Skip to content

chore(deps): bump the minor-and-patch group across 1 directory with 10 updates - #213

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/frontend/minor-and-patch-1e5b002df0
Open

chore(deps): bump the minor-and-patch group across 1 directory with 10 updates#213
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/frontend/minor-and-patch-1e5b002df0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 10 updates in the /frontend directory:

Package From To
axios 1.18.1 1.19.0
libphonenumber-js 1.13.9 1.13.10
lucide-react 1.27.0 1.28.0
@playwright/test 1.62.0 1.62.1
@types/node 26.1.1 26.1.2
@types/react 19.2.17 19.2.18
@types/react-dom 19.2.3 19.2.4
playwright 1.62.0 1.62.1
postcss 8.5.23 8.5.25
shadcn 4.15.0 4.16.1

Updates axios from 1.18.1 to 1.19.0

Release notes

Sourced from axios's releases.

v1.19.0 - July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

  • Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

  • Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)
  • Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
  • HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

  • Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)
  • Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)
  • Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)
  • Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)
  • URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11024, #11038)
  • Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)
  • Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)
  • Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)
  • Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

  • Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)
  • Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)
  • Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)
  • Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)
  • Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)
  • Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

... (truncated)

Changelog

Sourced from axios's changelog.

v1.19.0 — July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

  • Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

  • Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)
  • Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
  • HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

  • Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)

  • Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)

  • Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)

  • Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)

  • URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11008, #11038)

  • Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)

  • Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)

  • Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)

  • Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

  • Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)
  • Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)
  • Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)
  • Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)
  • Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)
  • Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

... (truncated)

Commits
  • 311fcc5 chore(release): prepare release 1.19.0 (#11095)
  • cb4fd74 chore(deps): bump axios from 1.16.1 to 1.18.1 in /docs (#11088)
  • 004c93a chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 in the github-action...
  • 122edde chore(deps-dev): bump the development_dependencies group with 3 updates (#11089)
  • c44f8d0 ci: use bundled npm for v1 publish (#11083)
  • 878bb29 fix(sandbox): resolve TypeError on constant variable path assignment (#11073)
  • a092bae fix(core): synchronous interceptors swallow errors and proceed with request (...
  • 3041b8f feat(HttpStatusCode): add missing 520 status code (#11067)
  • 58b16c8 refactor(helpers): extract duplicated setFormDataHeaders into a shared helper...
  • 3077e62 feat(types): Allow the Params property to be typed, instead of any (#11081)
  • Additional commits viewable in compare view

Updates libphonenumber-js from 1.13.9 to 1.13.10

Changelog

Sourced from libphonenumber-js's changelog.

1.13.10 / 30.7.2026

  • Updated metadata to version 9.0.36:
    • Updated alternate formatting data for country calling code(s): 995
    • Updated phone metadata for region code(s): BD, EH, FO, GE, IL, LI, MA, ML, NO, SJ
    • Updated short number metadata for region code(s): FO, IT
    • Updated carrier data for country calling code(s): 47 (en), 61 (en), 212 (en), 256 (en), 298 (en), 423 (en), 972 (en), 995 (en)
Commits

Updates lucide-react from 1.27.0 to 1.28.0

Release notes

Sourced from lucide-react's releases.

Version 1.28.0

What's Changed

Full Changelog: lucide-icons/lucide@1.27.0...1.28.0

Commits

Updates @playwright/test from 1.62.0 to 1.62.1

Release notes

Sourced from @​playwright/test's releases.

v1.62.1

Bug Fixes

  • #41989 [Regression]: tsconfig "extends" bare specifier isn't resolved via node_modules walk-up like tsc (fatal since 1.62)
  • #41998 [Regression]: directory-form tsconfig project references ("path": "../pkg") fail to resolve (fatal since 1.62)
  • #41985 Accessibility snapshot drops button name when text is nested inside spans with aria-hidden SVG
  • #42000 [Regression]: page.evaluate() arg of a branded primitive type (string & { brand }) no longer type-checks since 1.62
  • #42013 [BUG]Image-type actionable elements are not presented in the snapshot.
Commits
  • 26a9e47 cherry-pick(#42043): docs: release notes for v1.62 Python, Java, and .NET (#4...
  • 0a81d5d cherry-pick(#42040): docs(release-notes): mention the isolated headless clipb...
  • 8376826 cherry-pick(#42034): fix(aria): keep icon-only clickable elements in ai snaps...
  • 66c5cc9 chore: mark v1.62.1 (#42020)
  • 9672bc3 cherry-pick(#42009): fix(types): support branded primitives in evaluate argum...
  • 4325804 cherry-pick(#41988): fix(aria): preserve names from collapsed text contributors
  • 9632f8e cherry-pick(#42005): fix(tsconfig): do not throw when "extends"/"references" ...
  • See full diff in compare view

Updates @types/node from 26.1.1 to 26.1.2

Commits

Updates @types/react from 19.2.17 to 19.2.18

Commits

Updates @types/react-dom from 19.2.3 to 19.2.4

Commits

Updates playwright from 1.62.0 to 1.62.1

Release notes

Sourced from playwright's releases.

v1.62.1

Bug Fixes

  • #41989 [Regression]: tsconfig "extends" bare specifier isn't resolved via node_modules walk-up like tsc (fatal since 1.62)
  • #41998 [Regression]: directory-form tsconfig project references ("path": "../pkg") fail to resolve (fatal since 1.62)
  • #41985 Accessibility snapshot drops button name when text is nested inside spans with aria-hidden SVG
  • #42000 [Regression]: page.evaluate() arg of a branded primitive type (string & { brand }) no longer type-checks since 1.62
  • #42013 [BUG]Image-type actionable elements are not presented in the snapshot.
Commits
  • 26a9e47 cherry-pick(#42043): docs: release notes for v1.62 Python, Java, and .NET (#4...
  • 0a81d5d cherry-pick(#42040): docs(release-notes): mention the isolated headless clipb...
  • 8376826 cherry-pick(#42034): fix(aria): keep icon-only clickable elements in ai snaps...
  • 66c5cc9 chore: mark v1.62.1 (#42020)
  • 9672bc3 cherry-pick(#42009): fix(types): support branded primitives in evaluate argum...
  • 4325804 cherry-pick(#41988): fix(aria): preserve names from collapsed text contributors
  • 9632f8e cherry-pick(#42005): fix(tsconfig): do not throw when "extends"/"references" ...
  • See full diff in compare view

Updates postcss from 8.5.23 to 8.5.25

Release notes

Sourced from postcss's releases.

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).
Changelog

Sourced from postcss's changelog.

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).
Commits

Updates shadcn from 4.15.0 to 4.16.1

Release notes

Sourced from shadcn's releases.

shadcn@4.16.1

Patch Changes

shadcn@4.16.0

Minor Changes

Changelog

Sourced from shadcn's changelog.

4.16.1

Patch Changes

4.16.0

Minor Changes

Commits

@dependabot @github

dependabot Bot commented on behalf of github Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot
dependabot Bot requested a review from itsbkm as a code owner August 3, 2026 01:09
@dependabot
chore(deps): bump the minor-and-patch group across 1 directory with 1…
7a59570 
…0 updates

Bumps the minor-and-patch group with 10 updates in the /frontend directory:

| Package | From | To |
| --- | --- | --- |
| [axios](https://github.com/axios/axios) | `1.18.1` | `1.19.0` |
| [libphonenumber-js](https://gitlab.com/catamphetamine/libphonenumber-js) | `1.13.9` | `1.13.10` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.27.0` | `1.28.0` |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.62.0` | `1.62.1` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.1` | `26.1.2` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.17` | `19.2.18` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.3` | `19.2.4` |
| [playwright](https://github.com/microsoft/playwright) | `1.62.0` | `1.62.1` |
| [postcss](https://github.com/postcss/postcss) | `8.5.23` | `8.5.25` |
| [shadcn](https://github.com/shadcn-ui/ui/tree/HEAD/packages/shadcn) | `4.15.0` | `4.16.1` |



Updates `axios` from 1.18.1 to 1.19.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.18.1...v1.19.0)

Updates `libphonenumber-js` from 1.13.9 to 1.13.10
- [Changelog](https://gitlab.com/catamphetamine/libphonenumber-js/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/catamphetamine/libphonenumber-js/commits/master)

Updates `lucide-react` from 1.27.0 to 1.28.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.28.0/packages/lucide-react)

Updates `@playwright/test` from 1.62.0 to 1.62.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.62.0...v1.62.1)

Updates `@types/node` from 26.1.1 to 26.1.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/react` from 19.2.17 to 19.2.18
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `@types/react-dom` from 19.2.3 to 19.2.4
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `playwright` from 1.62.0 to 1.62.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.62.0...v1.62.1)

Updates `postcss` from 8.5.23 to 8.5.25
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.23...8.5.25)

Updates `shadcn` from 4.15.0 to 4.16.1
- [Release notes](https://github.com/shadcn-ui/ui/releases)
- [Changelog](https://github.com/shadcn-ui/ui/blob/main/packages/shadcn/CHANGELOG.md)
- [Commits](https://github.com/shadcn-ui/ui/commits/shadcn@4.16.1/packages/shadcn)

---
updated-dependencies:
- dependency-name: "@playwright/test"
  dependency-version: 1.62.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@types/node"
  dependency-version: 26.1.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@types/react"
  dependency-version: 19.2.18
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@types/react-dom"
  dependency-version: 19.2.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: axios
  dependency-version: 1.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: libphonenumber-js
  dependency-version: 1.13.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: lucide-react
  dependency-version: 1.28.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: playwright
  dependency-version: 1.62.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: postcss
  dependency-version: 8.5.25
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: shadcn
  dependency-version: 4.16.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore(deps): bump the minor-and-patch group in /frontend with 10 updates chore(deps): bump the minor-and-patch group across 1 directory with 10 updates Aug 3, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/frontend/minor-and-patch-1e5b002df0 branch from d320d0c to 7a59570 Compare August 3, 2026 20:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@itsbkm itsbkm Awaiting requested review from itsbkm itsbkm is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants