Skip to content

chore(deps): bump the production group across 1 directory with 25 updates#497

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-7520d29564
Open

chore(deps): bump the production group across 1 directory with 25 updates#497
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-7520d29564

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 15, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the production group with 25 updates in the / directory:

Package From To
@iconify-json/lucide 1.2.102 1.2.111
@iconify-json/simple-icons 1.2.77 1.2.86
@takumi-rs/image-response 0.62.8 1.8.3
@takumi-rs/wasm 0.62.8 1.8.3
@tanstack/react-query 5.99.0 5.101.0
@vercel/analytics 1.6.1 2.0.1
@vercel/speed-insights 1.3.1 2.0.0
@wagmi/core 3.4.11 3.5.0
abitype 1.2.3 1.2.4
accounts 0.10.7 0.14.9
ox 0.14.20 0.14.29
posthog-js 1.367.0 1.386.6
posthog-node 5.29.2 5.36.17
react 19.2.6 19.2.7
react-dom 19.2.6 19.2.7
react-server-dom-webpack 19.2.6 19.2.7
sql-formatter 15.7.3 15.8.1
tailwind-merge 3.5.0 3.6.0
tailwindcss 4.2.2 4.3.0
viem 2.48.8 2.52.2
vocs 2.0.10 2.0.12
wagmi 3.6.14 3.6.16
waku 1.0.0-beta.0 1.0.0-beta.3
webauthx 0.1.1 0.1.2
zod 4.3.6 4.4.3

Updates @iconify-json/lucide from 1.2.102 to 1.2.111

Commits

Updates @iconify-json/simple-icons from 1.2.77 to 1.2.86

Commits

Updates @takumi-rs/image-response from 0.62.8 to 1.8.3

Release notes

Sourced from @​takumi-rs/image-response's releases.

@​takumi-rs/image-response@​1.8.3

Patch Changes

  • takumi-js@1.8.3

@​takumi-rs/image-response@​1.8.2

Patch Changes

  • takumi-js@1.8.2

@​takumi-rs/image-response@​1.8.1

Patch Changes

  • Updated dependencies [55b058d]
    • takumi-js@1.8.1

@​takumi-rs/image-response@​1.8.0

Patch Changes

  • takumi-js@1.8.0

@​takumi-rs/image-response@​1.7.0

Patch Changes

  • 45a7f4a: Correct onError example in README
  • Updated dependencies [89a3088]
  • Updated dependencies [56579a2]
  • Updated dependencies [89a3088]
    • takumi-js@1.7.0

@​takumi-rs/image-response@​1.6.0

Patch Changes

  • takumi-js@1.6.0

@​takumi-rs/image-response@​1.5.1

Patch Changes

  • takumi-js@1.5.1

@​takumi-rs/image-response@​1.5.0

Patch Changes

  • takumi-js@1.5.0

@​takumi-rs/image-response@​1.4.1

Patch Changes

  • Updated dependencies [d6936e5]
    • takumi-js@1.4.1

... (truncated)

Commits
  • 3966fb6 Version Packages (#767)
  • bfc6e55 NAPI: fix Windows crash at process exit (#765)
  • 086ec46 Version Packages (#764)
  • 041e5fd Crate: speed up with zlib-rs for png, add +simd128 back (#762)
  • 5cb281f Version Packages (#759)
  • d1ff41f Crate: skip painting zero-sized nodes instead of full-viewport isolation (#760)
  • 55b058d JS: don't load default fonts in managed renderer when custom fonts are provid...
  • bede893 Version Packages (#756)
  • d74268a CI: enable build-std feature optimize_for_size
  • c86552c Crate: avoid inlining the slow pixel blending path
  • Additional commits viewable in compare view

Updates @takumi-rs/wasm from 0.62.8 to 1.8.3

Release notes

Sourced from @​takumi-rs/wasm's releases.

@​takumi-rs/wasm@​1.8.3

Patch Changes

  • @​takumi-rs/helpers@​1.8.3

@​takumi-rs/wasm@​1.8.2

Patch Changes

  • 041e5fd: Fix +simd128 flag being override by CI configuration
    • @​takumi-rs/helpers@​1.8.2

@​takumi-rs/wasm@​1.8.1

Patch Changes

  • 55b058d: Hold renderer state behind a lock so all methods take &self, preventing a panic from permanently breaking the wasm-bindgen borrow flag.
    • @​takumi-rs/helpers@​1.8.1

@​takumi-rs/wasm@​1.8.0

Minor Changes

  • ae2c9aa: Built with nightly Rust toolchain with panic=immediate-abort to reduce binary size

Patch Changes

  • @​takumi-rs/helpers@​1.8.0

@​takumi-rs/wasm@​1.7.0

Patch Changes

  • Updated dependencies [b908a4d]
  • Updated dependencies [4748c22]
  • Updated dependencies [42d0d03]
  • Updated dependencies [80e29da]
    • @​takumi-rs/helpers@​1.7.0

@​takumi-rs/wasm@​1.6.0

Patch Changes

  • @​takumi-rs/helpers@​1.6.0

@​takumi-rs/wasm@​1.5.1

Patch Changes

  • @​takumi-rs/helpers@​1.5.1

@​takumi-rs/wasm@​1.5.0

Patch Changes

  • @​takumi-rs/helpers@​1.5.0

... (truncated)

Commits
  • 3966fb6 Version Packages (#767)
  • bfc6e55 NAPI: fix Windows crash at process exit (#765)
  • 086ec46 Version Packages (#764)
  • 041e5fd Crate: speed up with zlib-rs for png, add +simd128 back (#762)
  • 5cb281f Version Packages (#759)
  • d1ff41f Crate: skip painting zero-sized nodes instead of full-viewport isolation (#760)
  • 55b058d JS: don't load default fonts in managed renderer when custom fonts are provid...
  • bede893 Version Packages (#756)
  • d74268a CI: enable build-std feature optimize_for_size
  • c86552c Crate: avoid inlining the slow pixel blending path
  • Additional commits viewable in compare view

Updates @tanstack/react-query from 5.99.0 to 5.101.0

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.101.0

Patch Changes

@​tanstack/react-query-next-experimental@​5.101.0

Patch Changes

  • #10857 7cf5923 - fix(react-query-next-experimental): replace deprecated 'isServer' with 'environmentManager.isServer()'

  • Updated dependencies []:

    • @​tanstack/react-query@​5.101.0

@​tanstack/react-query-persist-client@​5.101.0

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-persist-client-core@​5.101.0
    • @​tanstack/react-query@​5.101.0

@​tanstack/react-query@​5.101.0

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.101.0

@​tanstack/react-query-devtools@​5.100.14

Patch Changes

  • Updated dependencies [ed20b6d]:
    • @​tanstack/react-query@​5.100.14
    • @​tanstack/query-devtools@​5.100.14

@​tanstack/react-query-next-experimental@​5.100.14

Patch Changes

  • Updated dependencies [ed20b6d]:
    • @​tanstack/react-query@​5.100.14

@​tanstack/react-query-persist-client@​5.100.14

Patch Changes

  • Updated dependencies [ed20b6d]:
    • @​tanstack/react-query@​5.100.14
    • @​tanstack/query-persist-client-core@​5.100.14

@​tanstack/react-query@​5.100.14

Patch Changes

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.101.0

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.101.0

5.100.14

Patch Changes

  • fix(react-query): do not go into optimistic fetching state when not subscribed (#10759)

  • Updated dependencies []:

    • @​tanstack/query-core@​5.100.14

5.100.13

Patch Changes

  • Updated dependencies [d423168]:
    • @​tanstack/query-core@​5.100.13

5.100.12

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.100.12

5.100.11

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.100.11

5.100.10

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.100.10

5.100.9

Patch Changes

  • Updated dependencies [fcee7bd]:
    • @​tanstack/query-core@​5.100.9

... (truncated)

Commits

Updates @vercel/analytics from 1.6.1 to 2.0.1

Release notes

Sourced from @​vercel/analytics's releases.

v2.0.1

What's Changed

New Contributors

Full Changelog: vercel/analytics@v2.0.0...v2.0.1

v2.0.0

What's Changed

Breaking Changes

  • License changed from MPL-2.0 to MIT (#170)
  • Nuxt: introduce module support. If you need to configure it, load injectAnalytics() from @vercel/analytics/nuxt/runtime (#183)

Features

  • feat: load dynamic configuration (#184) — analytics config can now be loaded dynamically

Bug Fixes

  • fix: src and endpoint paths do not work when relative (#186)

Full Changelog: vercel/speed-insights@1.6.1...2.0.0

v2.0.0-canary.1

Canary release for testing 2.0.0 changes

Commits

Updates @vercel/speed-insights from 1.3.1 to 2.0.0

Release notes

Sourced from @​vercel/speed-insights's releases.

v2.0.0

What's Changed

Breaking Changes

  • License changed from Apache-2.0 to MIT (#111)
  • Nuxt: introduce module support (#110). In case you need to configure it, load injectSpeedInsights() from @vercel/speed-insights/nuxt/runtime

Features

  • feat: load dynamic configuration (#112) — speed insights config can now be loaded dynamically

Full Changelog: vercel/speed-insights@1.3.1...2.0.0

v2.0.0-canary.1

Canary release for testing 2.0.0 changes

1.5.0-canary.4

What's Changed

Full Changelog: vercel/speed-insights@1.2.0-canary.3...1.5.0-canary.4

Commits
  • 828d10c chore: bump version to v2.0.0
  • 15cb241 chore: bump version to v2.0.0-canary.1
  • b10a09c feat: load dynamic configuration (#112)
  • c6f4e37 feat(nuxt)!: Add support for injectSpeedInsights() and Nuxt module (#110)
  • See full diff in compare view

Updates @wagmi/core from 3.4.11 to 3.5.0

Release notes

Sourced from @​wagmi/core's releases.

@​wagmi/core@​3.5.0

Minor Changes

  • Added discovered EIP-6963 providers to the connector setup config. (#5128)

@​wagmi/core@​3.4.12

Patch Changes

  • Handled malformed cookie state in cookieToInitialState. (#5116)

  • wagmi/tempo: Renamed Actions.wallet.send to Actions.wallet.transfer and Hooks.wallet.useSend to Hooks.wallet.useTransfer. (#5121)

    Also bumps the accounts peer dependency to ~0.12.

    - await Actions.wallet.send(config, {
-   to: '0x...',
-   token: '0x...',
-   value: '1.5',
- })
+ await Actions.wallet.transfer(config, {
+   amount: '1.5',
+   to: '0x...',
+   token: '0x...',
+ })
    - const send = Hooks.wallet.useSend()
+ const transfer = Hooks.wallet.useTransfer()
Changelog

Sourced from @​wagmi/core's changelog.

3.5.0

Minor Changes

  • Added discovered EIP-6963 providers to the connector setup config. (#5128)

3.4.12

Patch Changes

  • Handled malformed cookie state in cookieToInitialState. (#5116)

  • wagmi/tempo: Renamed Actions.wallet.send to Actions.wallet.transfer and Hooks.wallet.useSend to Hooks.wallet.useTransfer. (#5121)

    Also bumps the accounts peer dependency to ~0.12.

    - await Actions.wallet.send(config, {
-   to: '0x...',
-   token: '0x...',
-   value: '1.5',
- })
+ await Actions.wallet.transfer(config, {
+   amount: '1.5',
+   to: '0x...',
+   token: '0x...',
+ })
    - const send = Hooks.wallet.useSend()
+ const transfer = Hooks.wallet.useTransfer()
Commits

Updates abitype from 1.2.3 to 1.2.4

Release notes

Sourced from abitype's releases.

abitype@1.2.4

Patch Changes

  • Fixed Zod identifier regex to anchor start and end, rejecting invalid identifiers like café, 2g, and hello👋. (#296)
Commits

Updates accounts from 0.10.7 to 0.14.9

Release notes

Sourced from accounts's releases.

accounts@0.14.9

Patch Changes

  • e15e2a4: Added mobileWebAuth() and tempoWalletMobileWebAuth() adapters, also available from accounts/mobileWebAuth as mobileWebAuth and tempoWallet.

    Added accounts/react-native/expo-web-browser.

    Added ProviderRequest.parse().

    Renamed accounts/react-native/secure-storage to accounts/react-native/expo-secure-store.

    Removed the reactNative() adapter.

accounts@0.14.8

Patch Changes

  • d0d3cea: Added OIDC identity-token support for verified email extraction.

accounts@0.14.7

Patch Changes

  • 8a9564b: Persist CLI access keys in filesystem-backed provider storage.

  • edab403: Allow Provider.create({ authorizeAccessKey }) to return undefined to skip access-key authorization for the current wallet_connect.

  • df1615e: Persist access keys through provider storage.

  • 1478791: Add provider-owned RPC action handling for adapters that expose a viem account with getAccount.

    Adapters can now implement getAccount and optional generateAccessKey instead of duplicating transaction, signing, and access-key RPC actions.

  • ad48834: Allowed the React Native adapter to connect without requesting an access key.

  • 648df76: Make accounts/react-native adapter-only and move React Native storage adapters behind explicit subpaths.

  • 694e022: Added a React Privy adapter at accounts/react/privy, backed Privy Ethereum signing with secp256k1_sign, and stopped exporting the lower-level Core JS Privy adapter from the root package entrypoint.

  • b1a3a69: Added ability to batch key authorization + server auth into one digest.

  • 18052eb: Added opt-in identity.email request capability to wallet_connect.

accounts@0.14.6

Patch Changes

  • 89a107f: Fixed getAccounts to respect signable.

accounts@0.14.5

Patch Changes

  • a33ed22: Added a strict option to Remote.validateSearch to let trusted wallet routes defer access-key policy validation.

... (truncated)

Changelog

Sourced from accounts's changelog.

0.14.9

Patch Changes

  • e15e2a4: Added mobileWebAuth() and tempoWalletMobileWebAuth() adapters, also available from accounts/mobileWebAuth as mobileWebAuth and tempoWallet.

    Added accounts/react-native/expo-web-browser.

    Added ProviderRequest.parse().

    Renamed accounts/react-native/secure-storage to accounts/react-native/expo-secure-store.

    Removed the reactNative() adapter.

0.14.8

Patch Changes

  • d0d3cea: Added OIDC identity-token support for verified email extraction.

0.14.7

Patch Changes

  • 8a9564b: Persist CLI access keys in filesystem-backed provider storage.

  • edab403: Allow Provider.create({ authorizeAccessKey }) to return undefined to skip access-key authorization for the current wallet_connect.

  • df1615e: Persist access keys through provider storage.

  • 1478791: Add provider-owned RPC action handling for adapters that expose a viem account with getAccount.

    Adapters can now implement getAccount and optional generateAccessKey instead of duplicating transaction, signing, and access-key RPC actions.

  • ad48834: Allowed the React Native adapter to connect without requesting an access key.

  • 648df76: Make accounts/react-native adapter-only and move React Native storage adapters behind explicit subpaths.

  • 694e022: Added a React Privy adapter at accounts/react/privy, backed Privy Ethereum signing with secp256k1_sign, and stopped exporting the lower-level Core JS Privy adapter from the root package entrypoint.

  • b1a3a69: Added ability to batch key authorization + server auth into one digest.

  • 18052eb: Added opt-in identity.email request capability to wallet_connect.

0.14.6

Patch Changes

  • 89a107f: Fixed getAccounts to respect signable.

0.14.5

Patch Changes

  • a33ed22: Added a strict option to Remote.validateSearch to let trusted wallet routes defer access-key policy validation.
  • b6fb206: Added showDeposit support to wallet_authorizeAccessKey requests.

... (truncated)

Commits

Updates ox from 0.14.20 to 0.14.29

Release notes

Sourced from ox's releases.

ox@0.14.29

Patch Changes

  • #268 ed93945 Thanks @​jxom! - viem/tempo: Added genesisConfig shorthand to TIP-1061 multisig helpers and renamed configId → genesisConfigId on the typed SignatureEnvelope.Multisig.

ox@0.14.28

Patch Changes

  • #265 f5328d2 Thanks @​jxom! - viem/tempo: Added support for TIP-1061 native multisig accounts.

ox@0.14.27

Patch Changes

  • #263 451a442 Thanks @​jxom! - ox/tempo: Added the ReceivePolicyReceipt module for encoding/decoding TIP-1028 receive-policy claim receipts (ClaimReceiptV1 witnesses) with decode, encode, from, fromLog, and fromTransactionReceipt (returns one receipt per TransferBlocked log).

ox@0.14.26

Patch Changes

  • #262 b1ac8c8 Thanks @​jxom! - ox/tempo: Added support for TIP-1049 (admin access keys) via optional isAdmin and account fields on KeyAuthorization that bind into the signing hash.

  • #260 581ccee Thanks @​jxom! - ox/tempo: Added support for TIP-1053 (witnesses in key authorizations) via an optional 32-byte witness field on KeyAuthorization that is included in the signing hash.

ox@0.14.25

Patch Changes

  • #256 ad7610b Thanks @​jxom! - Renamed ChannelDescriptor.from to Channel.from, made Channel.Channel the descriptor type, and changed Channel.computeId to receive channel and options separately.

ox@0.14.24

Patch Changes

  • #254 d837628 Thanks @​jxom! - Added ChannelDescriptor.from for normalizing TIP-20 channel reserve descriptors.

ox@0.14.23

Patch Changes

  • #252 19cd833 Thanks @​jxom! - Added TIP-20 channel reserve constants, channel id computation, and voucher signing helpers.

ox@0.14.22

Patch Changes

  • #227 ffa64c0 Thanks @​Genmin! - Fixed Secp256k1.verify narrowing signature branches before address recovery.

ox@0.14.21

Patch Changes

  • #246 32cf459 Thanks @​0xrusowsky! - Added TxEnvelopeTempo.encodeForSigning to expose the raw Tempo sender-signing preimage bytes.

  • #248 e0474e9 Thanks @​jxom! - Added blockTimestamp support to transaction RPC conversions.

Commits
  • 58ca601 chore: version packages (#269)
  • ed93945 feat(tempo): add genesisConfig shorthand to multisig helpers (#268)
  • ad3330f chore: version packages (#267)
  • 4b3fe3e chore: version packages (#266)
  • ef64a52 ci(tempo): use edge image (tracks main) instead of latest
  • b8a0714 test(tempo): skip TIP-1049 admin e2e until tempo release ships PR #4265
  • f5328d2 feat(tempo): native multisig (#265)
  • ae54345 ci: bump vitest hookTimeout to 60s for tempo localnet cold start
  • 7bb96ea chore: version packages (#264)
  • 451a442 feat(tempo): add ReceivePolicyReceipt module for TIP-1028 claim receipts (#263)
  • Additional commits viewable in compare view

Updates posthog-js from 1.367.0 to 1.386.6

Release notes

Sourced from posthog-js's releases.

posthog-js@1.386.6

1.386.6

Patch Changes

  • #3804 a27b163 Thanks @​pauldambra! - fix(product-tours): drop the cached tours blob when product tours is not enabled

    Tours fetched while product tours was enabled are cached under ph_product_tours in the main persistence blob. Once product tours is disabled (remote config or the disable_product_tours option) that cache was never cleaned up, so a potentially large stale blob kept riding on every persistence write — and on every cross-tab storage event those writes broadcast. onRemoteConfig now clears the cached tours whenever product tours resolves to disabled; they are re-fetched if it is ever re-enabled. (2026-06-11)

posthog-js@1.386.5

1.386.5

Patch Changes

  • #3801 bd06ac7 Thanks @​ksvat! - fix(replay): prevent silent recorder teardown on session-id rotation. When the session id rotates during active rrweb capture, _updateWindowAndSessionIds calls stop() then synchronously start('session_id_changed'). If stop() took the _stopAfterCompressionQueueDrains path (which fires whenever the compression queue is non-empty — common during steady recording), its async cleanup would later resolve and call _teardown() against the freshly-started recorder, stopping rrweb, removing event listeners, and emptying the V2 trigger-group matchers. From that point on, the recorder's status getter kept reporting active/sampled (the _strategy reference was still set), but rrweb was no longer producing events, no listeners were registered, and no $snapshot data reached the server — the session looked recording-eligible from event metadata yet produced no replay. start() now invalidates the compression-queue state (generation bump plus reset of the stop-in-progress flag and queued-event count), so any pending cleanup from a prior stop() bails at its existing generation check and a later stop() of the new recorder is not mistaken for the old in-progress one. Affects long-running tabs that rotate session id mid-use (idle timeout, session-past-max-length, or posthog.reset()). (2026-06-11)

posthog-js@1.386.4

1.386.4

Patch Changes

  • #3767 fdc07f3 Thanks @​arnohillen! - replay: jump scrolls instantly when seeking past pages that use scroll-behavior: smooth. During fast-forward the replayer applied scrolls with behavior: 'auto', which inherits the page's CSS scroll-behavior — so on sites that set scroll-behavior: smooth (e.g. Silk bottom sheets/modals) a seeked scroll animated from 0 instead of jumping, leaving scroll-revealed content (the open sheet) out of view and showing only the backdrop until the animation caught up. Sync scrolls now use behavior: 'instant', matching the method's stated intent that smooth scrolling be disabled while fast-forwarding. Full snapshot rebuilds apply their initial offset with behavior: 'instant' too, so the document-level scroll doesn't animate either. (2026-06-11)

posthog-js@1.386.3

1.386.3

Patch Changes

  • #3760 5ddfd44 Thanks @​benben! - fix(conversations): re-attach the support widget after SPA navigations that replace document.body (e.g. Turbo Drive), so the widget no longer disappears until a full page reload (2026-06-11)

  • #3690 dbf2377 Thanks @​pauldambra! - fix(sessionid): keep the session id stable across tabs

    A session now rotates only when every tab has been idle past the timeout, rather than whenever a single background tab decides it is idle. On the active event path an idle tab re-reads the session id from storage before rotating: if a sibling tab kept the session alive it does not rotate, and if a sibling already rotated it adopts that id instead of minting a new one. This removes spurious cross-tab session fragmentation (inflated session counts, truncated session durations, split replays). When a sibling session is adopted, onSessionId handlers fire with changeReason.crossTabAdoption: true so session recording, pageview state, and session-scoped properties follow the new session. When persistence_save_debounce_ms > 0 (the 2026-05-30 default) the refresh reads only the session-id key so it cannot clobber a sibling's write.

    Note: projects with significant multi-tab usage will see fewer but longer sessions after upgrading — this is a correction of previously over-counted sessions, not a traffic change. (2026-06-11)

  • #3795 21441a8 Thanks @​pauldambra! - fix(persistence): stop per-request metadata rewriting the split-storage entries on every load

    $feature_flag_evaluated_at, $feature_flag_request_id, and $surveys_loaded_at change on every /flags (or /surveys) load even when the flag and survey content is unchanged. With split_storage enabled that made the multi-hundred-KB __flags / __surveys localStorage entries dirty on every SPA navigation, re-broadcasting the full payload to every open same-origin tab via cross-tab storage events — the exact pressure the split exists to remove. These keys are now marked volatile: a value-only change neither dirties the group nor alters its fingerprint, so the write is skipped and the freshest value rides along on the next real content write. Adding or deleting a volatile key still writes through (presence is fingerprinted, the moving value is not), and the in-memory value is always current — only the on-disk copy may lag until the next content change. (2026-06-11)

  • Updated dependencies [dbf2377]:

    • @​posthog/types@​1.386.3
    • @​posthog/core@​1.32.3

posthog-js@1.386.2

1.386.2

... (truncated)

Commits
  • 9a4a324 chore: update versions and lockfile [version bump]
  • a27b163 fix(product-tours): drop the cached tours blob when product tours is not enab...
  • 9be4b68 chore: make release version bump tolerate stale main (#3792)
  • b817275 chore: update versions and lockfile [version bump]
  • bd06ac7 fix(replay): prevent silent recorder teardown on session-id rotation (#3801)
  • 669436d docs: improve API reference documentation (#3724)
  • ff75aa0 chore: update versions and lockfile [version bump]
  • b732ecb feat(mcp): add server-agnostic PostHog MCP Analytics capture API (#3781)
  • a4b00a7 chore: update versions and lockfile [version bump]
  • 7d441cb docs: clarify posthog-js CDN release flow (#3805)
  • Additional commits viewable in compare view

Updates posthog-node from 5.29.2 to 5.36.17

Release notes

Sourced from posthog-node's releases.

posthog-node@5.36.17

5.36.17

Patch Changes

  • Updated dependencies []:
    • @​posthog/core@​1.32.3

posthog-node@5.36.16

5.36.16

Patch Changes

  • Updated dependencies [25822ac]:
    • @​posthog/core@​1.32.2

posthog-node@5.36.9

5.36.9

Patch Changes

  • Updated dependencies [0c2acb9]:
    • @​posthog/core@​1.31.0
Changelog

Sourced from posthog-node's changelog.

5.36.17

Patch Changes

  • Updated dependencies []:
    • @​posthog/core@​1.32.3

5.36.16

Patch Changes

  • Updated dependencies [25822ac]:
    • @​posthog/core@​1.32.2

5.36.15

Patch Changes

  • Updated dependencies []:
    • @​posthog/core@​1.32.1

5.36.14

Patch Changes

  • Updated dependencies [612f97a]:
    • @​posthog/core@​1.32.0

5.36.13

Patch Changes

  • Updated dependencies []:
    • @​posthog/core@​1.31.4

5.36.12

Patch Changes

  • Updated dependencies []:
    • @​posthog/core@​1.31.3

5.36.11

Patch Changes

  • Updated dependencies []:
    • @​posthog/core@​1.31.2

5.36.10

... (truncated)

Commits
  • c7abf85 chore: update versions and lockfile [version bump]
  • 5fe3bd4 chore: update versions and lockfile [version bump]
  • defbc62 chore: update versions and lockfile [version bump]

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 15, 2026
@vercel

vercel Bot commented Jun 15, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
tempo-docs Ready Ready Preview, Comment Jun 19, 2026 1:12pm

Request Review

@socket-security

socket-security Bot commented Jun 15, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Added@​takumi-rs/​wasm@​1.8.3881007396100
Added@​iconify-json/​simple-icons@​1.2.861001007795100
Addedwebauthx@​0.1.27710010090100
Addedposthog-node@​5.36.179610078100100
Addedreact-server-dom-webpack@​19.2.71001007996100
Updatedaccounts@​0.10.7 ⏵ 0.14.97910099 +199 +2100
Added@​types/​react@​19.2.171001007995100
Addedwagmi@​3.6.16801007996100
Added@​iconify-json/​lucide@​1.2.1111001007995100
Addedposthog-js@​1.386.68710082100100
Added@​vercel/​analytics@​2.0.1991008387100
Addedreact@​19.2.71001008497100
Added@​takumi-rs/​image-response@​1.8.3851009996100
Addedwaku@​1.0.0-beta.38510010096100
Addedtailwind-merge@​3.6.01001008696100
Added@​vercel/​speed-insights@​2.0.0991008786100
Added@​tanstack/​react-query@​5.101.0991008898100
Addedabitype@​1.2.410010010088100
Addedvocs@​2.0.12901008896100
Addedreact-dom@​19.2.71001009298100
Addedsql-formatter@​15.8.110010010093100
Addedviem@​2.52.29710010096100
Addedox@​0.14.29991009997100

View full report

@socket-security

socket-security Bot commented Jun 15, 2026 •
edited
Loading

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm @takumi-rs/wasm is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package.json → npm/@takumi-rs/wasm@1.8.3

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@takumi-rs/wasm@1.8.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm js-yaml is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yaml → npm/unplugin-icons@23.0.1 → npm/vocs@2.0.12 → npm/js-yaml@4.2.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/js-yaml@4.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm posthog-js is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package.json → npm/posthog-js@1.386.6

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/posthog-js@1.386.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm preact is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yaml → npm/posthog-js@1.386.6 → npm/preact@10.29.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/preact@10.29.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@dependabot
chore(deps): bump the production group across 1 directory with 25 upd…
d25cd71 
…ates

Bumps the production group with 25 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@iconify-json/lucide](https://github.com/iconify/icon-sets) | `1.2.102` | `1.2.111` |
| [@iconify-json/simple-icons](https://github.com/iconify/icon-sets) | `1.2.77` | `1.2.86` |
| [@takumi-rs/image-response](https://github.com/kane50613/takumi) | `0.62.8` | `1.8.3` |
| [@takumi-rs/wasm](https://github.com/kane50613/takumi) | `0.62.8` | `1.8.3` |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.99.0` | `5.101.0` |
| [@vercel/analytics](https://github.com/vercel/analytics/tree/HEAD/packages/web) | `1.6.1` | `2.0.1` |
| [@vercel/speed-insights](https://github.com/vercel/speed-insights/tree/HEAD/packages/web) | `1.3.1` | `2.0.0` |
| [@wagmi/core](https://github.com/wevm/wagmi/tree/HEAD/packages/core) | `3.4.11` | `3.5.0` |
| [abitype](https://github.com/wevm/abitype) | `1.2.3` | `1.2.4` |
| [accounts](https://github.com/tempoxyz/accounts) | `0.10.7` | `0.14.9` |
| [ox](https://github.com/wevm/ox) | `0.14.20` | `0.14.29` |
| [posthog-js](https://github.com/PostHog/posthog-js) | `1.367.0` | `1.386.6` |
| [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.29.2` | `5.36.17` |
| [react](https://github.com/facebook/react/tree/HEAD/packages/react) | `19.2.6` | `19.2.7` |
| [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) | `19.2.6` | `19.2.7` |
| [react-server-dom-webpack](https://github.com/facebook/react/tree/HEAD/packages/react-server-dom-webpack) | `19.2.6` | `19.2.7` |
| [sql-formatter](https://github.com/sql-formatter-org/sql-formatter) | `15.7.3` | `15.8.1` |
| [tailwind-merge](https://github.com/dcastil/tailwind-merge) | `3.5.0` | `3.6.0` |
| [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.2.2` | `4.3.0` |
| [viem](https://github.com/wevm/viem) | `2.48.8` | `2.52.2` |
| [vocs](https://github.com/wevm/vocs) | `2.0.10` | `2.0.12` |
| [wagmi](https://github.com/wevm/wagmi/tree/HEAD/packages/react) | `3.6.14` | `3.6.16` |
| [waku](https://github.com/wakujs/waku/tree/HEAD/packages/waku) | `1.0.0-beta.0` | `1.0.0-beta.3` |
| [webauthx](https://github.com/wevm/webauthx) | `0.1.1` | `0.1.2` |
| [zod](https://github.com/colinhacks/zod) | `4.3.6` | `4.4.3` |



Updates `@iconify-json/lucide` from 1.2.102 to 1.2.111
- [Commits](https://github.com/iconify/icon-sets/commits)

Updates `@iconify-json/simple-icons` from 1.2.77 to 1.2.86
- [Commits](https://github.com/iconify/icon-sets/commits)

Updates `@takumi-rs/image-response` from 0.62.8 to 1.8.3
- [Release notes](https://github.com/kane50613/takumi/releases)
- [Commits](https://github.com/kane50613/takumi/compare/@takumi-rs/image-response@0.62.8...@takumi-rs/image-response@1.8.3)

Updates `@takumi-rs/wasm` from 0.62.8 to 1.8.3
- [Release notes](https://github.com/kane50613/takumi/releases)
- [Commits](https://github.com/kane50613/takumi/compare/@takumi-rs/wasm@0.62.8...@takumi-rs/wasm@1.8.3)

Updates `@tanstack/react-query` from 5.99.0 to 5.101.0
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.101.0/packages/react-query)

Updates `@vercel/analytics` from 1.6.1 to 2.0.1
- [Release notes](https://github.com/vercel/analytics/releases)
- [Commits](https://github.com/vercel/analytics/commits/v2.0.1/packages/web)

Updates `@vercel/speed-insights` from 1.3.1 to 2.0.0
- [Release notes](https://github.com/vercel/speed-insights/releases)
- [Commits](https://github.com/vercel/speed-insights/commits/v2.0.0/packages/web)

Updates `@wagmi/core` from 3.4.11 to 3.5.0
- [Release notes](https://github.com/wevm/wagmi/releases)
- [Changelog](https://github.com/wevm/wagmi/blob/main/packages/core/CHANGELOG.md)
- [Commits](https://github.com/wevm/wagmi/commits/@wagmi/core@3.5.0/packages/core)

Updates `abitype` from 1.2.3 to 1.2.4
- [Release notes](https://github.com/wevm/abitype/releases)
- [Commits](https://github.com/wevm/abitype/compare/abitype@1.2.3...abitype@1.2.4)

Updates `accounts` from 0.10.7 to 0.14.9
- [Release notes](https://github.com/tempoxyz/accounts/releases)
- [Changelog](https://github.com/tempoxyz/accounts/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tempoxyz/accounts/compare/accounts@0.10.7...accounts@0.14.9)

Updates `ox` from 0.14.20 to 0.14.29
- [Release notes](https://github.com/wevm/ox/releases)
- [Commits](https://github.com/wevm/ox/compare/ox@0.14.20...ox@0.14.29)

Updates `posthog-js` from 1.367.0 to 1.386.6
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.367.0...posthog-js@1.386.6)

Updates `posthog-node` from 5.29.2 to 5.36.17
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.36.17/packages/node)

Updates `react` from 19.2.6 to 19.2.7
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react)

Updates `react-dom` from 19.2.6 to 19.2.7
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react-dom)

Updates `react-server-dom-webpack` from 19.2.6 to 19.2.7
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react-server-dom-webpack)

Updates `sql-formatter` from 15.7.3 to 15.8.1
- [Release notes](https://github.com/sql-formatter-org/sql-formatter/releases)
- [Commits](sql-formatter-org/sql-formatter@v15.7.3...v15.8.1)

Updates `tailwind-merge` from 3.5.0 to 3.6.0
- [Release notes](https://github.com/dcastil/tailwind-merge/releases)
- [Commits](dcastil/tailwind-merge@v3.5.0...v3.6.0)

Updates `tailwindcss` from 4.2.2 to 4.3.0
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.0/packages/tailwindcss)

Updates `viem` from 2.48.8 to 2.52.2
- [Release notes](https://github.com/wevm/viem/releases)
- [Commits](https://github.com/wevm/viem/compare/viem@2.48.8...viem@2.52.2)

Updates `vocs` from 2.0.10 to 2.0.12
- [Release notes](https://github.com/wevm/vocs/releases)
- [Changelog](https://github.com/wevm/vocs/blob/main/CHANGELOG.md)
- [Commits](https://github.com/wevm/vocs/compare/vocs@2.0.10...vocs@2.0.12)

Updates `wagmi` from 3.6.14 to 3.6.16
- [Release notes](https://github.com/wevm/wagmi/releases)
- [Changelog](https://github.com/wevm/wagmi/blob/main/packages/react/CHANGELOG.md)
- [Commits](https://github.com/wevm/wagmi/commits/wagmi@3.6.16/packages/react)

Updates `waku` from 1.0.0-beta.0 to 1.0.0-beta.3
- [Release notes](https://github.com/wakujs/waku/releases)
- [Changelog](https://github.com/wakujs/waku/blob/main/CHANGELOG.md)
- [Commits](https://github.com/wakujs/waku/commits/v1.0.0-beta.3/packages/waku)

Updates `webauthx` from 0.1.1 to 0.1.2
- [Release notes](https://github.com/wevm/webauthx/releases)
- [Changelog](https://github.com/wevm/webauthx/blob/main/CHANGELOG.md)
- [Commits](https://github.com/wevm/webauthx/compare/webauthx@0.1.1...webauthx@0.1.2)

Updates `zod` from 4.3.6 to 4.4.3
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.3.6...v4.4.3)

---
updated-dependencies:
- dependency-name: "@iconify-json/lucide"
  dependency-version: 1.2.111
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: "@iconify-json/simple-icons"
  dependency-version: 1.2.86
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: "@takumi-rs/image-response"
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production
- dependency-name: "@takumi-rs/wasm"
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.101.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: "@vercel/analytics"
  dependency-version: 2.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production
- dependency-name: "@vercel/speed-insights"
  dependency-version: 2.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production
- dependency-name: "@wagmi/core"
  dependency-version: 3.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: abitype
  dependency-version: 1.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: accounts
  dependency-version: 0.14.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: ox
  dependency-version: 0.14.29
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: posthog-js
  dependency-version: 1.382.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: posthog-node
  dependency-version: 5.36.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: react
  dependency-version: 19.2.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: react-dom
  dependency-version: 19.2.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: react-server-dom-webpack
  dependency-version: 19.2.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: sql-formatter
  dependency-version: 15.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: tailwind-merge
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: tailwindcss
  dependency-version: 4.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: viem
  dependency-version: 2.52.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: vocs
  dependency-version: 2.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: wagmi
  dependency-version: 3.6.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: waku
  dependency-version: 1.0.0-beta.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: webauthx
  dependency-version: 0.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: zod
  dependency-version: 4.4.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/production-7520d29564 branch from af0dd20 to d25cd71 Compare June 19, 2026 13:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants