chore(deps): bump the everything-else group across 1 directory with 18 updates by dependabot[bot] · Pull Request #6582 · redis/RedisInsight

dependabot · 2026-11-09T00:08:13Z

Bumps the everything-else group with 18 updates in the / directory:

Package	From	To
@rdi-ui/pipeline	`0.1.35`	`0.1.51`
@sentry/electron	`7.18.0`	`7.20.2`
@sentry/react	`10.73.0`	`10.78.0`
axios	`1.20.0`	`1.21.0`
d3	`7.9.0`	`7.9.2`
dompurify	`3.4.14`	`3.4.17`
jszip	`3.10.1`	`3.10.2`
react-hook-form	`7.87.0`	`7.91.0`
socket.io-client	`4.8.3`	`4.8.4`
unist-util-visit	`5.1.0`	`5.2.0`
@sentry/vite-plugin	`5.4.0`	`5.4.1`
@sentry/webpack-plugin	`5.4.0`	`5.4.1`
@types/lodash	`4.17.25`	`4.17.27`
concurrently	`9.2.4`	`9.2.5`
core-js	`3.50.0`	`3.51.0`
csv-stringify	`6.8.3`	`6.9.0`
moment	`2.30.1`	`2.31.0`
tsx	`4.23.13`	`4.23.15`

Updates @rdi-ui/pipeline from 0.1.35 to 0.1.51

Updates @sentry/electron from 7.18.0 to 7.20.2

Release notes

Sourced from @sentry/electron's releases.

7.20.2

Bug Fixes 🐛

V7

Only add main process context lines to renderer frames in the app directory by @timfish in #1475

Allow removal of message listeners on utility processes by @timfish in #1474

Stop re-running event processors on every main process scope change by @timfish in #1470

7.20.1

Bug Fixes 🐛

Handle v1 standalone span envelopes from renderers (v7) by @timfish in #1451

Keep framework SDK default integrations in renderer init (v7) by @timfish in #1454

Internal Changes 🔧

Change the publish tag by @timfish in #1455

New Electron versions by @github-actions in #1434

7.20.0

New Features ✨

Return the real send result for renderer sendFeedback by @timfish in #1433

Update Sentry SDKs to v10.75.0 by @github-actions in #1431

Bug Fixes 🐛

Honour enabled: false for envelopes forwarded from renderers and utility processes by @timfish in #1432

Internal Changes 🔧

New Electron versions by @github-actions in #1430

7.19.0

New Features ✨

Update Sentry SDKs to v10.74.0 by @github-actions in #1426

Internal Changes 🔧

(deps-dev) Bump vitest from 4.1.0 to 4.1.11 by @dependabot in #1427

New Electron versions by @github-actions in #1425

Stabilize flaky window-good session test on Windows by @timfish in #1419

New Electron versions by @github-actions in #1424

Changelog

Sourced from @sentry/electron's changelog.

7.20.2

Bug Fixes 🐛

V7

Only add main process context lines to renderer frames in the app directory by @timfish in #1475

Allow removal of message listeners on utility processes by @timfish in #1474

Stop re-running event processors on every main process scope change by @timfish in #1470

7.20.1

Bug Fixes 🐛

Handle v1 standalone span envelopes from renderers (v7) by @timfish in #1451

Keep framework SDK default integrations in renderer init (v7) by @timfish in #1454

Internal Changes 🔧

Change the publish tag by @timfish in #1455

New Electron versions by @github-actions in #1434

7.20.0

New Features ✨

Return the real send result for renderer sendFeedback by @timfish in #1433

Update Sentry SDKs to v10.75.0 by @github-actions in #1431

Bug Fixes 🐛

Honour enabled: false for envelopes forwarded from renderers and utility processes by @timfish in #1432

Internal Changes 🔧

New Electron versions by @github-actions in #1430

7.19.0

New Features ✨

Update Sentry SDKs to v10.74.0 by @github-actions in #1426

Internal Changes 🔧

(deps-dev) Bump vitest from 4.1.0 to 4.1.11 by @dependabot in #1427

New Electron versions by @github-actions in #1425

Stabilize flaky window-good session test on Windows by @timfish in #1419

New Electron versions by @github-actions in #1424

Commits

64029a3 release: 7.20.2
faf4ce9 fix(v7): Only add main process context lines to renderer frames in the app di...
35cb0be fix(v7): Allow removal of message listeners on utility processes (#1474)
e3d93b9 fix(v7): Stop re-running event processors on every main process scope change ...
778502a Merge commit 'd1b000e78fd86476f49e6fec4207385a60196b09' into v7
d1b000e release: 7.20.1
877b0ab chore: Change the publish tag (#1455)
d3c6736 fix: Handle v1 standalone span envelopes from renderers (v7) (#1451)
9ff12c9 fix: Keep framework SDK default integrations in renderer init (v7) (#1454)
1a500a8 Merge remote-tracking branch 'remotes/origin/release/7.20.0'
Additional commits viewable in compare view

Updates @sentry/react from 10.73.0 to 10.78.0

Release notes

Sourced from @sentry/react's releases.

10.78.0

feat(v10/deno): Re-export portable helpers that Cloudflare exposes (#25708)

fix(v10/core): Drop sampled-out errors before they take a promise buffer slot (#25753)

fix(v10/core): Stop sending client reports for breadcrumbs (#25752)

fix(v10/core): Use trace_metric data category for metrics rate limits and client reports (#25612)

fix(v10/nextjs): Don't crash Cloudflare workers on import of the Next.js version helper (#25730)

Bundle size 📦

Path Size

@sentry/browser 27.64 KB

@sentry/browser - with treeshaking flags 26.12 KB

@sentry/browser (incl. Tracing) 46.2 KB

@sentry/browser (incl. Tracing + Span Streaming) 47.96 KB

@sentry/browser (incl. Tracing, Profiling) 50.87 KB

@sentry/browser (incl. Tracing, Replay) 84.73 KB

@sentry/browser (incl. Tracing, Replay) - with treeshaking flags 74.6 KB

@sentry/browser (incl. Tracing, Replay with Canvas) 89.33 KB

@sentry/browser (incl. Tracing, Replay, Feedback) 101.65 KB

@sentry/browser (incl. Feedback) 44.42 KB

@sentry/browser (incl. sendFeedback) 32.34 KB

@sentry/browser (incl. FeedbackAsync) 37.34 KB

@sentry/browser (incl. Metrics) 28.7 KB

@sentry/browser (incl. Logs) 28.94 KB

@sentry/browser (incl. Metrics & Logs) 29.6 KB

@sentry/react 29.42 KB

@sentry/react (incl. Tracing) 48.46 KB

@sentry/vue 33.39 KB

@sentry/vue (incl. Tracing) 48.52 KB

@sentry/svelte 27.66 KB

CDN Bundle 30 KB

CDN Bundle (incl. Tracing) 48.13 KB

CDN Bundle (incl. Logs, Metrics) 31.56 KB

CDN Bundle (incl. Tracing, Logs, Metrics) 49.42 KB

CDN Bundle (incl. Replay, Logs, Metrics) 70.13 KB

CDN Bundle (incl. Tracing, Replay) 84.97 KB

CDN Bundle (incl. Tracing, Replay, Logs, Metrics) 86.24 KB

CDN Bundle (incl. Tracing, Replay, Feedback) 90.65 KB

CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) 91.9 KB

CDN Bundle - uncompressed 89.11 KB

CDN Bundle (incl. Tracing) - uncompressed 145.03 KB

CDN Bundle (incl. Logs, Metrics) - uncompressed 93.71 KB

CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed 148.92 KB

CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed 216.26 KB

CDN Bundle (incl. Tracing, Replay) - uncompressed 262.18 KB

CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed 266.05 KB

CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed 275.56 KB

CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed 279.42 KB

@sentry/nextjs (client) 51.06 KB

... (truncated)

Changelog

Sourced from @sentry/react's changelog.

10.78.0

feat(v10/deno): Re-export portable helpers that Cloudflare exposes (#25708)

fix(v10/core): Drop sampled-out errors before they take a promise buffer slot (#25753)

fix(v10/core): Stop sending client reports for breadcrumbs (#25752)

fix(v10/core): Use trace_metric data category for metrics rate limits and client reports (#25612)

fix(v10/nextjs): Don't crash Cloudflare workers on import of the Next.js version helper (#25730)

10.77.1

Important Changes
feat(v10/nextjs): Add a tunnel route handler that sends only the event payload to Sentry (#25559)

The tunnelRoute option can now send events through a route handler in your app. The handler forwards only the event payload to Sentry, and no request headers. To use it, add this file next to your tunnelRoute option:
// app/sentry-tunnel/route.ts (or src/app/sentry-tunnel/route.ts)
export { POST } from '@sentry/nextjs/tunnel';
The handler accepts events for the DSN of your server SDK. To accept other DSNs, use createSentryTunnelRoute({ allowedDsns }) from the same import. Without the file, the tunnel route works as before.

With the handler, tunnel requests go through your middleware. If your middleware blocks unauthenticated requests, exclude the tunnel route in its matcher.

Also, the server no longer sends spans of tunnel requests when span streaming is on, because these spans only show the SDK's own traffic.
feat(v10/nextjs): Send tunnel route requests with credentials: 'omit' (#25561)

With tunnelRoute and no tunnel route handler, @sentry/nextjs now sends events from the browser with credentials: 'omit', because the tunnel route does not need cookies. If a layer in front of your app checks cookies before it lets requests through (for example Vercel Deployment Protection), you can send them again in your browser Sentry.init call:
// instrumentation-client.ts
Sentry.init({
  transportOptions: { fetchOptions: { credentials: 'same-origin' } },
});
fix(v10/deps)!: Limit @opentelemetry/api to <1.10.0 and the OpenTelemetry SDK to <3.0.0 (#25715)

Breaking change

If your app uses @opentelemetry/api 1.10.0 or OpenTelemetry SDK v3 together with v10 of the Sentry SDK, you must stay on @opentelemetry/api below 1.10.0 and OpenTelemetry SDK v2, or upgrade to v11.

@opentelemetry/api 1.10.0 only works with OpenTelemetry SDK v3 (@opentelemetry/core 3.x, @opentelemetry/instrumentation 0.300.x). The SDK v2 packages that v10 uses only support @opentelemetry/api below 1.10.0, and SDK v3 needs Node.js 22.15.0 or newer, while v10 supports Node.js 18 and newer. For this reason, v10 now limits @opentelemetry/api to <1.10.0, and the @opentelemetry/instrumentation and @opentelemetry/exporter-trace-otlp-http peer dependencies of @sentry/node-core to <0.300.0.

If your app depends on @opentelemetry/api directly, use a version below 1.10.0 (for example ~1.9.1). With 1.10.0, your app and the Sentry SDK use different copies of the API, and the OpenTelemetry calls of your app do not see the tracer provider of the Sentry SDK.

To use @opentelemetry/api 1.10.0 and OpenTelemetry SDK v3, upgrade to v11 of the Sentry SDK. For the upgrade steps, see the migration guide.

... (truncated)

Commits

5f277de release: 10.78.0
a4cc5f9 meta(changelog): Update changelog for 10.78.0 (#25831)
e4ea7fd fix(v10/deno): Re-export portable helpers that Cloudflare exposes (#25708)
26744d3 fix(v10/core): Drop sampled-out errors before they take a promise buffer slot...
3c8e1d7 fix(v10/core): Stop sending client reports for breadcrumbs (#25752)
0664050 fix(v10/nextjs): Don't crash Cloudflare workers on import of the Next.js vers...
76defeb fix(v10/core): Use trace_metric data category for metrics rate limits and c...
e2fa5ba meta(changelog): Merge 10.77.0 into 10.77.1 because 10.77.0 was not released ...
bb2bb52 fix(v10/astro): defer to @sentry/cloudflare/vite on Cloudflare Workers (#25...
65d23eb fix(v10/elysia): Set SDK metadata on the options passed to init (#25486)
Additional commits viewable in compare view

Updates axios from 1.20.0 to 1.21.0

Release notes

Sourced from axios's releases.

v1.21.0 — October 21, 2026

This release adds response timing and opt-in UTF-8 Basic authentication, improves request handling across runtimes, and changes how header defaults are recognized.

⚠️ Breaking Changes & Deprecations

Header Defaults: Only plain objects, null-prototype maps, and compatible AxiosHeaders instances are treated as common or method-specific defaults; literal headers such as Link are now preserved. Applications using custom class instances as defaults must convert them to plain maps, for example { post: { ...customDefaults } }, or compatible AxiosHeaders. Otherwise, those instances become literal header values, including on requests using other methods. (#11156)

🚀 New Features

Response Timing: Added response.duration, in milliseconds, including on error.response when present. Timing measures adapter execution and excludes interceptors and transforms; streamed responses stop timing when the stream becomes available. Axios replaces any existing duration value supplied by a custom adapter. (#11214)

UTF-8 Basic Authentication: Added transitional.encodeBasicAuthUsername: true to support Unicode usernames in XHR and Fetch requests. The option defaults to false, preserving existing authentication behavior; applications opting in should supply the original Unicode username and remove manual pre-encoding workarounds. (#11159)

🐛 Bug Fixes

Fetch Compatibility: Restored requests in runtimes such as Cloudflare Workers that reject the implicit cache: 'default', while preserving explicit caller settings. Response-size failures now retain their original ERR_BAD_RESPONSE and request context when runtime wrappers replace the underlying stream error. (#11194, #11179)

Runtime Consistency: Aligned encoded-byte size accounting, multipart uploads, proxy routing, same-origin resolution, parameter merging, and form serialization across adapters. Circular parameters now reject with ERR_BAD_OPTION_VALUE, and sparse or non-index numeric form fields serialize as keyed objects. With proxy: false, native proxyEnv agents using unsupported pool-management or TLS-session lifecycle overrides now reject with ERR_BAD_OPTION_VALUE; construct those agents without proxyEnv. (#11242)

Header Handling: Preserved headers named __proto__ using safe casing without changing the AxiosHeaders instance prototype. Function matchers in has(), delete(), and clear() now receive the headers instance as this, matching their declared contract. (#11134, #11216)

URL and Data URL Parsing: Accepted case-insensitive supported URL schemes and Base64 markers, and corrected decoding of percent-encoded Base64 data URLs. Node data URL allocation estimates remain aligned with decoding so configured size limits apply before allocation. (#11138, #11163, #11294)

Error Diagnostics: Preserved short reconstructed request stacks and appended wrapped error stacks under Caused by: so tooling that reads only error.stack retains the original failure context. (#11132, #11142)

Interceptor Removal: Restored removal through canonical numeric-string interceptor IDs, including after registry compaction. (#11139)

Proxy TLS: HTTPS CONNECT tunnels now apply current origin TLS options from an explicit httpsAgent, or from https.globalAgent when no explicit agent is supplied. This preserves process-wide custom CA settings through proxy tunnels. (#11178)

XHR Lifecycle: Used asynchronous Cookie Store reads for XSRF tokens where supported, preserving cookie fallback, timeout accounting, and cancellation. Upload and download progress listeners are now removed on completion, failure, timeout, and cancellation. (#11166, #11225)

HTTP/2 Sessions: Stopped reusing sessions immediately after GOAWAY and prevented draining sessions from scheduling idle timers that could delay process exit. (#11210)

TypeScript Declarations: Exposed the response-default marker as a public type to resolve TS2527 when consumers emit declarations involving unresolved response generics, covering both ESM and CommonJS. (#11125)

🔧 Maintenance & Chores

Configuration Performance: Reduced request configuration merge overhead, particularly for requests with many headers, while preserving merge semantics and prototype-pollution guards. (#11208)

Same-Origin Checks: Removed obsolete Internet Explorer detection without changing origin decisions in supported environments. (#11174)

Dependencies: Updated follow-redirects to 1.16.1 and refreshed development, documentation, test, and GitHub Actions dependencies. Removed unused dayjs from the docs package, root chalk, and chai from CJS module tests. (#11169, #11188, #11189, #11195, #11212, #11213, #11218, #11220, #11221, #11230, #11234, #11244, #11245, #11266, #11267, #11268, #11269, #11270, #11271, #11272, #11298, #11302, #11303, #11304, #11305, #11306, #11313, #11321, #11322, #11323, #11342)

Documentation: Fixed interceptor test links, updated README CDN examples to the published 1.20.0 bundle, and corrected guidance on interceptor options and request lifecycle ordering. (#11228, #11149, #11335)

Contributor Workflow: Consolidated agent instructions in AGENTS.md, standardized PR labels, required prerelease notes and validation evidence, and clarified that npm test requires installed Playwright browsers. (#11238, #11273, #11223, #11284)

Sponsors and Support: Added HeroDevs, Code for Japan, and Sweepico sponsor listings, refreshed sponsor data, and documented extended security support for Axios v0. (#11222, #11249, #11252, #11341)

Proxy Regression Coverage: Added a long dotted request-hostname test for NO_PROXY handling, extending coverage of an existing denial-of-service fix. (#11235)

Release Preparation: Updated package version metadata for 1.21.0. (#11346)

🌟 New Contributors

Welcome to our 24 new contributors. Thank you for helping improve Axios:

@lazerg (#11194)

@QIU-Guanzong (#11228)

@Iams4kura (#11125)

@vjymisal0 (#11179)

@jarrensj (#11238)

@LineGu (#11132)

@luantaraschi (#11134)

@Cyberhet (#11284)

@nyxst4ck (#11138)

... (truncated)

Changelog

Sourced from axios's changelog.

v1.21.0 — October 21, 2026

This release adds response timing and opt-in UTF-8 Basic authentication, improves request handling across runtimes, and changes how header defaults are recognized.

⚠️ Breaking Changes & Deprecations

Header Defaults: Only plain objects, null-prototype maps, and compatible AxiosHeaders instances are treated as common or method-specific defaults; literal headers such as Link are now preserved. Applications using custom class instances as defaults must convert them to plain maps, for example { post: { ...customDefaults } }, or compatible AxiosHeaders. Otherwise, those instances become literal header values, including on requests using other methods. (#11156)

🚀 New Features

Response Timing: Added response.duration, in milliseconds, including on error.response when present. Timing measures adapter execution and excludes interceptors and transforms; streamed responses stop timing when the stream becomes available. Axios replaces any existing duration value supplied by a custom adapter. (#11214)

UTF-8 Basic Authentication: Added transitional.encodeBasicAuthUsername: true to support Unicode usernames in XHR and Fetch requests. The option defaults to false, preserving existing authentication behavior; applications opting in should supply the original Unicode username and remove manual pre-encoding workarounds. (#11159)

🐛 Bug Fixes

Fetch Compatibility: Restored requests in runtimes such as Cloudflare Workers that reject the implicit cache: 'default', while preserving explicit caller settings. Response-size failures now retain their original ERR_BAD_RESPONSE and request context when runtime wrappers replace the underlying stream error. (#11194, #11179)

Runtime Consistency: Aligned encoded-byte size accounting, multipart uploads, proxy routing, same-origin resolution, parameter merging, and form serialization across adapters. Circular parameters now reject with ERR_BAD_OPTION_VALUE, and sparse or non-index numeric form fields serialize as keyed objects. With proxy: false, native proxyEnv agents using unsupported pool-management or TLS-session lifecycle overrides now reject with ERR_BAD_OPTION_VALUE; construct those agents without proxyEnv. (#11242)

Header Handling: Preserved headers named __proto__ using safe casing without changing the AxiosHeaders instance prototype. Function matchers in has(), delete(), and clear() now receive the headers instance as this, matching their declared contract. (#11134, #11216)

URL and Data URL Parsing: Accepted case-insensitive supported URL schemes and Base64 markers, and corrected decoding of percent-encoded Base64 data URLs. Node data URL allocation estimates remain aligned with decoding so configured size limits apply before allocation. (#11138, #11163, #11294)

Error Diagnostics: Preserved short reconstructed request stacks and appended wrapped error stacks under Caused by: so tooling that reads only error.stack retains the original failure context. (#11132, #11142)

Interceptor Removal: Restored removal through canonical numeric-string interceptor IDs, including after registry compaction. (#11139)

Proxy TLS: HTTPS CONNECT tunnels now apply current origin TLS options from an explicit httpsAgent, or from https.globalAgent when no explicit agent is supplied. This preserves process-wide custom CA settings through proxy tunnels. (#11178)

XHR Lifecycle: Used asynchronous Cookie Store reads for XSRF tokens where supported, preserving cookie fallback, timeout accounting, and cancellation. Upload and download progress listeners are now removed on completion, failure, timeout, and cancellation. (#11166, #11225)

HTTP/2 Sessions: Stopped reusing sessions immediately after GOAWAY and prevented draining sessions from scheduling idle timers that could delay process exit. (#11210)

TypeScript Declarations: Exposed the response-default marker as a public type to resolve TS2527 when consumers emit declarations involving unresolved response generics, covering both ESM and CommonJS. (#11125)

🔧 Maintenance & Chores

Configuration Performance: Reduced request configuration merge overhead, particularly for requests with many headers, while preserving merge semantics and prototype-pollution guards. (#11208)

Same-Origin Checks: Removed obsolete Internet Explorer detection without changing origin decisions in supported environments. (#11174)

Dependencies: Updated follow-redirects to 1.16.1 and refreshed development, documentation, test, and GitHub Actions dependencies. Removed unused dayjs from the docs package, root chalk, and chai from CJS module tests. (#11169, #11188, #11189, #11195, #11212, #11213, #11218, #11220, #11221, #11230, #11234, #11244, #11245, #11266, #11267, #11268, #11269, #11270, #11271, #11272, #11298, #11302, #11303, #11304, #11305, #11306, #11313, #11321, #11322, #11323, #11342)

Documentation: Fixed interceptor test links, updated README CDN examples to the published 1.20.0 bundle, and corrected guidance on interceptor options and request lifecycle ordering. (#11228, #11149, #11335)

Contributor Workflow: Consolidated agent instructions in AGENTS.md, standardized PR labels, required prerelease notes and validation evidence, and clarified that npm test requires installed Playwright browsers. (#11238, #11273, #11223, #11284)

Sponsors and Support: Added HeroDevs, Code for Japan, and Sweepico sponsor listings, refreshed sponsor data, and documented extended security support for Axios v0. (#11222, #11249, #11252, #11341)

Proxy Regression Coverage: Added a long dotted request-hostname test for NO_PROXY handling, extending coverage of an existing denial-of-service fix. (#11235)

Release Preparation: Updated package version metadata for 1.21.0. (#11346)

🌟 New Contributors

Welcome to our 24 new contributors. Thank you for helping improve Axios:

@lazerg (#11194)

@QIU-Guanzong (#11228)

@Iams4kura (#11125)

@vjymisal0 (#11179)

@jarrensj (#11238)

@LineGu (#11132)

@luantaraschi (#11134)

@Cyberhet (#11284)

@nyxst4ck (#11138)

... (truncated)

Commits

aa54a5e docs: remove cancelled sponsors from README (#11369)
e6b79d9 chore(release): prepare release 1.21.0 (#11346)
fceeb10 chore(deps-dev): bump the development_dependencies group with 4 updates (#11342)
7d15df3 docs: refresh sponsor data (#11341)
8d8e844 docs: correct interceptor options and request lifecycle guide (#11335)
326843a test(no-proxy): cover the request-hostname path with a long dotted host (#11235)
e5195ec feat(core): expose request duration on the response (#11214)
8d415e6 fix(headers): bind matcher callbacks to the headers instance (#11216)
b16dd77 fix(xhr): remove progress event listeners on request completion (#11225)
790b2ca chore(deps): bump the github-actions group with 3 updates (#11323)
Additional commits viewable in compare view

Updates d3 from 7.9.0 to 7.9.2

Release notes

Sourced from d3's releases.

v7.9.2

Revert d3-delaunay’s fix for collinear diagrams.

v7.9.1

Update dependencies.

Adopt pnpm and vitest.

Adopt npm trusted publishing.

Publish an ES module bundle instead of separate source files.

Commits

db118c9 7.9.2
374c4b3 fix docs build
78db499 7.9.1 (#4149)
3d1a90c Fix Bruls paper external URL in treemap.md (#4147)
ca958d4 docs: Incorrect alt text copied from the Observable Framework repository; it ...
42ccb63 fix broken link (#4084)
66bfe8c Fix external edge bundling references (#4039)
ab22394 fix: support links on d3js.org are outdated (#4015)
a10166c Update CHANGES.md
844b75a Update getting-started.md link to Svelte example (#3962)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for d3 since your current version.

Updates dompurify from 3.4.14 to 3.4.17

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.17

Fixed an issue with IN_PLACE, SAFE_FOR_TEMPLATES and shadow roots, thanks @manus-pi

Fixed IN_PLACE handling of nodes that hooks or custom elements tough during sanitization, thanks @uttej-badwane

Fixed the SMIL attributeName guard in XHTML mode, thanks @Koukyosyumei

Hardened several smaller edge cases (namespaces, literal-text elements, isValidAttribute()), thanks @artiphishell

Added a purify-edge test runner as a compatibility check, thanks @anzal1

Clarified the IN_PLACE documentation in the README about possible risks

Updated several dependencies

DOMPurify 3.4.16

Fixed a problem with IN_PLACE node removal when working with hooks, thanks @manus-pi

Fixed a problem with IN_PLACE sanitization and raw-text roots, thanks @h-t-m

Fixed a problem with ESM default exports landing in CommonJS declarations, thanks @ssi02014

Migrated from rollup to rolldown because performance, thanks @ssi02014

Bumped several dependencies where possible

DOMPurify 3.4.15

Added better clobbering hardening when XML content is involved, thanks @gnyselcuk

Added several smaller hardening and edge-case improvements, thanks @leechristensen

Bumped several dependencies where possible

Commits

a77a3e7 release: 3.4.17 (#1672)
b9b9d80 release: 3.4.16 (#1636)
1d7460c release: 3.4.15 (#1609)
See full diff in compare view

Updates jszip from 3.10.1 to 3.10.2

Changelog

Sourced from jszip's changelog.

v3.10.2 2026-09-09

Fix cross-realm binary type detection in getTypeOf. Fixes #759 (see #578)

Add missing types for JSZip.defaults. Fixes #690 (see #927)

Fix Blob support in Node.js 18 and up. Fixes #941 (see #955)

Commits

020fa33 Release preparation for 3.10.2 (#974)
d38fda5 Fix cross-realm binary type detection in getTypeOf (#578)
e682f9a Fix grunt build rebundling existing dist via browser field (#971)
5adef36 Add missing types for JSZip.defaults (#927)
41a1342 Fix blob support in Node.js 18 and up (#955)
643714a Move all continuous integration to GitHub Actions (#942)
418c11f Upgrade Playwright to the latest version (#940)
2ceb998 Create FUNDING.yml
See full diff in compare view

Maintainer changes

This version was pushed to npm by jkoops, a new releaser for jszip since your current version.

Updates react-hook-form from 7.87.0 to 7.91.0

Release notes

Sourced from react-hook-form's releases.

Version 7.91.0

🐞 Fixes

Fix useFieldArray not updating rows when using setValue or setValues (#13842, #13939)

Fix useFieldArray not unregistering values correctly on unmount (#13843)

Fix field registration without a value incorrectly adding array rows (Cursor Bugbot for commit 8165af8. Bugbot is set up for automated code reviews on this repo. Configure here.

…8 updates Bumps the everything-else group with 18 updates in the / directory: | Package | From | To | | --- | --- | --- | | @rdi-ui/pipeline | `0.1.35` | `0.1.51` | | [@sentry/electron](https://github.com/getsentry/sentry-electron) | `7.18.0` | `7.20.2` | | [@sentry/react](https://github.com/getsentry/sentry-javascript) | `10.73.0` | `10.78.0` | | [axios](https://github.com/axios/axios) | `1.20.0` | `1.21.0` | | [d3](https://github.com/d3/d3) | `7.9.0` | `7.9.2` | | [dompurify](https://github.com/cure53/DOMPurify) | `3.4.14` | `3.4.17` | | [jszip](https://github.com/Stuk/jszip) | `3.10.1` | `3.10.2` | | [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.87.0` | `7.91.0` | | [socket.io-client](https://github.com/socketio/socket.io) | `4.8.3` | `4.8.4` | | [unist-util-visit](https://github.com/syntax-tree/unist-util-visit) | `5.1.0` | `5.2.0` | | [@sentry/vite-plugin](https://github.com/getsentry/sentry-javascript) | `5.4.0` | `5.4.1` | | [@sentry/webpack-plugin](https://github.com/getsentry/sentry-javascript) | `5.4.0` | `5.4.1` | | [@types/lodash](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/lodash) | `4.17.25` | `4.17.27` | | [concurrently](https://github.com/open-cli-tools/concurrently) | `9.2.4` | `9.2.5` | | [core-js](https://github.com/zloirock/core-js/tree/HEAD/packages/core-js) | `3.50.0` | `3.51.0` | | [csv-stringify](https://github.com/adaltas/node-csv/tree/HEAD/packages/csv-stringify) | `6.8.3` | `6.9.0` | | [moment](https://github.com/moment/moment) | `2.30.1` | `2.31.0` | | [tsx](https://github.com/privatenumber/tsx) | `4.23.13` | `4.23.15` | Updates `@rdi-ui/pipeline` from 0.1.35 to 0.1.51 Updates `@sentry/electron` from 7.18.0 to 7.20.2 - [Release notes](https://github.com/getsentry/sentry-electron/releases) - [Changelog](https://github.com/getsentry/sentry-electron/blob/7.20.2/CHANGELOG.md) - [Commits](getsentry/sentry-electron@7.18.0...7.20.2) Updates `@sentry/react` from 10.73.0 to 10.78.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.78.0/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@10.73.0...10.78.0) Updates `axios` from 1.20.0 to 1.21.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.20.0...v1.21.0) Updates `d3` from 7.9.0 to 7.9.2 - [Release notes](https://github.com/d3/d3/releases) - [Changelog](https://github.com/d3/d3/blob/main/CHANGES.md) - [Commits](d3/d3@v7.9.0...v7.9.2) Updates `dompurify` from 3.4.14 to 3.4.17 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.4.14...3.4.17) Updates `jszip` from 3.10.1 to 3.10.2 - [Changelog](https://github.com/Stuk/jszip/blob/main/CHANGES.md) - [Commits](Stuk/jszip@v3.10.1...v3.10.2) Updates `react-hook-form` from 7.87.0 to 7.91.0 - [Release notes](https://github.com/react-hook-form/react-hook-form/releases) - [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md) - [Commits](react-hook-form/react-hook-form@v7.87.0...v7.91.0) Updates `socket.io-client` from 4.8.3 to 4.8.4 - [Release notes](https://github.com/socketio/socket.io/releases) - [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md) - [Commits](https://github.com/socketio/socket.io/compare/socket.io-client@4.8.3...socket.io-client@4.8.4) Updates `unist-util-visit` from 5.1.0 to 5.2.0 - [Release notes](https://github.com/syntax-tree/unist-util-visit/releases) - [Commits](syntax-tree/unist-util-visit@5.1.0...5.2.0) Updates `@sentry/vite-plugin` from 5.4.0 to 5.4.1 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@5.4.0...5.4.1) Updates `@sentry/webpack-plugin` from 5.4.0 to 5.4.1 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@5.4.0...5.4.1) Updates `@types/lodash` from 4.17.25 to 4.17.27 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/lodash) Updates `concurrently` from 9.2.4 to 9.2.5 - [Release notes](https://github.com/open-cli-tools/concurrently/releases) - [Commits](open-cli-tools/concurrently@v9.2.4...v9.2.5) Updates `core-js` from 3.50.0 to 3.51.0 - [Release notes](https://github.com/zloirock/core-js/releases) - [Changelog](https://github.com/zloirock/core-js/blob/master/CHANGELOG.md) - [Commits](https://github.com/zloirock/core-js/commits/v3.51.0/packages/core-js) Updates `csv-stringify` from 6.8.3 to 6.9.0 - [Changelog](https://github.com/adaltas/node-csv/blob/master/packages/csv-stringify/CHANGELOG.md) - [Commits](https://github.com/adaltas/node-csv/commits/csv-stringify@6.9.0/packages/csv-stringify) Updates `moment` from 2.30.1 to 2.31.0 - [Release notes](https://github.com/moment/moment/releases) - [Changelog](https://github.com/moment/moment/blob/develop/CHANGELOG.md) - [Commits](moment/moment@2.30.1...2.31.0) Updates `tsx` from 4.23.13 to 4.23.15 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.23.13...v4.23.15) --- updated-dependencies: - dependency-name: "@rdi-ui/pipeline" dependency-version: 0.1.51 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: everything-else - dependency-name: "@sentry/electron" dependency-version: 7.20.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: everything-else - dependency-name: "@sentry/react" dependency-version: 10.78.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: everything-else - dependency-name: axios dependency-version: 1.21.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: everything-else - dependency-name: d3 dependency-version: 7.9.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: everything-else - dependency-name: dompurify dependency-version: 3.4.17 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: everything-else - dependency-name: jszip dependency-version: 3.10.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: everything-else - dependency-name: react-hook-form dependency-version: 7.91.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: everything-else - dependency-name: socket.io-client dependency-version: 4.8.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: everything-else - dependency-name: unist-util-visit dependency-version: 5.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: everything-else - dependency-name: "@sentry/vite-plugin" dependency-version: 5.4.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: everything-else - dependency-name: "@sentry/webpack-plugin" dependency-version: 5.4.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: everything-else - dependency-name: "@types/lodash" dependency-version: 4.17.27 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: everything-else - dependency-name: concurrently dependency-version: 9.2.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: everything-else - dependency-name: core-js dependency-version: 3.51.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: everything-else - dependency-name: csv-stringify dependency-version: 6.9.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: everything-else - dependency-name: moment dependency-version: 2.31.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: everything-else - dependency-name: tsx dependency-version: 4.23.15 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: everything-else ... Signed-off-by: dependabot[bot] <support@github.com>

chatgpt-codex-connector · 2026-11-09T00:08:22Z

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-09T00:12:16.593846Z	`8165af8`	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8165af8610

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-11-09T00:12:13Z

-      "version": "1.9.1",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/api/-/api-1.9.1.tgz",
-      "integrity": "sha512-gLyJlPHPZYdAk1JENA9LeHejZe1Ti77/pTeFm/nMXmQH/HFZlcS/O2XJB+L8fkbrNSqhdtlvjBVjxwUYanNH5Q==",
+      "version": "1.10.0",


Keep OpenTelemetry API on 1.9.x with SDK 2.x

This resolves @opentelemetry/api to 1.10.0 while the newly locked @opentelemetry/core, resources, and sdk-trace 2.12.0 packages explicitly require <1.10.0; npm ls --package-lock-only --all consequently reports this pair as invalid. The upstream migration guide states that API 1.10 cannot be combined with SDK 2.x, so when the Electron main process initializes Sentry's Node tracing, it runs an unsupported combination that can disable or corrupt telemetry despite installation succeeding through legacy-peer-deps; pin the API to 1.9.x or move the complete SDK set to 3.x. See the OpenTelemetry migration guide.

Useful? React with 👍 / 👎.

cursor

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8165af8. Configure here.}

cursor · 2026-11-09T00:16:18Z

-    "@sentry/electron": "^7.18.0",
-    "@sentry/react": "^10.73.0",
+    "@sentry/electron": "^7.20.2",
+    "@sentry/react": "^10.78.0",


Sentry packages use mismatched core

Medium Severity

@sentry/react is now 10.78.0 and @sentry/electron 7.20.2 (which pins JS SDK 10.75.0), but the overrides entry still forces @sentry/core to 10.73.0. The lockfile resolves a single core at 10.73.0 while nested Electron packages ship @sentry/browser 10.75.0 beside top-level 10.78.0. Sentry packages pin exact core versions, so renderer Sentry.init(..., reactInit) and main-process init can load incompatible internals and drop or mis-handle events.

Additional Locations (2)

package.json#L117-L118

package-lock.json#L8707-L8711

^{Reviewed by Cursor Bugbot for commit 8165af8. Configure here.}

cursor · 2026-11-09T00:16:18Z

+      "integrity": "sha512-+rSRoOdln6NhXTVcBdHSlZxJDNzwxadeweK2ltZO3tVtfp6aklABc06xclDk6ovRR+EiGgIcSbh/6NgjFhnb3A==",
      "license": "Apache-2.0",
      "dependencies": {
-        "@opentelemetry/core": "2.11.0",


OpenTelemetry API exceeds Sentry range

Medium Severity

The lockfile now resolves @opentelemetry/api 1.10.0, while @opentelemetry/core, resources, sdk-trace, and sdk-trace-base all declare peers of @opentelemetry/api <1.10.0. @sentry/node 10.75.0 (pulled by @sentry/electron) sits on OpenTelemetry SDK v2, which Sentry v10 documents as incompatible with API 1.10.0. Electron main-process Sentry can fail to share a tracer provider or skip Node instrumentation.

Additional Locations (1)

package-lock.json#L8819-L8834

^{Reviewed by Cursor Bugbot for commit 8165af8. Configure here.}

dependabot Bot requested a review from a team as a code owner November 9, 2026 00:08

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 9, 2026

chatgpt-codex-connector Bot reviewed Nov 9, 2026

View reviewed changes

dependabot Bot temporarily deployed to production November 9, 2026 00:13 Inactive

cursor Bot reviewed Nov 9, 2026

View reviewed changes

Navigation Menu

Repository navigation

chore(deps): bump the everything-else group across 1 directory with 18 updates - #6582

chore(deps): bump the everything-else group across 1 directory with 18 updates#6582
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/everything-else-db09f0faf5

dependabot Bot commented on behalf of github Nov 9, 2026 •

edited by cursor Bot

Loading

Uh oh!

chatgpt-codex-connector Bot commented Nov 9, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Nov 9, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot Nov 9, 2026

Uh oh!

cursor Bot Nov 9, 2026

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Path	Size
`@sentry/browser`	27.64 KB
`@sentry/browser` - with treeshaking flags	26.12 KB
`@sentry/browser` (incl. Tracing)	46.2 KB
`@sentry/browser` (incl. Tracing + Span Streaming)	47.96 KB
`@sentry/browser` (incl. Tracing, Profiling)	50.87 KB
`@sentry/browser` (incl. Tracing, Replay)	84.73 KB
`@sentry/browser` (incl. Tracing, Replay) - with treeshaking flags	74.6 KB
`@sentry/browser` (incl. Tracing, Replay with Canvas)	89.33 KB
`@sentry/browser` (incl. Tracing, Replay, Feedback)	101.65 KB
`@sentry/browser` (incl. Feedback)	44.42 KB
`@sentry/browser` (incl. sendFeedback)	32.34 KB
`@sentry/browser` (incl. FeedbackAsync)	37.34 KB
`@sentry/browser` (incl. Metrics)	28.7 KB
`@sentry/browser` (incl. Logs)	28.94 KB
`@sentry/browser` (incl. Metrics & Logs)	29.6 KB
`@sentry/react`	29.42 KB
`@sentry/react` (incl. Tracing)	48.46 KB
`@sentry/vue`	33.39 KB
`@sentry/vue` (incl. Tracing)	48.52 KB
`@sentry/svelte`	27.66 KB
CDN Bundle	30 KB
CDN Bundle (incl. Tracing)	48.13 KB
CDN Bundle (incl. Logs, Metrics)	31.56 KB
CDN Bundle (incl. Tracing, Logs, Metrics)	49.42 KB
CDN Bundle (incl. Replay, Logs, Metrics)	70.13 KB
CDN Bundle (incl. Tracing, Replay)	84.97 KB
CDN Bundle (incl. Tracing, Replay, Logs, Metrics)	86.24 KB
CDN Bundle (incl. Tracing, Replay, Feedback)	90.65 KB
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics)	91.9 KB
CDN Bundle - uncompressed	89.11 KB
CDN Bundle (incl. Tracing) - uncompressed	145.03 KB
CDN Bundle (incl. Logs, Metrics) - uncompressed	93.71 KB
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed	148.92 KB
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed	216.26 KB
CDN Bundle (incl. Tracing, Replay) - uncompressed	262.18 KB
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed	266.05 KB
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed	275.56 KB
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed	279.42 KB
`@sentry/nextjs` (client)	51.06 KB

Conversation

dependabot Bot commented on behalf of github Nov 9, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

7.20.2

Bug Fixes 🐛

V7

7.20.1

Bug Fixes 🐛

Internal Changes 🔧

7.20.0

New Features ✨

Bug Fixes 🐛

Internal Changes 🔧

7.19.0

New Features ✨

Internal Changes 🔧

7.20.2

Bug Fixes 🐛

V7

7.20.1

Bug Fixes 🐛

Internal Changes 🔧

7.20.0

New Features ✨

Bug Fixes 🐛

Internal Changes 🔧

7.19.0

New Features ✨

Internal Changes 🔧

10.78.0

Bundle size 📦

10.78.0

10.77.1

Important Changes

v1.21.0 — October 21, 2026

⚠️ Breaking Changes & Deprecations

🚀 New Features

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

v1.21.0 — October 21, 2026

⚠️ Breaking Changes & Deprecations

🚀 New Features

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

v7.9.2

v7.9.1

DOMPurify 3.4.17

DOMPurify 3.4.16

DOMPurify 3.4.15

v3.10.2 2026-09-09

Version 7.91.0

🐞 Fixes

Uh oh!

chatgpt-codex-connector Bot commented Nov 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Nov 9, 2026

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Nov 9, 2026

Choose a reason for hiding this comment

Sentry packages use mismatched core

Uh oh!

cursor Bot Nov 9, 2026

Choose a reason for hiding this comment

OpenTelemetry API exceeds Sentry range

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

dependabot Bot commented on behalf of github Nov 9, 2026 •

edited by cursor Bot

Loading

chatgpt-codex-connector Bot commented Nov 9, 2026 •

edited

Loading