Skip to content

build(deps): bump the production-dependencies group across 1 directory with 9 updates - #55

Merged
tatelilith merged 2 commits into
mainfrom
dependabot/npm_and_yarn/production-dependencies-00c5072b75
Aug 17, 2026
Merged

build(deps): bump the production-dependencies group across 1 directory with 9 updates#55
tatelilith merged 2 commits into
mainfrom
dependabot/npm_and_yarn/production-dependencies-00c5072b75

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 9 updates in the / directory:

Package From To
@hono/node-server 2.1.0 2.1.1
@node-rs/argon2 2.0.2 2.1.0
hono 4.13.1 4.13.2
openid-client 6.8.4 6.8.5
sanitize-html 2.17.6 2.17.7
@hookform/resolvers 5.7.1 5.8.0
i18next 25.8.13 25.10.10
lucide-react 0.469.0 0.577.0
react-i18next 16.5.4 16.6.6

Updates @hono/node-server from 2.1.0 to 2.1.1

Release notes

Sourced from @​hono/node-server's releases.

v2.1.1

What's Changed

Full Changelog: honojs/node-server@v2.1.0...v2.1.1

Commits

Updates @node-rs/argon2 from 2.0.2 to 2.1.0

Commits
  • 3b28965 chore(release): publish
  • 64b9227 chore(deps): lock file maintenance (#1182)
  • b0ea4a0 perf(argon2): simdutf8, crate PHC decode, argon2-rust 1.1 (#1189)
  • 2b8b617 feat(argon2): switch backend to argon2-rust (#1188)
  • 05156db chore(deps): update rust crate jsonwebtoken to v11 (#1177)
  • 1933745 chore: upgrade all npm deps (#1187)
  • 317e00e chore(deps): update cross-platform-actions/action action to v1.4.0 (#1185)
  • 284ee70 chore(deps): update dependency oxfmt to ^0.63.0 (#1186)
  • 54d5564 chore(deps): update dependency oxfmt to ^0.62.0 (#1183)
  • 23aad38 chore(deps): update yarn to v4.18.0 (#1180)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​node-rs/argon2 since your current version.


Updates hono from 4.13.1 to 4.13.2

Release notes

Sourced from hono's releases.

v4.13.2

What's Changed

  • fix(secure-headers): output standard empty parentheses () instead of none for disabled Permissions-Policy directives in honojs/hono#5197
  • fix(jsx): render async children of document metadata tags instead of [object Promise] in honojs/hono#5204
  • fix(etag): resolve incorrect incremental hashing for chunked responses in honojs/hono#5199
  • fix(client): serialize multiple cookies correctly in honojs/hono#5202
  • fix(etag): stabilize digest across stream chunks in honojs/hono#5205
  • fix(url): strip trailing question mark correctly for optional params with regex quantifiers in honojs/hono#5209
  • perf(cors): pre-join static array header options during initialization in honojs/hono#5210
  • fix(client): send falsy JSON bodies in honojs/hono#5215
  • feat(secure-headers): add missing W3C Permissions-Policy directives in honojs/hono#5214

Full Changelog: honojs/hono@v4.13.1...v4.13.2

Commits
  • 41bdc42 4.13.2
  • 6ea514d feat(secure-headers): add missing W3C Permissions-Policy directives (#5214)
  • 329b6f4 fix(client): send falsy JSON bodies (#5215)
  • a1e4ac7 perf(cors): pre-join static array header options during initialization (#5210)
  • d982f63 fix(url): strip trailing question mark correctly for optional params with reg...
  • 26de731 fix(etag): stabilize digest across stream chunks (#5205)
  • 7075369 Revert " fix(etag): resolve incorrect incremental hashing for chunked respons...
  • f2a72d3 fix(client): serialize multiple cookies correctly (#5202)
  • 8a5852d fix(etag): resolve incorrect incremental hashing for chunked responses (#5199)
  • 765d13b fix(jsx): render async children of document metadata tags instead of [object ...
  • Additional commits viewable in compare view

Updates openid-client from 6.8.4 to 6.8.5

Release notes

Sourced from openid-client's releases.

v6.8.5

Fixes

  • types: expose custom fetch duplex option (a125bc8)
  • types: use portable oauth4webapi declarations (2cab98f)

Documentation

  • improve API index tables (c6e4ae3)
  • update README.md and SECURITY.md to reflect passed EOL dates (d3721c2)
Changelog

Sourced from openid-client's changelog.

6.8.5 (2026-08-11)

Fixes

  • types: expose custom fetch duplex option (a125bc8)
  • types: use portable oauth4webapi declarations (2cab98f)

Documentation

  • improve API index tables (c6e4ae3)
  • update README.md and SECURITY.md to reflect passed EOL dates (d3721c2)
Commits
  • efb53e5 chore(release): 6.8.5
  • 4a66935 test: deflake Retry-After date assertions
  • 6b7afa3 chore: bump packages
  • 6222df6 ci: validate package types and artifacts
  • c6e4ae3 docs: improve API index tables
  • a125bc8 fix(types): expose custom fetch duplex option
  • 2cab98f fix(types): use portable oauth4webapi declarations
  • 20b3d30 ci: use shared release workflows
  • ebf4e1d chore: bump packages
  • 85382f0 ci: use prebuilt conformance suite images
  • Additional commits viewable in compare view

Updates sanitize-html from 2.17.6 to 2.17.7

Changelog

Sourced from sanitize-html's changelog.

2.17.7 (2026-08-13)

Security

  • Fixed an XSS / URL scheme policy bypass affecting configurations that allow the SVG animation elements (animate, animateColor, animateMotion, animateTransform or set) together with attributeName and one of the animation value attributes. The default configuration was not affected, as these elements are not in the default allowedTags. apostrophecms was not affected. Thanks to koyokr for responsibly disclosing the vulnerability (GHSA-g8qq-57p8-ggw5).
Commits

Updates @hookform/resolvers from 5.7.1 to 5.8.0

Release notes

Sourced from @​hookform/resolvers's releases.

v5.8.0

5.8.0 (2026-08-13)

Features

Commits

Updates i18next from 25.8.13 to 25.10.10

Release notes

Sourced from i18next's releases.

v25.10.10

  • feat: suppress support notice automatically in production environments (NODE_ENV=production)

v25.10.9

  • feat(types): export SelectorParam<Ns, KPrefix> helper type — a stable, readable alternative to Parameters<TFunction<Ns>>[0] for typing selector function props 2414

v25.10.8

  • fix(types): reorder TFunctionSelector overloads so Parameters<TFunction> resolves to the general selector signature instead of the branded SelectorKey type 2412

v25.10.7

v25.10.6

v25.10.5

  • feat(types): selector functions as keyPrefix in getFixedT now provide full type-safe key narrowing — the returned t function is scoped to the prefix subtree 2367

v25.10.4

  • feat(types): i18nKey of <Trans i18nKey={sk} /> to accept a SelectorKey 2364

v25.10.3

  • check also for I18NEXT_NO_SUPPORT_NOTICE env variable

v25.10.2

  • feat(types): keyFromSelector is now type-safe — the selector callback is constrained against your resource definitions, catching invalid keys at compile time. Supports optional ns and keyPrefix options for non-default namespace/prefix contexts 2364

v25.10.1

  • fix(types): FilterKeys now correctly excludes base keys that have context variants when the provided context doesn't match any of them (e.g. key some with variant some_me is no longer accessible with context="one")

v25.10.0

  • feat(types): keyFromSelector now returns a branded SelectorKey type that t() accepts directly, enabling pre-computed and reusable translation keys 2364
  • feat: support selector syntax for keyPrefix in getFixedT and per-call options 2367
  • feat(types): interpolation values are now automatically typed based on built-in format specifiers — {{val, number}} requires number, {{val, datetime}} requires Date, {{name}} requires string, etc. Custom formatters can be typed via interpolationFormatTypeMap in CustomTypeOptions 2378
  • fix(types): FilterKeys in selector mode now preserves non-context, non-plural leaf keys when context is provided, fixing incorrect type narrowing when combining returnObjects: true with context 2398

v25.9.0

  • feat(types): selector API now enforces { count: number } when a key resolves to plural forms 2373
  • fix(types): string unions with invalid members are now correctly detected as type errors when used as context option 2172

v25.8.20

    • fix: getFixedT() selector now resolves namespaces against the effective ns rather than the global init options #2406

v25.8.19

  • fix: selector API namespace resolution regression for single-string ns and primary namespace in array #2405. Reverts the broad namespace-prefix rewrite from v25.8.15 and replaces it with a targeted fix that only rewrites paths starting with a secondary namespace in a multi-namespace array, matching the type-level contract of GetSource

v25.8.18

  • improve selector api to accept array of selector functions, analogous to array of keys 2404

v25.8.17

... (truncated)

Changelog

Sourced from i18next's changelog.

25.10.10

  • feat: suppress support notice automatically in production environments (NODE_ENV=production)

25.10.9

  • feat(types): export SelectorParam<Ns, KPrefix> helper type — a stable, readable alternative to Parameters<TFunction<Ns>>[0] for typing selector function props 2414

25.10.8

  • fix(types): reorder TFunctionSelector overloads so Parameters<TFunction> resolves to the general selector signature instead of the branded SelectorKey type 2412

25.10.7

25.10.5

  • feat(types): selector functions as keyPrefix in getFixedT now provide full type-safe key narrowing — the returned t function is scoped to the prefix subtree 2367

25.10.4

  • feat(types): exists() is now a type guard that narrows the key to SelectorKey, so a validated key can be passed directly to t() 2364

25.10.3

  • check also for I18NEXT_NO_SUPPORT_NOTICE env variable

25.10.2

  • feat(types): keyFromSelector is now type-safe — the selector callback is constrained against your resource definitions, catching invalid keys at compile time. Supports optional ns and keyPrefix options for non-default namespace/prefix contexts 2364

25.10.1

  • fix(types): FilterKeys now correctly excludes base keys that have context variants when the provided context doesn't match any of them (e.g. key some with variant some_me is no longer accessible with context="one")

25.10.0

  • feat(types): keyFromSelector now returns a branded SelectorKey type that t() accepts directly, enabling pre-computed and reusable translation keys 2364
  • feat: support selector syntax for keyPrefix in getFixedT and per-call options 2367
  • feat(types): interpolation values are now automatically typed based on built-in format specifiers — {{val, number}} requires number, {{val, datetime}} requires Date, {{name}} requires string, etc. Custom formatters can be typed via interpolationFormatTypeMap in CustomTypeOptions 2378
  • fix(types): FilterKeys in selector mode now preserves non-context, non-plural leaf keys when context is provided, fixing incorrect type narrowing when combining returnObjects: true with context 2398

25.9.0

  • feat(types): selector API now enforces { count: number } when a key resolves to plural forms 2373
  • fix(types): string unions with invalid members are now correctly detected as type errors when used as context option 2172

25.8.20

... (truncated)

Commits
  • e0fa838 25.10.10
  • 796fdd9 feat: suppress support notice automatically in production environments (`NODE...
  • 07f585f changelog
  • 1ba9951 jsr update
  • 8ea74a9 25.10.9
  • 74220cc lint fix
  • c972af2 feat(types): export SelectorParam\<Ns, KPrefix> helper type — a stable, read...
  • 2b5313d jsr update
  • c11655f 25.10.8
  • 5bb5665 fix(types): reorder TFunctionSelector overloads so Parameters\<TFunction> ...
  • Additional commits viewable in compare view

Updates lucide-react from 0.469.0 to 0.577.0

Release notes

Sourced from lucide-react's releases.

Version 0.577.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@0.576.0...0.577.0

Version 0.576.0

What's Changed

Full Changelog: lucide-icons/lucide@0.575.0...0.576.0

Version 0.575.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@0.573.0...0.575.0

Version 0.574.0

What's Changed

New Contributors

... (truncated)

Commits
  • f6c0d06 chore(deps): bump rollup from 4.53.3 to 4.59.0 (#4106)
  • 67c0485 feat(scripts): added helper script to automatically update OpenCollective bac...
  • b6ed43d feat(packages): Added aria-hidden fallback for decorative icons to all packag...
  • 076e0bb chore(dependencies): Update dependencies (#3809)
  • 80d6f73 fix(icons): Rename fingerprint icon to fingerprint-pattern (#3767)
  • 1cfb3ff chore(deps-dev): bump vite from 6.3.5 to 6.3.6 (#3611)
  • e71198d chore: icon alias improvements (#2861)
  • 3e644fd chore(scripts): Refactor scripts to typescript (#3316)
  • 19fa01b build(deps-dev): bump vite from 6.3.2 to 6.3.4 (#3181)
  • 03eb862 use implicit return in react package (#2325)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for lucide-react since your current version.


Updates react-i18next from 16.5.4 to 16.6.6

Changelog

Sourced from react-i18next's changelog.

16.6.6

  • fix(peer-deps): bump i18next peer dependency to >= 25.10.9 to match required type exports (ConstrainTarget, ApplyTarget, GetSource) used by TransSelector 1911

16.6.5

  • fix(types): selector keyPrefix overload in useTranslation no longer matches when keyPrefix is absent, fixing defaultNS: false with explicit ns option 2412

16.6.4

  • allow TypeScript 6 as peer dependency 1910

16.6.3

  • fix(types): merge TransSelector overloads into a single signature so typeof Trans remains extendable 1909

16.6.2

  • feat(types): useTranslation now accepts selector functions as keyPrefix with full type-safe key narrowing when enableSelector is enabled 2367

16.6.1

  • feat(types): i18nKey of <Trans i18nKey={sk} /> to accept a SelectorKey 2364

16.6.0

  • warn when t is called before ready with useSuspense: false 1896
  • type-safe values prop on <Trans /> component — interpolation variables are now inferred from the translation string when custom types are configured 1772

16.5.8

  • A selector function cannot be resolved without an i18n instance... returning empty string is safer than leaking the raw function reference. 1907

16.5.7

  • fix: <Trans> component with enableSelector: true does not support multiple selectors for fallbacks 1907

16.5.6

  • fix: prevent crash in useSSR when init() hasn't been called before useSSR — now logs a warning instead of throwing 1604

16.5.5

  • fix: prevent crash in useSSR, getInitialProps and Translation when no i18next instance is available (e.g. in monorepo setups with duplicate react-i18next copies) — now logs a clear warning instead of throwing 1604
Commits

@dependabot @github

dependabot Bot commented on behalf of github Aug 17, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot
build(deps): bump the production-dependencies group across 1 director…
f0cf363 
…y with 9 updates

Bumps the production-dependencies group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@hono/node-server](https://github.com/honojs/node-server) | `2.1.0` | `2.1.1` |
| [@node-rs/argon2](https://github.com/napi-rs/node-rs) | `2.0.2` | `2.1.0` |
| [hono](https://github.com/honojs/hono) | `4.13.1` | `4.13.2` |
| [openid-client](https://github.com/panva/openid-client) | `6.8.4` | `6.8.5` |
| [sanitize-html](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html) | `2.17.6` | `2.17.7` |
| [@hookform/resolvers](https://github.com/react-hook-form/resolvers) | `5.7.1` | `5.8.0` |
| [i18next](https://github.com/i18next/i18next) | `25.8.13` | `25.10.10` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `0.469.0` | `0.577.0` |
| [react-i18next](https://github.com/i18next/react-i18next) | `16.5.4` | `16.6.6` |



Updates `@hono/node-server` from 2.1.0 to 2.1.1
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v2.1.0...v2.1.1)

Updates `@node-rs/argon2` from 2.0.2 to 2.1.0
- [Release notes](https://github.com/napi-rs/node-rs/releases)
- [Commits](https://github.com/napi-rs/node-rs/compare/@node-rs/argon2@2.0.2...@node-rs/argon2@2.1.0)

Updates `hono` from 4.13.1 to 4.13.2
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.1...v4.13.2)

Updates `openid-client` from 6.8.4 to 6.8.5
- [Release notes](https://github.com/panva/openid-client/releases)
- [Changelog](https://github.com/panva/openid-client/blob/main/CHANGELOG.md)
- [Commits](panva/openid-client@v6.8.4...v6.8.5)

Updates `sanitize-html` from 2.17.6 to 2.17.7
- [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md)
- [Commits](https://github.com/apostrophecms/apostrophe/commits/HEAD/packages/sanitize-html)

Updates `@hookform/resolvers` from 5.7.1 to 5.8.0
- [Release notes](https://github.com/react-hook-form/resolvers/releases)
- [Commits](react-hook-form/resolvers@v5.7.1...v5.8.0)

Updates `i18next` from 25.8.13 to 25.10.10
- [Release notes](https://github.com/i18next/i18next/releases)
- [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/i18next@v25.8.13...v25.10.10)

Updates `lucide-react` from 0.469.0 to 0.577.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/0.577.0/packages/lucide-react)

Updates `react-i18next` from 16.5.4 to 16.6.6
- [Changelog](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/react-i18next@v16.5.4...v16.6.6)

---
updated-dependencies:
- dependency-name: "@hono/node-server"
  dependency-version: 2.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@hookform/resolvers"
  dependency-version: 5.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@node-rs/argon2"
  dependency-version: 2.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: hono
  dependency-version: 4.13.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: i18next
  dependency-version: 25.10.10
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: lucide-react
  dependency-version: 0.577.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: openid-client
  dependency-version: 6.8.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: react-i18next
  dependency-version: 16.6.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: sanitize-html
  dependency-version: 2.17.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title build(deps): bump the production-dependencies group with 9 updates build(deps): bump the production-dependencies group across 1 directory with 9 updates Aug 17, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/production-dependencies-00c5072b75 branch from 46d25f7 to f0cf363 Compare August 17, 2026 02:41
@tatelilith
build(deps): regenerate license inventory for the production group
96043a5 
The production-dependencies rollup changes resolved versions, so the
committed inventory no longer matches what `pnpm licenses:check`
regenerates and the license-inventory gate fails.

Regenerated with `pnpm licenses:write`. Version fields only — every
license identifier is unchanged and no package entered or left the
inventory, so the 827-package, 16-license surface is the same as before.
@tatelilith
tatelilith merged commit 94cecd4 into main Aug 17, 2026
17 checks passed
@tatelilith
tatelilith deleted the dependabot/npm_and_yarn/production-dependencies-00c5072b75 branch August 17, 2026 02:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@tatelilith