Skip to content

deps(npm): bump the ui-dependencies group across 1 directory with 21 updates#23

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/ui-dependencies-a9e3fbe1e6
Open

deps(npm): bump the ui-dependencies group across 1 directory with 21 updates#23
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/ui-dependencies-a9e3fbe1e6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the ui-dependencies group with 20 updates in the / directory:

Package From To
@tabler/icons-react 3.36.1 3.44.0
@types/mdx 2.0.13 2.0.14
fumadocs-core 16.5.1 16.9.3
fumadocs-mdx 14.2.6 15.0.11
jotai 2.17.1 2.20.0
lru-cache 11.2.5 11.5.1
lucide-react 0.563.0 1.17.0
next 16.1.6 16.2.7
radix-ui 1.4.3 1.5.0
react 19.2.4 19.2.7
@types/react 19.2.13 19.2.17
react-dom 19.2.4 19.2.7
tailwind-merge 3.4.0 3.6.0
@tailwindcss/postcss 4.1.18 4.3.0
@types/node 25.2.1 25.9.2
eslint 9.39.2 10.4.1
eslint-config-next 16.1.6 16.2.7
pagefind 1.4.0 1.5.2
prettier 3.8.1 3.8.3
typescript 5.9.3 6.0.3

Updates @tabler/icons-react from 3.36.1 to 3.44.0

Release notes

Sourced from @​tabler/icons-react's releases.

Release 3.44.0

18 new icons:

  • outline/code-ai
  • outline/email-stamp
  • outline/foodsteps
  • outline/git-pull-request-conflict
  • outline/noise-reduction
  • outline/photo-alt
  • outline/pointer-2
  • outline/pointer-collaboration-2
  • outline/pointer-collaboration
  • outline/roulette
  • outline/scan-cube
  • outline/sketching
  • outline/sparkle-2
  • outline/sparkle-highlight
  • outline/sparkle
  • outline/sphere-2
  • outline/text-scan-ai
  • outline/vignette

Fixed icons: outline/air-balloon, outline/body-scan, outline/chart-sankey, outline/ear-scan, outline/grid-scan, outline/line-scan, outline/object-scan, outline/photo-scan, outline/route-scan, outline/scan-eye, outline/scan-letter-a, outline/scan-letter-t, outline/scan-position, outline/scan-traces, outline/scan, outline/text-scan-2, outline/user-scan, outline/zoom-scan

Release 3.43.0

18 new icons:

  • outline/acorn
  • outline/acrobatic
  • outline/banana
  • outline/brand-audible
  • outline/building-eiffel-tower
  • outline/car-door
  • outline/car-lifter
  • outline/chocolate
  • outline/dumbbell
  • outline/exercise-ball
  • outline/flood
  • outline/hula-hoop
  • outline/leaf-maple
  • outline/notdef
  • outline/rugby
  • outline/taiwan-dollar
  • outline/target-2
  • outline/unicycle

... (truncated)

Commits
  • 6d128ed Release 3.44.0
  • e40738b Release 3.43.0
  • 076f4a9 Release 3.42.0
  • 9b27b65 Release 3.41.1
  • ebad60b Update homepage links in documentation and package files to point to the new ...
  • 8ed617b Update README files to wrap images in anchor tags linking to the Tabler Icons...
  • ef6e875 Update dependencies in pnpm-lock.yaml and package.json files (#1497)
  • 6cbe885 Release 3.41.0
  • 19d735e Add JSDoc with previews in icons-react (#1472)
  • e4ca377 Release 3.40.0
  • Additional commits viewable in compare view

Updates @types/mdx from 2.0.13 to 2.0.14

Commits

Updates fumadocs-core from 16.5.1 to 16.9.3

Release notes

Sourced from fumadocs-core's releases.

fumadocs-core@16.9.3

Patch Changes

  • 42f0255: Support invalidate & revalidate on dynamic loader
  • a807798: Improve source API utils & types

fumadocs-core@16.9.1

Patch Changes

  • e77b9b3: Introduce pagesIndex property to explicitly define the index page for folder
  • 334c8fd: [i18n] support different orders of preset() calls

fumadocs-core@16.8.12

Patch Changes

  • 768b676: Standardize structuredData in page data

fumadocs-core@16.8.11

Patch Changes

  • 1dc86c7: loosen the range for waku

fumadocs-core@16.8.10

Patch Changes

  • 062beab: fix internal types
  • 505cfe0: Add remark-block-id plugin

fumadocs-core@16.8.8

No release notes provided.

fumadocs-core@16.8.7

No release notes provided.

fumadocs-core@16.8.6

No release notes provided.

fumadocs-core@16.8.5

Patch Changes

  • 79d3209: Narrow schema type for private OpenAPI properties

fumadocs-core@16.8.4

Patch Changes

  • 61b15e9: fix Shiki languages not loaded under lazy mode
  • 1a5433c: Support $ in locale for page tree generation

fumadocs-core@16.8.3

No release notes provided.

Commits

Updates fumadocs-mdx from 14.2.6 to 15.0.11

Release notes

Sourced from fumadocs-mdx's releases.

fumadocs-mdx@15.0.11

Patch Changes

  • 2d65ceb: Support hot reload in source.config.ts with Vite plugin

fumadocs-mdx@15.0.10

Patch Changes

  • d35d0d6: Respect root in Vite config
  • Updated dependencies [42f0255]
  • Updated dependencies [a807798]
    • fumadocs-core@16.9.3

fumadocs-mdx@15.0.9

Patch Changes

  • cd04425: Support _fumadocs_skipViteConfig internal flag

fumadocs-mdx@15.0.8

Patch Changes

  • dca5b49: Fix compatibility with ?raw query string
  • Updated dependencies [e77b9b3]
  • Updated dependencies [334c8fd]
    • fumadocs-core@16.9.1

fumadocs-mdx@15.0.7

Patch Changes

  • 768b676: Standardize structuredData in page data
  • Updated dependencies [768b676]
    • fumadocs-core@16.8.12

fumadocs-mdx@15.0.6

Patch Changes

  • da4a81a: Update vite configs

fumadocs-mdx@15.0.5

Patch Changes

  • 1fb6a61: Support custom base directory for content sources

fumadocs-mdx@15.0.4

Patch Changes

  • 819b6ec: Support Rolldown integration

fumadocs-mdx@15.0.3

Patch Changes

... (truncated)

Commits

Updates jotai from 2.17.1 to 2.20.0

Release notes

Sourced from jotai's releases.

v2.20.0

This release improves performance in high-throughput scenarios. Huge kudos to @​dmaskasky!

What's Changed

Full Changelog: pmndrs/jotai@v2.19.1...v2.20.0

v2.19.1

This release includes several small refactors to improve performance.

What's Changed

New Contributors

Full Changelog: pmndrs/jotai@v2.19.0...v2.19.1

v2.19.0

We improved the core to enable atom caching for performance for some cases.

What's Changed

New Contributors

Full Changelog: pmndrs/jotai@v2.18.1...v2.19.0

v2.18.1

This release fixes a regression introduced in v2.12.1, which affects an uncommon edge case.

What's Changed

... (truncated)

Commits

Updates lru-cache from 11.2.5 to 11.5.1

Changelog

Sourced from lru-cache's changelog.

cringe lorg

11.5

  • Add backgroundFetchSize option, defaulting to 1, to set an effective size for provisional background fetch objects while in flight, if they do not shadow an existing stale entry.

11.4

  • Add cache property to status objects, in order to differentiate which cache is emitting the metric or trace.
  • Several small bugs regarding fetch behavior edge cases.
    • onInsert does not fire for background fetch internal promises.
    • dispose() and disposeAfter() now fire for the stale value left behind when an in-process background fetch is pre-empted by eviction.
    • fetchMethod that returns a non-Promise value is handled correctly.
    • No Error is created, or abort() signaled, when a background fetch promise is resolved. (Presumably the implementation is done by that point.)

11.3

  • Add observability features, expand the coverage of LRUCache.Status objects.

11.2

  • Add the perf option to specify performance, Date, or any other object with a now() method that returns a number.

11.1

  • Add the onInsert method

11.0

  • Drop support for node less than v20

10.4

  • Accidental minor update, should've been patch.

10.3

  • add forceFetch() method
  • set disposeReason to 'expire' when it's the result of a TTL

... (truncated)

Commits
Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates lucide-react from 0.563.0 to 1.17.0

Release notes

Sourced from lucide-react's releases.

Version 1.17.0

What's Changed

Full Changelog: lucide-icons/lucide@1.16.0...1.17.0

Version 1.16.0

What's Changed

Full Changelog: lucide-icons/lucide@1.15.0...1.16.0

Version 1.15.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.14.0...1.15.0

... (truncated)

Commits

Updates next from 16.1.6 to 16.2.7

Release notes

Sourced from next's releases.

v16.2.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • Backport documentation fixes for v16.2 (#93804)
  • [backport] Patch playwright-core to resolve _finishedPromise on requestFailed (#93920)
  • [backport] Fix dev mode hydration failure when page is served from HTTP cache (#93492)
  • [backport] Fix catch-all router.query corruption with basePath + rewrites (#93917)
  • [backport] Encode non-ASCII characters in cache tags at construction (#93918)
  • [backport] Fix server action forwarding loop with middleware rewrites (#93919)
  • [backport] Turbopack: switch from base40 to base38 hash encoding (#93932)
  • [ci] Disable hanging node 24 typescript tests on 16.2 backport branch (#94164)
  • [backport] Fix "type: module" in project dir when using standalone or adapters (#94050)
  • [backport] Propagate adapter preferred regions (#94200)
  • [16.2.x] Don't drop FormData entries (#94240)
  • [backport] feat(turbopack): add LocalPathOrProjectPath PostCSS config resolution (#94284)

Credits

Huge thanks to @​eps1lon, @​icyJoseph, @​unstubbable, @​mischnic, @​bgw, @​timneutkens, and @​lukesandberg for helping!

v16.2.6

[!NOTE] This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

Moderate:

Low:

... (truncated)

Commits
  • 9bd3c26 v16.2.7
  • c63224f [backport] feat(turbopack): add LocalPathOrProjectPath PostCSS config resolut...
  • 63115c7 [16.2.x] Don't drop FormData entries (#94240)
  • aef22fd [backport] Propagate adapter preferred regions (#94200)
  • f126e72 [backport] Fix "type: module" in project dir when using standalone or adapter...
  • bda3e2a [ci] Disable hanging node 24 typescript tests on 16.2 backport branch (#94164)
  • 7e16e07 [backport] Turbopack: switch from base40 to base38 hash encoding (#93932)
  • 6139f4b [backport] Fix server action forwarding loop with middleware rewrites (#93919)
  • c021d10 [backport] Encode non-ASCII characters in cache tags at construction (#93918)
  • 9184ddb [backport] Fix catch-all router.query corruption with basePath + `rewrite...
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.


Updates radix-ui from 1.4.3 to 1.5.0

Changelog

Sourced from radix-ui's changelog.

1.5.0

Context Menu

  • Added support for a controlled open prop on ContextMenu.Root. This is intended for reading the open state and closing the menu programmatically, though we discourage opening the menu programmatically since opening the menu depends on user interaction to position the menu.

    function ControlledContextMenu() {
  const [open, setOpen] = React.useState(false);
  return (
    <ContextMenu.Root open={open} onOpenChange={setOpen}>
      <ContextMenu.Trigger>Open</ContextMenu.Trigger>
      <ContextMenu.Content>
        <button type="button" onClick={() => setOpen(false)}>
          Close me
        </button>
        <ContextMenu.Item>Item 1</ContextMenu.Item>
        <ContextMenu.Item>Item 2</ContextMenu.Item>
      </ContextMenu.Content>
    </ContextMenu.Root>
  );
}

  • Fixed a bug in where submenus remained expanded after re-opening on long-press touch events.

Dialog

  • Fixed a bug where iOS text selection and editing on HTML inputs within dialogs were broken.
  • Fixed a bug causing disabled pointer events in closed dialogs.

One-Time Password Field

  • Fixed pasting into One-Time Password Field in environments that do not support the legacy "Text" clipboard format by reading the pasted value as "text/plain".
  • Fixed issues with focus management in React 19.2+.
  • Fixed a bug to ensure that pasted values exceeding the field length are truncated.

Popper

  • Fixed a "Maximum update depth exceeded" bug for pages with a large number of popper instances.
  • Exposed data-side and data-align on PopperAnchor element

Presence

  • Fixed a "Maximum update depth exceeded" bug in React 19 that could occur when Presence was given a child with an unstable ref.

Radio Group

  • Added unstable RadioGroupItemProvider, RadioGroupItemTrigger and RadioGroupItemBubbleInput parts. These expose the previously internal composition of a radio item that included a visually hidden input so consumers can directly access and recompose them. The RadioGroupItem component continues to render them by default.

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for radix-ui since your current version.


Updates react from 19.2.4 to 19.2.7

Release notes

Sourced from react's releases.

19.2.7 (June 1st, 2026)

React Server Components

19.2.6 (May 6th, 2026)

React Server Components

19.2.5 (April 8th, 2026)

React Server Components

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react since your current version.


Updates @types/react from 19.2.13 to 19.2.17

Commits

Updates react-dom from 19.2.4 to 19.2.7

Release notes

Sourced from react-dom's releases.

19.2.7 (June 1st, 2026)

React Server Components

19.2.6 (May 6th, 2026)

React Server Components

19.2.5 (April 8th, 2026)

React Server Components

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react-dom since your current version.


Updates tailwind-merge from 3.4.0 to 3.6.0

Release notes

Sourced from tailwind-merge's releases.

v3.6.0

New Features

Documentation

Other

Full Changelog: dcastil/tailwind-merge@v3.5.0...v3.6.0

Thanks to @​brandonmcconnell, @​manavm1990, @​langy, @​roboflow, @​syntaxfm, @​getsentry, @​codecov, a private sponsor, @​block, @​openclaw, @​sourcegraph, @​mike-healy and more via @​thnxdev for sponsoring tailwind-merge! ❤️

v3.5.0

New Features

Full Changelog: dcastil/tailwind-merge@v3.4.1...v3.5.0

Thanks to @​brandonmcconnell, @​manavm1990, @​langy, @​roboflow, @​syntaxfm, @​getsentry, @​codecov, a private sponsor, @​block, @​openclaw, @​sourcegraph and more via @​thnxdev for sponsoring tailwind-merge! ❤️

v3.4.1

Bug Fixes

Full Changelog: dcastil/tailwind-merge@v3.4.0...v3.4.1

Thanks to @​brandonmcconnell, @​manavm1990, @​langy, @​roboflow, @​syntaxfm, @​getsentry, @​codecov, a private sponsor, @​block, @​openclaw, @​sourcegraph and more via @​thnxdev for sponsoring tailwind-merge! ❤️

Commits
  • d54f7e5 v3.6.0
  • 638871a Update README to add info about Tailwind CSS v4.3 support
  • 39fc7b5 Revert "v3.6.0"
  • bd8390f v3.6.0
  • 802877c add v3.6.0 changelog
  • a35feda Merge pull request #665 from dcastil/renovate/rollup-plugin-babel-7.x
  • 940389c Merge pull request #667 from dcastil/renovate/release-drafter-release-drafter...
  • 005af6d pin to specific version
  • 5816ced implement breaking changes
  • 17041e1 Merge pull request #676 from dcastil/dependabot/npm_and_yarn/babel/plugin-tra...
  • Additional commits viewable in compare view

Updates @tailwindcss/postcss from 4.1.18 to 4.3.0

Release notes

Sourced from @​tailwindcss/postcss's releases.

v4.3.0

Added

  • Add @container-size utility (#18901)
  • Add scrollbar-{auto,thin,none} utilities for scrollbar-width, and scrollbar-thumb-* / scrollbar-track-* color utilities for scrollbar-color (#19981, #20019)
  • Add scrollbar-gutter-* utilities (#20018)
  • Add zoom-* utilities (#20020)
  • Add tab-* utilities (#20022)
  • Allow using @variant with stacked variants (e.g. @variant hover:focus { … }) (#19996)
  • Allow using @variant with compound variants (e.g. @variant hover, focus { … }) (#19996)
  • Support --default(…) in --value(…) and --modifier(…) for functional @utility definitions (#19989)

Fixed

  • Ensure @plugin resolves package JavaScript entries instead of browser CSS entries when using @tailwindcss/vite (#19949)
  • Fix relative @import and @plugin paths resolving from the wrong directory when using @tailwindcss/vite (#19965)
  • Ensure CSS files containing @variant are processed by @tailwindcss/vite (#19966)
  • Resolve imports relative to base when result.opts.from is not provided when using @tailwindcss/postcss (#19980)
  • Canonicalization: preserve significant _ whitespace in arbitrary values (#19986)
  • Canonicalization: add parentheses when removing whitespace from arbitrary values would hurt readability (e.g. w-[calc(100%---spacing(60))] → w-[calc(100%-(--spacing(60)))]) (#19986)
  • Canonicalization: preserve the original unit in arbitrary values instead of normalizing to base units (e.g. -mt-[20in] → mt-[-20in], not mt-[-1920px]) (#19988)
  • Canonicalization: migrate arbitrary :has() variants from [&:has(…)] to has-[…] (#19991)
  • Upgrade: don’t migrate inline style attributes (e.g. style="flex-grow: 1" → style="flex-grow: 1", not style="grow: 1") (#19918)
  • Allow multiple @utility definitions with the same name but different value types (#19777)
  • Export missing PluginWithConfig type from tailwindcss/plugin to fix errors when inferring plugin config types (#19707)
  • Ensure start and end legacy utilities without values do not generate CSS (#20003)
  • Ensure --value(…) is required in functional @utility definitions (#20005)
  • Canonicalization: preserve required whitespace around operators in negated arbitrary values (e.g. -left-[(var(--a)+var(--b))]) (#20011)

v4.2.4

Fixed

  • Ensure imports in @import and @plugin still resolve correctly when using Vite aliases in @tailwindcss/vite (#19947)

v4.2.3

Fixed

  • Canonicalization: improve canonicalizations for tracking-* utilities by preferring non-negative utilities (e.g. -tracking-tighter → tracking-wider) (#19827)
  • Fix crash due to invalid characters in candidate (exceeding valid unicode code point range) (#19829)
  • Ensure query params in imports are considered unique resources when using @tailwindcss/webpack (#19723)
  • Canonicalization: collapse arbitrary values into shorthand utilities (e.g. px-[1.2rem] py-[1.2rem] → p-[1.2rem]) (#19837)
  • Canonicalization: collapse border-{t,b}-* into border-y-*, border-{l,r}-* into border-x-*, and border-{t,r,b,l}-* into border-* (#19842)
  • Canonicalization: collapse scroll-m{t,b}-* into scroll-my-*, scroll-m{l,r}-* into scroll-mx-*, and scroll-m{t,r,b,l}-* into scroll-m-* (#19842)
  • Canonicalization: collapse scroll-p{t,b}-* into scroll-py-*, scroll-p{l,r}-* into scroll-px-*, and scroll-p{t,r,b,l}-* into scroll-p-* (#19842)
  • Canonicalization: collapse overflow-{x,y}-* into overflow-* (#19842)
  • Canonicalization: collapse overscroll-{x,y}-* into overscroll-* (#19842)
  • Read from --placeholder-color instead of --background-color for placeholder-* utilities (Description has been truncated

@dependabot
deps(npm): bump the ui-dependencies group across 1 directory with 21 …
d5b163e 
…updates

Bumps the ui-dependencies group with 20 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@tabler/icons-react](https://github.com/tabler/tabler-icons/tree/HEAD/packages/icons-react) | `3.36.1` | `3.44.0` |
| [@types/mdx](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/mdx) | `2.0.13` | `2.0.14` |
| [fumadocs-core](https://github.com/fuma-nama/fumadocs) | `16.5.1` | `16.9.3` |
| [fumadocs-mdx](https://github.com/fuma-nama/fumadocs) | `14.2.6` | `15.0.11` |
| [jotai](https://github.com/pmndrs/jotai) | `2.17.1` | `2.20.0` |
| [lru-cache](https://github.com/isaacs/node-lru-cache) | `11.2.5` | `11.5.1` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `0.563.0` | `1.17.0` |
| [next](https://github.com/vercel/next.js) | `16.1.6` | `16.2.7` |
| [radix-ui](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/radix-ui) | `1.4.3` | `1.5.0` |
| [react](https://github.com/facebook/react/tree/HEAD/packages/react) | `19.2.4` | `19.2.7` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.13` | `19.2.17` |
| [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) | `19.2.4` | `19.2.7` |
| [tailwind-merge](https://github.com/dcastil/tailwind-merge) | `3.4.0` | `3.6.0` |
| [@tailwindcss/postcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss) | `4.1.18` | `4.3.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.2.1` | `25.9.2` |
| [eslint](https://github.com/eslint/eslint) | `9.39.2` | `10.4.1` |
| [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.1.6` | `16.2.7` |
| [pagefind](https://github.com/Pagefind/pagefind) | `1.4.0` | `1.5.2` |
| [prettier](https://github.com/prettier/prettier) | `3.8.1` | `3.8.3` |
| [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `6.0.3` |



Updates `@tabler/icons-react` from 3.36.1 to 3.44.0
- [Release notes](https://github.com/tabler/tabler-icons/releases)
- [Commits](https://github.com/tabler/tabler-icons/commits/v3.44.0/packages/icons-react)

Updates `@types/mdx` from 2.0.13 to 2.0.14
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/mdx)

Updates `fumadocs-core` from 16.5.1 to 16.9.3
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/commits/fumadocs-core@16.9.3)

Updates `fumadocs-mdx` from 14.2.6 to 15.0.11
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/commits/fumadocs-mdx@15.0.11)

Updates `jotai` from 2.17.1 to 2.20.0
- [Release notes](https://github.com/pmndrs/jotai/releases)
- [Commits](pmndrs/jotai@v2.17.1...v2.20.0)

Updates `lru-cache` from 11.2.5 to 11.5.1
- [Changelog](https://github.com/isaacs/node-lru-cache/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-lru-cache@v11.2.5...v11.5.1)

Updates `lucide-react` from 0.563.0 to 1.17.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.17.0/packages/lucide-react)

Updates `next` from 16.1.6 to 16.2.7
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v16.1.6...v16.2.7)

Updates `radix-ui` from 1.4.3 to 1.5.0
- [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/radix-ui/CHANGELOG.md)
- [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/radix-ui)

Updates `react` from 19.2.4 to 19.2.7
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react)

Updates `@types/react` from 19.2.13 to 19.2.17
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `react-dom` from 19.2.4 to 19.2.7
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react-dom)

Updates `tailwind-merge` from 3.4.0 to 3.6.0
- [Release notes](https://github.com/dcastil/tailwind-merge/releases)
- [Commits](dcastil/tailwind-merge@v3.4.0...v3.6.0)

Updates `@tailwindcss/postcss` from 4.1.18 to 4.3.0
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.0/packages/@tailwindcss-postcss)

Updates `@types/node` from 25.2.1 to 25.9.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/react` from 19.2.13 to 19.2.17
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `eslint` from 9.39.2 to 10.4.1
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v9.39.2...v10.4.1)

Updates `eslint-config-next` from 16.1.6 to 16.2.7
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](https://github.com/vercel/next.js/commits/v16.2.7/packages/eslint-config-next)

Updates `pagefind` from 1.4.0 to 1.5.2
- [Release notes](https://github.com/Pagefind/pagefind/releases)
- [Changelog](https://github.com/Pagefind/pagefind/blob/main/CHANGELOG.md)
- [Commits](Pagefind/pagefind@v1.4.0...v1.5.2)

Updates `prettier` from 3.8.1 to 3.8.3
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.8.1...3.8.3)

Updates `tailwindcss` from 4.1.18 to 4.3.0
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.0/packages/tailwindcss)

Updates `typescript` from 5.9.3 to 6.0.3
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](microsoft/TypeScript@v5.9.3...v6.0.3)

---
updated-dependencies:
- dependency-name: "@tabler/icons-react"
  dependency-version: 3.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ui-dependencies
- dependency-name: "@types/mdx"
  dependency-version: 2.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ui-dependencies
- dependency-name: fumadocs-core
  dependency-version: 16.9.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ui-dependencies
- dependency-name: fumadocs-mdx
  dependency-version: 15.0.11
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ui-dependencies
- dependency-name: jotai
  dependency-version: 2.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ui-dependencies
- dependency-name: lru-cache
  dependency-version: 11.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ui-dependencies
- dependency-name: lucide-react
  dependency-version: 1.17.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ui-dependencies
- dependency-name: next
  dependency-version: 16.2.7
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ui-dependencies
- dependency-name: radix-ui
  dependency-version: 1.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ui-dependencies
- dependency-name: react
  dependency-version: 19.2.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ui-dependencies
- dependency-name: "@types/react"
  dependency-version: 19.2.17
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: ui-dependencies
- dependency-name: react-dom
  dependency-version: 19.2.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ui-dependencies
- dependency-name: tailwind-merge
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ui-dependencies
- dependency-name: "@tailwindcss/postcss"
  dependency-version: 4.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: ui-dependencies
- dependency-name: "@types/node"
  dependency-version: 25.9.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: ui-dependencies
- dependency-name: "@types/react"
  dependency-version: 19.2.17
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: ui-dependencies
- dependency-name: eslint
  dependency-version: 10.4.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: ui-dependencies
- dependency-name: eslint-config-next
  dependency-version: 16.2.7
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: ui-dependencies
- dependency-name: pagefind
  dependency-version: 1.5.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: ui-dependencies
- dependency-name: prettier
  dependency-version: 3.8.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: ui-dependencies
- dependency-name: tailwindcss
  dependency-version: 4.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: ui-dependencies
- dependency-name: typescript
  dependency-version: 6.0.3
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: ui-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 9, 2026
@socket-security

socket-security Bot commented Jun 9, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatednext@​16.1.6 ⏵ 16.2.764 +13100 +7591 +19970
Updatedeslint-config-next@​16.1.6 ⏵ 16.2.7991006798 +1100
Updatedfumadocs-mdx@​14.2.6 ⏵ 15.0.11981007296100
Updated@​types/​mdx@​2.0.13 ⏵ 2.0.141001007286100
Updatedfumadocs-core@​16.5.1 ⏵ 16.9.398 +110077 +295 -1100
Updated@​types/​react@​19.2.13 ⏵ 19.2.171001007996100
Updatedlucide-react@​0.563.0 ⏵ 1.17.0100 +110098 +29580 -19
Updatedradix-ui@​1.4.3 ⏵ 1.5.097 +11008197100
Updated@​types/​node@​25.2.1 ⏵ 25.9.2100 +110081 +196100
Updatedtailwindcss@​4.1.18 ⏵ 4.3.0100 +110084 +198100
Updatedreact@​19.2.4 ⏵ 19.2.71001008497100
Updatedtailwind-merge@​3.4.0 ⏵ 3.6.0100 +110086 +195100
Updatedpagefind@​1.4.0 ⏵ 1.5.29910086 +187100
Updatedjotai@​2.17.1 ⏵ 2.20.088 -1110010091100
Updated@​tabler/​icons-react@​3.36.1 ⏵ 3.44.09810098 +190 -2100
Updatedtypescript@​5.9.3 ⏵ 6.0.3100 +110090 +19590
Updatedreact-dom@​19.2.4 ⏵ 19.2.71001009298100
Updatedlru-cache@​11.2.5 ⏵ 11.5.199 +11009993100
Updatedprettier@​3.8.1 ⏵ 3.8.398 +110097 +193100
Updatedeslint@​9.39.2 ⏵ 10.4.198 +110010095100
Updated@​tailwindcss/​postcss@​4.1.18 ⏵ 4.3.0100 +110010098100

View full report

@socket-security

socket-security Bot commented Jun 9, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm @typescript-eslint/eslint-plugin is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package-lock.json → npm/eslint-config-next@16.2.7 → npm/@typescript-eslint/eslint-plugin@8.61.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript-eslint/eslint-plugin@8.61.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm es-abstract is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package-lock.json → npm/eslint-config-next@16.2.7 → npm/es-abstract@1.24.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/es-abstract@1.24.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm jotai is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package-lock.json → npm/jotai@2.20.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/jotai@2.20.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm js-yaml is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package-lock.json → npm/fumadocs-core@16.9.3 → npm/fumadocs-mdx@15.0.11 → npm/js-yaml@4.2.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/js-yaml@4.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants