build(deps-dev): bump the dev-dependencies group across 1 directory with 8 updates by dependabot[bot] · Pull Request #7196 · ether/etherpad

dependabot · 2025-10-28T15:15:13Z

Bumps the dev-dependencies group with 8 updates in the / directory:

Package	From	To
@types/cookie-parser	`1.4.9`	`1.4.10`
@types/express	`5.0.3`	`5.0.5`
set-cookie-parser	`2.7.1`	`2.7.2`
vitest	`4.0.1`	`4.0.4`
@vitejs/plugin-react	`5.0.4`	`5.1.0`
eslint-plugin-react-hooks	`7.0.0`	`7.0.1`
lucide-react	`0.546.0`	`0.548.0`
react-i18next	`16.1.6`	`16.2.1`

Updates @types/cookie-parser from 1.4.9 to 1.4.10

Commits

See full diff in compare view

Updates @types/express from 5.0.3 to 5.0.5

Commits

See full diff in compare view

Updates set-cookie-parser from 2.7.1 to 2.7.2

Changelog

Sourced from set-cookie-parser's changelog.

v2.7.2 - 2025-10-27

Fixed:

Prevent Object prototype pollution by malicious cookies

Removed cookie values from error logs due to their potentially sensitive nature

Commits

6e0577b 2.7.2
e828710 2.7.2 changelog
400be29 Merge pull request #71 from ExodusMovement/andrej/prototype-pollution
6d36c0c chore: add tests for forbidden keys
0857d99 revert: allow empty string cookies
43131a2 Revert "feat: allow logging cookie values if logCookieValues is set"
7423bba feat: allow logging cookie values if logCookieValues is set
ca7f865 fix: isForbiddenKey
bfd65d3 feat: harden forbidden keys
4d74d29 feat: harden against prototype pollution
Additional commits viewable in compare view

Updates vitest from 4.0.1 to 4.0.4

Release notes

Sourced from vitest's releases.

v4.0.4

   🐞 Bug Fixes

browser:

Correct typo - by @benmccann in vitest-dev/vitest#8796 (ede1f)

Publish a missing context file for webdriverio - by @sheremet-va in vitest-dev/vitest#8824 (7c7b6)

mocker:

Support mocking builtins without node: prefix - by @sheremet-va in vitest-dev/vitest#8829 (06208)

pool:

Runner's error listener causing MaxListenersExceededWarning - by @AriPerkkio in vitest-dev/vitest#8820 (d1bff)

Capture workers stdio to logger - by @AriPerkkio in vitest-dev/vitest#8809 (fb95f)

spy:

Allow classes in vi.mocked utility - by @sheremet-va in vitest-dev/vitest#8839 (f8756)

worker:

Rpc listener leak when isolate: false - by @AriPerkkio in vitest-dev/vitest#8821 (573dc)

   🏎 Performance

utils: Optimized reducer to avoid creating new objects - by @Connormiha in vitest-dev/vitest#8818 (d19ce)

    View changes on GitHub

v4.0.3

   🐞 Bug Fixes

Preserve reporter options from config when CLI reporters override them - by @Copilot and sheremet-va in vitest-dev/vitest#8794 (15552)

browser: More stable in-source testing validation - by @sheremet-va in vitest-dev/vitest#8793 (62297)

happy-dom: Support fetch globals - by @sheremet-va in vitest-dev/vitest#8791 (0fb74)

init: Use correct jsx/tsx extension - by @sheremet-va in vitest-dev/vitest#8792 (abc04)

    View changes on GitHub

v4.0.2

   🐞 Bug Fixes

browser:

Don't print the deprecation notice in node_modules - by @sheremet-va in vitest-dev/vitest#8779 (588f7)

pool:

Assign envs before running tests to keep in sync with process.env - by @sheremet-va in vitest-dev/vitest#8769 (26ce8)

spy:

Properly inherit implementation's length - by @sheremet-va in vitest-dev/vitest#8778 (d4c2b)

Reset spies if both restoreMocks and mockReset are set in the config - by @sheremet-va in vitest-dev/vitest#8781 (2eedb)

    View changes on GitHub

Commits

9b75ec5 chore: release v4.0.4
fb95fc7 fix(pool): capture workers stdio to logger (#8809)
06208d3 fix(mocker): support mocking builtins without node: prefix (#8829)
573dc06 fix(worker): rpc listener leak when isolate: false (#8821)
d1bff3b fix(pool): runner's error listener causing MaxListenersExceededWarning (#8820)
d19cece perf(utils): optimized reducer to avoid creating new objects (#8818)
ede1f39 fix(browser): correct typo (#8796)
ca1766f chore: release v4.0.3
155521a fix: preserve reporter options from config when CLI reporters override them (...
abc046f fix(init): use correct jsx/tsx extension (#8792)
Additional commits viewable in compare view

Updates @vitejs/plugin-react from 5.0.4 to 5.1.0

Release notes

Sourced from @vitejs/plugin-react's releases.

plugin-react@5.1.0

Add @vitejs/plugin-react/preamble virtual module for SSR HMR (#890)

SSR applications can now initialize HMR runtime by importing @vitejs/plugin-react/preamble at the top of their client entry instead of manually calling transformIndexHtml. This simplifies SSR setup for applications that don't use the transformIndexHtml API.

