deps(deps): bump the minor-and-patch group with 39 updates by dependabot[bot] · Pull Request #181 · profullstack/media-streamer

dependabot · 2026-08-17T18:32:45Z

Bumps the minor-and-patch group with 39 updates:

Package	From	To
@noriginmedia/norigin-spatial-navigation	`3.1.0`	`3.3.0`
@radix-ui/react-dialog	`1.1.15`	`1.1.23`
@radix-ui/react-dropdown-menu	`2.1.16`	`2.1.24`
@radix-ui/react-progress	`1.1.8`	`1.1.16`
@radix-ui/react-scroll-area	`1.2.10`	`1.2.18`
@radix-ui/react-separator	`1.1.8`	`1.1.15`
@radix-ui/react-slider	`1.3.6`	`1.4.7`
@radix-ui/react-slot	`1.2.4`	`1.3.3`
@radix-ui/react-tabs	`1.1.13`	`1.1.21`
@radix-ui/react-toast	`1.2.15`	`1.2.23`
@radix-ui/react-tooltip	`1.2.8`	`1.2.16`
@supabase/supabase-js	`2.99.3`	`2.112.3`
hls.js	`1.6.16`	`1.7.0`
imapflow	`1.3.6`	`1.7.0`
isomorphic-dompurify	`3.12.0`	`3.22.0`
lightweight-charts	`5.2.0`	`5.2.1`
linkedom	`0.18.12`	`0.18.13`
lucide-react	`1.14.0`	`1.31.0`
mailparser	`3.9.9`	`3.9.15`
mpegts.js	`1.8.0`	`1.8.2`
next	`16.2.4`	`16.3.1`
posthog-js	`1.381.0`	`1.417.1`
react	`19.2.5`	`19.2.8`
@types/react	`19.2.14`	`19.2.18`
react-dom	`19.2.5`	`19.2.8`
@types/react-dom	`19.2.3`	`19.2.4`
resend	`6.12.2`	`6.20.0`
sax	`1.6.0`	`1.6.1`
tailwind-merge	`3.5.0`	`3.6.0`
video.js	`8.23.7`	`8.24.0`
@playwright/test	`1.60.0`	`1.62.1`
@tailwindcss/postcss	`4.2.4`	`4.3.3`
@testing-library/user-event	`14.6.1`	`14.6.4`
@vitest/coverage-v8	`4.1.8`	`4.1.10`
eslint-config-next	`16.2.4`	`16.3.1`
postcss	`8.5.14`	`8.5.26`
tailwindcss	`4.2.4`	`4.3.3`
tsx	`4.21.0`	`4.23.12`
vitest	`4.1.8`	`4.1.10`

Updates @noriginmedia/norigin-spatial-navigation from 3.1.0 to 3.3.0

Release notes

Sourced from @noriginmedia/norigin-spatial-navigation's releases.

@noriginmedia/norigin-spatial-navigation-react@3.3.0

Minor Changes

b816f56: Add measureChildrenLayout option to useFocusable (default true) to control whether a container's direct children are measured during navigation and updateAllLayouts. Set it to false on containers driven by their own nextFocusResolver to skip layout measurement that the resolver doesn't need.

Patch Changes

Updated dependencies [b816f56]

@noriginmedia/norigin-spatial-navigation-core@4.1.0

@noriginmedia/norigin-spatial-navigation@3.3.0

Minor Changes

b816f56: Add measureChildrenLayout option to useFocusable (default true) to control whether a container's direct children are measured during navigation and updateAllLayouts. Set it to false on containers driven by their own nextFocusResolver to skip layout measurement that the resolver doesn't need.

Patch Changes

Updated dependencies [b816f56]

@noriginmedia/norigin-spatial-navigation-core@4.1.0

@noriginmedia/norigin-spatial-navigation-react@3.3.0

@noriginmedia/norigin-spatial-navigation-react@3.2.1

Patch Changes

54353b0: - Add nextFocusResolver to override default behavior

Updated dependencies [54353b0]

Updated dependencies [54353b0]

Updated dependencies [54353b0]

@noriginmedia/norigin-spatial-navigation-core@4.0.0

@noriginmedia/norigin-spatial-navigation@3.2.1

Patch Changes

Updated dependencies [54353b0]

Updated dependencies [54353b0]

Updated dependencies [54353b0]

@noriginmedia/norigin-spatial-navigation-core@4.0.0

@noriginmedia/norigin-spatial-navigation-react@3.2.1

@noriginmedia/norigin-spatial-navigation-core@3.2.0

Minor Changes

a18ed66: Add focusOnPresetKey init option (default true) to control whether a component is automatically focused when it is added and its focus key was already set as the current focus key (e.g. setFocus was called before the component mounted). Set it to false to disable this implicit refocus on add.

@noriginmedia/norigin-spatial-navigation-react@3.2.0

Minor Changes

a18ed66: Add focusOnPresetKey init option (default true) to control whether a component is automatically focused when it is added and its focus key was already set as the current focus key (e.g. setFocus was called before the component mounted). Set it to false to disable this implicit refocus on add.

Patch Changes

... (truncated)

Commits

5483dc2 ci: Release Packages (#243)
b816f56 Add measureChildrenLayout option to skip child layout measurement (#242)
58b5da0 ci: Release Packages (#240)
54353b0 React Native TV support (#239)
2a0924b ci: Release Packages (#237)
a18ed66 feat: configurable focus-on-preset-key behavior + CLAUDE.md (#236)
02f652b Update README.md to use latest logos (#232)
dd47d22 Added SKILL.md for agents to use this library (#229)
See full diff in compare view

Updates @radix-ui/react-dialog from 1.1.15 to 1.1.23

Changelog

Sourced from @radix-ui/react-dialog's changelog.

1.1.23

Reverted breaking changes that caused compatibility issues with React Server Components.

Updated dependencies: @radix-ui/react-compose-refs@1.1.5, @radix-ui/react-context@1.2.2, @radix-ui/react-dismissable-layer@1.1.19, @radix-ui/react-focus-guards@1.1.6, @radix-ui/react-focus-scope@1.1.16, @radix-ui/react-id@1.1.4, @radix-ui/react-portal@1.1.17, @radix-ui/react-presence@1.1.10, @radix-ui/react-primitive@2.1.10, @radix-ui/react-slot@1.3.3, @radix-ui/react-use-controllable-state@1.2.6, @radix-ui/react-use-layout-effect@1.1.4

1.1.22

Updated dependencies: @radix-ui/react-slot@1.3.2, @radix-ui/react-primitive@2.1.9, @radix-ui/react-dismissable-layer@1.1.18, @radix-ui/react-focus-scope@1.1.15, @radix-ui/react-portal@1.1.16

1.1.21

Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation.

Updated dependencies: @radix-ui/primitive@1.1.7, @radix-ui/react-compose-refs@1.1.4, @radix-ui/react-context@1.2.1, @radix-ui/react-dismissable-layer@1.1.17, @radix-ui/react-focus-guards@1.1.5, @radix-ui/react-focus-scope@1.1.14, @radix-ui/react-id@1.1.3, @radix-ui/react-portal@1.1.15, @radix-ui/react-presence@1.1.9, @radix-ui/react-primitive@2.1.8, @radix-ui/react-slot@1.3.1, @radix-ui/react-use-controllable-state@1.2.5, @radix-ui/react-use-layout-effect@1.1.3

1.1.20

Fixed broken ARIA references in Dialogs where a title or description elements are not rendered.

Improved tree-shaking so bundlers can drop unused components. Component parts are now marked /* @__PURE__ */ and use named render functions instead of Component.displayName = ... assignments, which previously prevented dead-code elimination with some bundlers.

Updated dependencies: @radix-ui/react-dismissable-layer@1.1.16, @radix-ui/react-focus-scope@1.1.13, @radix-ui/react-portal@1.1.14, @radix-ui/react-presence@1.1.8, @radix-ui/react-use-controllable-state@1.2.4, @radix-ui/primitive@1.1.6, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.2.0, @radix-ui/react-focus-guards@1.1.4, @radix-ui/react-id@1.1.2, @radix-ui/react-primitive@2.1.7, @radix-ui/react-slot@1.3.0, @radix-ui/react-use-layout-effect@1.1.2

1.1.19

Updated dependencies: @radix-ui/react-dismissable-layer@1.1.15, @radix-ui/primitive@1.1.5, @radix-ui/react-context@1.2.0, @radix-ui/react-focus-scope@1.1.12, @radix-ui/react-presence@1.1.7

1.1.18

Updated dependencies: @radix-ui/react-primitive@2.1.7, @radix-ui/react-dismissable-layer@1.1.14, @radix-ui/react-focus-scope@1.1.11, @radix-ui/react-portal@1.1.13

1.1.17

Removed dev-only warnings for dialogs when title and/or description is not rendered.

Fixed Dismissable Layer so outside interactions stopped by extension UI overlays do not dismiss dialogs or popovers.

Updated dependencies: @radix-ui/react-slot@1.3.0, @radix-ui/react-dismissable-layer@1.1.13, @radix-ui/react-primitive@2.1.6, @radix-ui/react-focus-scope@1.1.10, @radix-ui/react-portal@1.1.12

1.1.16

Fixed disabled pointer events in closed dialogs

Fixed a bug where iOS text selection and editing on HTML inputs within react-dialog were broken

Fixed triggers referencing a non-existent element via aria-controls when their content is removed from the DOM (credit to @dodomorandi for the original PR)

Added repository.directory to all package.json files

Updated dependencies: @radix-ui/react-presence@1.1.6, @radix-ui/react-slot@1.2.5, @radix-ui/react-focus-guards@1.1.4, @radix-ui/react-dismissable-layer@1.1.12, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-focus-scope@1.1.9, @radix-ui/react-id@1.1.2, @radix-ui/react-portal@1.1.11, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-controllable-state@1.2.3

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @radix-ui/react-dialog since your current version.

Updates @radix-ui/react-dropdown-menu from 2.1.16 to 2.1.24

Changelog

Sourced from @radix-ui/react-dropdown-menu's changelog.

2.1.24

Reverted breaking changes that caused compatibility issues with React Server Components.

Updated dependencies: @radix-ui/react-compose-refs@1.1.5, @radix-ui/react-context@1.2.2, @radix-ui/react-id@1.1.4, @radix-ui/react-menu@2.1.24, @radix-ui/react-primitive@2.1.10, @radix-ui/react-use-controllable-state@1.2.6

2.1.23

Updated dependencies: @radix-ui/react-menu@2.1.23, @radix-ui/react-primitive@2.1.9

2.1.22

Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation.

Updated dependencies: @radix-ui/primitive@1.1.7, @radix-ui/react-compose-refs@1.1.4, @radix-ui/react-context@1.2.1, @radix-ui/react-id@1.1.3, @radix-ui/react-menu@2.1.22, @radix-ui/react-primitive@2.1.8, @radix-ui/react-use-controllable-state@1.2.5

2.1.21

Improved tree-shaking so bundlers can drop unused components. Component parts are now marked /* @__PURE__ */ and use named render functions instead of Component.displayName = ... assignments, which previously prevented dead-code elimination with some bundlers.

Updated dependencies: @radix-ui/react-menu@2.1.21, @radix-ui/react-use-controllable-state@1.2.4, @radix-ui/primitive@1.1.6, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.2.0, @radix-ui/react-id@1.1.2, @radix-ui/react-primitive@2.1.7

2.1.20

Fixed menu items, tab triggers, toolbar links, and select items intercepting Space/Enter keys that originate from focusable descendants.

Updated dependencies: @radix-ui/primitive@1.1.5, @radix-ui/react-context@1.2.0, @radix-ui/react-menu@2.1.20

2.1.19

Fixed infinite re-render loop in React 19 caused by unstable composed ref callback references.

Other updates

Updated dependencies: @radix-ui/react-primitive@2.1.7, @radix-ui/react-menu@2.1.19

2.1.18

Fixed a bug where menus and submenus remained open after a window loses focus.

Updated dependencies: @radix-ui/react-menu@2.1.18, @radix-ui/react-primitive@2.1.6

2.1.17

Added repository.directory to all package.json files

Updated dependencies: @radix-ui/react-menu@2.1.17, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-id@1.1.2, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-controllable-state@1.2.3

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @radix-ui/react-dropdown-menu since your current version.

Updates @radix-ui/react-progress from 1.1.8 to 1.1.16

Changelog

Sourced from @radix-ui/react-progress's changelog.

1.1.16

Reverted breaking changes that caused compatibility issues with React Server Components.

Updated dependencies: @radix-ui/react-context@1.2.2, @radix-ui/react-primitive@2.1.10

1.1.15

Updated dependencies: @radix-ui/react-primitive@2.1.9

1.1.14

Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation.

Updated dependencies: @radix-ui/react-context@1.2.1, @radix-ui/react-primitive@2.1.8

1.1.13

Improved tree-shaking so bundlers can drop unused components. Component parts are now marked /* @__PURE__ */ and use named render functions instead of Component.displayName = ... assignments, which previously prevented dead-code elimination with some bundlers.

Updated dependencies: @radix-ui/react-context@1.2.0, @radix-ui/react-primitive@2.1.7

1.1.12

Updated dependencies: @radix-ui/react-context@1.2.0

1.1.11

Updated dependencies: @radix-ui/react-primitive@2.1.7

1.1.10

Updated dependencies: @radix-ui/react-primitive@2.1.6

1.1.9

Added repository.directory to all package.json files

Updated dependencies: @radix-ui/react-context@1.1.4, @radix-ui/react-primitive@2.1.5

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @radix-ui/react-progress since your current version.

Updates @radix-ui/react-scroll-area from 1.2.10 to 1.2.18

Changelog

Sourced from @radix-ui/react-scroll-area's changelog.

1.2.18

Reverted breaking changes that caused compatibility issues with React Server Components.

Updated dependencies: @radix-ui/react-compose-refs@1.1.5, @radix-ui/react-context@1.2.2, @radix-ui/react-direction@1.1.4, @radix-ui/react-presence@1.1.10, @radix-ui/react-primitive@2.1.10, @radix-ui/react-use-callback-ref@1.1.4, @radix-ui/react-use-layout-effect@1.1.4

1.2.17

Updated dependencies: @radix-ui/react-primitive@2.1.9

1.2.16

Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation.

Updated dependencies: @radix-ui/number@1.1.3, @radix-ui/primitive@1.1.7, @radix-ui/react-compose-refs@1.1.4, @radix-ui/react-context@1.2.1, @radix-ui/react-direction@1.1.3, @radix-ui/react-presence@1.1.9, @radix-ui/react-primitive@2.1.8, @radix-ui/react-use-callback-ref@1.1.3, @radix-ui/react-use-layout-effect@1.1.3

1.2.15

Improved tree-shaking so bundlers can drop unused components. Component parts are now marked /* @__PURE__ */ and use named render functions instead of Component.displayName = ... assignments, which previously prevented dead-code elimination with some bundlers.

Updated dependencies: @radix-ui/react-presence@1.1.8, @radix-ui/primitive@1.1.6, @radix-ui/number@1.1.2, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.2.0, @radix-ui/react-direction@1.1.2, @radix-ui/react-primitive@2.1.7, @radix-ui/react-use-callback-ref@1.1.2, @radix-ui/react-use-layout-effect@1.1.2

1.2.14

Fixed --radix-scroll-area-corner-width and --radix-scroll-area-corner-height not resetting to 0 when the corner is removed (eg. when one of the scrollbars is no longer visible). Previously these values would stick around and leave a permanent gap on the remaining scrollbar.

Updated dependencies: @radix-ui/primitive@1.1.5, @radix-ui/react-context@1.2.0, @radix-ui/react-presence@1.1.7

1.2.13

Fixed infinite re-render loop in React 19 caused by unstable composed ref callback references.

Other updates

Updated dependencies: @radix-ui/react-primitive@2.1.7

1.2.12

Stabilized the viewport style tag unless the nonce changes.

Fixed Duplicate index signature errors that surfaced when consuming multiple packages together.

Updated dependencies: @radix-ui/react-primitive@2.1.6

1.2.11

Fixed missing data-state attribute for Scroll Area scrollbars

Added repository.directory to all package.json files

Updated dependencies: @radix-ui/react-presence@1.1.6, @radix-ui/react-direction@1.1.2, @radix-ui/number@1.1.2, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-callback-ref@1.1.2, @radix-ui/react-use-layout-effect@1.1.2

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @radix-ui/react-scroll-area since your current version.

Updates @radix-ui/react-separator from 1.1.8 to 1.1.15

Changelog

Sourced from @radix-ui/react-separator's changelog.

1.1.15

Reverted breaking changes that caused compatibility issues with React Server Components.

Updated dependencies: @radix-ui/react-primitive@2.1.10

1.1.14

Updated dependencies: @radix-ui/react-primitive@2.1.9

1.1.13

Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation.

Updated dependencies: @radix-ui/react-primitive@2.1.8

1.1.12

Improved tree-shaking so bundlers can drop unused components. Component parts are now marked /* @__PURE__ */ and use named render functions instead of Component.displayName = ... assignments, which previously prevented dead-code elimination with some bundlers.

Updated dependencies: @radix-ui/react-primitive@2.1.7

1.1.11

Updated dependencies: @radix-ui/react-primitive@2.1.7

1.1.10

Updated dependencies: @radix-ui/react-primitive@2.1.6

1.1.9

Added repository.directory to all package.json files

Updated dependencies: @radix-ui/react-primitive@2.1.5

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @radix-ui/react-separator since your current version.

Updates @radix-ui/react-slider from 1.3.6 to 1.4.7

Changelog

Sourced from @radix-ui/react-slider's changelog.

1.4.7

Reverted breaking changes that caused compatibility issues with React Server Components.

Updated dependencies: @radix-ui/react-collection@1.1.15, @radix-ui/react-compose-refs@1.1.5, @radix-ui/react-context@1.2.2, @radix-ui/react-direction@1.1.4, @radix-ui/react-primitive@2.1.10, @radix-ui/react-use-controllable-state@1.2.6, @radix-ui/react-use-layout-effect@1.1.4, @radix-ui/react-use-previous@1.1.4, @radix-ui/react-use-size@1.1.4

1.4.6

Updated dependencies: @radix-ui/react-collection@1.1.14, @radix-ui/react-primitive@2.1.9

1.4.5

Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation.

Updated dependencies: @radix-ui/number@1.1.3, @radix-ui/primitive@1.1.7, @radix-ui/react-collection@1.1.13, @radix-ui/react-compose-refs@1.1.4, @radix-ui/react-context@1.2.1, @radix-ui/react-direction@1.1.3, @radix-ui/react-primitive@2.1.8, @radix-ui/react-use-controllable-state@1.2.5, @radix-ui/react-use-layout-effect@1.1.3, @radix-ui/react-use-previous@1.1.3, @radix-ui/react-use-size@1.1.3

1.4.4

Fixed a bug where onValueCommit was not called when a slider thumb was dragged across another thumb.

Improved tree-shaking so bundlers can drop unused components. Component parts are now marked /* @__PURE__ */ and use named render functions instead of Component.displayName = ... assignments, which previously prevented dead-code elimination with some bundlers.

Updated dependencies: @radix-ui/react-use-controllable-state@1.2.4, @radix-ui/primitive@1.1.6, @radix-ui/number@1.1.2, @radix-ui/react-collection@1.1.12, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.2.0, @radix-ui/react-direction@1.1.2, @radix-ui/react-primitive@2.1.7, @radix-ui/react-use-layout-effect@1.1.2, @radix-ui/react-use-previous@1.1.2, @radix-ui/react-use-size@1.1.2

1.4.3

Fixed a bug in form control components to ensure their values are updated when their associated form's is reset. This affects RadioGroup, Slider, Select, and Switch.

Fixed keyboard stepping skipping a valid value when the current value is off the step grid (eg, a defaultValue that isn't a multiple of step from min). Stepping now snaps to the next step-aligned value in the direction of travel, matching native <input type="range"> behavior.

Updated dependencies: @radix-ui/primitive@1.1.5, @radix-ui/react-context@1.2.0, @radix-ui/react-collection@1.1.12

1.4.2

Fixed infinite re-render loop in React 19 caused by unstable composed ref callback references.

Other updates

Updated dependencies: @radix-ui/react-primitive@2.1.7, @radix-ui/react-collection@1.1.11

1.4.1

Fixed Duplicate index signature errors that surfaced when consuming multiple packages together.

Updated dependencies: @radix-ui/react-primitive@2.1.6, @radix-ui/react-collection@1.1.10

1.4.0

Added unstable ThumbProvider, ThumbTrigger, and BubbleInput parts to Slider. SliderThumb was previously a single component that implicitly rendered a hidden native input for form submission. It is now composed from these new parts, which are exposed so consumers can decouple the bubble input from the thumb (for example, to render or customize it independently) instead of relying on SliderThumb to render it implicitly. SliderThumb continues to render all three by default, so existing usage is unaffected.

Added focusVisible for non-keyboard interactions with slider thumbs for progressively enabling styles using :focus-visible alongside programmatic focus management

Fixed Slider focus bugs in scrollable context

Fixed a Slider bug where very small step values made the thumbs unresponsive

Added repository.directory to all package.json files

Updated dependencies: @radix-ui/react-collection@1.1.9, @radix-ui/react-direction@1.1.2, @radix-ui/number@1.1.2, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-controllable-state@1.2.3, @radix-ui/react-use-layout-effect@1.1.2, @radix-ui/react-use-previous@1.1.2, @radix-ui/react-use-size@1.1.2

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @radix-ui/react-slider since your current version.

Updates @radix-ui/react-slot from 1.2.4 to 1.3.3

Changelog

Sourced from @radix-ui/react-slot's changelog.

1.3.2, 1.3.3

Reverted breaking changes that caused compatibility issues with React Server Components.

1.3.1

Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation.

Updated dependencies: @radix-ui/primitive@1.1.7, @radix-ui/react-compose-refs@1.1.4

1.3.0

Added generic type arguments for SlotProps and createSlot

SlotProps and createSlot now accept generic type arguments to specify the type of element a slot should render, as well as its props.
const Slot = createSlot<HTMLButtonElement, MyCustomButtonProps>('Slot');
1.2.5

Fixed infinite re-render loop in React 19 caused by Slot creating a new ref callback on every render

Added support for nested Slottable via a render prop, so a slotted element can be wrapped while still merging Slot props and refs onto it

Added repository.directory to all package.json files

Improved error messages for invalid slot children

Updated dependencies: @radix-ui/react-compose-refs@1.1.3

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @radix-ui/react-slot since your current version.

Updates @radix-ui/react-tabs from 1.1.13 to 1.1.21

Changelog

Sourced from @radix-ui/react-tabs's changelog.

1.1.21

Reverted breaking changes that caused compatibility issues with React Server Components.

Updated dependencies: @radix-ui/react-context@1.2.2, @radix-ui/react-direction@1.1.4, @radix-ui/react-id@1.1.4, @radix-ui/react-presence@1.1.10, @radix-ui/react-primitive@2.1.10, @radix-ui/react-roving-focus@1.1.19, @radix-ui/react-use-controllable-state@1.2.6

1.1.20

Updated dependencies: @radix-ui/react-primitive@2.1.9, @radix-ui/react-roving-focus@1.1.18

1.1.19

Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation.

Updated dependencies: @radix-ui/primitive@1.1.7, @radix-ui/react-context@1.2.1, @radix-ui/react-direction@1.1.3, @radix-ui/react-id@1.1.3, @radix-ui/react-presence@1.1.9, @radix-ui/react-primitive@2.1.8, @radix-ui/react-roving-focus@1.1.17, @radix-ui/react-use-controllable-state@1.2.5

1.1.18

Improved tree-shaking so bundlers can drop unused components. Component parts are now marked /* @__PURE__ */ and use named render functions instead of Component.displayName = ... assignments, which previously prevented dead-code elimination with some bundlers.

