Skip to content

fix(deps): bump the prod-minor-patch group across 1 directory with 12 updates#409

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/prod-minor-patch-b211419737
Open

fix(deps): bump the prod-minor-patch group across 1 directory with 12 updates#409
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/prod-minor-patch-b211419737

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Jun 8, 2026

Bumps the prod-minor-patch group with 12 updates in the / directory:

Package From To
@ably/chat 1.3.1 1.4.0
@inquirer/prompts 8.4.2 8.5.2
@oclif/core 4.11.1 4.11.4
@oclif/plugin-autocomplete 3.2.48 3.2.50
@oclif/plugin-warn-if-update-available 3.1.63 3.1.65
react 19.2.6 19.2.7
react-dom 19.2.6 19.2.7
sigstore 4.1.0 4.1.1
tar 7.5.15 7.5.16
ws 8.20.0 8.21.0
lucide-react 1.14.0 1.17.0
tailwind-merge 3.5.0 3.6.0

Updates @ably/chat from 1.3.1 to 1.4.0

Release notes

Sourced from @​ably/chat's releases.

V1.4.0

What's Changed

New Contributors

Full Changelog: ably/ably-chat-js@1.3.1...1.4.0

Changelog

Sourced from @​ably/chat's changelog.

1.4.0 (2026-05-28)

New Features

  • Message Version History: Added room.messages.getVersions(serial) to retrieve the full version history of a message — the original create followed by any updates and deletes — in oldest-first order. #730
  • Idempotent REST Publishing: Added an opt-in idempotentRestPublishing flag on ChatClientOptions (default false). When enabled, the SDK attaches an idempotencyKey to send, update, and delete message requests so the server can deduplicate retried publish attempts. #726

Bug Fixes

  • Package Exports: Reordered the "types" condition to appear first in package.json exports so type resolution works correctly across bundlers. #725
  • Security: Bumped ws to 8.20.1 to resolve GHSA-58qx-3vcg-4xpx. #727
Commits
  • 1c9b068 Merge pull request #729 from ably/release/1.4.0
  • 89e560c chore: release 1.4.0
  • 47e4211 chore: release 1.4.0
  • 85b0e35 Merge pull request #730 from ably/feat/message-versions
  • 7770e52 docs: fix getVersions JSDoc and restore eslint ignores for local files
  • 3234f73 test: replace fixed sleep with vi.waitFor in versions integration test
  • b94dfd9 feat: add getVersions() to retrieve full message version history
  • b740b63 Merge pull request #726 from ably/feat/add-idempotent-rest-publish-support
  • f999a29 review: make idempotentRestPublishing required on ChatApi
  • 6592172 review: address PR #726 feedback
  • Additional commits viewable in compare view

Updates @inquirer/prompts from 8.4.2 to 8.5.2

Release notes

Sourced from @​inquirer/prompts's releases.

@​inquirer/prompts@​8.5.2

  • Fix security warnings in external-editor

@​inquirer/prompts@​8.5.1

  • Rolled back mute-stream dependency from v4 to v3 to undo breaking compatible engines.
  • Added tooling to prevent regression of the above in the future. This surfaced our min engines already enforced a higher limit, so adjusted the explicit limits to match the current state.

@​inquirer/prompts@​8.5.0

  • Feat: Read env variable INQUIRER_KEYBINDINGS to enable vim or emacs keybindings; making this a user preference instead of a library author preference. One caveat is doing so disable the search feature in the select prompt. Syntax: INQUIRER_KEYBINDINGS=vim,emacs.
  • Fix: Line wraps would sometime cause the cursor to be mispositioned relative to the input.
  • Chore: Bump dependencies.

@​inquirer/prompts@​8.4.3

  • Fix: Windows rendering bug
  • Fix: Preserve exact literal types in choices array (Typescript only)
  • Fix: Allow input default value to be of type undefined (Typescript only)
  • Bump dependencies
Commits
  • bfd8710 chore: Publish new release
  • 55cc5f3 feat: add reusable package lint CLI
  • 3af9ed0 test(inquirer): capture prompt runner output
  • 4381857 fix(@​inquirer/input): remove stale lint suppression
  • 45df331 fix(@​inquirer/external-editor): harden editor temp files
  • adef323 chore: limit CI token permissions
  • b43359d chore: Publish new release
  • 24ecae2 chore: fix yarn.lock
  • b078d97 fix: validate package engine compatibility
  • 3a49f9f chore(deps-dev): Bump oxfmt in the formatting group (#2143)
  • Additional commits viewable in compare view

Updates @oclif/core from 4.11.1 to 4.11.4

Release notes

Sourced from @​oclif/core's releases.

4.11.4

Bug Fixes

  • deps: bump semver from 7.8.0 to 7.8.1 (65e054c)

4.11.3

Bug Fixes

  • updating tinyglobby dependency [skip-validate-pr] (1dc29ff)

4.11.2

Bug Fixes

  • deps: bump semver from 7.7.4 to 7.8.0 (1471fe3)
Changelog

Sourced from @​oclif/core's changelog.

4.11.4 (2026-05-23)

Bug Fixes

  • deps: bump semver from 7.8.0 to 7.8.1 (65e054c)

4.11.3 (2026-05-15)

Bug Fixes

  • updating tinyglobby dependency [skip-validate-pr] (1dc29ff)

4.11.2 (2026-05-09)

Bug Fixes

  • deps: bump semver from 7.7.4 to 7.8.0 (1471fe3)
Commits
  • d55138e chore(release): 4.11.4 [skip ci]
  • ef99bf7 Merge pull request #1604 from oclif/dependabot-npm_and_yarn-semver-7.8.1
  • 65e054c fix(deps): bump semver from 7.8.0 to 7.8.1
  • 09e6926 Merge pull request #1602 from oclif/dependabot-npm_and_yarn-oclif-plugin-plug...
  • 6b029a8 chore(dev-deps): bump @​oclif/plugin-plugins from 5.4.68 to 5.4.69
  • bd28ff2 Merge pull request #1598 from oclif/dependabot-npm_and_yarn-oclif-plugin-help...
  • 37cb4d8 Merge pull request #1599 from oclif/dependabot-npm_and_yarn-oclif-plugin-plug...
  • a240a45 chore(dev-deps): bump @​oclif/plugin-plugins from 5.4.65 to 5.4.68
  • ae42b32 chore(dev-deps): bump @​oclif/plugin-help from 6.2.47 to 6.2.48
  • 101c033 chore(release): 4.11.3 [skip ci]
  • Additional commits viewable in compare view

Updates @oclif/plugin-autocomplete from 3.2.48 to 3.2.50

Release notes

Sourced from @​oclif/plugin-autocomplete's releases.

3.2.50

Bug Fixes

  • deps: bump @​oclif/core from 4.11.3 to 4.11.4 (#1151) (f25d073)

3.2.49

Bug Fixes

  • deps: bump @​oclif/core from 4.11.0 to 4.11.2 (#1146) (4127ce2)
Changelog

Sourced from @​oclif/plugin-autocomplete's changelog.

3.2.50 (2026-05-24)

Bug Fixes

  • deps: bump @​oclif/core from 4.11.3 to 4.11.4 (#1151) (f25d073)

3.2.49 (2026-05-10)

Bug Fixes

  • deps: bump @​oclif/core from 4.11.0 to 4.11.2 (#1146) (4127ce2)
Commits
  • 7121dfb chore(release): 3.2.50 [skip ci]
  • f25d073 fix(deps): bump @​oclif/core from 4.11.3 to 4.11.4 (#1151)
  • 6434cf0 chore(dev-deps): bump oclif from 4.23.5 to 4.23.7 (#1152)
  • e57879e chore(dev-deps): bump eslint-config-oclif from 6.0.164 to 6.0.165 (#1153)
  • 6f0f40b chore(dev-deps): bump eslint-config-oclif from 6.0.162 to 6.0.164 (#1147)
  • cee68f5 chore(dev-deps): bump oclif from 4.23.0 to 4.23.5 (#1150)
  • 0fe489d chore(dev-deps): bump eslint-config-oclif from 6.0.160 to 6.0.162 (#1144)
  • de7a0ad chore(dev-deps): bump @​oclif/plugin-help from 6.2.45 to 6.2.48 (#1145)
  • 5250e7c chore(release): 3.2.49 [skip ci]
  • 4127ce2 fix(deps): bump @​oclif/core from 4.11.0 to 4.11.2 (#1146)
  • See full diff in compare view

Updates @oclif/plugin-warn-if-update-available from 3.1.63 to 3.1.65

Release notes

Sourced from @​oclif/plugin-warn-if-update-available's releases.

3.1.65

Bug Fixes

  • deps: bump @​oclif/core from 4.11.2 to 4.11.3 (#1019) (8a5e833)

3.1.64

Bug Fixes

  • deps: bump @​oclif/core from 4.11.0 to 4.11.2 (#1016) (6aa16a8)
Changelog

Sourced from @​oclif/plugin-warn-if-update-available's changelog.

3.1.65 (2026-05-17)

Bug Fixes

  • deps: bump @​oclif/core from 4.11.2 to 4.11.3 (#1019) (8a5e833)

3.1.64 (2026-05-10)

Bug Fixes

  • deps: bump @​oclif/core from 4.11.0 to 4.11.2 (#1016) (6aa16a8)
Commits
  • 26797da chore(release): 3.1.65 [skip ci]
  • 8a5e833 fix(deps): bump @​oclif/core from 4.11.2 to 4.11.3 (#1019)
  • d8e24c6 chore(dev-deps): bump eslint-config-oclif from 6.0.162 to 6.0.164 (#1020)
  • c7801bd chore(release): 3.1.64 [skip ci]
  • 6aa16a8 fix(deps): bump @​oclif/core from 4.11.0 to 4.11.2 (#1016)
  • 505e8eb chore(dev-deps): bump eslint-config-oclif from 6.0.160 to 6.0.162 (#1017)
  • See full diff in compare view

Updates react from 19.2.6 to 19.2.7

Release notes

Sourced from react's releases.

19.2.7 (June 1st, 2026)

React Server Components

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react since your current version.


Updates react-dom from 19.2.6 to 19.2.7

Release notes

Sourced from react-dom's releases.

19.2.7 (June 1st, 2026)

React Server Components

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react-dom since your current version.


Updates sigstore from 4.1.0 to 4.1.1

Release notes

Sourced from sigstore's releases.

sigstore@4.1.1

Patch Changes

  • 7845532: Verification of OID certificate extensions
  • f074710: Require inclusion promise in Rekor entry when used as timestamp source
  • Updated dependencies [b5aa4f1]
  • Updated dependencies [7845532]
  • Updated dependencies [f074710]
    • @​sigstore/core@​3.2.1
    • @​sigstore/verify@​3.1.1
Commits

Updates tar from 7.5.15 to 7.5.16

Commits

Updates ws from 8.20.0 to 8.21.0

Release notes

Sourced from ws's releases.

8.21.0

Features

  • Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

  • Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});

The vulnerability was responsibly disclosed and fixed by Nadav Magier.

In vulnerable versions, the issue can be mitigated by lowering the value of the maxPayload option if possible.

8.20.1

... (truncated)

Commits
  • bca91ad [dist] 8.21.0
  • 2b2abd4 [security] Limit retained message parts
  • 78eabe2 [security] Add latest vulnerability to SECURITY.md
  • 5d9b316 [dist] 8.20.1
  • c0327ec [security] Fix uninitialized memory disclosure in websocket.close()
  • ce2a3d6 [ci] Test on node 26
  • 58e45b8 [ci] Do not test on node 25
  • 5f26c24 [ci] Run the lint step on node 24
  • See full diff in compare view

Updates lucide-react from 1.14.0 to 1.17.0

Release notes

Sourced from lucide-react's releases.

Version 1.17.0

What's Changed

Full Changelog: lucide-icons/lucide@1.16.0...1.17.0

Version 1.16.0

What's Changed

Full Changelog: lucide-icons/lucide@1.15.0...1.16.0

Version 1.15.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.14.0...1.15.0

Commits

Updates tailwind-merge from 3.5.0 to 3.6.0

Release notes

Sourced from tailwind-merge's releases.

v3.6.0

New Features

Documentation

Other

Full Changelog: dcastil/tailwind-merge@v3.5.0...v3.6.0

Thanks to @​brandonmcconnell, @​manavm1990, @​langy, @​roboflow, @​syntaxfm, @​getsentry, @​codecov, a private sponsor, @​block, @​openclaw, @​sourcegraph, @​mike-healy and more via @​thnxdev for sponsoring tailwind-merge! ❤️

Commits
  • d54f7e5 v3.6.0
  • 638871a Update README to add info about Tailwind CSS v4.3 support
  • 39fc7b5 Revert "v3.6.0"
  • bd8390f v3.6.0
  • 802877c add v3.6.0 changelog
  • a35feda Merge pull request #665 from dcastil/renovate/rollup-plugin-babel-7.x
  • 940389c Merge pull request #667 from dcastil/renovate/release-drafter-release-drafter...
  • 005af6d pin to specific version
  • 5816ced implement breaking changes
  • 17041e1 Merge pull request #676 from dcastil/dependabot/npm_and_yarn/babel/plugin-tra...
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
fix(deps): bump the prod-minor-patch group across 1 directory with 12…
2a4803e 
… updates

Bumps the prod-minor-patch group with 12 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@ably/chat](https://github.com/ably/ably-chat-js) | `1.3.1` | `1.4.0` |
| [@inquirer/prompts](https://github.com/SBoudrias/Inquirer.js) | `8.4.2` | `8.5.2` |
| [@oclif/core](https://github.com/oclif/core) | `4.11.1` | `4.11.4` |
| [@oclif/plugin-autocomplete](https://github.com/oclif/plugin-autocomplete) | `3.2.48` | `3.2.50` |
| [@oclif/plugin-warn-if-update-available](https://github.com/oclif/plugin-warn-if-update-available) | `3.1.63` | `3.1.65` |
| [react](https://github.com/facebook/react/tree/HEAD/packages/react) | `19.2.6` | `19.2.7` |
| [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) | `19.2.6` | `19.2.7` |
| [sigstore](https://github.com/sigstore/sigstore-js) | `4.1.0` | `4.1.1` |
| [tar](https://github.com/isaacs/node-tar) | `7.5.15` | `7.5.16` |
| [ws](https://github.com/websockets/ws) | `8.20.0` | `8.21.0` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.14.0` | `1.17.0` |
| [tailwind-merge](https://github.com/dcastil/tailwind-merge) | `3.5.0` | `3.6.0` |



Updates `@ably/chat` from 1.3.1 to 1.4.0
- [Release notes](https://github.com/ably/ably-chat-js/releases)
- [Changelog](https://github.com/ably/ably-chat-js/blob/main/CHANGELOG.md)
- [Commits](ably/ably-chat-js@1.3.1...1.4.0)

Updates `@inquirer/prompts` from 8.4.2 to 8.5.2
- [Release notes](https://github.com/SBoudrias/Inquirer.js/releases)
- [Commits](https://github.com/SBoudrias/Inquirer.js/compare/@inquirer/prompts@8.4.2...@inquirer/prompts@8.5.2)

Updates `@oclif/core` from 4.11.1 to 4.11.4
- [Release notes](https://github.com/oclif/core/releases)
- [Changelog](https://github.com/oclif/core/blob/main/CHANGELOG.md)
- [Commits](oclif/core@4.11.1...4.11.4)

Updates `@oclif/plugin-autocomplete` from 3.2.48 to 3.2.50
- [Release notes](https://github.com/oclif/plugin-autocomplete/releases)
- [Changelog](https://github.com/oclif/plugin-autocomplete/blob/main/CHANGELOG.md)
- [Commits](oclif/plugin-autocomplete@3.2.48...3.2.50)

Updates `@oclif/plugin-warn-if-update-available` from 3.1.63 to 3.1.65
- [Release notes](https://github.com/oclif/plugin-warn-if-update-available/releases)
- [Changelog](https://github.com/oclif/plugin-warn-if-update-available/blob/main/CHANGELOG.md)
- [Commits](oclif/plugin-warn-if-update-available@3.1.63...3.1.65)

Updates `react` from 19.2.6 to 19.2.7
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react)

Updates `react-dom` from 19.2.6 to 19.2.7
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react-dom)

Updates `sigstore` from 4.1.0 to 4.1.1
- [Release notes](https://github.com/sigstore/sigstore-js/releases)
- [Commits](https://github.com/sigstore/sigstore-js/compare/sigstore@4.1.0...sigstore@4.1.1)

Updates `tar` from 7.5.15 to 7.5.16
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-tar@v7.5.15...v7.5.16)

Updates `ws` from 8.20.0 to 8.21.0
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.20.0...8.21.0)

Updates `lucide-react` from 1.14.0 to 1.17.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.17.0/packages/lucide-react)

Updates `tailwind-merge` from 3.5.0 to 3.6.0
- [Release notes](https://github.com/dcastil/tailwind-merge/releases)
- [Commits](dcastil/tailwind-merge@v3.5.0...v3.6.0)

---
updated-dependencies:
- dependency-name: "@ably/chat"
  dependency-version: 1.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-patch
- dependency-name: "@inquirer/prompts"
  dependency-version: 8.5.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-patch
- dependency-name: "@oclif/core"
  dependency-version: 4.11.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-minor-patch
- dependency-name: "@oclif/plugin-autocomplete"
  dependency-version: 3.2.50
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-minor-patch
- dependency-name: "@oclif/plugin-warn-if-update-available"
  dependency-version: 3.1.65
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-minor-patch
- dependency-name: react
  dependency-version: 19.2.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-minor-patch
- dependency-name: react-dom
  dependency-version: 19.2.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-minor-patch
- dependency-name: sigstore
  dependency-version: 4.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-minor-patch
- dependency-name: tar
  dependency-version: 7.5.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-minor-patch
- dependency-name: ws
  dependency-version: 8.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-patch
- dependency-name: lucide-react
  dependency-version: 1.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-patch
- dependency-name: tailwind-merge
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jun 8, 2026
@vercel
Copy link
Copy Markdown

vercel Bot commented Jun 8, 2026 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
cli-web-cli Ready Ready Preview, Comment Jun 8, 2026 9:30am

Request Review

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants