Skip to content

chore(deps): bump the npm-dependencies group with 22 updates#776

Open
dependabot[bot] wants to merge 2 commits intomainfrom
dependabot/npm_and_yarn/npm-dependencies-750df7c4f6
Open

chore(deps): bump the npm-dependencies group with 22 updates#776
dependabot[bot] wants to merge 2 commits intomainfrom
dependabot/npm_and_yarn/npm-dependencies-750df7c4f6

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 27, 2026

Bumps the npm-dependencies group with 22 updates:

Package From To
@emotion/styled 11.14.0 11.14.1
@iconify/react 6.0.0 6.0.2
@mui/styles 6.4.12 6.5.0
ajv 8.17.1 8.20.0
axios 1.12.2 1.15.2
i18next-http-backend 3.0.2 3.0.6
js-yaml 4.1.0 4.1.1
lodash 4.17.21 4.18.1
@types/lodash 4.17.17 4.17.24
ramda 0.30.1 0.32.0
react-hook-form 7.57.0 7.74.0
simplebar-react 3.3.1 3.3.2
socket.io-client 4.8.1 4.8.3
tss-react 4.9.18 4.9.20
yaml 2.8.0 2.8.3
@testing-library/dom 10.4.0 10.4.1
@testing-library/jest-dom 6.6.3 6.9.1
@testing-library/react 16.3.0 16.3.2
@types/ramda 0.30.2 0.31.1
eslint-plugin-import 2.31.0 2.32.0
eslint-plugin-react 7.37.4 7.37.5
ts-jest 29.4.1 29.4.9

Updates @emotion/styled from 11.14.0 to 11.14.1

Release notes

Sourced from @​emotion/styled's releases.

@​emotion/styled@​11.14.1

Patch Changes

  • #3334 0facbe4 Thanks @​ZachRiegel! - Renamed default-exported variable in @emotion/styled to aid inferred import names in auto-import completions in IDEs
Commits

Updates @iconify/react from 6.0.0 to 6.0.2

Commits

Updates @mui/styles from 6.4.12 to 6.5.0

Release notes

Sourced from @​mui/styles's releases.

v6.5.0

A big thanks to the 2 contributors who made this release possible.

CSS layers make it easier to override styles by splitting a single style sheet into multiple layers. To learn more, check out the CSS layers documentation.

@mui/material@6.5.0

@mui/system@6.5.0

@mui/material-nextjs@6.5.0

Docs

All contributors of this release in alphabetical order: @​sai6855, @​siriwatknp

Changelog

Sourced from @​mui/styles's changelog.

6.5.0

Jul 2, 2025

A big thanks to the 2 contributors who made this release possible.

CSS layers make it easier to override styles by splitting a single style sheet into multiple layers. To learn more, check out the CSS layers documentation.

@mui/material@6.5.0

@mui/system@6.5.0

@mui/material-nextjs@6.5.0

Docs

All contributors of this release in alphabetical order: @​sai6855, @​siriwatknp

Commits

Updates ajv from 8.17.1 to 8.20.0

Release notes

Sourced from ajv's releases.

v8.20.0

What's Changed

Full Changelog: ajv-validator/ajv@v8.19.0...v8.20.0

v8.19.0

What's Changed

Full Changelog: ajv-validator/ajv@v8.18.0...v8.19.0

v8.18.0

What's Changed

New Contributors

Full Changelog: ajv-validator/ajv@v8.17.1...v8.18.0

Commits

Updates axios from 1.12.2 to 1.15.2

Release notes

Sourced from axios's releases.

v1.15.2

This release delivers prototype-pollution hardening for the Node HTTP adapter, adds an opt-in allowedSocketPaths allowlist to mitigate SSRF via Unix domain sockets, fixes a keep-alive socket memory leak, and ships supply-chain hardening across CI and security docs.

🔒 Security Fixes

  • Prototype Pollution Hardening (HTTP Adapter): Hardened the Node HTTP adapter and resolveConfig/mergeConfig/validator paths to read only own properties and use null-prototype config objects, preventing polluted auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser from influencing requests. (#10779)
  • SSRF via socketPath: Rejects non-string socketPath values and adds an opt-in allowedSocketPaths config option to restrict permitted Unix domain socket paths, returning AxiosError ERR_BAD_OPTION_VALUE on mismatch. (#10777)
  • Supply-chain Hardening: Added .npmrc with ignore-scripts=true, lockfile lint CI, non-blocking reproducible build diff, scoped CODEOWNERS, expanded SECURITY.md/THREATMODEL.md with provenance verification (npm audit signatures), 60-day resolution policy, and maintainer incident-response runbook. (#10776)

🚀 New Features

  • allowedSocketPaths Config Option: New request config option (and TypeScript types) to allowlist Unix domain socket paths used by the Node http adapter; backwards compatible when unset. (#10777)

🐛 Bug Fixes

  • Keep-alive Socket Memory Leak: Installs a single per-socket error listener tracking the active request via kAxiosSocketListener/kAxiosCurrentReq, eliminating per-request listener accumulation, MaxListenersExceededWarning, and linear heap growth under concurrent or long-running keep-alive workloads (fixes #10780). (#10788)

🔧 Maintenance & Chores

  • Changelog: Updated CHANGELOG.md with v1.15.1 release notes. (#10781)

Full Changelog

v1.15.1

This release ships a coordinated set of security hardening fixes across headers, body/redirect limits, multipart handling, and XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes, test migrations, and threat-model documentation updates.

🔒 Security Fixes

  • Header Injection Hardening: Tightened validation and sanitisation across request header construction to close the header-injection attack surface. (#10749)
  • CRLF Stripping in Multipart Headers: Correctly strips CR/LF from multipart header values to prevent injection via field names and filenames. (#10758)
  • Prototype Pollution / Auth Bypass: Replaced unsafe in checks with hasOwnProperty to prevent authentication bypass via prototype pollution on config objects, with additional regression tests. (#10761, #10760)
  • withXSRFToken Truthy Bypass: Short-circuits on any truthy non-boolean value, so an ambiguous config no longer silently leaks the XSRF token cross-origin. (#10762)
  • maxBodyLength With Zero Redirects: Enforces maxBodyLength even when maxRedirects is set to 0, closing a bypass path for oversized request bodies. (#10753)
  • Streamed Response maxContentLength Bypass: Applies maxContentLength to streamed responses that previously bypassed the cap. (#10754)
  • Follow-up CVE Completion: Completes an earlier incomplete CVE fix to fully close the regression window. (#10755)

🚀 New Features

  • AI-Based Docs Translations: Initial scaffold for AI-assisted translations of the documentation site. (#10705)
  • Location Request Header Type: Adds Location to CommonRequestHeadersList for accurate typing of redirect-aware requests. (#7528)

🐛 Bug Fixes

  • FormData Handling: Removes Content-Type when no boundary is present on FormData fetch requests, supports multi-select fields, cancels request.body instead of the source stream on fetch abort, and fixes a recursion bug in form-data serialisation. (#7314, #10676, #10702, #10726)
  • HTTP Adapter: Handles socket-only request errors without leaking keep-alive listeners. (#10576)
  • Progress Events: Clamps loaded to total for computable upload/download progress events. (#7458)
  • Types: Aligns runWhen type with the runtime behaviour in InterceptorManager and makes response header keys case-insensitive. (#7529, #10677)
  • buildFullPath: Uses strict equality in the base/relative URL check. (#7252)
  • AxiosURLSearchParams Regex: Improves the regex used for param serialisation to avoid edge-case mismatches. (#10736)
  • Resilient Value Parsing: Parses out header/config values instead of throwing on malformed input. (#10687)

... (truncated)

Changelog

Sourced from axios's changelog.

v1.15.2 - April 21, 2026

This release delivers prototype-pollution hardening for the Node HTTP adapter, adds an opt-in allowedSocketPaths allowlist to mitigate SSRF via Unix domain sockets, fixes a keep-alive socket memory leak, and ships supply-chain hardening across CI and security docs.

🔒 Security Fixes

  • Prototype Pollution Hardening (HTTP Adapter): Hardened the Node HTTP adapter and resolveConfig/mergeConfig/validator paths to read only own properties and use null-prototype config objects, preventing polluted auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser from influencing requests. (#10779)
  • SSRF via socketPath: Rejects non-string socketPath values and adds an opt-in allowedSocketPaths config option to restrict permitted Unix domain socket paths, returning AxiosError ERR_BAD_OPTION_VALUE on mismatch. (#10777)
  • Supply-chain Hardening: Added .npmrc with ignore-scripts=true, lockfile lint CI, non-blocking reproducible build diff, scoped CODEOWNERS, expanded SECURITY.md/THREATMODEL.md with provenance verification (npm audit signatures), 60-day resolution policy, and maintainer incident-response runbook. (#10776)

🚀 New Features

  • allowedSocketPaths Config Option: New request config option (and TypeScript types) to allowlist Unix domain socket paths used by the Node http adapter; backwards compatible when unset. (#10777)

🐛 Bug Fixes

  • Keep-alive Socket Memory Leak: Installs a single per-socket error listener tracking the active request via kAxiosSocketListener/kAxiosCurrentReq, eliminating per-request listener accumulation, MaxListenersExceededWarning, and linear heap growth under concurrent or long-running keep-alive workloads (fixes #10780). (#10788)

🔧 Maintenance & Chores

  • Changelog: Updated CHANGELOG.md with v1.15.1 release notes. (#10781)

Full Changelog

v1.15.1 - April 19, 2026

This release ships a coordinated set of security hardening fixes across headers, body/redirect limits, multipart handling, and XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes, test migrations, and threat-model documentation updates.

🔒 Security Fixes

  • Header Injection Hardening: Tightened validation and sanitisation across request header construction to close the header-injection attack surface. (#10749)

  • CRLF Stripping in Multipart Headers: Correctly strips CR/LF from multipart header values to prevent injection via field names and filenames. (#10758)

  • Prototype Pollution / Auth Bypass: Replaced unsafe in checks with hasOwnProperty to prevent authentication bypass via prototype pollution on config objects, with additional regression tests. (#10761, #10760)

  • withXSRFToken Truthy Bypass: Short-circuits on any truthy non-boolean value, so an ambiguous config no longer silently leaks the XSRF token cross-origin. (#10762)

  • maxBodyLength With Zero Redirects: Enforces maxBodyLength even when maxRedirects is set to 0, closing a bypass path for oversized request bodies. (#10753)

  • Streamed Response maxContentLength Bypass: Applies maxContentLength to streamed responses that previously bypassed the cap. (#10754)

  • Follow-up CVE Completion: Completes an earlier incomplete CVE fix to fully close the regression window. (#10755)

🚀 New Features

  • AI-Based Docs Translations: Initial scaffold for AI-assisted translations of the documentation site. (#10705)

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for axios since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates i18next-http-backend from 3.0.2 to 3.0.6

Changelog

Sourced from i18next-http-backend's changelog.

3.0.6

  • fix: allow forward slashes in ns values so nested namespace names (mapping to URL layouts such as /locales/en/a/b.json) fetch correctly again. 3.0.5's security fix applied the same strict URL-segment check to both lng and ns, which was correct for lng (no BCP-47 shape contains /) but over-strict for ns — nested namespaces containing / were never officially supported, but the behaviour fell out of the implicit string-substitution semantics of loadPath and is common enough in the wild to be worth accommodating. isSafeUrlSegment is now split into isSafeLangUrlSegment (strict — still rejects /) and isSafeNsUrlSegment (loose — allows / but still rejects .., \, URL-structure characters, control chars, prototype keys, and oversized inputs). isSafeUrlSegment is kept as a backwards-compatible alias for the strict check. The 3.0.5 security fix remains in force for every concrete attack pattern from the original advisory.

3.0.5

Security release — all issues found via an internal audit. See published advisory GHSA-q89c-q3h5-w34g.

  • security: refuse to build request URLs when lng or ns values contain path-traversal, URL-structure (?, #, %, @, whitespace), path separators, control characters, prototype keys, or exceed 128 chars. Prevents path traversal / SSRF / URL injection via attacker-controlled language-code values. isSafeUrlSegment is permissive for legitimate i18next language codes (any BCP-47-like shape, underscores, hyphens, dots, +-joined multi-language requests) (GHSA-q89c-q3h5-w34g)
  • security: per-instance omitFetchOptions — the fetch-options-stripping fallback is now scoped to a single backend instance via options._omitFetchOptions instead of a module-level boolean. One instance hitting a "not implemented" fetch error no longer permanently strips requestOptions (including credentials, mode, cache) from every other backend instance in the same process
  • security: strip CR/LF/NUL and other C0/C1 control characters from lng/ns / URL values before they appear in error-callback strings (CWE-117 log forging)
  • security: redact user:password credentials from URLs before including them in error-callback strings — prevents leaking basic-auth credentials embedded in loadPath / addPath
  • security: iterate own enumerable keys only (Object.keys + prototype-key guard) in addQueryString and in the customHeaders loop in XHR mode — prevents prototype-pollution amplification into the URL and request headers
  • chore: ignore .env* and *.pem/*.key files in .gitignore

3.0.4

  • use own interpolation function for loadPath and addPath instead of relying on i18next's interpolator i18next#2420 — this means only {{lng}} and {{ns}} placeholders are supported; custom interpolation prefix/suffix from i18next config no longer applies to backend paths
Commits
  • ddf1048 3.0.6
  • d73cfdc fix: allow forward slashes in ns values
  • 9abbdee Bump i18next-http-backend from 1.4.0 to 3.0.5 in /example/i18next-vue (#184)
  • b4ca8bb Bump i18next-http-backend from 3.0.1 to 3.0.5 in /example/fallback (#183)
  • dffddd4 Bump i18next-http-backend from 3.0.2 to 3.0.5 in /example/next (#182)
  • fd29b40 Bump i18next-http-backend from 1.3.2 to 3.0.5 in /example/vue (#181)
  • dc68dbe docs: link published GHSA advisory in v3.0.5 notes
  • 5757fa3 3.0.5
  • 4cee84f security: hardening for 3.0.5
  • 4cbc487 Bump next from 16.2.1 to 16.2.3 in /example/next (#180)
  • Additional commits viewable in compare view

Updates js-yaml from 4.1.0 to 4.1.1

Changelog

Sourced from js-yaml's changelog.

[4.1.1] - 2025-11-12

Security

  • Fix prototype pollution issue in yaml merge (<<) operator.
Commits

Updates lodash from 4.17.21 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

  • Add security notice for _.template in threat model and API docs (#6099)
  • Document lower > upper behavior in _.random (#6115)
  • Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

Commits
  • cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
  • 75535f5 chore: prune stale advisory refs (#6170)
  • 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
  • 59be2de release(minor): bump to 4.18.0 (#6161)
  • af63457 fix: broken tests for _.template 879aaa9
  • 1073a76 fix: linting issues
  • 879aaa9 fix: validate imports keys in _.template
  • fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
  • 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
  • b819080 ci: add dist sync validation workflow (#6137)
  • Additional commits viewable in compare view

Updates @types/lodash from 4.17.17 to 4.17.24

Commits

Updates ramda from 0.30.1 to 0.32.0

Release notes

Sourced from ramda's releases.

v0.32.0

upgrade guide

v0.31.3

upgrade guide

Commits

Updates react-hook-form from 7.57.0 to 7.74.0

Release notes

Sourced from react-hook-form's releases.

Version 7.74.0

🪇 feat: setValues (#13201)

setValues((data) => {
  return {
    ...data,
    name: 'test'
  }
})
setValues(formValues);

🐞 fix: preserve previous field value when useController name changes (#13395) 🐞 fix: handle null parent when unregistering nested field (#13396) 🐞 fix: treat NaN as empty when valueAsNumber is true in validateField (#13388) 🪢 fix build to exclude test files (#13387)

thanks to @​Yihao-G & @​mixelburg

Version 7.73.1

⚡perf: memoize submit (#13378) 🚉 perf: improve deepEqual performance (#13362) 👀 perf: skip re-render in setValue when value is unchanged (#13352) ✂️ remove unneeded flag check for shouldDirty 🚨 fix: safely access field._f during register (#13365) 🧹 close #13298: improve fieldState errors when resolver uses dot-notation string keys (#13350) 🐞 fix #13178: update state correctly in watch callback with Controller, trigger, and reset (#13180) 🐞 fix #13331: skip field array validation when mode is onBlur (#13333) 🐞 fix #13334 sDirty remains false after deletion an item with shouldDirty: true (#13357) 🐞 fix: handle nested field when parent defaultValue is null (#13348)

thanks to @​Prasadzoman, @​cyphercodes, @​lorenzoceglia, @​rizwan-rizu, @​tomeelog & @​ap0nia

Version 7.72.1

🐞 fix: add isDirty check for numeric string keys in defaultValues (issue #13346) (#13347) 🐞 fix: prevent setValue with shouldDirty from polluting unrelated dirty fields (#13326) 🐞 fix: memoize control in HookFormControlContext to prevent render conflicts (#13272) (#13312) 🐞 fix: isNameInFieldArray should check all ancestor paths for nested field arrays (#13318) 🐞 fix: #13320 formState.isValid incorrect on Controller re-mount (#13324)

thanks to @​6810779s, @​candymask0712, @​olagokemills, @​shahmir-oscilar & @​bae080311

Version 7.72.0

⚓️ feat: built-in form level validate (#13195)

useForm({
  validate: async ({ formValues }: FormValidateResult) => {
</tr></table>

... (truncated)

Commits
  • 8a816ed 7.74.0
  • ef641fe 🐞 fix: preserve previous field value when useController name changes (#13395)
  • a08a8e8 🐞 fix: handle null parent when unregistering nested field (#13396)
  • 2374a64 📖 thanks KANAME for the support over the years
  • 6737b99 🌡️ test: cover valueAsNumber NaN required validation in validateField (#13391)
  • 29cdd08 🐞 fix: treat NaN as empty when valueAsNumber is true in validateField (#13388)
  • 44df01d Revert "Revert "🪢 fix build to exclude test files (#13387)""
  • bf525c1 Revert "Revert "🪇 feat: setValues (#13201)""
  • 6cd9e45 7.73.1
  • 9b07561 Revert "🪢 fix build to exclude test files (#13387)"
  • Additional commits viewable in compare view

Updates simplebar-react from 3.3.1 to 3.3.2

Changelog

Sourced from simplebar-react's changelog.

v3.3.2 (Thu Jul 03 2025)

🐛 Bug Fix

⚠️ Pushed to master

Authors: 2

Commits

Updates socket.io-client from 4.8.1 to 4.8.3

Release notes

Sourced from socket.io-client's releases.

socket.io-client@4.8.3

There were some minor bug fixes on the server side, which mandate a client bump.

Dependencies

socket.io-client@4.8.2

Bug Fixes

  • bundle: do not mangle the "_placeholder" attribute (bis) (cdae019)
  • drain queue before emitting "connect" (#5259) (d19928e)

Dependencies

Commits
  • e9e5bed chore(release): socket.io-client@4.8.3
  • 9581f9b fix(sio): do not throw when calling io.close() on a stopped server
  • 579d43f refactor: remove unused files
  • ee9aac3 chore(release): socket.io-parser@4.2.5
  • 968277c chore(release): socket.io-adapter@2.5.6
  • 2bf16bd chore(release): engine.io-client@6.6.4
  • ad61607 docs(eio): fix link in the release notes
  • dd71792 chore(release): socket.io@4.8.2
  • bb0b480 fix(sio): improve io.close() function (#5344)
  • 161be91 test(sio): pin version of the client bundle in the tests
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for socket.io-client since your current version.


Updates tss-react from 4.9.18 to 4.9.20

Release notes

Sourced from tss-react's releases.

Release v4.9.20

Full Changelog: garronej/tss-react@v4.9.19...v4.9.20

Release v4.9.19

Full Changelog: garronej/tss-react@v4.9.18...v4.9.19

Commits

@dependabot
chore(deps): bump the npm-dependencies group with 22 updates
74a2961 
Bumps the npm-dependencies group with 22 updates:

| Package | From | To |
| --- | --- | --- |
| [@emotion/styled](https://github.com/emotion-js/emotion) | `11.14.0` | `11.14.1` |
| [@iconify/react](https://github.com/iconify/iconify/tree/HEAD/components/react) | `6.0.0` | `6.0.2` |
| [@mui/styles](https://github.com/mui/material-ui/tree/HEAD/packages/mui-styles) | `6.4.12` | `6.5.0` |
| [ajv](https://github.com/ajv-validator/ajv) | `8.17.1` | `8.20.0` |
| [axios](https://github.com/axios/axios) | `1.12.2` | `1.15.2` |
| [i18next-http-backend](https://github.com/i18next/i18next-http-backend) | `3.0.2` | `3.0.6` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.0` | `4.1.1` |
| [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.18.1` |
| [@types/lodash](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/lodash) | `4.17.17` | `4.17.24` |
| [ramda](https://github.com/ramda/ramda) | `0.30.1` | `0.32.0` |
| [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.57.0` | `7.74.0` |
| [simplebar-react](https://github.com/grsmto/simplebar/tree/HEAD/packages/simplebar-react) | `3.3.1` | `3.3.2` |
| [socket.io-client](https://github.com/socketio/socket.io) | `4.8.1` | `4.8.3` |
| [tss-react](https://github.com/garronej/tss-react) | `4.9.18` | `4.9.20` |
| [yaml](https://github.com/eemeli/yaml) | `2.8.0` | `2.8.3` |
| [@testing-library/dom](https://github.com/testing-library/dom-testing-library) | `10.4.0` | `10.4.1` |
| [@testing-library/jest-dom](https://github.com/testing-library/jest-dom) | `6.6.3` | `6.9.1` |
| [@testing-library/react](https://github.com/testing-library/react-testing-library) | `16.3.0` | `16.3.2` |
| [@types/ramda](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/ramda) | `0.30.2` | `0.31.1` |
| [eslint-plugin-import](https://github.com/import-js/eslint-plugin-import) | `2.31.0` | `2.32.0` |
| [eslint-plugin-react](https://github.com/jsx-eslint/eslint-plugin-react) | `7.37.4` | `7.37.5` |
| [ts-jest](https://github.com/kulshekhar/ts-jest) | `29.4.1` | `29.4.9` |


Updates `@emotion/styled` from 11.14.0 to 11.14.1
- [Release notes](https://github.com/emotion-js/emotion/releases)
- [Changelog](https://github.com/emotion-js/emotion/blob/main/CHANGELOG.md)
- [Commits](https://github.com/emotion-js/emotion/compare/@emotion/styled@11.14.0...@emotion/styled@11.14.1)

Updates `@iconify/react` from 6.0.0 to 6.0.2
- [Commits](https://github.com/iconify/iconify/commits/HEAD/components/react)

Updates `@mui/styles` from 6.4.12 to 6.5.0
- [Release notes](https://github.com/mui/material-ui/releases)
- [Changelog](https://github.com/mui/material-ui/blob/v6.5.0/CHANGELOG.md)
- [Commits](https://github.com/mui/material-ui/commits/v6.5.0/packages/mui-styles)

Updates `ajv` from 8.17.1 to 8.20.0
- [Release notes](https://github.com/ajv-validator/ajv/releases)
- [Commits](ajv-validator/ajv@v8.17.1...v8.20.0)

Updates `axios` from 1.12.2 to 1.15.2
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.12.2...v1.15.2)

Updates `i18next-http-backend` from 3.0.2 to 3.0.6
- [Changelog](https://github.com/i18next/i18next-http-backend/blob/master/CHANGELOG.md)
- [Commits](i18next/i18next-http-backend@v3.0.2...v3.0.6)

Updates `js-yaml` from 4.1.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)

Updates `lodash` from 4.17.21 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.18.1)

Updates `@types/lodash` from 4.17.17 to 4.17.24
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/lodash)

Updates `ramda` from 0.30.1 to 0.32.0
- [Release notes](https://github.com/ramda/ramda/releases)
- [Changelog](https://github.com/ramda/ramda/blob/master/CHANGELOG.md)
- [Commits](ramda/ramda@v0.30.1...v0.32.0)

Updates `react-hook-form` from 7.57.0 to 7.74.0
- [Release notes](https://github.com/react-hook-form/react-hook-form/releases)
- [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md)
- [Commits](react-hook-form/react-hook-form@v7.57.0...v7.74.0)

Updates `simplebar-react` from 3.3.1 to 3.3.2
- [Release notes](https://github.com/grsmto/simplebar/releases)
- [Changelog](https://github.com/Grsmto/simplebar/blob/master/packages/simplebar-react/CHANGELOG.md)
- [Commits](https://github.com/grsmto/simplebar/commits/simplebar-react@3.3.2/packages/simplebar-react)

Updates `socket.io-client` from 4.8.1 to 4.8.3
- [Release notes](https://github.com/socketio/socket.io/releases)
- [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md)
- [Commits](https://github.com/socketio/socket.io/compare/socket.io-client@4.8.1...socket.io-client@4.8.3)

Updates `tss-react` from 4.9.18 to 4.9.20
- [Release notes](https://github.com/garronej/tss-react/releases)
- [Commits](garronej/tss-react@v4.9.18...v4.9.20)

Updates `yaml` from 2.8.0 to 2.8.3
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.8.0...v2.8.3)

Updates `@testing-library/dom` from 10.4.0 to 10.4.1
- [Release notes](https://github.com/testing-library/dom-testing-library/releases)
- [Changelog](https://github.com/testing-library/dom-testing-library/blob/main/CHANGELOG.md)
- [Commits](testing-library/dom-testing-library@v10.4.0...v10.4.1)

Updates `@testing-library/jest-dom` from 6.6.3 to 6.9.1
- [Release notes](https://github.com/testing-library/jest-dom/releases)
- [Changelog](https://github.com/testing-library/jest-dom/blob/main/CHANGELOG.md)
- [Commits](testing-library/jest-dom@v6.6.3...v6.9.1)

Updates `@testing-library/react` from 16.3.0 to 16.3.2
- [Release notes](https://github.com/testing-library/react-testing-library/releases)
- [Changelog](https://github.com/testing-library/react-testing-library/blob/main/CHANGELOG.md)
- [Commits](testing-library/react-testing-library@v16.3.0...v16.3.2)

Updates `@types/lodash` from 4.17.17 to 4.17.24
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/lodash)

Updates `@types/ramda` from 0.30.2 to 0.31.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/ramda)

Updates `eslint-plugin-import` from 2.31.0 to 2.32.0
- [Release notes](https://github.com/import-js/eslint-plugin-import/releases)
- [Changelog](https://github.com/import-js/eslint-plugin-import/blob/main/CHANGELOG.md)
- [Commits](import-js/eslint-plugin-import@v2.31.0...v2.32.0)

Updates `eslint-plugin-react` from 7.37.4 to 7.37.5
- [Release notes](https://github.com/jsx-eslint/eslint-plugin-react/releases)
- [Changelog](https://github.com/jsx-eslint/eslint-plugin-react/blob/master/CHANGELOG.md)
- [Commits](jsx-eslint/eslint-plugin-react@v7.37.4...v7.37.5)

Updates `ts-jest` from 29.4.1 to 29.4.9
- [Release notes](https://github.com/kulshekhar/ts-jest/releases)
- [Changelog](https://github.com/kulshekhar/ts-jest/blob/main/CHANGELOG.md)
- [Commits](kulshekhar/ts-jest@v29.4.1...v29.4.9)

---
updated-dependencies:
- dependency-name: "@emotion/styled"
  dependency-version: 11.14.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: "@iconify/react"
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: "@mui/styles"
  dependency-version: 6.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: ajv
  dependency-version: 8.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: axios
  dependency-version: 1.15.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: i18next-http-backend
  dependency-version: 3.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: js-yaml
  dependency-version: 4.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: "@types/lodash"
  dependency-version: 4.17.24
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: ramda
  dependency-version: 0.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: react-hook-form
  dependency-version: 7.74.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: simplebar-react
  dependency-version: 3.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: socket.io-client
  dependency-version: 4.8.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: tss-react
  dependency-version: 4.9.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: yaml
  dependency-version: 2.8.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: "@testing-library/dom"
  dependency-version: 10.4.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: "@testing-library/jest-dom"
  dependency-version: 6.9.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: "@testing-library/react"
  dependency-version: 16.3.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: "@types/lodash"
  dependency-version: 4.17.24
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: "@types/ramda"
  dependency-version: 0.31.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: eslint-plugin-import
  dependency-version: 2.32.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: eslint-plugin-react
  dependency-version: 7.37.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: ts-jest
  dependency-version: 29.4.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github Apr 27, 2026

Labels

The following labels could not be found: dependabot. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Apr 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] approved these changes

@dennisvankekem dennisvankekem Awaiting requested review from dennisvankekem dennisvankekem is a code owner

@ferruhcihan ferruhcihan Awaiting requested review from ferruhcihan ferruhcihan is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@svcAPLBot