chore(deps): bump the pnpm-patch group across 1 directory with 7 updates by dependabot[bot] · Pull Request #669 · security-alliance/frameworks

dependabot · 2026-10-26T09:22:12Z

Bumps the pnpm-patch group with 7 updates in the / directory:

Package	From	To
react	`19.3.0`	`19.3.1`
react-dom	`19.3.0`	`19.3.1`
react-router-dom	`7.18.3`	`7.18.4`
react-server-dom-webpack	`19.3.0`	`19.3.1`
uuid	`14.0.2`	`14.0.3`
cspell	`10.3.5`	`10.3.6`
vocs	`2.10.0`	`2.10.3`

Updates react from 19.3.0 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

Improve transport protocol (#37845 by @unstubbable and @eps1lon)

Commits

61aa00d [19.3.x][Flight] Improve transport protocol (#37845)
See full diff in compare view

Updates react-dom from 19.3.0 to 19.3.1

Release notes

Sourced from react-dom's releases.

19.3.1 (October 14th, 2026)

React Server Components

Improve transport protocol (#37845 by @unstubbable and @eps1lon)

Commits

61aa00d [19.3.x][Flight] Improve transport protocol (#37845)
See full diff in compare view

Updates react-router-dom from 7.18.3 to 7.18.4

Changelog

Sourced from react-router-dom's changelog.

v7.18.4

Patch Changes

Updated dependencies:

react-router@7.18.4

Commits

1b1e0b0 Release v7.18.4 (#15498)
See full diff in compare view

Updates react-server-dom-webpack from 19.3.0 to 19.3.1

Release notes

Sourced from react-server-dom-webpack's releases.

19.3.1 (October 14th, 2026)

React Server Components

Improve transport protocol (#37845 by @unstubbable and @eps1lon)

Commits

61aa00d [19.3.x][Flight] Improve transport protocol (#37845)
See full diff in compare view

Updates uuid from 14.0.2 to 14.0.3

Release notes

Sourced from uuid's releases.

v14.0.3

14.0.3 (2026-10-09)

Bug Fixes

fix CITGM #1154 (#981) (b44f159)

Changelog

Sourced from uuid's changelog.

14.0.3 (2026-10-09)

Bug Fixes

fix CITGM #1154 (#981) (b44f159)

Commits

993ff7b chore(main): release 14.0.3 (#982)
f7d19b9 chore: update workflow actions (#983)
b44f159 fix: fix CITGM #1154 (#981)
dd8c173 chore: update deps (#975)
See full diff in compare view

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates cspell from 10.3.5 to 10.3.6

Release notes

Sourced from cspell's releases.

v10.3.6

Fixes

fix: Report unknown CSpell directives again (#9319)

Summary

cspell lint reports unknown in-document directives again, such as cspell:bad-dir, when --validate-directives or validateDirectives: true in the config asks for them. Since 9.1.0 they were found but never shown or counted.

--validate-directives and --no-validate-directives override the config setting.

An unknown directive counts as an issue, so cspell lint exits with an error, as it did before 9.1.0.

The JSON reporter, @cspell/cspell-json-reporter, includes them in its output again.

The default reporter and the JSON reporter now ask to receive directive issues. Other reporters still only get them if they ask for them.

The command-line flag is now applied as a setting, like --report, so it controls what is shown as well as what is checked.

fix(cspell-io): Keep redirected requests under the private root (#9329)

Summary

createRedirectProvider in cspell-io now only serves requests that map to a location under its private root. A request that would resolve outside the private root is refused with VFSErrorUnsupportedRequest, the same error as a request outside the public root.

Refused: a path that starts with a separator (/, \, %2F, %5C) right after the public root.

Now served from inside the private root: file names that look like a URL scheme or a drive, such as a:b.txt or C|. They used to resolve to a different URL.

cspell itself does not use createRedirectProvider. This affects projects that use cspell-io directly.

The part of the URL after the public root is resolved as a relative path under the private root, and the result is checked to be under the private root: same protocol, same host, and the same path prefix.

Results coming back from the private file system are checked the same way before they are shown under the public root.

The change is in commit 25359026e1.

... (truncated)

Changelog

Sourced from cspell's changelog.

v10.3.6 (2026-09-29)

Fixes

fix: Report unknown CSpell directives again (#9319)

Summary

cspell lint reports unknown in-document directives again, such as cspell:bad-dir, when --validate-directives or validateDirectives: true in the config asks for them. Since 9.1.0 they were found but never shown or counted.

--validate-directives and --no-validate-directives override the config setting.

An unknown directive counts as an issue, so cspell lint exits with an error, as it did before 9.1.0.

The JSON reporter, @cspell/cspell-json-reporter, includes them in its output again.

The default reporter and the JSON reporter now ask to receive directive issues. Other reporters still only get them if they ask for them.

The command-line flag is now applied as a setting, like --report, so it controls what is shown as well as what is checked.

fix(cspell-io): Keep redirected requests under the private root (#9329)

Summary

createRedirectProvider in cspell-io now only serves requests that map to a location under its private root. A request that would resolve outside the private root is refused with VFSErrorUnsupportedRequest, the same error as a request outside the public root.

Refused: a path that starts with a separator (/, \, %2F, %5C) right after the public root.

Now served from inside the private root: file names that look like a URL scheme or a drive, such as a:b.txt or C|. They used to resolve to a different URL.

cspell itself does not use createRedirectProvider. This affects projects that use cspell-io directly.

The part of the URL after the public root is resolved as a relative path under the private root, and the result is checked to be under the private root: same protocol, same host, and the same path prefix.

Results coming back from the private file system are checked the same way before they are shown under the public root.

The change is in commit 25359026e1.

... (truncated)

Commits

8559198 v10.3.6
72e1be3 chore: Prepare Release v10.3.6 (auto-deploy) (#9305)
e230ca0 test: Give time-limited RPC and worker tests room on slow runners (#9330)
8eae6b6 fix: Report unknown CSpell directives again (#9319)
a5f5111 fix: Don't reuse cached results made with different command-line options (#9318)
2f897be fix: --show-perf-summary shows where all of the run's time goes (#9307)
fe37b7b chore: Label per package, and bugs links to its open issues (#9309)
See full diff in compare view

Updates vocs from 2.10.0 to 2.10.3

Release notes

Sourced from vocs's releases.

vocs@2.10.3

Patch Changes

4b8ec1c: Stopped dev server requests from re-bundling and re-importing vocs.config.ts until the config or one of its imports changes.

66bfd9c: Reduced dev server memory by skipping source maps for generated config and search index modules.

9447ca3: Loaded only the configured or inferred Shiki languages up front and lazily loaded other fence languages on first use, reducing dev server memory and cold-start time.

203e918: Reduced dev server memory by passing parsed OpenAPI data to in-process environments instead of serializing it into virtual modules.

10112a1: Reduced dev server memory by evaluating server modules without their inline source maps, which Node and V8 each retained, while keeping stack traces mapped to source.

66bfd9c: Reduced dev server memory by compiling MDX without the jsxDEV source locations that React 19 ignores.

4b8ec1c: Released finished page renders from dev server memory that React DOM server context and Vite's crawl-end timer kept alive.

66bfd9c: Reduced dev server memory by no longer inlining source maps into server module code, mapping stack frames from the module graph instead.

4b8ec1c: Reduced dev server memory on code-heavy pages by rendering code block contents through one shared renderer, with static markup as HTML strings.

vocs@2.10.2

Patch Changes

e4d801d: Added Waku rc.2 support while preserving metadata rendering, document defaults, and rc.1 compatibility.

vocs@2.10.1

Patch Changes

6fddcde: Read page modification dates from one Git history snapshot per build instead of running a Git log for each page.

ab9f5d1: Prebundled Mermaid when installed so diagrams work in development without a custom Vite configuration.

4f08d1e: Generate Markdown exports after the client bundle so server passes do not repeat the work and output cleanup preserves the files.

ce99cd7: Added a viewport-prefetch opt-out and disabled viewport prefetching for persistent logo links while preserving intent-based prefetching.

Changelog

Sourced from vocs's changelog.

2.10.3

Patch Changes

4b8ec1c: Stopped dev server requests from re-bundling and re-importing vocs.config.ts until the config or one of its imports changes.

66bfd9c: Reduced dev server memory by skipping source maps for generated config and search index modules.

9447ca3: Loaded only the configured or inferred Shiki languages up front and lazily loaded other fence languages on first use, reducing dev server memory and cold-start time.

203e918: Reduced dev server memory by passing parsed OpenAPI data to in-process environments instead of serializing it into virtual modules.

10112a1: Reduced dev server memory by evaluating server modules without their inline source maps, which Node and V8 each retained, while keeping stack traces mapped to source.

66bfd9c: Reduced dev server memory by compiling MDX without the jsxDEV source locations that React 19 ignores.

4b8ec1c: Released finished page renders from dev server memory that React DOM server context and Vite's crawl-end timer kept alive.

66bfd9c: Reduced dev server memory by no longer inlining source maps into server module code, mapping stack frames from the module graph instead.

4b8ec1c: Reduced dev server memory on code-heavy pages by rendering code block contents through one shared renderer, with static markup as HTML strings.

2.10.2

Patch Changes

e4d801d: Added Waku rc.2 support while preserving metadata rendering, document defaults, and rc.1 compatibility.

2.10.1

Patch Changes

6fddcde: Read page modification dates from one Git history snapshot per build instead of running a Git log for each page.

ab9f5d1: Prebundled Mermaid when installed so diagrams work in development without a custom Vite configuration.

4f08d1e: Generate Markdown exports after the client bundle so server passes do not repeat the work and output cleanup preserves the files.

ce99cd7: Added a viewport-prefetch opt-out and disabled viewport prefetching for persistent logo links while preserving intent-based prefetching.

Commits

759e999 chore: version packages (#659)
4b8ec1c fix: reduce dev server memory on code-heavy pages (#656)
66bfd9c perf: drop retained source map and jsxDEV copies in dev (#661)
10112a1 perf(waku): evaluate dev server modules without inline source maps (#660)
9447ca3 perf: load shiki languages lazily (#658)
203e918 perf(openapi): share parsed data with in-process dev environments (#657)
e8de9c9 chore: version packages (#655)
e4d801d fix: support waku rc.2 (#654)
4b5f31d chore: version packages (#645)
ab9f5d1 fix: prebundle optional mermaid dependency (#653)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the pnpm-patch group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.3.0` | `19.3.1` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.3.0` | `19.3.1` | | [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `7.18.3` | `7.18.4` | | [react-server-dom-webpack](https://github.com/react/react/tree/HEAD/packages/react-server-dom-webpack) | `19.3.0` | `19.3.1` | | [uuid](https://github.com/uuidjs/uuid) | `14.0.2` | `14.0.3` | | [cspell](https://github.com/streetsidesoftware/cspell/tree/HEAD/packages/cspell) | `10.3.5` | `10.3.6` | | [vocs](https://github.com/wevm/vocs) | `2.10.0` | `2.10.3` | Updates `react` from 19.3.0 to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react) Updates `react-dom` from 19.3.0 to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom) Updates `react-router-dom` from 7.18.3 to 7.18.4 - [Release notes](https://github.com/remix-run/react-router/releases) - [Changelog](https://github.com/remix-run/react-router/blob/react-router-dom@7.18.4/packages/react-router-dom/CHANGELOG.md) - [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.18.4/packages/react-router-dom) Updates `react-server-dom-webpack` from 19.3.0 to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-server-dom-webpack) Updates `uuid` from 14.0.2 to 14.0.3 - [Release notes](https://github.com/uuidjs/uuid/releases) - [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md) - [Commits](uuidjs/uuid@v14.0.2...v14.0.3) Updates `cspell` from 10.3.5 to 10.3.6 - [Release notes](https://github.com/streetsidesoftware/cspell/releases) - [Changelog](https://github.com/streetsidesoftware/cspell/blob/main/packages/cspell/CHANGELOG.md) - [Commits](https://github.com/streetsidesoftware/cspell/commits/v10.3.6/packages/cspell) Updates `vocs` from 2.10.0 to 2.10.3 - [Release notes](https://github.com/wevm/vocs/releases) - [Changelog](https://github.com/wevm/vocs/blob/main/CHANGELOG.md) - [Commits](https://github.com/wevm/vocs/compare/vocs@2.10.0...vocs@2.10.3) --- updated-dependencies: - dependency-name: react dependency-version: 19.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: pnpm-patch - dependency-name: react-dom dependency-version: 19.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: pnpm-patch - dependency-name: react-router-dom dependency-version: 7.18.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: pnpm-patch - dependency-name: react-server-dom-webpack dependency-version: 19.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: pnpm-patch - dependency-name: uuid dependency-version: 14.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: pnpm-patch - dependency-name: cspell dependency-version: 10.3.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: pnpm-patch - dependency-name: vocs dependency-version: 2.10.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: pnpm-patch ... Signed-off-by: dependabot[bot] <support@github.com>

cloudflare-workers-and-pages · 2026-10-26T09:22:14Z

Deploying frameworks with Cloudflare Pages

Latest commit:	`1813af4`
Status:	✅ Deploy successful!
Preview URL:	https://3733d141.frameworks-573.pages.dev
Branch Preview URL:	https://dependabot-npm-and-yarn-deve-if0u.frameworks-573.pages.dev

View logs

socket-security · 2026-10-26T09:22:37Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
react-router-dom@7.18.3 ⏵ 7.18.4			^-2
react-server-dom-webpack@19.3.0 ⏵ 19.3.1		⁺¹
react@19.3.0 ⏵ 19.3.1
vocs@2.10.0 ⏵ 2.10.3	⁺¹	⁺¹
uuid@14.0.2 ⏵ 14.0.3
react-dom@19.3.0 ⏵ 19.3.1		⁺¹
cspell@10.3.5 ⏵ 10.3.6	⁺¹		⁺¹

View full report

scode2277 · 2026-10-26T13:15:57Z

@dependabot rebase

dependabot · 2026-10-26T13:19:22Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 26, 2026

dependabot Bot closed this Oct 26, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/develop/pnpm-patch-9a588cfbce branch October 26, 2026 13:19

Navigation Menu

Repository navigation

chore(deps): bump the pnpm-patch group across 1 directory with 7 updates - #669

chore(deps): bump the pnpm-patch group across 1 directory with 7 updates#669
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/develop/pnpm-patch-9a588cfbce

dependabot Bot commented on behalf of github Oct 26, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages Bot commented Oct 26, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Oct 26, 2026

Uh oh!

scode2277 commented Oct 26, 2026

Uh oh!

dependabot Bot commented on behalf of github Oct 26, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

19.3.1 (October 14th, 2026)

React Server Components

19.3.1 (October 14th, 2026)

React Server Components

v7.18.4

Patch Changes

19.3.1 (October 14th, 2026)

React Server Components

v14.0.3

14.0.3 (2026-10-09)

Bug Fixes

14.0.3 (2026-10-09)

Bug Fixes

v10.3.6

Fixes

fix: Report unknown CSpell directives again (#9319)

Summary

fix(cspell-io): Keep redirected requests under the private root (#9329)

Summary

v10.3.6 (2026-09-29)

Fixes

fix: Report unknown CSpell directives again (#9319)

Summary

fix(cspell-io): Keep redirected requests under the private root (#9329)

Summary

vocs@2.10.3

Patch Changes

vocs@2.10.2

Patch Changes

vocs@2.10.1

Patch Changes

2.10.3

Patch Changes

2.10.2

Patch Changes

2.10.1

Patch Changes

Uh oh!

cloudflare-workers-and-pages Bot commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying frameworks with Cloudflare Pages

Uh oh!

socket-security Bot commented Oct 26, 2026

Uh oh!

scode2277 commented Oct 26, 2026

Uh oh!

dependabot Bot commented on behalf of github Oct 26, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Oct 26, 2026 •

edited

Loading

cloudflare-workers-and-pages Bot commented Oct 26, 2026 •

edited

Loading