Updated dependencies: @radix-ui/react-presence@1.1.8, @radix-ui/react-roving-focus@1.1.16, @radix-ui/react-use-controllable-state@1.2.4, @radix-ui/primitive@1.1.6, @radix-ui/react-context@1.2.0, @radix-ui/react-direction@1.1.2, @radix-ui/react-id@1.1.2, @radix-ui/react-primitive@2.1.7

1.1.17

Fixed menu items, tab triggers, toolbar links, and select items intercepting Space/Enter keys that originate from focusable descendants.

Updated dependencies: @radix-ui/primitive@1.1.5, @radix-ui/react-context@1.2.0, @radix-ui/react-roving-focus@1.1.15, @radix-ui/react-presence@1.1.7

1.1.16

Updated dependencies: @radix-ui/react-primitive@2.1.7, @radix-ui/react-roving-focus@1.1.14

1.1.15

Updated dependencies: @radix-ui/react-primitive@2.1.6, @radix-ui/react-roving-focus@1.1.13

1.1.14

Fixed triggers referencing a non-existent element via aria-controls when their content is removed from the DOM (credit to @dodomorandi for the original PR)

Added repository.directory to all package.json files

Updated dependencies: @radix-ui/react-presence@1.1.6, @radix-ui/react-direction@1.1.2, @radix-ui/primitive@1.1.4, @radix-ui/react-context@1.1.4, @radix-ui/react-id@1.1.2, @radix-ui/react-primitive@2.1.5, @radix-ui/react-roving-focus@1.1.12, @radix-ui/react-use-controllable-state@1.2.3

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @radix-ui/react-tabs since your current version.

Updates @radix-ui/react-toast from 1.2.15 to 1.2.23

Changelog

Sourced from @radix-ui/react-toast's changelog.

1.2.23

Reverted breaking changes that caused compatibility issues with React Server Components.

Updated dependencies: @radix-ui/react-collection@1.1.15, @radix-ui/react-compose-refs@1.1.5, @radix-ui/react-context@1.2.2, @radix-ui/react-dismissable-layer@1.1.19, @radix-ui/react-portal@1.1.17, @radix-ui/react-presence@1.1.10, @radix-ui/react-primitive@2.1.10, @radix-ui/react-use-callback-ref@1.1.4, @radix-ui/react-use-controllable-state@1.2.6, @radix-ui/react-use-layout-effect@1.1.4, @radix-ui/react-visually-hidden@1.2.11

1.2.22

Updated dependencies: @radix-ui/react-collection@1.1.14, @radix-ui/react-primitive@2.1.9, @radix-ui/react-dismissable-layer@1.1.18, @radix-ui/react-portal@1.1.16, @radix-ui/react-visually-hidden@1.2.10

1.2.21

Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation.

Updated dependencies: @radix-ui/primitive@1.1.7, @radix-ui/react-collection@1.1.13, @radix-ui/react-compose-refs@1.1.4, @radix-ui/react-context@1.2.1, @radix-ui/react-dismissable-layer@1.1.17, @radix-ui/react-portal@1.1.15, @radix-ui/react-presence@1.1.9, @radix-ui/react-primitive@2.1.8, @radix-ui/react-use-callback-ref@1.1.3, @radix-ui/react-use-controllable-state@1.2.5, @radix-ui/react-use-layout-effect@1.1.3, @radix-ui/react-visually-hidden@1.2.9

1.2.20

Improved tree-shaking so bundlers can drop unused components. Component parts are now marked /* @__PURE__ */ and use named render functions instead of Component.displayName = ... assignments, which previously prevented dead-code elimination with some bundlers.

Fixed Toast removing non-focused toasts when pressing Escape.

Updated dependencies: @radix-ui/react-dismissable-layer@1.1.16, @radix-ui/react-portal@1.1.14, @radix-ui/react-presence@1.1.8, @radix-ui/react-visually-hidden@1.2.8, @radix-ui/react-use-controllable-state@1.2.4, @radix-ui/primitive@1.1.6, @radix-ui/react-collection@1.1.12, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.2.0, @radix-ui/react-primitive@2.1.7, @radix-ui/react-use-callback-ref@1.1.2, @radix-ui/react-use-layout-effect@1.1.2

1.2.19

Updated dependencies: @radix-ui/react-dismissable-layer@1.1.15, @radix-ui/primitive@1.1.5, @radix-ui/react-context@1.2.0, @radix-ui/react-presence@1.1.7, @radix-ui/react-collection@1.1.12

1.2.18

Fixed infinite re-render loop in React 19 caused by unstable composed ref callback references.

Cleared the close timer on unmount to prevent memory leaks and errors in test environments

Updated dependencies: @radix-ui/react-primitive@2.1.7, @radix-ui/react-dismissable-layer@1.1.14, @radix-ui/react-collection@1.1.11, @radix-ui/react-portal@1.1.13, @radix-ui/react-visually-hidden@1.2.7

1.2.17

Updated dependencies: @radix-ui/react-dismissable-layer@1.1.13, @radix-ui/react-primitive@2.1.6, @radix-ui/react-collection@1.1.10, @radix-ui/react-portal@1.1.12, @radix-ui/react-visually-hidden@1.2.6

1.2.16

Allow to specify container for ToastAnnounce

Added repository.directory to all package.json files

Updated dependencies: @radix-ui/react-presence@1.1.6, @radix-ui/react-dismissable-layer@1.1.12, @radix-ui/react-collection@1.1.9, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-portal@1.1.11, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-callback-ref@1.1.2, @radix-ui/react-use-controllable-state@1.2.3, @radix-ui/react-use-layout-effect@1.1.2, @radix-ui/react-visually-hidden@1.2.5

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @radix-ui/react-toast since your current version.

Updates @radix-ui/react-tooltip from 1.2.8 to 1.2.16

Changelog

Sourced from @radix-ui/react-tooltip's changelog.

1.2.16

Reverted breaking changes that caused compatibility issues with React Server Components.

Updated dependencies: @radix-ui/react-compose-refs@1.1.5, @radix-ui/react-context@1.2.2, @radix-ui/react-dismissable-layer@1.1.19, @radix-ui/react-id@1.1.4, @radix-ui/react-popper@1.3.7, @radix-ui/react-portal@1.1.17, @radix-ui/react-presence@1.1.10, @radix-ui/react-primitive@2.1.10, @radix-ui/react-slot@1.3.3, @radix-ui/react-use-controllable-state@1.2.6, @radix-ui/react-use-layout-effect@1.1.4, @radix-ui/react-visually-hidden@1.2.11

1.2.15

Updated dependencies: @radix-ui/react-slot@1.3.2, @radix-ui/react-primitive@2.1.9, @radix-ui/react-dismissable-layer@1.1.18, @radix-ui/react-popper@1.3.6, @radix-ui/react-portal@1.1.16, @radix-ui/react-visually-hidden@1.2.10

1.2.14

Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation.

Updated dependencies: @radix-ui/primitive@1.1.7, @radix-ui/react-compose-refs@1.1.4, @radix-ui/react-context@1.2.1, @radix-ui/react-dismissable-layer@1.1.17, @radix-ui/react-id@1.1.3, @radix-ui/react-popper@1.3.5, @radix-ui/react-portal@1.1.15, @radix-ui/react-presence@1.1.9, @radix-ui/react-primitive@2.1.8, @radix-ui/react-slot@1.3.1, @radix-ui/react-use-controllable-state@1.2.5, @radix-ui/react-use-layout-effect@1.1.3, @radix-ui/react-visually-hidden@1.2.9

1.2.13

Fixed a bug where Tooltip.Content children were mounted to the DOM twice.

Improved tree-shaking so bundlers can drop unused components. Component parts are now marked /* @__PURE__ */ and use named render functions instead of Component.displayName = ... assignments, which previously prevented dead-code elimination with some bundlers.

Updated dependencies: @radix-ui/react-popper@1.3.4, @radix-ui/react-dismissable-layer@1.1.16, @radix-ui/react-portal@1.1.14, @radix-ui/react-presence@1.1.8, @radix-ui/react-visually-hidden@1.2.8, @radix-ui/react-use-controllable-state@1.2.4, @radix-ui/primitive@1.1.6, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.2.0, @radix-ui/react-id@1.1.2, @radix-ui/react-primitive@2.1.7, @radix-ui/react-slot@1.3.0, @radix-ui/react-use-layout-effect@1.1.2

1.2.12

Updated dependencies: @radix-ui/react-dismissable-layer@1.1.15, @radix-ui/primitive@1.1.5, @radix-ui/react-context@1.2.0, @radix-ui/react-presence@1.1.7, @radix-ui/react-popper@1.3.3

1.2.11

Updated dependencies: @radix-ui/react-primitive@2.1.7, @radix-ui/react-dismissable-layer@1.1.14, @radix-ui/react-popper@1.3.2, @radix-ui/react-portal@1.1.13, @radix-ui/react-visually-hidden@1.2.7

1.2.10

Updated dependencies: @radix-ui/react-slot@1.3.0, @radix-ui/react-popper@1.3.1, @radix-ui/react-dismissable-layer@1.1.13, @radix-ui/react-primitive@2.1.6, @radix-ui/react-portal@1.1.12, @radix-ui/react-visually-hidden@1.2.6

1.2.9

Fixed runtime error when event target is non-Node

Fixed a Tooltip bug so that skipDelayDuration={0} works as expected. Previously, the open delay could still be skipped when moving between triggers.

Added repository.directory to all package.json files

Updated dependencies: @radix-ui/react-presence@1.1.6, @radix-ui/react-popper@1.3.0, @radix-ui/react-slot@1.2.5, @radix-ui/react-dismissable-layer@1.1.12, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-id@1.1.2, @radix-ui/react-portal@1.1.11, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-controllable-state@1.2.3, @radix-ui/react-visually-hidden@1.2.5

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @radix-ui/react-tooltip since your current version.

Updates @supabase/supabase-js from 2.99.3 to 2.112.3

Release notes

Sourced from @supabase/supabase-js's releases.

v2.112.3

2.112.3 (2026-08-11)

🩹 Fixes

supabase: add trace context headers to canonical CORS allow-list (#2603)

supabase: improve trace propagation sampling and diagnostics (#2604)

❤️ Thank You

Katerina Skroumpelou @mandarini

v2.112.3-canary.0

2.112.3-canary.0 (2026-08-11)

🩹 Fixes

supabase: add trace context headers to canonical CORS allow-list (#2603)

supabase: improve trace propagation sampling and diagnostics (#2604)

❤️ Thank You

Katerina Skroumpelou @mandarini

v2.112.2

2.112.2 (2026-08-06)

🩹 Fixes

realtime: prevent duplicate on bindings (#2594)

realtime: clear stale join payload on sign-out (#2597)

❤️ Thank You

Filipe Cabaço @filipecabaco

Vaibhav @7ttp

v2.112.2-canary.1

2.112.2-canary.1 (2026-08-06)

🩹 Fixes

realtime: clear stale join payload on sign-out (#2597)

❤️ Thank You

Vaibhav @7ttp

v2.112.2-canary.0

2.112.2-canary.0 (2026-08-06)

... (truncated)

Changelog

Sourced from @supabase/supabase-js's changelog.

2.112.3 (2026-08-11)

🩹 Fixes

supabase: improve trace propagation sampling and diagnostics (#2604)

supabase: add trace context headers to canonical CORS allow-list (#2603)

❤️ Thank You

Katerina Skroumpelou @mandarini

2.112.2 (2026-08-06)

This was a version bump only for @supabase/supabase-js to align it with other projects, there were no code changes.

2.112.1 (2026-08-05)

🩹 Fixes

realtime: ensure setAuth doesn't disable token refresh (#2592)

❤️ Thank You

Eduardo Gurgel

2.112.0 (2026-08-03)

🚀 Features

supabase: move OpenTelemetry tracing to opt-in /tracing subpath (#2583)

🩹 Fixes

supabase: forward db retry option (#2571)

❤️ Thank You

Katerina Skroumpelou @mandarini

Vaibhav @7ttp

2.111.0 (2026-07-28)

This was a version bump only for @supabase/supabase-js to align it with other projects, there were no code changes.

2.110.9 (2026-07-27)

This was a version bump only for @supabase/supabase-js to align it with other projects, there were no code changes.

2.110.8 (2026-07-21)

... (truncated)

Commits

e44447c fix(supabase): improve trace propagation sampling and diagnostics (#2604)
9f0358c fix(supabase): add trace context headers to canonical CORS allow-list (#2603)
84beab1 chore(release): version 2.112.2 changelogs (#2599)
07b27ee chore(release): version 2.112.1 changelogs (#2593)
1831402 fix(realtime): ensure setAuth doesn't disable token refresh (#2592)
0136f34 chore(release): version 2.112.0 changelogs (#2589)
2877b5b test(supabase): replace test-tracing harness with real-OTel unit and e2e cove...
a413544 feat(supabase): move OpenTelemetry tracing to opt-in /tracing subpath (#2583)
e6c975c fix(supabase): forward db retry option (#2571)
a262492 chore(release): version 2.111.0 changelogs (#2572)
Additional commits viewable in compare view

Updates hls.js from 1.6.16 to 1.7.0

Release notes

Sourced from hls.js's releases.

v1.7.0

Summary

HLS.js v1.7.0 adds I-frame playlist support, improved playback of protected content, and CMCD v2 for standardized streaming analytics. It also delivers smoother audio-track switching, faster startup through parallel init-segment loading, and fixes across Low-Latency HLS, subtitles, interstitials, and live streaming.

Highlights to try in this release:

I-frame playback — call hls.createIFramePlayer() and loadMediaAt(time) to render frames from a stream's #EXT-X-I-FRAME-STREAM-INF variants in a video element, or load an #EXT-X-I-FRAMES-ONLY media playlist directly.

Smoother audio switching — set hls.nextAudioTrack (or pass { flushImmediate: true } to setAudioOption for an immediate one) to schedule a seamless audio-rendition change that avoids stalls and added live latency.

CMCD v2 — set cmcd.version: 2 to enable it, and configure cmcd.eventTargets to send standardized event reports to an external analytics endpoint. Not all CMCD v2 events, fields, and HLS.js features are supported as of this release.

Faster startup — alternate audio and video init segments now load in parallel; try a stream with separate audio/video renditions.

Improved support for looped video — a new loopBackBufferFlush config option flushes the lower-quality back buffer on looped streams.

Tune level selection — abrSwitchInterval throttles automatic quality switches, and errorPenaltyExpireMs lets a level penalized by a load error be re-elected instead of being avoided for the rest of the session.

Stop loading stale live streams — set liveMaxUnchangedPlaylistRefresh to error out with PLAYLIST_UNCHANGED_ERROR after a set number of unchanged playlist reloads instead of polling a dead playlist indefinitely.

Recover from broken appends — on live and VOD alike, appendTimeout bounds a SourceBuffer append that never completes, while MEDIA_SOURCE_REQUIRES_RESET and BUFFER_APPEND_NO_PROGRESS report a MediaSource that has to be reset and fragments that append without ever buffering.

Demo page

https://073606d7.hls-js-dev.pages.dev/demo/

Breaking changes

No public exports were removed and no runtime behavior changes are required to upgrade from v1.6 to v1.7. TypeScript consumers might see new compile errors where previously loose types have been narrowed. Each is listed with upgrade guidance in the migration guide: https://github.com/video-dev/hls.js/blob/v1.7.0/MIGRATING.md#migrating-from-hlsjs-16-to-17

Some exported type dependencies ("eventemitter3", "@svta/cml-cmcd", "@svta/cml-utils", "@svta/cml-structured-field-values") have not been bundled with hls.d.ts. This will be addressed in an upcoming patch.

Changes since the last release

Bumps the minor-and-patch group with 39 updates: | Package | From | To | | --- | --- | --- | | [@noriginmedia/norigin-spatial-navigation](https://github.com/NoriginMedia/norigin-spatial-navigation) | `3.1.0` | `3.3.0` | | [@radix-ui/react-dialog](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/dialog) | `1.1.15` | `1.1.23` | | [@radix-ui/react-dropdown-menu](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/dropdown-menu) | `2.1.16` | `2.1.24` | | [@radix-ui/react-progress](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/progress) | `1.1.8` | `1.1.16` | | [@radix-ui/react-scroll-area](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/scroll-area) | `1.2.10` | `1.2.18` | | [@radix-ui/react-separator](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/separator) | `1.1.8` | `1.1.15` | | [@radix-ui/react-slider](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/slider) | `1.3.6` | `1.4.7` | | [@radix-ui/react-slot](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/slot) | `1.2.4` | `1.3.3` | | [@radix-ui/react-tabs](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/tabs) | `1.1.13` | `1.1.21` | | [@radix-ui/react-toast](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/toast) | `1.2.15` | `1.2.23` | | [@radix-ui/react-tooltip](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/tooltip) | `1.2.8` | `1.2.16` | | [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.99.3` | `2.112.3` | | [hls.js](https://github.com/video-dev/hls.js) | `1.6.16` | `1.7.0` | | [imapflow](https://github.com/postalsys/imapflow) | `1.3.6` | `1.7.0` | | [isomorphic-dompurify](https://github.com/kkomelin/isomorphic-dompurify) | `3.12.0` | `3.22.0` | | [lightweight-charts](https://github.com/tradingview/lightweight-charts) | `5.2.0` | `5.2.1` | | [linkedom](https://github.com/WebReflection/linkedom) | `0.18.12` | `0.18.13` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.14.0` | `1.31.0` | | [mailparser](https://github.com/nodemailer/mailparser) | `3.9.9` | `3.9.15` | | [mpegts.js](https://github.com/xqq/mpegts.js) | `1.8.0` | `1.8.2` | | [next](https://github.com/vercel/next.js) | `16.2.4` | `16.3.1` | | [posthog-js](https://github.com/PostHog/posthog-js) | `1.381.0` | `1.417.1` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.5` | `19.2.8` | | [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.14` | `19.2.18` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.5` | `19.2.8` | | [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.3` | `19.2.4` | | [resend](https://github.com/resend/resend-node) | `6.12.2` | `6.20.0` | | [sax](https://github.com/isaacs/sax-js) | `1.6.0` | `1.6.1` | | [tailwind-merge](https://github.com/dcastil/tailwind-merge) | `3.5.0` | `3.6.0` | | [video.js](https://github.com/videojs/video.js) | `8.23.7` | `8.24.0` | | [@playwright/test](https://github.com/microsoft/playwright) | `1.60.0` | `1.62.1` | | [@tailwindcss/postcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss) | `4.2.4` | `4.3.3` | | [@testing-library/user-event](https://github.com/testing-library/user-event) | `14.6.1` | `14.6.4` | | [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.8` | `4.1.10` | | [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.2.4` | `16.3.1` | | [postcss](https://github.com/postcss/postcss) | `8.5.14` | `8.5.26` | | [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.2.4` | `4.3.3` | | [tsx](https://github.com/privatenumber/tsx) | `4.21.0` | `4.23.12` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.8` | `4.1.10` | Updates `@noriginmedia/norigin-spatial-navigation` from 3.1.0 to 3.3.0 - [Release notes](https://github.com/NoriginMedia/norigin-spatial-navigation/releases) - [Changelog](https://github.com/NoriginMedia/Norigin-Spatial-Navigation/blob/main/CHANGELOG.md) - [Commits](https://github.com/NoriginMedia/norigin-spatial-navigation/compare/@noriginmedia/norigin-spatial-navigation@3.1.0...@noriginmedia/norigin-spatial-navigation@3.3.0) Updates `@radix-ui/react-dialog` from 1.1.15 to 1.1.23 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/dialog/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/dialog) Updates `@radix-ui/react-dropdown-menu` from 2.1.16 to 2.1.24 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/dropdown-menu/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/dropdown-menu) Updates `@radix-ui/react-progress` from 1.1.8 to 1.1.16 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/progress/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/progress) Updates `@radix-ui/react-scroll-area` from 1.2.10 to 1.2.18 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/scroll-area/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/scroll-area) Updates `@radix-ui/react-separator` from 1.1.8 to 1.1.15 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/separator/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/separator) Updates `@radix-ui/react-slider` from 1.3.6 to 1.4.7 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/slider/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/slider) Updates `@radix-ui/react-slot` from 1.2.4 to 1.3.3 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/slot/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/slot) Updates `@radix-ui/react-tabs` from 1.1.13 to 1.1.21 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/tabs/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/tabs) Updates `@radix-ui/react-toast` from 1.2.15 to 1.2.23 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/toast/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/toast) Updates `@radix-ui/react-tooltip` from 1.2.8 to 1.2.16 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/tooltip/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/tooltip) Updates `@supabase/supabase-js` from 2.99.3 to 2.112.3 - [Release notes](https://github.com/supabase/supabase-js/releases) - [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md) - [Commits](https://github.com/supabase/supabase-js/commits/v2.112.3/packages/core/supabase-js) Updates `hls.js` from 1.6.16 to 1.7.0 - [Release notes](https://github.com/video-dev/hls.js/releases) - [Changelog](https://github.com/video-dev/hls.js/blob/master/docs/release-process.md) - [Commits](video-dev/hls.js@v1.6.16...v1.7.0) Updates `imapflow` from 1.3.6 to 1.7.0 - [Release notes](https://github.com/postalsys/imapflow/releases) - [Changelog](https://github.com/postalsys/imapflow/blob/master/CHANGELOG.md) - [Commits](postalsys/imapflow@v1.3.6...v1.7.0) Updates `isomorphic-dompurify` from 3.12.0 to 3.22.0 - [Release notes](https://github.com/kkomelin/isomorphic-dompurify/releases) - [Commits](kkomelin/isomorphic-dompurify@3.12.0...3.22.0) Updates `lightweight-charts` from 5.2.0 to 5.2.1 - [Release notes](https://github.com/tradingview/lightweight-charts/releases) - [Commits](tradingview/lightweight-charts@v5.2.0...v5.2.1) Updates `linkedom` from 0.18.12 to 0.18.13 - [Commits](WebReflection/linkedom@v0.18.12...v0.18.13) Updates `lucide-react` from 1.14.0 to 1.31.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.31.0/packages/lucide-react) Updates `mailparser` from 3.9.9 to 3.9.15 - [Release notes](https://github.com/nodemailer/mailparser/releases) - [Changelog](https://github.com/nodemailer/mailparser/blob/master/CHANGELOG.md) - [Commits](nodemailer/mailparser@v3.9.9...v3.9.15) Updates `mpegts.js` from 1.8.0 to 1.8.2 - [Release notes](https://github.com/xqq/mpegts.js/releases) - [Commits](xqq/mpegts.js@v1.8.0...v1.8.2) Updates `next` from 16.2.4 to 16.3.1 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.2.4...v16.3.1) Updates `posthog-js` from 1.381.0 to 1.417.1 - [Release notes](https://github.com/PostHog/posthog-js/releases) - [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md) - [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.381.0...posthog-js@1.417.1) Updates `react` from 19.2.5 to 19.2.8 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react) Updates `@types/react` from 19.2.14 to 19.2.18 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `react-dom` from 19.2.5 to 19.2.8 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom) Updates `@types/react-dom` from 19.2.3 to 19.2.4 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom) Updates `resend` from 6.12.2 to 6.20.0 - [Release notes](https://github.com/resend/resend-node/releases) - [Changelog](https://github.com/resend/resend-node/blob/canary/CHANGELOG.md) - [Commits](https://github.com/resend/resend-node/commits) Updates `sax` from 1.6.0 to 1.6.1 - [Commits](isaacs/sax-js@v1.6.0...v1.6.1) Updates `tailwind-merge` from 3.5.0 to 3.6.0 - [Release notes](https://github.com/dcastil/tailwind-merge/releases) - [Commits](dcastil/tailwind-merge@v3.5.0...v3.6.0) Updates `video.js` from 8.23.7 to 8.24.0 - [Release notes](https://github.com/videojs/video.js/releases) - [Changelog](https://github.com/videojs/video.js/blob/main/CHANGELOG.md) - [Commits](videojs/video.js@v8.23.7...v8.24.0) Updates `@playwright/test` from 1.60.0 to 1.62.1 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.60.0...v1.62.1) Updates `@tailwindcss/postcss` from 4.2.4 to 4.3.3 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.3/packages/@tailwindcss-postcss) Updates `@testing-library/user-event` from 14.6.1 to 14.6.4 - [Release notes](https://github.com/testing-library/user-event/releases) - [Changelog](https://github.com/testing-library/user-event/blob/main/CHANGELOG.md) - [Commits](testing-library/user-event@v14.6.1...v14.6.4) Updates `@types/react` from 19.2.14 to 19.2.18 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `@types/react-dom` from 19.2.3 to 19.2.4 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom) Updates `@vitest/coverage-v8` from 4.1.8 to 4.1.10 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/coverage-v8) Updates `eslint-config-next` from 16.2.4 to 16.3.1 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.1/packages/eslint-config-next) Updates `postcss` from 8.5.14 to 8.5.26 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.14...8.5.26) Updates `tailwindcss` from 4.2.4 to 4.3.3 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.3/packages/tailwindcss) Updates `tsx` from 4.21.0 to 4.23.12 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.21.0...v4.23.12) Updates `vitest` from 4.1.8 to 4.1.10 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest) --- updated-dependencies: - dependency-name: "@noriginmedia/norigin-spatial-navigation" dependency-version: 3.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@radix-ui/react-dialog" dependency-version: 1.1.23 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@radix-ui/react-dropdown-menu" dependency-version: 2.1.24 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@radix-ui/react-progress" dependency-version: 1.1.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@radix-ui/react-scroll-area" dependency-version: 1.2.18 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@radix-ui/react-separator" dependency-version: 1.1.15 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@radix-ui/react-slider" dependency-version: 1.4.7 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@radix-ui/react-slot" dependency-version: 1.3.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@radix-ui/react-tabs" dependency-version: 1.1.21 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@radix-ui/react-toast" dependency-version: 1.2.23 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@radix-ui/react-tooltip" dependency-version: 1.2.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@supabase/supabase-js" dependency-version: 2.112.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: hls.js dependency-version: 1.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: imapflow dependency-version: 1.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: isomorphic-dompurify dependency-version: 3.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: lightweight-charts dependency-version: 5.2.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: linkedom dependency-version: 0.18.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: lucide-react dependency-version: 1.31.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: mailparser dependency-version: 3.9.15 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: mpegts.js dependency-version: 1.8.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: next dependency-version: 16.3.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: posthog-js dependency-version: 1.417.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: react dependency-version: 19.2.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@types/react" dependency-version: 19.2.18 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: react-dom dependency-version: 19.2.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@types/react-dom" dependency-version: 19.2.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: resend dependency-version: 6.20.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: sax dependency-version: 1.6.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: tailwind-merge dependency-version: 3.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: video.js dependency-version: 8.24.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@playwright/test" dependency-version: 1.62.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@tailwindcss/postcss" dependency-version: 4.3.3 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@testing-library/user-event" dependency-version: 14.6.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@types/react" dependency-version: 19.2.18 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@types/react-dom" dependency-version: 19.2.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@vitest/coverage-v8" dependency-version: 4.1.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: eslint-config-next dependency-version: 16.3.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: postcss dependency-version: 8.5.26 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: tailwindcss dependency-version: 4.3.3 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: tsx dependency-version: 4.23.12 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: vitest dependency-version: 4.1.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-08-17T18:32:46Z

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

socket-security · 2026-08-17T18:33:29Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	posthog-js@1.417.1
	next@16.3.1
	@radix-ui/react-separator@1.1.15
	eslint-config-next@16.3.1
	@radix-ui/react-progress@1.1.16
	@radix-ui/react-slot@1.3.3
	@radix-ui/react-tabs@1.1.21
	@radix-ui/react-dropdown-menu@2.1.24
	@radix-ui/react-dialog@1.1.23
	@radix-ui/react-tooltip@1.2.16
	@radix-ui/react-toast@1.2.23
	@radix-ui/react-slider@1.4.7
	@radix-ui/react-scroll-area@1.2.18
	@noriginmedia/norigin-spatial-navigation@3.3.0
	@types/react-dom@19.2.4
	@types/react@19.2.18
	@vitest/coverage-v8@4.1.10
	vitest@4.1.10
	mailparser@3.9.15
	hls.js@1.7.0
	lucide-react@1.31.0
	postcss@8.5.26
	linkedom@0.18.13
	tailwindcss@4.3.3
	react@19.2.8
	mpegts.js@1.8.2
	tailwind-merge@3.6.0
	sax@1.6.1
	@testing-library/user-event@14.6.4
	lightweight-charts@5.2.1
	react-dom@19.2.8
	video.js@8.24.0
See 5 more rows in the dashboard

View full report

socket-security · 2026-08-17T18:33:31Z

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. It is recommended to resolve "Warn" alerts too. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Block		High CVE: DeepmergeTS has stack exhaustion when merging recursive object graphs in npm `deepmerge-ts` CVE: GHSA-ggr8-5vv4-36mx DeepmergeTS has stack exhaustion when merging recursive object graphs (HIGH) Affected versions: < 8.0.0 Patched version: 8.0.0 From: pnpm-lock.yaml → `npm/mailparser@3.9.15` → `npm/deepmerge-ts@7.1.6` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/deepmerge-ts@7.1.6`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `@videojs/http-streaming` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/video.js@8.24.0` → `npm/@videojs/http-streaming@3.17.5` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@videojs/http-streaming@3.17.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `@videojs/http-streaming` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/video.js@8.24.0` → `npm/@videojs/http-streaming@3.17.5` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@videojs/http-streaming@3.17.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `@videojs/vhs-utils` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/video.js@8.24.0` → `npm/@videojs/vhs-utils@4.1.2` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@videojs/vhs-utils@4.1.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@zone-eu/mailsplit` under EUPL-1.2 License: EUPL-1.2 - The applicable license policy does not permit this license (5) (package/LICENSE.EUPL-1.2) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/LICENSE.EUPL-1.2) License: EUPL-1.1+ - This license classifier is not allowed by the applicable policy (package/package.json) From: pnpm-lock.yaml → `npm/mailparser@3.9.15` → `npm/imapflow@1.7.0` → `npm/@zone-eu/mailsplit@5.4.15` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@zone-eu/mailsplit@5.4.15`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `jsdom` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/isomorphic-dompurify@3.22.0` → `npm/jsdom@30.0.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/jsdom@30.0.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Publisher changed: npm `mpd-parser` is now published by essk Author: essk From: pnpm-lock.yaml → `npm/video.js@8.24.0` → `npm/mpd-parser@1.4.0` ℹ Read more on: This package \| This alert \| What is unstable ownership? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/mpd-parser@1.4.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `playwright-core` under ms-azure-data-studio License: ms-azure-data-studio - The applicable license policy does not permit this license (5) (package/ThirdPartyNotices.txt) From: pnpm-lock.yaml → `npm/@playwright/test@1.62.1` → `npm/playwright-core@1.62.1` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/playwright-core@1.62.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `playwright` under ms-azure-data-studio License: ms-azure-data-studio - The applicable license policy does not permit this license (5) (package/ThirdPartyNotices.txt) From: pnpm-lock.yaml → `npm/@playwright/test@1.62.1` → `npm/playwright@1.62.1` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/playwright@1.62.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Telemetry collection: npm `posthog-js` Note: The package/dist/module.full.js fragment implements client-side telemetry/session replay by instrumenting network APIs (fetch/XHR) and capturing request/response metadata and bodies, along with user interactions/DOM data for replay, and can dynamically load external scripts. This creates substantial privacy, data-exposure, and supply-chain risks, including potential runtime script injection/execution and possible remote asset/config manipulation that could affect integrity, even in the absence of explicit malware. From: package.json → `npm/posthog-js@1.417.1` ℹ Read more on: This package \| This alert \| What is telemetry? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Most telemetry comes with settings to disable it. Consider disabling telemetry if you do not want to be tracked. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/posthog-js@1.417.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Telemetry collection: npm `posthog-js` Note: The package/dist/array.full.js module instruments fetch and XMLHttpRequest, captures request/response headers and optionally bodies, wraps console/error handling, and persists survey interaction state in client storage. It may load external scripts and render HTML for session replay, creating substantial privacy exposure and potential data leakage, with an added HTML rendering capability that could introduce XSS risk if upstream content is not sanitized. Requires strict consent controls, redaction/masking, destination allow-listing or deny lists, HTML content sanitization, and thorough configuration review/lockdown. From: package.json → `npm/posthog-js@1.417.1` ℹ Read more on: This package \| This alert \| What is telemetry? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Most telemetry comes with settings to disable it. Consider disabling telemetry if you do not want to be tracked. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/posthog-js@1.417.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Telemetry collection: npm `posthog-js` Note: A browser analytics/telemetry SDK loads external JavaScript dynamically from remote asset URLs via a script loader, enabling broad data collection and potential runtime changes to the page. This creates supply-chain and runtime integrity risks if attacker-controlled endpoints or assets can be injected, potentially causing data exfiltration or remote DOM/JS alterations; mitigations include CSP, SRI, trusted hosting, version pinning, allowlists, data minimization, and ongoing monitoring of loaded assets. From: package.json → `npm/posthog-js@1.417.1` ℹ Read more on: This package \| This alert \| What is telemetry? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Most telemetry comes with settings to disable it. Consider disabling telemetry if you do not want to be tracked. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/posthog-js@1.417.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Telemetry collection: npm `posthog-js` Note: The file package/dist/array.full.no-external.js implements client-side telemetry instrumentation for session replay, DOM/form capture, and network traffic (including request/response headers and potentially bodies), as well as console and error handling. It may patch fetch/XHR, wrap console handling, and use cookies/localStorage (and possibly a Web Worker) for data collection, with options for loading remote configurations or scripts. Depending on configuration and defaults, misconfiguration can lead to excessive data capture or data exfiltration/privacy exposure, though there is no direct evidence of malware or outbound endpoints in the fragment. From: package.json → `npm/posthog-js@1.417.1` ℹ Read more on: This package \| This alert \| What is telemetry? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Most telemetry comes with settings to disable it. Consider disabling telemetry if you do not want to be tracked. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/posthog-js@1.417.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Telemetry collection: npm `posthog-js` Note: The package/dist/module.no-external.js module functions as a client analytics/telemetry SDK that collects browser/interaction context, persists state, and transmits data to remote endpoints. It supports dynamic loading of external dependencies and remote configurations, enabling server-driven DOM transforms (including innerHTML). This introduces XSS trust boundary risks, privacy concerns, data exfiltration potential, and an expanded supply-chain attack surface if remote payloads or dependencies are compromised or not integrity-protected. From: package.json → `npm/posthog-js@1.417.1` ℹ Read more on: This package \| This alert \| What is telemetry? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Most telemetry comes with settings to disable it. Consider disabling telemetry if you do not want to be tracked. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/posthog-js@1.417.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Telemetry collection: npm `posthog-js` Note: The file package/dist/all-external-dependencies.js implements intrusive client-side instrumentation that patches fetch/XHR to capture request/response metadata and potentially bodies, wraps global error/console handlers, and forwards aggregated telemetry to configured endpoints (including analytics/session replay pipelines). It may render UI via innerHTML and persist data in localStorage, creating substantial privacy and data-exfiltration risks and potential XSS if upstream content is not sanitized; this requires careful privacy/consent controls and strict supply-chain integrity review. From: package.json → `npm/posthog-js@1.417.1` ℹ Read more on: This package \| This alert \| What is telemetry? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Most telemetry comes with settings to disable it. Consider disabling telemetry if you do not want to be tracked. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/posthog-js@1.417.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Publisher changed: npm `process-warning` is now published by climba03003 Author: climba03003 From: pnpm-lock.yaml → `npm/imapflow@1.7.0` → `npm/process-warning@5.1.0` ℹ Read more on: This package \| This alert \| What is unstable ownership? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/process-warning@5.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `rollup` under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/LICENSE.md) From: pnpm-lock.yaml → `npm/@vitejs/plugin-react@5.1.4` → `npm/vitest@4.1.10` → `npm/rollup@4.62.4` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/rollup@4.62.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

ralyodio · 2026-08-18T08:57:34Z

@dependabot rebase

dependabot · 2026-08-18T09:07:37Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

ralyodio mentioned this pull request Aug 18, 2026

deps: name autoblog by its tarball, so Dependabot cannot resolve it over SSH #183

Merged

dependabot Bot closed this Aug 18, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/minor-and-patch-21a2811b37 branch August 18, 2026 09:07

Navigation Menu

Uh oh!

deps(deps): bump the minor-and-patch group with 39 updates - #181

deps(deps): bump the minor-and-patch group with 39 updates#181
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/minor-and-patch-21a2811b37

dependabot Bot commented on behalf of github Aug 17, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Aug 17, 2026

Uh oh!

socket-security Bot commented Aug 17, 2026

Uh oh!

socket-security Bot commented Aug 17, 2026

Uh oh!

ralyodio commented Aug 18, 2026

Uh oh!

dependabot Bot commented on behalf of github Aug 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

@​noriginmedia/norigin-spatial-navigation-react@​3.3.0

Minor Changes

Patch Changes

@​noriginmedia/norigin-spatial-navigation@​3.3.0

Minor Changes

Patch Changes

@​noriginmedia/norigin-spatial-navigation-react@​3.2.1

Patch Changes

@​noriginmedia/norigin-spatial-navigation@​3.2.1

Patch Changes

@​noriginmedia/norigin-spatial-navigation-core@​3.2.0

Minor Changes

@​noriginmedia/norigin-spatial-navigation-react@​3.2.0

Minor Changes

Patch Changes

1.1.23

1.1.22

1.1.21

1.1.20

1.1.19

1.1.18

1.1.17

1.1.16

2.1.24

2.1.23

2.1.22

2.1.21

2.1.20

2.1.19

Other updates

2.1.18

2.1.17

1.1.16

1.1.15

1.1.14

1.1.13

1.1.12

1.1.11

1.1.10

1.1.9

1.2.18

1.2.17

1.2.16

1.2.15

1.2.14

1.2.13

Other updates

1.2.12

1.2.11

1.1.15

1.1.14

1.1.13

1.1.12

1.1.11

1.1.10

1.1.9

1.4.7

1.4.6

1.4.5

1.4.4

1.4.3

1.4.2

Other updates

1.4.1

1.4.0

1.3.2, 1.3.3

1.3.1

1.3.0

Added generic type arguments for SlotProps and createSlot

1.2.5

1.1.21

1.1.20

1.1.19

1.1.18

1.1.17

1.1.16

dependabot Bot commented on behalf of github Aug 17, 2026 •

edited

Loading

`@noriginmedia/norigin-spatial-navigation-react@3`.3.0

`@noriginmedia/norigin-spatial-navigation@3`.3.0

`@noriginmedia/norigin-spatial-navigation-react@3`.2.1

`@noriginmedia/norigin-spatial-navigation@3`.2.1

`@noriginmedia/norigin-spatial-navigation-core@3`.2.0

`@noriginmedia/norigin-spatial-navigation-react@3`.2.0

Added generic type arguments for `SlotProps` and `createSlot`