Fix raw Rolldown support for Rolldown 1.0.0-beta.44+ (#930)

Rolldown 1.0.0-beta.44+ removed the top-level jsx option in favor of transform.jsx. This plugin now uses the transform.jsx option to support Rolldown 1.0.0-beta.44+.

Changelog

Sourced from @vitejs/plugin-react's changelog.

5.1.0 (2025-10-24)

Add @vitejs/plugin-react/preamble virtual module for SSR HMR (#890)

SSR applications can now initialize HMR runtime by importing @vitejs/plugin-react/preamble at the top of their client entry instead of manually calling transformIndexHtml. This simplifies SSR setup for applications that don't use the transformIndexHtml API.

Fix raw Rolldown support for Rolldown 1.0.0-beta.44+ (#930)

Rolldown 1.0.0-beta.44+ removed the top-level jsx option in favor of transform.jsx. This plugin now uses the transform.jsx option to support Rolldown 1.0.0-beta.44+.

Commits

3e5a374 release: plugin-react@5.1.0
44cbed4 fix(react): compat with newer rolldown (#930)
c54d3c6 chore(deps): update all non-major dependencies (#926)
a2d76d9 fix(deps): update all non-major dependencies (#918)
fffb7eb feat(react): expose virtual module to simplify hmr preamble setup on ssr (#890)
b79592a fix(deps): update react-related dependencies (#901)
2d239fc fix(deps): update all non-major dependencies (#896)
73be2f0 chore(deps): fix vitest > rolldown-vite dependency (#889)
407795d fix(deps): update all non-major dependencies (#887)
47db473 chore(react): fix ecosystem-ci failure (#888)
See full diff in compare view

Updates eslint-plugin-react-hooks from 7.0.0 to 7.0.1

Changelog

Sourced from eslint-plugin-react-hooks's changelog.

7.0.1

Disallowed passing inline useEffectEvent values as JSX props to guard against accidental propagation. (#34820 by @jf-eirinha)

Switch to export = so eslint-plugin-react-hooks emits correct types for consumers in Node16 ESM projects. (#34949 by @karlhorky)

Tightened the typing of configs.flat so the configs export is always defined. (#34950 by @poteto)

Fix named import runtime errors. (#34951, #34953 by @karlhorky)

Commits

See full diff in compare view

Updates lucide-react from 0.546.0 to 0.548.0

Release notes

Sourced from lucide-react's releases.

Version 0.548.0

What's Changed

feat(docs): add new package for Slint by @cnlancehu in lucide-icons/lucide#3698

docs(site): add introductions for packages in documentation by @mattheskaiser in lucide-icons/lucide#3643

Fix default prop by @ericfennis in lucide-icons/lucide#3730

feat(icons): added gamepad-directional icon by @felipeajzanetti in lucide-icons/lucide#3693

New Contributors

@cnlancehu made their first contribution in lucide-icons/lucide#3698

@mattheskaiser made their first contribution in lucide-icons/lucide#3643

@felipeajzanetti made their first contribution in lucide-icons/lucide#3693

Full Changelog: lucide-icons/lucide@0.547.0...0.548.0

Version 0.547.0

What's Changed

fix(docs): update brand logo statement link in github action by @karsa-mistmere in lucide-icons/lucide#3630

chore(deps): bump astro from 5.5.2 to 5.14.4 by @dependabot[bot] in lucide-icons/lucide#3683

fix(packages/lucide): replace elements inside \<template> (#2635) by @KhalidAlansary in lucide-icons/lucide#3576

feat(icons): added birdhouse icon by @hieu-onefold in lucide-icons/lucide#3378

New Contributors

@KhalidAlansary made their first contribution in lucide-icons/lucide#3576

@hieu-onefold made their first contribution in lucide-icons/lucide#3378

Full Changelog: lucide-icons/lucide@0.546.0...0.547.0

Commits

See full diff in compare view

Updates react-i18next from 16.1.6 to 16.2.1

Changelog

Sourced from react-i18next's changelog.

16.2.1

fix regression in v16.2.0: bindI18nStore does not work correctly 1879

16.2.0

try to address: useTranslation hook violates React's rules of hooks by conditionally calling inner hooks 1863

Commits

badbfa3 16.2.1
dc7225e fix regression in v16.2.0: bindI18nStore #1879
aa66a89 16.2.0
a080c76 address #1863 with Option 2
0c33e69 Merge branch 'try-fix-react-violation-2'
3bf5c85 use use-sync-external-store shim for useSyncExternalStore
e505cb0 try useSyncExternalStore
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…ith 8 updates Bumps the dev-dependencies group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@types/cookie-parser](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/cookie-parser) | `1.4.9` | `1.4.10` | | [@types/express](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/express) | `5.0.3` | `5.0.5` | | [set-cookie-parser](https://github.com/nfriedly/set-cookie-parser) | `2.7.1` | `2.7.2` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.0.1` | `4.0.4` | | [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `5.0.4` | `5.1.0` | | [eslint-plugin-react-hooks](https://github.com/facebook/react/tree/HEAD/packages/eslint-plugin-react-hooks) | `7.0.0` | `7.0.1` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `0.546.0` | `0.548.0` | | [react-i18next](https://github.com/i18next/react-i18next) | `16.1.6` | `16.2.1` | Updates `@types/cookie-parser` from 1.4.9 to 1.4.10 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/cookie-parser) Updates `@types/express` from 5.0.3 to 5.0.5 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/express) Updates `set-cookie-parser` from 2.7.1 to 2.7.2 - [Changelog](https://github.com/nfriedly/set-cookie-parser/blob/master/CHANGELOG.md) - [Commits](nfriedly/set-cookie-parser@v2.7.1...v2.7.2) Updates `vitest` from 4.0.1 to 4.0.4 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.4/packages/vitest) Updates `@vitejs/plugin-react` from 5.0.4 to 5.1.0 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@5.1.0/packages/plugin-react) Updates `eslint-plugin-react-hooks` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/facebook/react/releases) - [Changelog](https://github.com/facebook/react/blob/main/packages/eslint-plugin-react-hooks/CHANGELOG.md) - [Commits](https://github.com/facebook/react/commits/HEAD/packages/eslint-plugin-react-hooks) Updates `lucide-react` from 0.546.0 to 0.548.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/0.548.0/packages/lucide-react) Updates `react-i18next` from 16.1.6 to 16.2.1 - [Changelog](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md) - [Commits](i18next/react-i18next@v16.1.6...v16.2.1) --- updated-dependencies: - dependency-name: "@types/cookie-parser" dependency-version: 1.4.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: "@types/express" dependency-version: 5.0.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: set-cookie-parser dependency-version: 2.7.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: vitest dependency-version: 4.0.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: "@vitejs/plugin-react" dependency-version: 5.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: eslint-plugin-react-hooks dependency-version: 7.0.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: lucide-react dependency-version: 0.548.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: react-i18next dependency-version: 16.2.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2025-10-29T15:19:12Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Oct 28, 2025

dependabot Bot closed this Oct 29, 2025

dependabot Bot deleted the dependabot/npm_and_yarn/dev-dependencies-f6642a67f2 branch October 29, 2025 15:19

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps-dev): bump the dev-dependencies group across 1 directory with 8 updates#7196

build(deps-dev): bump the dev-dependencies group across 1 directory with 8 updates#7196
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/dev-dependencies-f6642a67f2

dependabot Bot commented on behalf of github Oct 28, 2025 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Oct 29, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Oct 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v2.7.2 - 2025-10-27

v4.0.4

🐞 Bug Fixes

🏎 Performance

View changes on GitHub

v4.0.3

🐞 Bug Fixes

View changes on GitHub

v4.0.2

🐞 Bug Fixes

View changes on GitHub

plugin-react@5.1.0

Add @vitejs/plugin-react/preamble virtual module for SSR HMR (#890)

Fix raw Rolldown support for Rolldown 1.0.0-beta.44+ (#930)

5.1.0 (2025-10-24)

Add @vitejs/plugin-react/preamble virtual module for SSR HMR (#890)

Fix raw Rolldown support for Rolldown 1.0.0-beta.44+ (#930)

7.0.1

Version 0.548.0

What's Changed

New Contributors

Version 0.547.0

What's Changed

New Contributors

16.2.1

16.2.0

Uh oh!

dependabot Bot commented on behalf of github Oct 29, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Oct 28, 2025 •

edited

Loading

Add `@vitejs/plugin-react/preamble` virtual module for SSR HMR (#890)

Add `@vitejs/plugin-react/preamble` virtual module for SSR HMR (#890)