in #1432

Internal Changes 🔧

7.19.0

New Features ✨

Internal Changes 🔧

Changelog

Sourced from @​sentry/electron's changelog.

7.20.2

Bug Fixes 🐛

V7

  • Only add main process context lines to renderer frames in the app directory by @​timfish in #1475
  • Allow removal of message listeners on utility processes by @​timfish in #1474
  • Stop re-running event processors on every main process scope change by @​timfish in #1470

7.20.1

Bug Fixes 🐛

  • Handle v1 standalone span envelopes from renderers (v7) by @​timfish in #1451
  • Keep framework SDK default integrations in renderer init (v7) by @​timfish in #1454

Internal Changes 🔧

7.20.0

New Features ✨

Bug Fixes 🐛

  • Honour enabled: false for envelopes forwarded from renderers and utility processes by @​timfish in #1432

Internal Changes 🔧

7.19.0

New Features ✨

Internal Changes 🔧

Commits
  • 64029a3 release: 7.20.2
  • faf4ce9 fix(v7): Only add main process context lines to renderer frames in the app di...
  • 35cb0be fix(v7): Allow removal of message listeners on utility processes (#1474)
  • e3d93b9 fix(v7): Stop re-running event processors on every main process scope change ...
  • 778502a Merge commit 'd1b000e78fd86476f49e6fec4207385a60196b09' into v7
  • d1b000e release: 7.20.1
  • 877b0ab chore: Change the publish tag (#1455)
  • d3c6736 fix: Handle v1 standalone span envelopes from renderers (v7) (#1451)
  • 9ff12c9 fix: Keep framework SDK default integrations in renderer init (v7) (#1454)
  • 1a500a8 Merge remote-tracking branch 'remotes/origin/release/7.20.0'
  • Additional commits viewable in compare view

Updates @sentry/react from 10.73.0 to 10.78.0

Release notes

Sourced from @​sentry/react's releases.

10.78.0

  • feat(v10/deno): Re-export portable helpers that Cloudflare exposes (#25708)
  • fix(v10/core): Drop sampled-out errors before they take a promise buffer slot (#25753)
  • fix(v10/core): Stop sending client reports for breadcrumbs (#25752)
  • fix(v10/core): Use trace_metric data category for metrics rate limits and client reports (#25612)
  • fix(v10/nextjs): Don't crash Cloudflare workers on import of the Next.js version helper (#25730)

Bundle size 📦

Path Size
@​sentry/browser 27.64 KB
@​sentry/browser - with treeshaking flags 26.12 KB
@​sentry/browser (incl. Tracing) 46.2 KB
@​sentry/browser (incl. Tracing + Span Streaming) 47.96 KB
@​sentry/browser (incl. Tracing, Profiling) 50.87 KB
@​sentry/browser (incl. Tracing, Replay) 84.73 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags 74.6 KB
@​sentry/browser (incl. Tracing, Replay with Canvas) 89.33 KB
@​sentry/browser (incl. Tracing, Replay, Feedback) 101.65 KB
@​sentry/browser (incl. Feedback) 44.42 KB
@​sentry/browser (incl. sendFeedback) 32.34 KB
@​sentry/browser (incl. FeedbackAsync) 37.34 KB
@​sentry/browser (incl. Metrics) 28.7 KB
@​sentry/browser (incl. Logs) 28.94 KB
@​sentry/browser (incl. Metrics & Logs) 29.6 KB
@​sentry/react 29.42 KB
@​sentry/react (incl. Tracing) 48.46 KB
@​sentry/vue 33.39 KB
@​sentry/vue (incl. Tracing) 48.52 KB
@​sentry/svelte 27.66 KB
CDN Bundle 30 KB
CDN Bundle (incl. Tracing) 48.13 KB
CDN Bundle (incl. Logs, Metrics) 31.56 KB
CDN Bundle (incl. Tracing, Logs, Metrics) 49.42 KB
CDN Bundle (incl. Replay, Logs, Metrics) 70.13 KB
CDN Bundle (incl. Tracing, Replay) 84.97 KB
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) 86.24 KB
CDN Bundle (incl. Tracing, Replay, Feedback) 90.65 KB
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) 91.9 KB
CDN Bundle - uncompressed 89.11 KB
CDN Bundle (incl. Tracing) - uncompressed 145.03 KB
CDN Bundle (incl. Logs, Metrics) - uncompressed 93.71 KB
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed 148.92 KB
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed 216.26 KB
CDN Bundle (incl. Tracing, Replay) - uncompressed 262.18 KB
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed 266.05 KB
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed 275.56 KB
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed 279.42 KB
@​sentry/nextjs (client) 51.06 KB

... (truncated)

Changelog

Sourced from @​sentry/react's changelog.

10.78.0

  • feat(v10/deno): Re-export portable helpers that Cloudflare exposes (#25708)
  • fix(v10/core): Drop sampled-out errors before they take a promise buffer slot (#25753)
  • fix(v10/core): Stop sending client reports for breadcrumbs (#25752)
  • fix(v10/core): Use trace_metric data category for metrics rate limits and client reports (#25612)
  • fix(v10/nextjs): Don't crash Cloudflare workers on import of the Next.js version helper (#25730)

10.77.1

Important Changes

  • feat(v10/nextjs): Add a tunnel route handler that sends only the event payload to Sentry (#25559)

    The tunnelRoute option can now send events through a route handler in your app. The handler forwards only the event payload to Sentry, and no request headers. To use it, add this file next to your tunnelRoute option:

    // app/sentry-tunnel/route.ts (or src/app/sentry-tunnel/route.ts)
export { POST } from '@sentry/nextjs/tunnel';

    The handler accepts events for the DSN of your server SDK. To accept other DSNs, use createSentryTunnelRoute({ allowedDsns }) from the same import. Without the file, the tunnel route works as before.

    With the handler, tunnel requests go through your middleware. If your middleware blocks unauthenticated requests, exclude the tunnel route in its matcher.

    Also, the server no longer sends spans of tunnel requests when span streaming is on, because these spans only show the SDK's own traffic.

  • feat(v10/nextjs): Send tunnel route requests with credentials: 'omit' (#25561)

    With tunnelRoute and no tunnel route handler, @sentry/nextjs now sends events from the browser with credentials: 'omit', because the tunnel route does not need cookies. If a layer in front of your app checks cookies before it lets requests through (for example Vercel Deployment Protection), you can send them again in your browser Sentry.init call:

    // instrumentation-client.ts
Sentry.init({
  transportOptions: { fetchOptions: { credentials: 'same-origin' } },
});

  • fix(v10/deps)!: Limit @opentelemetry/api to <1.10.0 and the OpenTelemetry SDK to <3.0.0 (#25715)

    Breaking change

    If your app uses @opentelemetry/api 1.10.0 or OpenTelemetry SDK v3 together with v10 of the Sentry SDK, you must stay on @opentelemetry/api below 1.10.0 and OpenTelemetry SDK v2, or upgrade to v11.

    @opentelemetry/api 1.10.0 only works with OpenTelemetry SDK v3 (@opentelemetry/core 3.x, @opentelemetry/instrumentation 0.300.x). The SDK v2 packages that v10 uses only support @opentelemetry/api below 1.10.0, and SDK v3 needs Node.js 22.15.0 or newer, while v10 supports Node.js 18 and newer. For this reason, v10 now limits @opentelemetry/api to <1.10.0, and the @opentelemetry/instrumentation and @opentelemetry/exporter-trace-otlp-http peer dependencies of @sentry/node-core to <0.300.0.

    If your app depends on @opentelemetry/api directly, use a version below 1.10.0 (for example ~1.9.1). With 1.10.0, your app and the Sentry SDK use different copies of the API, and the OpenTelemetry calls of your app do not see the tracer provider of the Sentry SDK.

    To use @opentelemetry/api 1.10.0 and OpenTelemetry SDK v3, upgrade to v11 of the Sentry SDK. For the upgrade steps, see the migration guide.

... (truncated)

Commits
  • 5f277de release: 10.78.0
  • a4cc5f9 meta(changelog): Update changelog for 10.78.0 (#25831)
  • e4ea7fd fix(v10/deno): Re-export portable helpers that Cloudflare exposes (#25708)
  • 26744d3 fix(v10/core): Drop sampled-out errors before they take a promise buffer slot...
  • 3c8e1d7 fix(v10/core): Stop sending client reports for breadcrumbs (#25752)
  • 0664050 fix(v10/nextjs): Don't crash Cloudflare workers on import of the Next.js vers...
  • 76defeb fix(v10/core): Use trace_metric data category for metrics rate limits and c...
  • e2fa5ba meta(changelog): Merge 10.77.0 into 10.77.1 because 10.77.0 was not released ...
  • bb2bb52 fix(v10/astro): defer to @sentry/cloudflare/vite on Cloudflare Workers (#25...
  • 65d23eb fix(v10/elysia): Set SDK metadata on the options passed to init (#25486)
  • Additional commits viewable in compare view

Updates axios from 1.20.0 to 1.21.0

Release notes

Sourced from axios's releases.

v1.21.0 — October 21, 2026

This release adds response timing and opt-in UTF-8 Basic authentication, improves request handling across runtimes, and changes how header defaults are recognized.

⚠️ Breaking Changes & Deprecations

  • Header Defaults: Only plain objects, null-prototype maps, and compatible AxiosHeaders instances are treated as common or method-specific defaults; literal headers such as Link are now preserved. Applications using custom class instances as defaults must convert them to plain maps, for example { post: { ...customDefaults } }, or compatible AxiosHeaders. Otherwise, those instances become literal header values, including on requests using other methods. (#11156)

🚀 New Features

  • Response Timing: Added response.duration, in milliseconds, including on error.response when present. Timing measures adapter execution and excludes interceptors and transforms; streamed responses stop timing when the stream becomes available. Axios replaces any existing duration value supplied by a custom adapter. (#11214)
  • UTF-8 Basic Authentication: Added transitional.encodeBasicAuthUsername: true to support Unicode usernames in XHR and Fetch requests. The option defaults to false, preserving existing authentication behavior; applications opting in should supply the original Unicode username and remove manual pre-encoding workarounds. (#11159)

🐛 Bug Fixes

  • Fetch Compatibility: Restored requests in runtimes such as Cloudflare Workers that reject the implicit cache: 'default', while preserving explicit caller settings. Response-size failures now retain their original ERR_BAD_RESPONSE and request context when runtime wrappers replace the underlying stream error. (#11194, #11179)
  • Runtime Consistency: Aligned encoded-byte size accounting, multipart uploads, proxy routing, same-origin resolution, parameter merging, and form serialization across adapters. Circular parameters now reject with ERR_BAD_OPTION_VALUE, and sparse or non-index numeric form fields serialize as keyed objects. With proxy: false, native proxyEnv agents using unsupported pool-management or TLS-session lifecycle overrides now reject with ERR_BAD_OPTION_VALUE; construct those agents without proxyEnv. (#11242)
  • Header Handling: Preserved headers named __proto__ using safe casing without changing the AxiosHeaders instance prototype. Function matchers in has(), delete(), and clear() now receive the headers instance as this, matching their declared contract. (#11134, #11216)
  • URL and Data URL Parsing: Accepted case-insensitive supported URL schemes and Base64 markers, and corrected decoding of percent-encoded Base64 data URLs. Node data URL allocation estimates remain aligned with decoding so configured size limits apply before allocation. (#11138, #11163, #11294)
  • Error Diagnostics: Preserved short reconstructed request stacks and appended wrapped error stacks under Caused by: so tooling that reads only error.stack retains the original failure context. (#11132, #11142)
  • Interceptor Removal: Restored removal through canonical numeric-string interceptor IDs, including after registry compaction. (#11139)
  • Proxy TLS: HTTPS CONNECT tunnels now apply current origin TLS options from an explicit httpsAgent, or from https.globalAgent when no explicit agent is supplied. This preserves process-wide custom CA settings through proxy tunnels. (#11178)
  • XHR Lifecycle: Used asynchronous Cookie Store reads for XSRF tokens where supported, preserving cookie fallback, timeout accounting, and cancellation. Upload and download progress listeners are now removed on completion, failure, timeout, and cancellation. (#11166, #11225)
  • HTTP/2 Sessions: Stopped reusing sessions immediately after GOAWAY and prevented draining sessions from scheduling idle timers that could delay process exit. (#11210)
  • TypeScript Declarations: Exposed the response-default marker as a public type to resolve TS2527 when consumers emit declarations involving unresolved response generics, covering both ESM and CommonJS. (#11125)

🔧 Maintenance & Chores

  • Configuration Performance: Reduced request configuration merge overhead, particularly for requests with many headers, while preserving merge semantics and prototype-pollution guards. (#11208)
  • Same-Origin Checks: Removed obsolete Internet Explorer detection without changing origin decisions in supported environments. (#11174)
  • Dependencies: Updated follow-redirects to 1.16.1 and refreshed development, documentation, test, and GitHub Actions dependencies. Removed unused dayjs from the docs package, root chalk, and chai from CJS module tests. (#11169, #11188, #11189, #11195, #11212, #11213, #11218, #11220, #11221, #11230, #11234, #11244, #11245, #11266, #11267, #11268, #11269, #11270, #11271, #11272, #11298, #11302, #11303, #11304, #11305, #11306, #11313, #11321, #11322, #11323, #11342)
  • Documentation: Fixed interceptor test links, updated README CDN examples to the published 1.20.0 bundle, and corrected guidance on interceptor options and request lifecycle ordering. (#11228, #11149, #11335)
  • Contributor Workflow: Consolidated agent instructions in AGENTS.md, standardized PR labels, required prerelease notes and validation evidence, and clarified that npm test requires installed Playwright browsers. (#11238, #11273, #11223, #11284)
  • Sponsors and Support: Added HeroDevs, Code for Japan, and Sweepico sponsor listings, refreshed sponsor data, and documented extended security support for Axios v0. (#11222, #11249, #11252, #11341)
  • Proxy Regression Coverage: Added a long dotted request-hostname test for NO_PROXY handling, extending coverage of an existing denial-of-service fix. (#11235)
  • Release Preparation: Updated package version metadata for 1.21.0. (#11346)

🌟 New Contributors

Welcome to our 24 new contributors. Thank you for helping improve Axios:

... (truncated)

Changelog

Sourced from axios's changelog.

v1.21.0 — October 21, 2026

This release adds response timing and opt-in UTF-8 Basic authentication, improves request handling across runtimes, and changes how header defaults are recognized.

⚠️ Breaking Changes & Deprecations

  • Header Defaults: Only plain objects, null-prototype maps, and compatible AxiosHeaders instances are treated as common or method-specific defaults; literal headers such as Link are now preserved. Applications using custom class instances as defaults must convert them to plain maps, for example { post: { ...customDefaults } }, or compatible AxiosHeaders. Otherwise, those instances become literal header values, including on requests using other methods. (#11156)

🚀 New Features

  • Response Timing: Added response.duration, in milliseconds, including on error.response when present. Timing measures adapter execution and excludes interceptors and transforms; streamed responses stop timing when the stream becomes available. Axios replaces any existing duration value supplied by a custom adapter. (#11214)
  • UTF-8 Basic Authentication: Added transitional.encodeBasicAuthUsername: true to support Unicode usernames in XHR and Fetch requests. The option defaults to false, preserving existing authentication behavior; applications opting in should supply the original Unicode username and remove manual pre-encoding workarounds. (#11159)

🐛 Bug Fixes

  • Fetch Compatibility: Restored requests in runtimes such as Cloudflare Workers that reject the implicit cache: 'default', while preserving explicit caller settings. Response-size failures now retain their original ERR_BAD_RESPONSE and request context when runtime wrappers replace the underlying stream error. (#11194, #11179)
  • Runtime Consistency: Aligned encoded-byte size accounting, multipart uploads, proxy routing, same-origin resolution, parameter merging, and form serialization across adapters. Circular parameters now reject with ERR_BAD_OPTION_VALUE, and sparse or non-index numeric form fields serialize as keyed objects. With proxy: false, native proxyEnv agents using unsupported pool-management or TLS-session lifecycle overrides now reject with ERR_BAD_OPTION_VALUE; construct those agents without proxyEnv. (#11242)
  • Header Handling: Preserved headers named __proto__ using safe casing without changing the AxiosHeaders instance prototype. Function matchers in has(), delete(), and clear() now receive the headers instance as this, matching their declared contract. (#11134, #11216)
  • URL and Data URL Parsing: Accepted case-insensitive supported URL schemes and Base64 markers, and corrected decoding of percent-encoded Base64 data URLs. Node data URL allocation estimates remain aligned with decoding so configured size limits apply before allocation. (#11138, #11163, #11294)
  • Error Diagnostics: Preserved short reconstructed request stacks and appended wrapped error stacks under Caused by: so tooling that reads only error.stack retains the original failure context. (#11132, #11142)
  • Interceptor Removal: Restored removal through canonical numeric-string interceptor IDs, including after registry compaction. (#11139)
  • Proxy TLS: HTTPS CONNECT tunnels now apply current origin TLS options from an explicit httpsAgent, or from https.globalAgent when no explicit agent is supplied. This preserves process-wide custom CA settings through proxy tunnels. (#11178)
  • XHR Lifecycle: Used asynchronous Cookie Store reads for XSRF tokens where supported, preserving cookie fallback, timeout accounting, and cancellation. Upload and download progress listeners are now removed on completion, failure, timeout, and cancellation. (#11166, #11225)
  • HTTP/2 Sessions: Stopped reusing sessions immediately after GOAWAY and prevented draining sessions from scheduling idle timers that could delay process exit. (#11210)
  • TypeScript Declarations: Exposed the response-default marker as a public type to resolve TS2527 when consumers emit declarations involving unresolved response generics, covering both ESM and CommonJS. (#11125)

🔧 Maintenance & Chores

  • Configuration Performance: Reduced request configuration merge overhead, particularly for requests with many headers, while preserving merge semantics and prototype-pollution guards. (#11208)
  • Same-Origin Checks: Removed obsolete Internet Explorer detection without changing origin decisions in supported environments. (#11174)
  • Dependencies: Updated follow-redirects to 1.16.1 and refreshed development, documentation, test, and GitHub Actions dependencies. Removed unused dayjs from the docs package, root chalk, and chai from CJS module tests. (#11169, #11188, #11189, #11195, #11212, #11213, #11218, #11220, #11221, #11230, #11234, #11244, #11245, #11266, #11267, #11268, #11269, #11270, #11271, #11272, #11298, #11302, #11303, #11304, #11305, #11306, #11313, #11321, #11322, #11323, #11342)
  • Documentation: Fixed interceptor test links, updated README CDN examples to the published 1.20.0 bundle, and corrected guidance on interceptor options and request lifecycle ordering. (#11228, #11149, #11335)
  • Contributor Workflow: Consolidated agent instructions in AGENTS.md, standardized PR labels, required prerelease notes and validation evidence, and clarified that npm test requires installed Playwright browsers. (#11238, #11273, #11223, #11284)
  • Sponsors and Support: Added HeroDevs, Code for Japan, and Sweepico sponsor listings, refreshed sponsor data, and documented extended security support for Axios v0. (#11222, #11249, #11252, #11341)
  • Proxy Regression Coverage: Added a long dotted request-hostname test for NO_PROXY handling, extending coverage of an existing denial-of-service fix. (#11235)
  • Release Preparation: Updated package version metadata for 1.21.0. (#11346)

🌟 New Contributors

Welcome to our 24 new contributors. Thank you for helping improve Axios:

... (truncated)

Commits
  • aa54a5e docs: remove cancelled sponsors from README (#11369)
  • e6b79d9 chore(release): prepare release 1.21.0 (#11346)
  • fceeb10 chore(deps-dev): bump the development_dependencies group with 4 updates (#11342)
  • 7d15df3 docs: refresh sponsor data (#11341)
  • 8d8e844 docs: correct interceptor options and request lifecycle guide (#11335)
  • 326843a test(no-proxy): cover the request-hostname path with a long dotted host (#11235)
  • e5195ec feat(core): expose request duration on the response (#11214)
  • 8d415e6 fix(headers): bind matcher callbacks to the headers instance (#11216)
  • b16dd77 fix(xhr): remove progress event listeners on request completion (#11225)
  • 790b2ca chore(deps): bump the github-actions group with 3 updates (#11323)
  • Additional commits viewable in compare view

Updates dompurify from 3.4.14 to 3.4.17

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.17

  • Fixed an issue with IN_PLACE, SAFE_FOR_TEMPLATES and shadow roots, thanks @​manus-pi
  • Fixed IN_PLACE handling of nodes that hooks or custom elements tough during sanitization, thanks @​uttej-badwane
  • Fixed the SMIL attributeName guard in XHTML mode, thanks @​Koukyosyumei
  • Hardened several smaller edge cases (namespaces, literal-text elements, isValidAttribute()), thanks @​artiphishell
  • Added a purify-edge test runner as a compatibility check, thanks @​anzal1
  • Clarified the IN_PLACE documentation in the README about possible risks
  • Updated several dependencies

DOMPurify 3.4.16

  • Fixed a problem with IN_PLACE node removal when working with hooks, thanks @​manus-pi
  • Fixed a problem with IN_PLACE sanitization and raw-text roots, thanks @​h-t-m
  • Fixed a problem with ESM default exports landing in CommonJS declarations, thanks @​ssi02014
  • Migrated from rollup to rolldown because performance, thanks @​ssi02014
  • Bumped several dependencies where possible

DOMPurify 3.4.15

  • Added better clobbering hardening when XML content is involved, thanks @​gnyselcuk
  • Added several smaller hardening and edge-case improvements, thanks @​leechristensen
  • Bumped several dependencies where possible
Commits

Updates jszip from 3.10.1 to 3.10.2

Changelog

Sourced from jszip's changelog.

v3.10.2 2026-09-09

  • Fix cross-realm binary type detection in getTypeOf. Fixes #759 (see #578)
  • Add missing types for JSZip.defaults. Fixes #690 (see #927)
  • Fix Blob support in Node.js 18 and up. Fixes #941 (see #955)
Commits
Maintainer changes

This version was pushed to npm by jkoops, a new releaser for jszip since your current version.


Updates react-hook-form from 7.87.0 to 7.91.0

Release notes

Sourced from react-hook-form's releases.

Version 7.91.0

🐞 Fixes

  • Fix useFieldArray not updating rows when using setValue or setValues (#13842, #13939)
  • Fix useFieldArray not unregistering values correctly on unmount (#13843)
  • Fix field registration without a value incorrectly adding array rows (#13846, #13849)
  • Fix useFieldArray reindexing fields incorrectly when array rules are registered (#13873)
  • Fix useFieldArray losing validation rules after reset() (#13940)
  • Fix stale field array validation results after array changes (#13888)
  • Fix useFieldArray validation after submission in onBlur mode (#13867)
  • Fix dirty state updates when setValues changes field arrays (#13870)
  • Fix stale asynchronous validation results after reset() and unregister() (#13908, #13912, #13934)
  • Fix Controller validation using stale DOM values (#13880)
  • Fix isValid not updating correctly after reset() and subsequent changes (#13847, #13930)
  • Fix handleSubmit leaving isSubmitting active when validation throws (#13905)
  • Fix empty validation message arrays being treated as errors (#13937)
  • Fix delayed validation errors not being flushed on blur (#13861)
  • Fix form state subscriptions and validity updates (#13866, #13877, #13906)
  • Fix d...

    Description has been truncated

    [!NOTE]
    Medium Risk
    Medium risk from a large @rdi-ui/pipeline jump and axios 1.21 header-default behavior, plus security-sensitive dompurify and broad Sentry/HTTP client updates without accompanying code changes—regression testing on RDI pipeline, API HTTP calls, markdown rendering, and error reporting is advisable.

    Overview
    This PR only updates package.json and package-lock.json: no application source changes.

    The largest bump is @rdi-ui/pipeline (0.1.35 → 0.1.50), which Redis Insight uses for RDI pipeline management. The new version pulls in CodeMirror JSON/YAML linting, codemirror-json-schema, and related validation stack transitively—reviewers should smoke-test that RDI pipeline UI after install.

    Runtime libraries are refreshed across the board: Sentry (@sentry/electron, @sentry/react, build plugins), axios 1.21.0 (note the release breaking change around header defaults if anything uses non-plain objects as default headers), dompurify (markdown sanitization in MarkdownViewer), react-hook-form, socket.io-client, jszip, and unist-util-visit. Dev-only bumps include concurrently, core-js, moment, tsx, and @types/lodash.

    The lockfile also reflects new transitive packages (e.g. Shiki, JSON schema helpers) from @rdi-ui/pipeline and updated OpenTelemetry/Sentry dependency trees.

    Reviewed by Cursor Bugbot for commit 7e43742. Bugbot is set up for automated code reviews on this repo. Configure here.

@dependabot
chore(deps): bump the everything-else group across 1 directory with 1…
7e43742 
…7 updates

Bumps the everything-else group with 17 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| @rdi-ui/pipeline | `0.1.35` | `0.1.50` |
| [@sentry/electron](https://github.com/getsentry/sentry-electron) | `7.18.0` | `7.20.2` |
| [@sentry/react](https://github.com/getsentry/sentry-javascript) | `10.73.0` | `10.78.0` |
| [axios](https://github.com/axios/axios) | `1.20.0` | `1.21.0` |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.4.14` | `3.4.17` |
| [jszip](https://github.com/Stuk/jszip) | `3.10.1` | `3.10.2` |
| [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.87.0` | `7.91.0` |
| [socket.io-client](https://github.com/socketio/socket.io) | `4.8.3` | `4.8.4` |
| [unist-util-visit](https://github.com/syntax-tree/unist-util-visit) | `5.1.0` | `5.2.0` |
| [@sentry/vite-plugin](https://github.com/getsentry/sentry-javascript) | `5.4.0` | `5.4.1` |
| [@sentry/webpack-plugin](https://github.com/getsentry/sentry-javascript) | `5.4.0` | `5.4.1` |
| [@types/lodash](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/lodash) | `4.17.25` | `4.17.27` |
| [concurrently](https://github.com/open-cli-tools/concurrently) | `9.2.4` | `9.2.5` |
| [core-js](https://github.com/zloirock/core-js/tree/HEAD/packages/core-js) | `3.50.0` | `3.51.0` |
| [csv-stringify](https://github.com/adaltas/node-csv/tree/HEAD/packages/csv-stringify) | `6.8.3` | `6.9.0` |
| [moment](https://github.com/moment/moment) | `2.30.1` | `2.31.0` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.13` | `4.23.15` |



Updates `@rdi-ui/pipeline` from 0.1.35 to 0.1.50

Updates `@sentry/electron` from 7.18.0 to 7.20.2
- [Release notes](https://github.com/getsentry/sentry-electron/releases)
- [Changelog](https://github.com/getsentry/sentry-electron/blob/7.20.2/CHANGELOG.md)
- [Commits](getsentry/sentry-electron@7.18.0...7.20.2)

Updates `@sentry/react` from 10.73.0 to 10.78.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.78.0/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.73.0...10.78.0)

Updates `axios` from 1.20.0 to 1.21.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.20.0...v1.21.0)

Updates `dompurify` from 3.4.14 to 3.4.17
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.14...3.4.17)

Updates `jszip` from 3.10.1 to 3.10.2
- [Changelog](https://github.com/Stuk/jszip/blob/main/CHANGES.md)
- [Commits](Stuk/jszip@v3.10.1...v3.10.2)

Updates `react-hook-form` from 7.87.0 to 7.91.0
- [Release notes](https://github.com/react-hook-form/react-hook-form/releases)
- [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md)
- [Commits](react-hook-form/react-hook-form@v7.87.0...v7.91.0)

Updates `socket.io-client` from 4.8.3 to 4.8.4
- [Release notes](https://github.com/socketio/socket.io/releases)
- [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md)
- [Commits](https://github.com/socketio/socket.io/compare/socket.io-client@4.8.3...socket.io-client@4.8.4)

Updates `unist-util-visit` from 5.1.0 to 5.2.0
- [Release notes](https://github.com/syntax-tree/unist-util-visit/releases)
- [Commits](syntax-tree/unist-util-visit@5.1.0...5.2.0)

Updates `@sentry/vite-plugin` from 5.4.0 to 5.4.1
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@5.4.0...5.4.1)

Updates `@sentry/webpack-plugin` from 5.4.0 to 5.4.1
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@5.4.0...5.4.1)

Updates `@types/lodash` from 4.17.25 to 4.17.27
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/lodash)

Updates `concurrently` from 9.2.4 to 9.2.5
- [Release notes](https://github.com/open-cli-tools/concurrently/releases)
- [Commits](open-cli-tools/concurrently@v9.2.4...v9.2.5)

Updates `core-js` from 3.50.0 to 3.51.0
- [Release notes](https://github.com/zloirock/core-js/releases)
- [Changelog](https://github.com/zloirock/core-js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/zloirock/core-js/commits/v3.51.0/packages/core-js)

Updates `csv-stringify` from 6.8.3 to 6.9.0
- [Changelog](https://github.com/adaltas/node-csv/blob/master/packages/csv-stringify/CHANGELOG.md)
- [Commits](https://github.com/adaltas/node-csv/commits/csv-stringify@6.9.0/packages/csv-stringify)

Updates `moment` from 2.30.1 to 2.31.0
- [Release notes](https://github.com/moment/moment/releases)
- [Changelog](https://github.com/moment/moment/blob/develop/CHANGELOG.md)
- [Commits](moment/moment@2.30.1...2.31.0)

Updates `tsx` from 4.23.13 to 4.23.15
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.23.13...v4.23.15)

---
updated-dependencies:
- dependency-name: "@rdi-ui/pipeline"
  dependency-version: 0.1.50
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: everything-else
- dependency-name: "@sentry/electron"
  dependency-version: 7.20.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: everything-else
- dependency-name: "@sentry/react"
  dependency-version: 10.78.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: everything-else
- dependency-name: axios
  dependency-version: 1.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: everything-else
- dependency-name: dompurify
  dependency-version: 3.4.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: everything-else
- dependency-name: jszip
  dependency-version: 3.10.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: everything-else
- dependency-name: react-hook-form
  dependency-version: 7.91.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: everything-else
- dependency-name: socket.io-client
  dependency-version: 4.8.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: everything-else
- dependency-name: unist-util-visit
  dependency-version: 5.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: everything-else
- dependency-name: "@sentry/vite-plugin"
  dependency-version: 5.4.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: everything-else
- dependency-name: "@sentry/webpack-plugin"
  dependency-version: 5.4.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: everything-else
- dependency-name: "@types/lodash"
  dependency-version: 4.17.27
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: everything-else
- dependency-name: concurrently
  dependency-version: 9.2.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: everything-else
- dependency-name: core-js
  dependency-version: 3.51.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: everything-else
- dependency-name: csv-stringify
  dependency-version: 6.9.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: everything-else
- dependency-name: moment
  dependency-version: 2.31.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: everything-else
- dependency-name: tsx
  dependency-version: 4.23.15
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: everything-else
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Nov 2, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner November 2, 2026 00:10
@dependabot dependabot Bot added the javascript Pull requests that update javascript code label Nov 2, 2026
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 2, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-11-02T00:12:35.235904Z 7e43742 PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Nov 2, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7e43742cb5

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread package.json
Comment on lines +279 to +280
"@sentry/electron": "^7.20.2",
"@sentry/react": "^10.78.0",

@chatgpt-codex-connector chatgpt-codex-connector Bot Nov 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Keep the Sentry SDK packages aligned with the core override

When the UI or desktop initializes these SDKs, the global @sentry/core: 10.73.0 override in package.json still forces that version even though the updated @sentry/react and @sentry/electron packages declare exact core dependencies of 10.78.0 and 10.75.0 respectively. Previously the runtime Sentry packages were consistently on 10.73.0; this mixed graph can cause missing-export/runtime failures and break error reporting. Update or remove the override, or keep the SDK packages on aligned versions.

Useful? React with 👍 / 👎.

@dependabot
dependabot Bot deployed to production November 2, 2026 00:17 Active
@dependabot
dependabot Bot deployed to production November 2, 2026 00:17 Active
@dependabot
dependabot Bot deployed to production November 2, 2026 00:17 Active
@dependabot
dependabot Bot deployed to production November 2, 2026 00:17 Active
@dependabot
dependabot Bot deployed to production November 2, 2026 00:17 Active
@dependabot
dependabot Bot deployed to production November 2, 2026 00:17 Active
@dependabot
dependabot Bot deployed to production November 2, 2026 00:17 Active
cursor[bot]
cursor Bot reviewed Nov 2, 2026
View reviewed changes

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 7e43742. Configure here.

Comment thread package.json
"@sentry/electron": "^7.18.0",
"@sentry/react": "^10.73.0",
"@sentry/electron": "^7.20.2",
"@sentry/react": "^10.78.0",

@cursor cursor Bot Nov 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sentry core override left stale

Medium Severity

Bumping @sentry/react to 10.78.0 and @sentry/electron to 7.20.2 leaves the @sentry/core override at 10.73.0. Those packages pin core to 10.78.0 and 10.75.0. Sentry SDKs share internal core APIs at exact versions, so Sentry.init and captureException can throw or drop events in main and renderer.

Additional Locations (2)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 7e43742. Configure here.

This branch had an error being deployed

1 failed and 1 active deployments
production — 7e43742c Deployed Nov 2, 2026 by dependabot[bot] via integration-tests / ITest (mods-preview) #8705
staging — 7e43742c Deployed Nov 2, 2026 by dependabot[bot] via Build Linux / Build linux x64 #2281
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments
@cursor cursor[bot] cursor[bot] left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants