Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 26 updates#45

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-be3cb0a72f
Closed

chore(deps): bump the production-dependencies group across 1 directory with 26 updates#45
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-be3cb0a72f

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 20, 2026 •
edited
Loading

Bumps the production-dependencies group with 26 updates in the / directory:

Package From To
@sentry/node 10.48.0 10.49.0
effect 3.21.0 3.21.1
fumadocs-core 16.7.16 16.8.1
fumadocs-mdx 14.2.14 14.3.1
fumadocs-ui 16.7.16 16.8.1
next 16.2.3 16.2.4
@sentry/react-native 8.7.0 8.8.0
@tanstack/react-query 5.99.0 5.99.2
@tanstack/react-store 0.10.0 0.11.0
axios 1.15.0 1.15.1
react-native 0.85.1 0.85.2
@base-ui/react 1.4.0 1.4.1
@sentry/browser 10.48.0 10.49.0
@tanstack/react-query-devtools 5.99.0 5.99.2
shadcn 4.2.0 4.3.1
@opentelemetry/api-logs 0.214.0 0.215.0
@opentelemetry/exporter-logs-otlp-http 0.214.0 0.215.0
@opentelemetry/exporter-metrics-otlp-http 0.214.0 0.215.0
@opentelemetry/exporter-trace-otlp-http 0.214.0 0.215.0
@opentelemetry/resources 2.6.1 2.7.0
@opentelemetry/sdk-logs 0.214.0 0.215.0
@opentelemetry/sdk-metrics 2.6.1 2.7.0
@opentelemetry/sdk-node 0.214.0 0.215.0
@opentelemetry/sdk-trace-base 2.6.1 2.7.0
@aws-sdk/client-s3 3.1030.0 3.1033.0
@aws-sdk/s3-request-presigner 3.1030.0 3.1033.0

Updates @sentry/node from 10.48.0 to 10.49.0

Release notes

Sourced from @​sentry/node's releases.

10.49.0

Important Changes

  • feat(browser): Add View Hierarchy integration (#14981)

    A new viewHierarchyIntegration captures the DOM structure when an error occurs, providing a snapshot of the page state for debugging. Enable it in your Sentry configuration:

    import * as Sentry from '@sentry/browser';
Sentry.init({
dsn: 'DSN',
integrations: [Sentry.viewHierarchyIntegration()],
});

  • feat(cloudflare): Split alarms into multiple traces and link them (#19373)

    Durable Object alarms now create separate traces for each alarm invocation, with proper linking between related alarms for better observability.

  • feat(cloudflare): Enable RPC trace propagation with enableRpcTracePropagation (#19991, #20345)

    A new enableRpcTracePropagation option enables automatic trace propagation for Cloudflare RPC calls via .fetch(), ensuring distributed traces flow correctly across service bindings.

  • feat(core): Add enableTruncation option to AI integrations (#20167, #20181, #20182, #20183, #20184)

    All AI integrations (OpenAI, Anthropic, Google GenAI, LangChain, LangGraph) now support an enableTruncation option to control whether large AI inputs/outputs are truncated.

  • feat(opentelemetry): Vendor AsyncLocalStorageContextManager (#20243)

    The OpenTelemetry context manager is now vendored internally, reducing external dependencies and ensuring consistent behavior across environments.

Other Changes

  • feat(core): Export a reusable function to add tracing headers (#20076)
  • feat(core): Expose rewriteSources top level option (#20142)
  • feat(deps): bump defu from 6.1.4 to 6.1.6 (#20104)
  • feat(node-native): Add support for V8 v14 (Node v25+) (#20125)
  • feat(node): Include global scope for eventLoopBlockIntegration (#20108)
  • fix(core, node): Support loading Express options lazily (#20211)
  • fix(core): Set conversation_id only on gen_ai spans (#20274)
  • fix(core): Use ai.operationId for Vercel AI V6 operation name mapping (#20285)
  • fix(deno): Avoid inferring invalid span op from Deno tracer (#20128)
  • fix(deno): Handle reader.closed rejection from releaseLock() in streaming (#20187)
  • fix(nextjs): Preserve directive prologues in turbopack loaders (#20103)
  • fix(nextjs): Skip custom browser tracing setup for bot user agents (#20263)
  • fix(opentelemetry): Use WeakRef for context stored on scope to prevent memory leak (#20328)
  • fix(replay): Use live click attributes in breadcrumbs (#20262)

... (truncated)

Changelog

Sourced from @​sentry/node's changelog.

10.49.0

Important Changes

  • feat(browser): Add View Hierarchy integration (#14981)

    A new viewHierarchyIntegration captures the DOM structure when an error occurs, providing a snapshot of the page state for debugging. Enable it in your Sentry configuration:

    import * as Sentry from '@sentry/browser';
Sentry.init({
dsn: 'DSN',
integrations: [Sentry.viewHierarchyIntegration()],
});

  • feat(cloudflare): Split alarms into multiple traces and link them (#19373)

    Durable Object alarms now create separate traces for each alarm invocation, with proper linking between related alarms for better observability.

  • feat(cloudflare): Enable RPC trace propagation with enableRpcTracePropagation (#19991, #20345)

    A new enableRpcTracePropagation option enables automatic trace propagation for Cloudflare RPC calls via .fetch(), ensuring distributed traces flow correctly across service bindings.

  • feat(core): Add enableTruncation option to AI integrations (#20167, #20181, #20182, #20183, #20184)

    All AI integrations (OpenAI, Anthropic, Google GenAI, LangChain, LangGraph) now support an enableTruncation option to control whether large AI inputs/outputs are truncated.

  • feat(opentelemetry): Vendor AsyncLocalStorageContextManager (#20243)

    The OpenTelemetry context manager is now vendored internally, reducing external dependencies and ensuring consistent behavior across environments.

Other Changes

  • feat(core): Export a reusable function to add tracing headers (#20076)
  • feat(core): Expose rewriteSources top level option (#20142)
  • feat(deps): bump defu from 6.1.4 to 6.1.6 (#20104)
  • feat(node-native): Add support for V8 v14 (Node v25+) (#20125)
  • feat(node): Include global scope for eventLoopBlockIntegration (#20108)
  • fix(core, node): Support loading Express options lazily (#20211)
  • fix(core): Set conversation_id only on gen_ai spans (#20274)
  • fix(core): Use ai.operationId for Vercel AI V6 operation name mapping (#20285)
  • fix(deno): Avoid inferring invalid span op from Deno tracer (#20128)
  • fix(deno): Handle reader.closed rejection from releaseLock() in streaming (#20187)
  • fix(nextjs): Preserve directive prologues in turbopack loaders (#20103)
  • fix(nextjs): Skip custom browser tracing setup for bot user agents (#20263)
  • fix(opentelemetry): Use WeakRef for context stored on scope to prevent memory leak (#20328)
  • fix(replay): Use live click attributes in breadcrumbs (#20262)

... (truncated)

Commits
  • 745af79 release: 10.49.0
  • 46dcef1 Merge pull request #20348 from getsentry/prepare-release/10.49.0
  • bf4e188 meta(changelog): Update changelog for 10.49.0
  • 5f72df5 feat(cloudflare): Enable RPC trace propagation with enableRpcTracePropagation...
  • 50438f9 feat(browser): Emit web vitals as streamed spans (#19827)
  • 3332fec fix(opentelemetry): Use WeakRef for context stored on scope to prevent memory...
  • 684a41f ref(opentelemetry): Replace @opentelemetry/resources with inline `getSentry...
  • 8b2a9dc ci: Remove Docker container for Verdaccio package publishing (#20329)
  • 0007c7b ci: Extract test names for flaky test issues (#20298)
  • 9b9d65c chore(ci): Bump actions/cache to v5 and actions/download-artifact to v7 (#20249)
  • Additional commits viewable in compare view

Updates effect from 3.21.0 to 3.21.1

Release notes

Sourced from effect's releases.

effect@3.21.1

Patch Changes

  • #6139 f99048e Thanks @​marbemac! - Fix batched request resolver defects causing consumer fibers to hang forever.

    When a RequestResolver.makeBatched resolver died with a defect, the request Deferreds were never completed because the cleanup logic in invokeWithInterrupt used flatMap (which only runs on success). Changed to ensuring so uncompleted request entries are always resolved regardless of exit type.

Changelog

Sourced from effect's changelog.

3.21.1

Patch Changes

  • #6139 f99048e Thanks @​marbemac! - Fix batched request resolver defects causing consumer fibers to hang forever.

    When a RequestResolver.makeBatched resolver died with a defect, the request Deferreds were never completed because the cleanup logic in invokeWithInterrupt used flatMap (which only runs on success). Changed to ensuring so uncompleted request entries are always resolved regardless of exit type.

Commits

Updates fumadocs-core from 16.7.16 to 16.8.1

Release notes

Sourced from fumadocs-core's releases.

fumadocs-core@16.8.1

No release notes provided.

Commits
  • 998f775 Merge pull request #3221 from fuma-nama/changeset-release/dev
  • ef7e446 Docs: fix links
  • 3ae8809 UI: Improve TOC sizing
  • 8478be2 Docs: introduce dynamicLoader() API
  • 6c77249 Docs: introduce Local MD
  • cfeb2c5 OpenAPI: Fix @scalar/api-client-react version as 2.0.2 has a breaking change
  • da908c7 Chore: update examples usage
  • bc981eb Local MD: support custom module exports type
  • 974b093 Local MD: Support custom options for built-in plugins
  • d10688d Chore: keep legacy types for backward compat
  • Additional commits viewable in compare view

Updates fumadocs-mdx from 14.2.14 to 14.3.1

Release notes

Sourced from fumadocs-mdx's releases.

fumadocs-mdx@14.3.0

Minor Changes

  • fa9f678: Make Next.js config ESM only

    Newer Next.js supported .mts extension for Next.js config files, see Next.js docs for more info.

Commits
  • 00c01b6 Merge pull request #1041 from fuma-nama/changeset-release/dev
  • b571b21 Version Packages
  • e7443d7 UI: Fix development errors
  • a6a7b70 Merge branch 'main' into dev
  • 00209d0 docs: update information
  • 07e343e Merge pull request #1028 from fuma-nama/changeset-release/dev
  • d21abf0 Version Packages
  • acffcfd fix Orama type problems
  • a11804b UI: expose more providers from fumadocs-ui/provider
  • 46d9208 CFA: Add option for ESLint
  • Additional commits viewable in compare view
Attestation changes

This version has no provenance attestation, while the previous version (14.2.14) was attested. Review the package versions before updating.


Updates fumadocs-ui from 16.7.16 to 16.8.1

Release notes

Sourced from fumadocs-ui's releases.

fumadocs-ui@16.8.1

Patch Changes

  • 3ae8809: Improve TOC sizing
    • fumadocs-core@16.8.1
Commits
  • 998f775 Merge pull request #3221 from fuma-nama/changeset-release/dev
  • ef7e446 Docs: fix links
  • 3ae8809 UI: Improve TOC sizing
  • 8478be2 Docs: introduce dynamicLoader() API
  • 6c77249 Docs: introduce Local MD
  • cfeb2c5 OpenAPI: Fix @scalar/api-client-react version as 2.0.2 has a breaking change
  • da908c7 Chore: update examples usage
  • bc981eb Local MD: support custom module exports type
  • 974b093 Local MD: Support custom options for built-in plugins
  • d10688d Chore: keep legacy types for backward compat
  • Additional commits viewable in compare view

Updates next from 16.2.3 to 16.2.4

Release notes

Sourced from next's releases.

v16.2.4

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • chore: Bump reqwest to 0.13.2 (Fixes Google Fonts with Turbopack for Windows on ARM64) (#92713)
  • Turbopack: fix filesystem watcher config not applying follow_symlinks(false) (#92631)
  • Scope Safari ?ts= cache-buster to CSS/font assets only (Pages Router) (#92580)
  • Compiler: Support boolean and number primtives in next.config defines (#92731)
  • turbo-tasks: Fix recomputation loop by allowing cell cleanup on error during recomputation (#92725)
  • Turbopack: shorter error for ChunkGroupInfo::get_index_of (#92814)
  • Turbopack: shorter error message for ModuleBatchesGraph::get_entry_index (#92828)
  • Adding more system info to the 'initialize project' trace (#92427)

Credits

Huge thanks to @​Badbird5907, @​lukesandberg, @​andrewimm, @​sokra, and @​mischnic for helping!

Commits
  • 2275bd8 v16.2.4
  • e073983 Adding more system info to the 'initialize project' trace (#92427)
  • 8a540b5 Turbopack: shorter error message for ModuleBatchesGraph::get_entry_index (#92...
  • 2f5343f Turbopack: shorter error for ChunkGroupInfo::get_index_of (#92814)
  • 2ad9d3f turbo-tasks: Fix recomputation loop by allowing cell cleanup on error during ...
  • 6f3808e Compiler: Support boolean and number primtives in next.config defines (#92731)
  • fbc7684 Scope Safari ?ts= cache-buster to CSS/font assets only (Pages Router) (#92580)
  • 805d758 Turbopack: fix filesystem watcher config not applying follow_symlinks(false) ...
  • 1056fae chore: Bump reqwest to 0.13.2 (#92713)
  • See full diff in compare view

Updates @sentry/react-native from 8.7.0 to 8.8.0

Release notes

Sourced from @​sentry/react-native's releases.

8.8.0

Features

  • Enable "Open Sentry" button in Playground for Expo apps (#5947)
  • Add attachAllThreads option to attach full stack traces for all threads to captured events on iOS (#5960)
  • Add strictTraceContinuation and orgId options for trace continuation validation (#5829)
  • Add deeplinkIntegration for automatic deep link breadcrumbs (#5983)
  • Name navigation spans using dispatched action payload when useDispatchedActionData is enabled (#5982)

Fixes

  • Fix sourcemap upload script failing when withSentry is used programmatically in app.config.ts (#6006)
  • Retry native module resolution to prevent silent event drops in production Hermes builds (#5981)
  • Lazy-load Metro internal modules to prevent Expo 55 import errors (#5958)
  • Fix app start transaction profile offset by using the actual profiling start timestamp instead of the adjusted app start time (#5962)
  • Use React componentStack as fallback when error has no stack trace on Android (#5965)
  • Add SENTRY_PROJECT_ROOT env var to override project root in Xcode build phase scripts for monorepo setups (#5961)

Dependencies

Changelog

Sourced from @​sentry/react-native's changelog.

8.8.0

Features

  • Enable "Open Sentry" button in Playground for Expo apps (#5947)
  • Add attachAllThreads option to attach full stack traces for all threads to captured events on iOS (#5960)
  • Add strictTraceContinuation and orgId options for trace continuation validation (#5829)
  • Add deeplinkIntegration for automatic deep link breadcrumbs (#5983)
  • Name navigation spans using dispatched action payload when useDispatchedActionData is enabled (#5982)

Fixes

  • Fix sourcemap upload script failing when withSentry is used programmatically in app.config.ts (#6006)
  • Retry native module resolution to prevent silent event drops in production Hermes builds (#5981)
  • Lazy-load Metro internal modules to prevent Expo 55 import errors (#5958)
  • Fix app start transaction profile offset by using the actual profiling start timestamp instead of the adjusted app start time (#5962)
  • Use React componentStack as fallback when error has no stack trace on Android (#5965)
  • Add SENTRY_PROJECT_ROOT env var to override project root in Xcode build phase scripts for monorepo setups (#5961)

Dependencies

Commits
  • 738d7db release: 8.8.0
  • 0572a71 fix(core): Fix sourcemap upload when withSentry is used programmatically (#6006)
  • 93704e1 feat(tracing): Implement strict trace continuation (#5829)
  • 5bf96de chore(deps): bump follow-redirects from 1.15.11 to 1.16.0 (#6004)
  • 0d9949d chore: Bump sample app to React Native 0.85.1 (#5991)
  • 15f99d3 chore(deps): Bump E2E tests to 0.85.1 (#5990)
  • 7ac3378 Add deeplinkIntegration for automatic deep link breadcrumbs (#5983)
  • 04207c4 fix(core): Retry native module resolution to prevent silent event drops (#5981)
  • 50f4350 chore(lint): Fix lint issue (#5989)
  • 40fb54e feat(core): Name navigation spans using dispatched action payload (#5982)
  • Additional commits viewable in compare view

Updates @tanstack/react-query from 5.99.0 to 5.99.2

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.99.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.99.2
    • @​tanstack/react-query@​5.99.2

@​tanstack/react-query-next-experimental@​5.99.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.99.2

@​tanstack/react-query-persist-client@​5.99.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-persist-client-core@​5.99.2
    • @​tanstack/react-query@​5.99.2

@​tanstack/react-query@​5.99.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.99.2

@​tanstack/react-query-devtools@​5.99.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.99.1
    • @​tanstack/react-query@​5.99.1

@​tanstack/react-query-next-experimental@​5.99.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.99.1

@​tanstack/react-query-persist-client@​5.99.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-persist-client-core@​5.99.1
    • @​tanstack/react-query@​5.99.1

@​tanstack/react-query@​5.99.1

Patch Changes

  • Updated dependencies []:

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.99.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.99.2

5.99.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.99.1
Commits
  • a3ec7b3 ci: Version Packages (#10520)
  • 69d2757 ci: Version Packages (#10514)
  • 7ffa1ed test({react,preact,solid}-query/useQueries): fix test description from 'useQu...
  • bc83d37 test({react,preact}-query/useMutation): unify destructuring pattern in comple...
  • aad1bd5 test({react,preact}-query/useMutation): add parallel 'mutateAsync' tests with...
  • d7643b5 test({react,preact}-query/useMutation): add optimistic update tests with succ...
  • cd89d6f test({react,preact}-query/useMutation): add conditional handling and retry te...
  • 6e15fe6 test({react,preact}-query/useMutation): add chained 'mutateAsync' tests for s...
  • 792d3a5 test({react,preact}-query/useMutation): add callback tests when 'useMutation'...
  • 1b661b3 test({react,preact}-query/useMutation): add single callback tests for 'mutate...
  • Additional commits viewable in compare view

Updates @tanstack/react-store from 0.10.0 to 0.11.0

Release notes

Sourced from @​tanstack/react-store's releases.

@​tanstack/react-store@​0.11.0

Minor Changes

  • Hooks included in this release: (#306)
    • useAtom
    • useSelector
    • useStore (deprecated, replaced by useSelector)
    • createStoreContext (provides StoreProvider and useStoreContext for context-based consumption)

Patch Changes

  • Updated dependencies [4d87a83]:
    • @​tanstack/store@​0.11.0
Changelog

Sourced from @​tanstack/react-store's changelog.

0.11.0

Minor Changes

  • Hooks included in this release: (#306)
    • useAtom
    • useSelector
    • useStore (deprecated, replaced by useSelector)
    • createStoreContext (provides StoreProvider and useStoreContext for context-based consumption)

Patch Changes

  • Updated dependencies [4d87a83]:
    • @​tanstack/store@​0.11.0
Commits

Updates axios from 1.15.0 to 1.15.1

Release notes

Sourced from axios's releases.

v1.15.1

This release ships a coordinated set of security hardening fixes across headers, body/redirect limits, multipart handling, and XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes, test migrations, and threat-model documentation updates.

🔒 Security Fixes

  • Header Injection Hardening: Tightened validation and sanitisation across request header construction to close the header-injection attack surface. (#10749)
  • CRLF Stripping in Multipart Headers: Correctly strips CR/LF from multipart header values to prevent injection via field names and filenames. (#10758)
  • Prototype Pollution / Auth Bypass: Replaced unsafe in checks with hasOwnProperty to prevent authentication bypass via prototype pollution on config objects, with additional regression tests. (#10761, #10760)
  • withXSRFToken Truthy Bypass: Short-circuits on any truthy non-boolean value, so an ambiguous config no longer silently leaks the XSRF token cross-origin. (#10762)
  • maxBodyLength With Zero Redirects: Enforces maxBodyLength even when maxRedirects is set to 0, closing a bypass path for oversized request bodies. (#10753)
  • Streamed Response maxContentLength Bypass: Applies maxContentLength to streamed responses that previously bypassed the cap. (#10754)
  • Follow-up CVE Completion: Completes an earlier incomplete CVE fix to fully close the regression window. (#10755)

🚀 New Features

  • AI-Based Docs Translations: Initial scaffold for AI-assisted translations of the documentation site. (#10705)
  • Location Request Header Type: Adds Location to CommonRequestHeadersList for accurate typing of redirect-aware requests. (#7528)

🐛 Bug Fixes

  • FormData Handling: Removes Content-Type when no boundary is present on FormData fetch requests, supports multi-select fields, cancels request.body instead of the source stream on fetch abort, and fixes a recursion bug in form-data serialisation. (#7314, #10676, #10702, #10726)
  • HTTP Adapter: Handles socket-only request errors without leaking keep-alive listeners. (#10576)
  • Progress Events: Clamps loaded to total for computable upload/download progress events. (#7458)
  • Types: Aligns runWhen type with the runtime behaviour in InterceptorManager and makes response header keys case-insensitive. (#7529, #10677)
  • buildFullPath: Uses strict equality in the base/relative URL check. (#7252)
  • AxiosURLSearchParams Regex: Improves the regex used for param serialisation to avoid edge-case mismatches. (#10736)
  • Resilient Value Parsing: Parses out header/config values instead of throwing on malformed input. (#10687)
  • Docs Artefact Cleanup: Removes the docs content that was incorrectly committed. (#10727)

🔧 Maintenance & Chores

  • Threat Model & Security Docs: Ongoing refinement of THREATMODEL.md, including Hopper security update, TLS and tag-replay wording, mitigation descriptions, decompression-bomb guidance, and further cleanup. (#10672, #10715, #10718, #10722, #10763, #10765)
  • Test Coverage & Migration: Expanded shouldBypassProxy coverage for wildcard/IPv6/edge cases, documented and tested AxiosError.status, and migrated progressEventReducer tests to Vitest. (#10723, #10725, #10741)
  • Type Refactor: Uses TypeScript utility types to deduplicate literal unions. (#7520)
  • Repo & CI: Adds CODEOWNERS, switches v1.x releases to an ephemeral release branch, and removes orphaned Bower support. (#10739, #10738, #10746)
  • Changelog Backfill: Added missing version entries to the changelog. (#10704)
  • Dependencies: Bumped follow-redirects (1.15.11 → 1.16.0) in root and docs, axios (1.14.0 → 1.15.0) in docs, and a group of 5 development dependencies. (#10717, #10716, #10684, #10709)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog

Changelog

Sourced from axios's changelog.

v1.15.1 — April 19, 2026

This release ships a coordinated set of security hardening fixes across headers, body/redirect limits, multipart handling, and XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes, test migrations, and threat-model documentation updates.

🔒 Security Fixes

  • Header Injection Hardening: Tightened validation and sanitisation across request header construction to close the header-injection attack surface. (#10749)

  • CRLF Stripping in Multipart Headers: Correctly strips CR/LF from multipart header values to prevent injection via field names and filenames. (#10758)

  • Prototype Pollution / Auth Bypass: Replaced unsafe in checks with hasOwnProperty to prevent authentication bypass via prototype pollution on config objects, with additional regression tests. (#10761, #10760)

  • withXSRFToken Truthy Bypass: Short-circuits on any truthy non-boolean value, so an ambiguous config no longer silently leaks the XSRF token cross-origin. (#10762)

  • maxBodyLength With Zero Redirects: Enforces maxBodyLength even when maxRedirects is set to 0, closing a bypass path for oversized request bodies. (#10753)

  • Streamed Response maxContentLength Bypass: Applies maxContentLength to streamed responses that previously bypassed the cap. (#10754)

  • Follow-up CVE Completion: Completes an earlier incomplete CVE fix to fully close the regression window. (#10755)

🚀 New Features

  • AI-Based Docs Translations: Initial scaffold for AI-assisted translations of the documentation site. (#10705)

  • Location Request Header Type: Adds Location to CommonRequestHeadersList for accurate typing of redirect-aware requests. (#7528)

🐛 Bug Fixes

  • FormData Handling: Removes Content-Type when no boundary is present on FormData fetch requests, supports multi-select fields, cancels request.body instead of the source stream on fetch abort, and fixes a recursion bug in form-data serialisation. (#7314, #10676, #10702, #10726)

  • HTTP Adapter: Handles socket-only request errors without leaking keep-alive listeners. (#10576)

  • Progress Events: Clamps loaded to total for computable upload/download progress events. (#7458)

  • Types: Aligns runWhen type with the runtime behaviour in InterceptorManager and makes response header keys case-insensitive. (#7529, #10677)

  • buildFullPath: Uses strict equality in the base/relative URL check. (#7252)

  • AxiosURLSearchParams Regex: Improves the regex used for param serialisation to avoid edge-case mismatches. (#10736)

  • Resilient Value Parsing: Parses out header/config values instead of throwing on malformed input. (#10687)

  • Docs Artefact Cleanup: Removes the docs content that was incorrectly committed. (

@dependabot
chore(deps): bump the production-dependencies group across 1 director…
eb17e40 
…y with 26 updates

Bumps the production-dependencies group with 26 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@sentry/node](https://github.com/getsentry/sentry-javascript) | `10.48.0` | `10.49.0` |
| [effect](https://github.com/Effect-TS/effect/tree/HEAD/packages/effect) | `3.21.0` | `3.21.1` |
| [fumadocs-core](https://github.com/fuma-nama/fumadocs) | `16.7.16` | `16.8.1` |
| [fumadocs-mdx](https://github.com/fuma-nama/fumadocs) | `14.2.14` | `14.3.1` |
| [fumadocs-ui](https://github.com/fuma-nama/fumadocs) | `16.7.16` | `16.8.1` |
| [next](https://github.com/vercel/next.js) | `16.2.3` | `16.2.4` |
| [@sentry/react-native](https://github.com/getsentry/sentry-react-native) | `8.7.0` | `8.8.0` |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.99.0` | `5.99.2` |
| [@tanstack/react-store](https://github.com/TanStack/store/tree/HEAD/packages/react-store) | `0.10.0` | `0.11.0` |
| [axios](https://github.com/axios/axios) | `1.15.0` | `1.15.1` |
| [react-native](https://github.com/facebook/react-native/tree/HEAD/packages/react-native) | `0.85.1` | `0.85.2` |
| [@base-ui/react](https://github.com/mui/base-ui/tree/HEAD/packages/react) | `1.4.0` | `1.4.1` |
| [@sentry/browser](https://github.com/getsentry/sentry-javascript) | `10.48.0` | `10.49.0` |
| [@tanstack/react-query-devtools](https://github.com/TanStack/query/tree/HEAD/packages/react-query-devtools) | `5.99.0` | `5.99.2` |
| [shadcn](https://github.com/shadcn-ui/ui/tree/HEAD/packages/shadcn) | `4.2.0` | `4.3.1` |
| [@opentelemetry/api-logs](https://github.com/open-telemetry/opentelemetry-js) | `0.214.0` | `0.215.0` |
| [@opentelemetry/exporter-logs-otlp-http](https://github.com/open-telemetry/opentelemetry-js) | `0.214.0` | `0.215.0` |
| [@opentelemetry/exporter-metrics-otlp-http](https://github.com/open-telemetry/opentelemetry-js) | `0.214.0` | `0.215.0` |
| [@opentelemetry/exporter-trace-otlp-http](https://github.com/open-telemetry/opentelemetry-js) | `0.214.0` | `0.215.0` |
| [@opentelemetry/resources](https://github.com/open-telemetry/opentelemetry-js) | `2.6.1` | `2.7.0` |
| [@opentelemetry/sdk-logs](https://github.com/open-telemetry/opentelemetry-js) | `0.214.0` | `0.215.0` |
| [@opentelemetry/sdk-metrics](https://github.com/open-telemetry/opentelemetry-js) | `2.6.1` | `2.7.0` |
| [@opentelemetry/sdk-node](https://github.com/open-telemetry/opentelemetry-js) | `0.214.0` | `0.215.0` |
| [@opentelemetry/sdk-trace-base](https://github.com/open-telemetry/opentelemetry-js) | `2.6.1` | `2.7.0` |
| [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1030.0` | `3.1033.0` |
| [@aws-sdk/s3-request-presigner](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/packages/s3-request-presigner) | `3.1030.0` | `3.1033.0` |



Updates `@sentry/node` from 10.48.0 to 10.49.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.48.0...10.49.0)

Updates `effect` from 3.21.0 to 3.21.1
- [Release notes](https://github.com/Effect-TS/effect/releases)
- [Changelog](https://github.com/Effect-TS/effect/blob/main/packages/effect/CHANGELOG.md)
- [Commits](https://github.com/Effect-TS/effect/commits/effect@3.21.1/packages/effect)

Updates `fumadocs-core` from 16.7.16 to 16.8.1
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs-core@16.7.16...fumadocs-core@16.8.1)

Updates `fumadocs-mdx` from 14.2.14 to 14.3.1
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs-mdx@14.2.14...fumadocs-ui@14.3.1)

Updates `fumadocs-ui` from 16.7.16 to 16.8.1
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs-ui@16.7.16...fumadocs-ui@16.8.1)

Updates `next` from 16.2.3 to 16.2.4
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v16.2.3...v16.2.4)

Updates `@sentry/react-native` from 8.7.0 to 8.8.0
- [Release notes](https://github.com/getsentry/sentry-react-native/releases)
- [Changelog](https://github.com/getsentry/sentry-react-native/blob/main/CHANGELOG.md)
- [Commits](getsentry/sentry-react-native@8.7.0...8.8.0)

Updates `@tanstack/react-query` from 5.99.0 to 5.99.2
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.99.2/packages/react-query)

Updates `@tanstack/react-store` from 0.10.0 to 0.11.0
- [Release notes](https://github.com/TanStack/store/releases)
- [Changelog](https://github.com/TanStack/store/blob/main/packages/react-store/CHANGELOG.md)
- [Commits](https://github.com/TanStack/store/commits/@tanstack/react-store@0.11.0/packages/react-store)

Updates `axios` from 1.15.0 to 1.15.1
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.15.0...v1.15.1)

Updates `react-native` from 0.85.1 to 0.85.2
- [Release notes](https://github.com/facebook/react-native/releases)
- [Changelog](https://github.com/facebook/react-native/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react-native/commits/v0.85.2/packages/react-native)

Updates `@base-ui/react` from 1.4.0 to 1.4.1
- [Release notes](https://github.com/mui/base-ui/releases)
- [Changelog](https://github.com/mui/base-ui/blob/master/CHANGELOG.md)
- [Commits](https://github.com/mui/base-ui/commits/v1.4.1/packages/react)

Updates `@sentry/browser` from 10.48.0 to 10.49.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.48.0...10.49.0)

Updates `@tanstack/react-query-devtools` from 5.99.0 to 5.99.2
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query-devtools/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query-devtools@5.99.2/packages/react-query-devtools)

Updates `shadcn` from 4.2.0 to 4.3.1
- [Release notes](https://github.com/shadcn-ui/ui/releases)
- [Changelog](https://github.com/shadcn-ui/ui/blob/main/packages/shadcn/CHANGELOG.md)
- [Commits](https://github.com/shadcn-ui/ui/commits/shadcn@4.3.1/packages/shadcn)

Updates `@opentelemetry/api-logs` from 0.214.0 to 0.215.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@experimental/v0.214.0...experimental/v0.215.0)

Updates `@opentelemetry/exporter-logs-otlp-http` from 0.214.0 to 0.215.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@experimental/v0.214.0...experimental/v0.215.0)

Updates `@opentelemetry/exporter-metrics-otlp-http` from 0.214.0 to 0.215.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@experimental/v0.214.0...experimental/v0.215.0)

Updates `@opentelemetry/exporter-trace-otlp-http` from 0.214.0 to 0.215.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@experimental/v0.214.0...experimental/v0.215.0)

Updates `@opentelemetry/resources` from 2.6.1 to 2.7.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@v2.6.1...v2.7.0)

Updates `@opentelemetry/sdk-logs` from 0.214.0 to 0.215.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@experimental/v0.214.0...experimental/v0.215.0)

Updates `@opentelemetry/sdk-metrics` from 2.6.1 to 2.7.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@v2.6.1...v2.7.0)

Updates `@opentelemetry/sdk-node` from 0.214.0 to 0.215.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@experimental/v0.214.0...experimental/v0.215.0)

Updates `@opentelemetry/sdk-trace-base` from 2.6.1 to 2.7.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@v2.6.1...v2.7.0)

Updates `@aws-sdk/client-s3` from 3.1030.0 to 3.1033.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1033.0/clients/client-s3)

Updates `@aws-sdk/s3-request-presigner` from 3.1030.0 to 3.1033.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/packages/s3-request-presigner/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1033.0/packages/s3-request-presigner)

---
updated-dependencies:
- dependency-name: "@sentry/node"
  dependency-version: 10.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: effect
  dependency-version: 3.21.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: fumadocs-core
  dependency-version: 16.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: fumadocs-mdx
  dependency-version: 14.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: fumadocs-ui
  dependency-version: 16.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: next
  dependency-version: 16.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@sentry/react-native"
  dependency-version: 8.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.99.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@tanstack/react-store"
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: axios
  dependency-version: 1.15.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: react-native
  dependency-version: 0.85.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@base-ui/react"
  dependency-version: 1.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@sentry/browser"
  dependency-version: 10.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@tanstack/react-query-devtools"
  dependency-version: 5.99.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: shadcn
  dependency-version: 4.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@opentelemetry/api-logs"
  dependency-version: 0.215.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@opentelemetry/exporter-logs-otlp-http"
  dependency-version: 0.215.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@opentelemetry/exporter-metrics-otlp-http"
  dependency-version: 0.215.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@opentelemetry/exporter-trace-otlp-http"
  dependency-version: 0.215.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@opentelemetry/resources"
  dependency-version: 2.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@opentelemetry/sdk-logs"
  dependency-version: 0.215.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@opentelemetry/sdk-metrics"
  dependency-version: 2.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@opentelemetry/sdk-node"
  dependency-version: 0.215.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@opentelemetry/sdk-trace-base"
  dependency-version: 2.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@aws-sdk/client-s3"
  dependency-version: 3.1033.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@aws-sdk/s3-request-presigner"
  dependency-version: 3.1033.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 20, 2026
@vercel
Copy link
Copy Markdown

vercel Bot commented Apr 20, 2026 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
tx-agent-kit-docs Ready Ready Preview, Comment Apr 20, 2026 10:56pm

Request Review

@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github Apr 28, 2026

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Apr 28, 2026
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-be3cb0a72f branch April 28, 2026 00:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants