chore(deps)(deps): bump the bun-minor-and-patch group across 1 directory with 16 updates by dependabot[bot] · Pull Request #1203 · ChronoAIProject/Ornn

dependabot · 2026-07-07T10:41:34Z

Bumps the bun-minor-and-patch group with 15 updates in the / directory:

Package	From	To
eslint	`10.2.0`	`10.6.0`
typescript-eslint	`8.62.0`	`8.63.0`
hono	`4.12.27`	`4.12.28`
posthog-node	`5.38.6`	`5.39.4`
@xyflow/react	`12.11.1`	`12.11.2`
framer-motion	`12.42.0`	`12.42.2`
i18next	`26.3.3`	`26.3.4`
posthog-js	`1.395.0`	`1.398.0`
react-hook-form	`7.80.0`	`7.81.0`
react-router-dom	`7.18.0`	`7.18.1`
recharts	`3.9.0`	`3.9.2`
@tailwindcss/vite	`4.3.1`	`4.3.2`
@vitest/coverage-v8	`4.1.9`	`4.1.10`
vite	`8.1.0`	`8.1.3`
vitest	`4.1.9`	`4.1.10`

Updates eslint from 10.2.0 to 10.6.0

Release notes

Sourced from eslint's releases.

v10.6.0

Features

b1f9106 feat: detect Symbol() and BigInt() in no-constant-binary-expression (#20981) (Taejin Kim)

f291007 feat: add checkRelationalComparisons to no-constant-binary-expression (#20948) (sethamus)

Bug Fixes

6b05784 fix: prefer-exponentiation-operator invalid autofix at statement start (#20997) (Milos Djermanovic)

bb9eb2a fix: account for shadowed Boolean in no-extra-boolean-cast (#21013) (den$)

8fd8741 fix: don't report shadowed undefined in radix rule (#21011) (Pixel)

5784980 fix: don't report shadowed undefined in no-throw-literal (#21010) (Pixel)

9cd1e6d fix: suppress invalid class suggestion in no-promise-executor-return (#21008) (Pixel)

d4eb2dc fix: don't report shadowed undefined in prefer-promise-reject-errors (#21006) (Pixel)

2360464 fix: prefer-promise-reject-errors false positives for shadowed Promise (#21003) (den$)

63d52d2 fix: restore max-classes-per-file report range (#21002) (Pixel)

7feaff0 fix: callback detection logic for IIFEs in max-nested-callbacks (#20979) (fnx)

399a2ec fix: don't report inner non-callbacks in max-nested-callbacks (#20995) (Milos Djermanovic)

Documentation

a83683d docs: Update README (GitHub Actions Bot)

f5449f9 docs: document userland patterns for global assertionOptions in RuleT… (#20986) (playgirl)

bea49f7 docs: Update README (GitHub Actions Bot)

e5f70f9 docs: update code-path diagrams (#20984) (Tanuj Kanti)

8890c2d docs: add TypeScript config guidance for MCP server (#20796) (Pierluigi Lenoci)

3eb3d9b docs: Update README (GitHub Actions Bot)

c5bb59c docs: Update README (GitHub Actions Bot)

eb3c97c docs: fix grammar in prefer-const rule description (#20983) (lumir)

Chores

6a42034 ci: run ecosystem tests on main branch (#20891) (sethamus)

3dbacdb ci: bump actions/checkout from 6 to 7 (#21014) (dependabot[bot])

c3abfca chore: correct JSDoc param types in html formatter (#21018) (Minseon Kim)

a832320 ci: split ecosystem tests into separate jobs (#21001) (xbinaryx)

27166e7 chore: update ecosystem plugins (#21005) (ESLint Bot)

865d76e ci: bump pnpm/action-setup from 6.0.8 to 6.0.9 (#20989) (dependabot[bot])

27a88c9 chore: update dependency markdown-it to v14 in root (#20994) (Milos Djermanovic)

970cea6 chore: update dependency markdown-it to v14 (#20993) (Milos Djermanovic)

b482120 chore: update dependency prettier to v3.8.4 (#20990) (renovate[bot])

6993fb3 chore: update ecosystem plugins (#20985) (ESLint Bot)

v10.5.0

Features

5ca8c52 feat: correct stack tracking in max-nested-callbacks (#20973) (Pixel998)

b565783 feat: report no-with violations at the with keyword (#20971) (Pixel998)

2ce032f feat: report max-lines-per-function violations at function head (#20966) (Pixel998)

732cb3e feat: report max-nested-callbacks violations at function head (#20967) (Pixel998)

f9c138a feat: report max-depth violations on keywords (#20943) (Pixel998)

bdb496c feat: correct max-depth handling for else-if chains (#20944) (Pixel998)

c296873 feat: update error loc in max-statements to function header (#20907) (Taejin Kim)

Documentation

... (truncated)

Commits

5d12a04 10.6.0
f7ca54b Build: changelog update for 10.6.0
6a42034 ci: run ecosystem tests on main branch (#20891)
b1f9106 feat: detect Symbol() and BigInt() in no-constant-binary-expression (#20981)
3dbacdb ci: bump actions/checkout from 6 to 7 (#21014)
c3abfca chore: correct JSDoc param types in html formatter (#21018)
a83683d docs: Update README
a832320 ci: split ecosystem tests into separate jobs (#21001)
6b05784 fix: prefer-exponentiation-operator invalid autofix at statement start (#20997)
bb9eb2a fix: account for shadowed Boolean in no-extra-boolean-cast (#21013)
Additional commits viewable in compare view

Updates typescript-eslint from 8.62.0 to 8.63.0

Release notes

Sourced from typescript-eslint's releases.

v8.63.0

8.63.0 (2026-07-06)

🚀 Features

eslint-plugin: [no-misused-promises] detect async usage of a sync dispose usage (#12426)

🩹 Fixes

eslint-plugin: [method-signature-style] suggest converting readonly function properties instead of emitting invalid syntax (#12447, #12446)

eslint-plugin: [no-unnecessary-type-assertion] handle optional-chained calls to overloaded functions (#12491, #12485)

eslint-plugin: [no-base-to-string] don't flag a shadowed String() call (#12492)

scope-manager: export ClassStaticBlockScope (#12460)

❤️ Thank You

Evyatar Daud @StyleShit

Kristjan @KristjanTammekivi

Michael Naumov @mnaoumov

Serhii Leniv @Serhii-Leniv

송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.62.1

8.62.1 (2026-06-29)

🩹 Fixes

eslint-plugin: [prefer-optional-chain] use suggestion instead of autofix for trailing binary operator (#12328)

eslint-plugin: [no-unnecessary-boolean-literal-compare] preserve boolean result in fixer for nullable true comparisons (#12365)

eslint-plugin: [no-unnecessary-type-assertion] parenthesize object literal at left edge of expression statement (#12443, #12418)

❤️ Thank You

Kirk Waiblinger @kirkwaiblinger

mdm317

Patrick Aleite

송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.63.0 (2026-07-06)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.62.1 (2026-06-29)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

290cf6c chore(release): publish 8.63.0
3ea32f4 chore(release): publish 8.62.1
See full diff in compare view

Updates hono from 4.12.27 to 4.12.28

Release notes

Sourced from hono's releases.

v4.12.28

What's Changed

fix(serve-static): treat empty string content as found by @yusukebe in honojs/hono#5062

docs(MIGRATION): fix req.raw.headers reference (property, not method) by @EduardF1 in honojs/hono#5047

chore: don't publish *.tsbuildinfo by @yusukebe in honojs/hono#5066

fix(utils/body,validator): normalize Content-Type media type for case-insensitive matching by @yusukebe in honojs/hono#5067

fix: avoid circular dependency between body.ts and request.ts by @usualoma in honojs/hono#5071

fix(bun): report the requested subprotocol on WSContext.protocol by @greymoth-jp in honojs/hono#5059

chore: bump devDependencies by @yusukebe in honojs/hono#5085

fix(aws-lambda): detect V2 events by request context, not rawPath alone by @VihaanAgarwal in honojs/hono#5033

docs(context-storage): fix JSDoc by @yusukebe in honojs/hono#5086

New Contributors

@EduardF1 made their first contribution in honojs/hono#5047

@greymoth-jp made their first contribution in honojs/hono#5059

@VihaanAgarwal made their first contribution in honojs/hono#5033

Full Changelog: honojs/hono@v4.12.27...v4.12.28

Commits

626b185 4.12.28
d6b1d32 docs(context-storage): fix JSDoc (#5086)
45b081b fix(aws-lambda): detect V2 events by request context, not rawPath alone (#5033)
a05813c chore: bump devDependencies (#5085)
872997d fix(bun): report the requested subprotocol on WSContext.protocol (#5059)
82b321b fix: avoid circular dependency between body.ts and request.ts (#5071)
b20d422 fix(utils/body,validator): normalize Content-Type media type for case-insensi...
9728702 chore: don't publish *.tsbuildinfo (#5066)
ed8795e docs(MIGRATION): fix req.raw.headers reference (property, not method) (#5047)
03a9416 fix(serve-static): treat empty string content as found (#5062)
See full diff in compare view

Updates posthog-node from 5.38.6 to 5.39.4

Release notes

Sourced from posthog-node's releases.

posthog-node@5.39.4

5.39.4

Patch Changes

#4047 0c11747 Thanks @marandaneto! - Stop duplicating distinct_id inside /flags person properties. (2026-07-02)

Updated dependencies [5e7e132]:

@posthog/core@1.39.5

posthog-node@5.39.3

5.39.3

Patch Changes

#4055 64e04ba Thanks @marandaneto! - Retry /flags requests that receive HTTP 502 or 504 responses across SDKs that use the shared core flags client. (2026-07-02)

Updated dependencies [64e04ba]:

@posthog/core@1.39.4

posthog-node@5.39.2

5.39.2

Patch Changes

#4028 a664b81 Thanks @marandaneto! - Make Node flush() wait for pending asynchronous SDK work before draining the event queue, so events produced by helpers like captureException() are not missed. Pending work rejections no longer prevent queued events from flushing. (2026-07-01)

Updated dependencies [a664b81]:

@posthog/core@1.39.3

posthog-node@5.39.1

5.39.1

Patch Changes

#4029 b36b1cc Thanks @marandaneto! - Call before_send for identify, group identify, and alias events. (2026-06-30)

#4027 ab118d2 Thanks @marandaneto! - Safely serialize event batches with circular property references instead of crashing during flush. (2026-06-30)

Updated dependencies [ab118d2]:

@posthog/core@1.39.2

posthog-node@5.39.0

5.39.0

Minor Changes

#4006 0063128 Thanks @github-actions! - Add groupIdentifyImmediate() to await the network request when identifying a group, mirroring captureImmediate/identifyImmediate/aliasImmediate. Useful in edge/serverless environments where the background queue may not flush. The Convex integration now uses it directly instead of routing $groupidentify through captureImmediate. (2026-06-30)

... (truncated)

Changelog

Sourced from posthog-node's changelog.

5.39.4

Patch Changes

#4047 0c11747 Thanks @marandaneto! - Stop duplicating distinct_id inside /flags person properties. (2026-07-02)

Updated dependencies [5e7e132]:

@posthog/core@1.39.5

5.39.3

Patch Changes

#4055 64e04ba Thanks @marandaneto! - Retry /flags requests that receive HTTP 502 or 504 responses across SDKs that use the shared core flags client. (2026-07-02)

Updated dependencies [64e04ba]:

@posthog/core@1.39.4

5.39.2

Patch Changes

#4028 a664b81 Thanks @marandaneto! - Make Node flush() wait for pending asynchronous SDK work before draining the event queue, so events produced by helpers like captureException() are not missed. Pending work rejections no longer prevent queued events from flushing. (2026-07-01)

Updated dependencies [a664b81]:

@posthog/core@1.39.3

5.39.1

Patch Changes

#4029 b36b1cc Thanks @marandaneto! - Call before_send for identify, group identify, and alias events. (2026-06-30)

#4027 ab118d2 Thanks @marandaneto! - Safely serialize event batches with circular property references instead of crashing during flush. (2026-06-30)

Updated dependencies [ab118d2]:

@posthog/core@1.39.2

5.39.0

Minor Changes

#4006 0063128 Thanks @github-actions! - Add groupIdentifyImmediate() to await the network request when identifying a group, mirroring captureImmediate/identifyImmediate/aliasImmediate. Useful in edge/serverless environments where the background queue may not flush. The Convex integration now uses it directly instead of routing $groupidentify through captureImmediate. (2026-06-30)

Patch Changes

Updated dependencies [0063128]:

@posthog/core@1.39.0

... (truncated)

Commits

0ba87cb chore: update versions and lockfile [version bump]
0c11747 fix: stop duplicating distinct_id in flags person properties (#4047)
4eb8b21 chore: update versions and lockfile [version bump]
dd90e55 test(node): make local polling tests deterministic (#4043)
d1e6df8 chore: update versions and lockfile [version bump]
a664b81 fix: make flush wait for pending async work (#4028)
a5181ba chore: update versions and lockfile [version bump]
b36b1cc fix(node): run before_send for all captured events (#4029)
ab118d2 fix(node): handle circular event properties during flush (#4027)
0c95bce fix: satisfy SDK compliance harness 0.8.0 (#3998)
Additional commits viewable in compare view

Updates @xyflow/react from 12.11.1 to 12.11.2

Release notes

Sourced from @xyflow/react's releases.

@xyflow/react@12.11.2

Patch Changes

#5825 5072914 - Only create an XYDrag instance for draggable nodes.

#5847 742860c - Stop the MiniMap from re-rendering on every store update.

#5846 17c64a1 - Apply the viewport pan/zoom transform imperatively so the Viewport component only renders once.

Updated dependencies [c707267, 0c0cebc, 56cf3b0, a01bb6b, 9b3f390, cdfcbeb]:

@xyflow/system@0.0.79

Changelog

Sourced from @xyflow/react's changelog.

12.11.2

Patch Changes

#5825 5072914 - Only create an XYDrag instance for draggable nodes.

#5847 742860c - Stop the MiniMap from re-rendering on every store update.

#5846 17c64a1 - Apply the viewport pan/zoom transform imperatively so the Viewport component only renders once.

Updated dependencies [c707267, 0c0cebc, 56cf3b0, a01bb6b, 9b3f390, cdfcbeb]:

@xyflow/system@0.0.79

Commits

3ab66ef chore(packages): bump
01d58b6 Merge pull request #5846 from AlaricBaraou/perf/viewport-imperative-transform
742860c perf(react): skip minimap re-renders when its geometry is unchanged
17c64a1 perf(react): apply the viewport transform imperatively instead of re-renderin...
775bdd6 Merge pull request #5825 from AlaricBaraou/perf/xydrag-draggable-only
576a43d refactor(react): pass nodesDraggable to prevent wrong initial state
5072914 perf(react): only create an XYDrag instance for draggable nodes
See full diff in compare view

Updates framer-motion from 12.42.0 to 12.42.2

Changelog

Sourced from framer-motion's changelog.

[12.42.2] 2026-07-01

Fixed

animateView: Cropped group layers now animate border-radius from the old to new radius.

[12.42.1] 2026-06-30

Fixed

animateView: Old layer fade out now cancelled when defining .new().

Commits

40e8756 v12.42.2
718ccc7 Merge pull request #3768 from motiondivision/view-cropped-corner-radius
19195a4 Dedupe corner-radius longhands; merge crop box/radii measurements
5299aa6 Resolve cropped-clip radius timing once; fix transition-option leak
937cdf3 Animate cropped view-transition group corner radius
fd2d6f6 v12.42.1
2223d87 Hold the old layer when only a non-opacity .new() is set
See full diff in compare view

Updates i18next from 26.3.3 to 26.3.4

Release notes

Sourced from i18next's releases.

v26.3.4

fix(security): deepExtend (used by addResourceBundle(..., deep, overwrite)) no longer recurses into inherited properties. It checked key existence with the in operator, which walks the prototype chain, so a source key matching an inherited built-in (e.g. hasOwnProperty, toString) caused recursion into the shared Object.prototype function and, with overwrite: true, could overwrite e.g. Object.prototype.hasOwnProperty.call with a non-callable value — corrupting a shared built-in process-wide (DoS). Existence is now checked with Object.prototype.hasOwnProperty.call, so such keys are copied as plain own data instead. This complements the existing __proto__/constructor guard and is also strictly more correct for an own-property merge. Only affects applications that pass attacker-controlled data with deep: true and overwrite: true; no standard backend/integration does this. Distinct from CVE-2026-48713 / CVE-2026-48714 (different packages, setPath mechanism). Thanks to zx (Jace) for the responsible disclosure.

Changelog

Sourced from i18next's changelog.

26.3.4

fix(security): deepExtend (used by addResourceBundle(..., deep, overwrite)) no longer recurses into inherited properties. It checked key existence with the in operator, which walks the prototype chain, so a source key matching an inherited built-in (e.g. hasOwnProperty, toString) caused recursion into the shared Object.prototype function and, with overwrite: true, could overwrite e.g. Object.prototype.hasOwnProperty.call with a non-callable value — corrupting a shared built-in process-wide (DoS). Existence is now checked with Object.prototype.hasOwnProperty.call, so such keys are copied as plain own data instead. This complements the existing __proto__/constructor guard and is also strictly more correct for an own-property merge. Only affects applications that pass attacker-controlled data with deep: true and overwrite: true; no standard backend/integration does this. Distinct from CVE-2026-48713 / CVE-2026-48714 (different packages, setPath mechanism). See advisory GHSA-6jcc-5g8w-32mx, CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H). Thanks to zx (Jace) @manus-use for the responsible disclosure.

Commits

817ede5 26.3.4
46d0dd8 build
642137b fix(security): prevent deepExtend from recursing into inherited built-ins
See full diff in compare view

Updates posthog-js from 1.395.0 to 1.398.0

Release notes

Sourced from posthog-js's releases.

posthog-js@1.398.0

1.398.0

Minor Changes

#4070 ef119bf Thanks @posthog! - Add a disableAutofocus survey appearance option. When set, open-text survey questions no longer steal focus when they render, which is useful for embedded (inline) surveys that shouldn't grab the caret or scroll the page on load. Defaults to false, preserving the existing autofocus behavior. (2026-07-06)

posthog-js@1.397.0

1.397.0

Minor Changes

#4089 cc340db Thanks @bs1180! - feat(web): add a posthog-js/customizations subpath entry point exposing the optional customizations (setAllPersonProfilePropertiesAsPersonPropertiesForFlags, the before-send sampling helpers, and the redux/kea loggers) as a proper ES module with bundled types, replacing the internal posthog-js/lib/src/customizations deep import. Also fixes the TypeScript definitions so setAllPersonProfilePropertiesAsPersonPropertiesForFlags accepts the instance passed to the loaded callback (the documented usage), and the loaded callback's instance type now includes config. (2026-07-06)

posthog-js@1.396.9

1.396.9

Patch Changes

#4077 2595440 Thanks @pauldambra! - fix(web): stop retrying log batches forever when requests die before an HTTP response (status 0, e.g. an ad blocker) — after 3 consecutive such failures while the browser reports itself online, the logs pipeline stops sending and drops batches instead of buffering and retrying for the life of the page; the online event reopens it, and genuine offline periods still queue for the reconnect flush (2026-07-06)

posthog-js@1.396.8

1.396.8

Patch Changes

#4062 2af0026 Thanks @posthog! - fix(web): prevent an infinite-recursion stack overflow in the logs console capture. The console wrapper's own capture path can emit internal debug lines through PostHog's logger, which wrote back to the wrapped console and re-entered capture until the stack blew (RangeError: Maximum call stack size exceeded). The wrapper now exposes the original console method via __rrweb_original__ (so the internal logger bypasses it) and guards against re-entrancy from any code that logs mid-capture. (2026-07-06)

posthog-js@1.396.7

1.396.7

Patch Changes

#4080 08cd27b Thanks @marandaneto! - fix(web): stop repeatedly hitting blocked feature flag and conversations polling endpoints after consecutive status-0 failures (2026-07-06)

posthog-js@1.396.6

1.396.6

Patch Changes

#4053 45d1b36 Thanks @posthog! - feat(web): add a graceful shutdown() to the browser client for parity with posthog-node, so isomorphic teardown code (e.g. the Nuxt module) that calls posthog.shutdown() on the client no longer throws TypeError: shutdown is not a function. It best-effort flushes the queued events and always resolves. (2026-07-03)

#4054 f0657eb Thanks @posthog! - fix(web): detect our own feature-flag request timeouts via a timedOut flag instead of the abort reason, so they are logged at warn (not error) on browsers that don't propagate controller.abort(reason) — keeping benign timeouts out of error tracking's console-error capture (2026-07-03)

... (truncated)

Commits

f937d5d chore: update versions and lockfile [version bump]
ef119bf feat(surveys): add disableAutofocus appearance option (#4070)
781ea3b feat: add official PostHog OpenFeature web provider (browser) (#4069)
4ca562a chore: update versions and lockfile [version bump]
cc340db feat: add posthog-js/customizations subpath entry point (#4089)
3c7f95a chore: update versions and lockfile [version bump]
2595440 fix(web): stop retrying log batches forever on status-0 failures (#4077)
26b92fe chore: update PostHog watcher action (#4088)
bd55d32 chore: update versions and lockfile [version bump]
2af0026 fix(web): guard logs console capture against infinite recursion (#4062)
Additional commits viewable in compare view

Updates react-hook-form from 7.80.0 to 7.81.0

Release notes

Sourced from react-hook-form's releases.

Version 7.81.0

⚜️ feat: FieldArray component (#13394)
<FieldArray
  control={control}
  name="test"
  render={({ fields }) => null}
/>
🐞 fix #13538 useFieldArray min 1 item validation error changes its location in the errors object (#13539) 🐞 fix #13569 calling reset triggers subscribe with latest name instead of undefined (#13574) 🐞 fix(useController): reflect cleared parent object in controlled fields (#13550) (#13553) 🐞 fix(flatten): preserve Date values as leaf nodes (#13566) 🐛 fix(unset): guard against prototype keyword path traversal (#13559) (#13560) 🏸 improve setValue api with shrink value (#13576) 👝 close #13577 improve re-render with useFieldArray reset (#13578) 🐞 fix #13575 issue: clearErrors changes the name value from form.subscribe (#13579)

thanks to @DakshSinghDhami, @JSap0914, @tran-simon & @EduardF1

Changelog

Sourced from react-hook-form's changelog.

[7.81.0] - 2026-07-05

Added

FieldArray component built on useFieldArray for controlled field-array rendering

Fixed

clearErrors changing the name value from form.subscribe

reset triggering subscribe with the latest name instead of undefined

setValues leaving stale elements behind when shrinking a field array

flatten preserving Date values as leaf nodes

useFieldArray min length validation error changing location in the errors object

useController not reflecting a cleared parent object in controlled fields

Security

Harden unset() against prototype-path traversal (__proto__ / constructor / prototype), matching the existing set() guard

Performance

Improve re-render with useFieldArray reset

Commits

46b217e 7.81.0
6595a91 🐞 fix #13575 issue: clearErrors changes the name value from form.subscribe (#...
cae5dfe 👝 close #13577 improve re-render with useFieldArray reset (#13578)
5b2b743 🏸 improve setValue api with shrink value (#13576)
6112441 🐞 fix #13569 calling reset triggers subscribe with latest name instead of und...
f89388f 🐞 fix(flatten): preserve Date values as leaf nodes (#13566)
46381fa Revert "docs: fix grammar in demo descriptions (#13565)" (#13568)
d4c804a Revert "test: remove duplicate UseFieldArray slug (#13564)" (#13567)
63ec54f test: remove duplicate UseFieldArray slug (#13564)
08792ad docs: fix grammar in demo descriptions (#13565)
Additional commits viewable in compare view

Updates react-router-dom from 7.18.0 to 7.18.1

Changelog

Sourced from react-router-dom's changelog.

v7.18.1

Patch Changes

Fix incorrect package.json main field for CommonJS builds (#15238)

Updated dependencies:

react-router@7.18.1

Commits

afdf85d Release v7.18.1 (#15253)

…ory with 16 updates Bumps the bun-minor-and-patch group with 15 updates in the / directory: | Package | From | To | | --- | --- | --- | | [eslint](https://github.com/eslint/eslint) | `10.2.0` | `10.6.0` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.62.0` | `8.63.0` | | [hono](https://github.com/honojs/hono) | `4.12.27` | `4.12.28` | | [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.38.6` | `5.39.4` | | [@xyflow/react](https://github.com/xyflow/xyflow/tree/HEAD/packages/react) | `12.11.1` | `12.11.2` | | [framer-motion](https://github.com/motiondivision/motion) | `12.42.0` | `12.42.2` | | [i18next](https://github.com/i18next/i18next) | `26.3.3` | `26.3.4` | | [posthog-js](https://github.com/PostHog/posthog-js) | `1.395.0` | `1.398.0` | | [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.80.0` | `7.81.0` | | [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `7.18.0` | `7.18.1` | | [recharts](https://github.com/recharts/recharts) | `3.9.0` | `3.9.2` | | [@tailwindcss/vite](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite) | `4.3.1` | `4.3.2` | | [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.9` | `4.1.10` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.1.0` | `8.1.3` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.9` | `4.1.10` | Updates `eslint` from 10.2.0 to 10.6.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.2.0...v10.6.0) Updates `typescript-eslint` from 8.62.0 to 8.63.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.63.0/packages/typescript-eslint) Updates `hono` from 4.12.27 to 4.12.28 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.27...v4.12.28) Updates `posthog-node` from 5.38.6 to 5.39.4 - [Release notes](https://github.com/PostHog/posthog-js/releases) - [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md) - [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.39.4/packages/node) Updates `@xyflow/react` from 12.11.1 to 12.11.2 - [Release notes](https://github.com/xyflow/xyflow/releases) - [Changelog](https://github.com/xyflow/xyflow/blob/main/packages/react/CHANGELOG.md) - [Commits](https://github.com/xyflow/xyflow/commits/@xyflow/react@12.11.2/packages/react) Updates `framer-motion` from 12.42.0 to 12.42.2 - [Changelog](https://github.com/motiondivision/motion/blob/main/CHANGELOG.md) - [Commits](motiondivision/motion@v12.42.0...v12.42.2) Updates `i18next` from 26.3.3 to 26.3.4 - [Release notes](https://github.com/i18next/i18next/releases) - [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md) - [Commits](i18next/i18next@v26.3.3...v26.3.4) Updates `posthog-js` from 1.395.0 to 1.398.0 - [Release notes](https://github.com/PostHog/posthog-js/releases) - [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md) - [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.395.0...posthog-js@1.398.0) Updates `react-hook-form` from 7.80.0 to 7.81.0 - [Release notes](https://github.com/react-hook-form/react-hook-form/releases) - [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md) - [Commits](react-hook-form/react-hook-form@v7.80.0...v7.81.0) Updates `react-router-dom` from 7.18.0 to 7.18.1 - [Release notes](https://github.com/remix-run/react-router/releases) - [Changelog](https://github.com/remix-run/react-router/blob/react-router-dom@7.18.1/packages/react-router-dom/CHANGELOG.md) - [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.18.1/packages/react-router-dom) Updates `recharts` from 3.9.0 to 3.9.2 - [Release notes](https://github.com/recharts/recharts/releases) - [Changelog](https://github.com/recharts/recharts/blob/main/CHANGELOG.md) - [Commits](recharts/recharts@v3.9.0...v3.9.2) Updates `@tailwindcss/vite` from 4.3.1 to 4.3.2 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.2/packages/@tailwindcss-vite) Updates `@vitest/coverage-v8` from 4.1.9 to 4.1.10 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/coverage-v8) Updates `tailwindcss` from 4.3.1 to 4.3.2 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.2/packages/tailwindcss) Updates `vite` from 8.1.0 to 8.1.3 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.1.3/packages/vite) Updates `vitest` from 4.1.9 to 4.1.10 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest) --- updated-dependencies: - dependency-name: eslint dependency-version: 10.6.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: bun-minor-and-patch - dependency-name: typescript-eslint dependency-version: 8.63.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: bun-minor-and-patch - dependency-name: hono dependency-version: 4.12.28 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: bun-minor-and-patch - dependency-name: posthog-node dependency-version: 5.39.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: bun-minor-and-patch - dependency-name: "@xyflow/react" dependency-version: 12.11.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: bun-minor-and-patch - dependency-name: framer-motion dependency-version: 12.42.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: bun-minor-and-patch - dependency-name: i18next dependency-version: 26.3.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: bun-minor-and-patch - dependency-name: posthog-js dependency-version: 1.398.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: bun-minor-and-patch - dependency-name: react-hook-form dependency-version: 7.81.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: bun-minor-and-patch - dependency-name: react-router-dom dependency-version: 7.18.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: bun-minor-and-patch - dependency-name: recharts dependency-version: 3.9.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: bun-minor-and-patch - dependency-name: "@tailwindcss/vite" dependency-version: 4.3.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: bun-minor-and-patch - dependency-name: "@vitest/coverage-v8" dependency-version: 4.1.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: bun-minor-and-patch - dependency-name: tailwindcss dependency-version: 4.3.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: bun-minor-and-patch - dependency-name: vite dependency-version: 8.1.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: bun-minor-and-patch - dependency-name: vitest dependency-version: 4.1.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: bun-minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-07-07T10:41:35Z

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

dependabot · 2026-07-13T00:12:20Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added the infra Infrastructure & deployment label Jul 7, 2026

dependabot Bot requested a review from chronoai-shining as a code owner July 7, 2026 10:41

dependabot Bot added the infra Infrastructure & deployment label Jul 7, 2026

dependabot Bot closed this Jul 13, 2026

dependabot Bot deleted the dependabot/bun/bun-minor-and-patch-8a05d8c302 branch July 13, 2026 00:12

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps)(deps): bump the bun-minor-and-patch group across 1 directory with 16 updates#1203

chore(deps)(deps): bump the bun-minor-and-patch group across 1 directory with 16 updates#1203
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/bun/bun-minor-and-patch-8a05d8c302

dependabot Bot commented on behalf of github Jul 7, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Jul 7, 2026

Uh oh!

dependabot Bot commented on behalf of github Jul 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v10.6.0

Features

Bug Fixes

Documentation

Chores

v10.5.0

Features

Documentation

v8.63.0

8.63.0 (2026-07-06)

🚀 Features

🩹 Fixes

❤️ Thank You

v8.62.1

8.62.1 (2026-06-29)

🩹 Fixes

❤️ Thank You

8.63.0 (2026-07-06)

8.62.1 (2026-06-29)

v4.12.28

What's Changed

New Contributors

posthog-node@5.39.4

5.39.4

Patch Changes

posthog-node@5.39.3

5.39.3

Patch Changes

posthog-node@5.39.2

5.39.2

Patch Changes

posthog-node@5.39.1

5.39.1

Patch Changes

posthog-node@5.39.0

5.39.0

Minor Changes

5.39.4

Patch Changes

5.39.3

Patch Changes

5.39.2

Patch Changes

5.39.1

Patch Changes

5.39.0

Minor Changes

Patch Changes

@​xyflow/react@​12.11.2

Patch Changes

12.11.2

Patch Changes

[12.42.2] 2026-07-01

Fixed

[12.42.1] 2026-06-30

Fixed

v26.3.4

26.3.4

posthog-js@1.398.0

1.398.0

Minor Changes

posthog-js@1.397.0

1.397.0

Minor Changes

posthog-js@1.396.9

1.396.9

Patch Changes

posthog-js@1.396.8

1.396.8

Patch Changes

posthog-js@1.396.7

1.396.7

Patch Changes

posthog-js@1.396.6

1.396.6

Patch Changes

dependabot Bot commented on behalf of github Jul 7, 2026 •

edited

Loading

`@xyflow/react@12`.11.2