Skip to content

chore(deps)(deps): bump the web-dependencies group across 1 directory with 19 updates#54

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/web/web-dependencies-c10d9f5ed4
Open

chore(deps)(deps): bump the web-dependencies group across 1 directory with 19 updates#54
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/web/web-dependencies-c10d9f5ed4

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot Bot commented on behalf of github May 4, 2026 •
edited
Loading

Bumps the web-dependencies group with 16 updates in the /web directory:

Package From To
i18next-browser-languagedetector 8.2.0 8.2.1
livekit-client 2.16.0 2.18.8
maplibre-gl 5.14.0 5.24.0
web-vitals 5.1.0 5.2.0
zustand 5.0.9 5.0.12
@playwright/test 1.58.0 1.59.1
@testing-library/react 16.3.0 16.3.2
@types/maplibre-gl 1.13.2 1.14.0
@vitest/coverage-v8 4.0.18 4.1.5
autoprefixer 10.4.22 10.5.0
axe-core 4.11.1 4.11.4
eslint-plugin-react-hooks 7.0.1 7.1.1
eslint-plugin-react-refresh 0.4.24 0.5.2
msw 2.12.7 2.14.2
postcss 8.5.6 8.5.13
typescript-eslint 8.49.0 8.59.1

Updates i18next-browser-languagedetector from 8.2.0 to 8.2.1

Changelog

Sourced from i18next-browser-languagedetector's changelog.

8.2.1

  • Add missing typescript definition for hash options 33154
Commits

Updates livekit-client from 2.16.0 to 2.18.8

Release notes

Sourced from livekit-client's releases.

v2.18.8

Patch Changes

  • Add local data track flush method - #1925 (@​1egoman)

  • Implement negotiation tracking based on offerId - #1927 (@​lukasIO)

  • Ignore data track promise rejections after a subscription readable stream is discarded - #1917 (@​1egoman)

  • chore: improve logging foundation for implicit context retrieval - #1907 (@​lukasIO)

v2.18.7

Patch Changes

  • Pass optional LocalTrack reference to processors - #1916 (@​lukasIO)

  • Ensure priority isn't set on all simulcast layers when using Firefox on iOS - #1920 (@​lukasIO)

v2.18.6

Patch Changes

v2.18.5

Patch Changes

  • Defer onEnterPiP visibility update until after the next microtask and animation frame so Document Picture-in-Picture embedders can append DOM into the PiP window before isElementInPiP runs. - #1868 (@​gparant)

  • Differentiate different 404 responses on validate path - #1901 (@​lukasIO)

  • await screen share audio unpublish before returning setEnabled - #1899 (@​lukasIO)

  • Avoid attaching a new Closing event listener for each waitForBufferStatusLow call - #1896 (@​1egoman)

  • Re-compute encoding params after track replace - #1902 (@​lukasIO)

  • Harden extension id computation and retry publishing on negotiation failure - #1895 (@​lukasIO)

  • fix: ensure udpated tokens get set on the regionUrlProvider - #1900 (@​lukasIO)

v2.18.4

Patch Changes

  • fix: handle race between LocalTrackSubscribed signal and publishTrack completion - #1872 (@​pabloFuente)

  • Harden RemoteParticipant.dataTracks map to work when a data track subscription is processed before the room connect is complete - #1888 (@​1egoman)

  • Update dependency webrtc-adapter to v9.0.5 - #1858 (@​renovate)

  • Ensure transport manager is reset before attempting legacy fallback path - #1893 (@​lukasIO)

... (truncated)

Changelog

Sourced from livekit-client's changelog.

2.18.8

Patch Changes

  • Add local data track flush method - #1925 (@​1egoman)

  • Implement negotiation tracking based on offerId - #1927 (@​lukasIO)

  • Ignore data track promise rejections after a subscription readable stream is discarded - #1917 (@​1egoman)

  • chore: improve logging foundation for implicit context retrieval - #1907 (@​lukasIO)

2.18.7

Patch Changes

  • Pass optional LocalTrack reference to processors - #1916 (@​lukasIO)

  • Ensure priority isn't set on all simulcast layers when using Firefox on iOS - #1920 (@​lukasIO)

2.18.6

Patch Changes

2.18.5

Patch Changes

  • Defer onEnterPiP visibility update until after the next microtask and animation frame so Document Picture-in-Picture embedders can append DOM into the PiP window before isElementInPiP runs. - #1868 (@​gparant)

  • Differentiate different 404 responses on validate path - #1901 (@​lukasIO)

  • await screen share audio unpublish before returning setEnabled - #1899 (@​lukasIO)

  • Avoid attaching a new Closing event listener for each waitForBufferStatusLow call - #1896 (@​1egoman)

  • Re-compute encoding params after track replace - #1902 (@​lukasIO)

  • Harden extension id computation and retry publishing on negotiation failure - #1895 (@​lukasIO)

  • fix: ensure udpated tokens get set on the regionUrlProvider - #1900 (@​lukasIO)

2.18.4

Patch Changes

  • fix: handle race between LocalTrackSubscribed signal and publishTrack completion - #1872 (@​pabloFuente)

... (truncated)

Commits

Updates maplibre-gl from 5.14.0 to 5.24.0

Release notes

Sourced from maplibre-gl's releases.

v5.24.0

✨ Features and improvements

  • GPU performance optimization: Render halo and glyph in a single pass (-40% Time Reduction) (#7436) (by @​xavierjs)
  • Optimize matrix inversions and reduce GPU stalls (#7367) (by @​xavierjs)
  • Add example showing how to measure map performance using built-in events (load, idle, render) (#7077) (by @​CommanderStorm)

🐞 Bug fixes

v5.23.0

✨ Features and improvements

  • Add touchZoomRotate.setZoomRate() and touchZoomRotate.setZoomThreshold() to customize touch zoom speed and pinch sensitivity (#7271)
  • Improve ability to communicate with imported scripts in workers and use makeRequest in workres as well (#7451) (by @​HarelM)
  • Allow opacity and opacityWhenCovered in Marker and MarkerOptions to accept number in addition to string, and add maplibregl-marker-covered CSS class to Marker element when covered by 3D terrain or a globe (#7433) (by @​YuChunTsao)
  • perf: add a bench for terrain rendering and fix _demMatrixCache lookup being wasted cycles by actually using the cache (#7400) (by @​CommanderStorm)

🐞 Bug fixes

  • Fix polygon text label placement drifting far from center for convex polygons at high zoom due to coordinate rounding in geojson-vt (#7380) (by @​CommanderStorm)
  • Ensure that a successful ArrayBuffer response from a custom protocol that is null/undefined is set to an empty ArrayBuffer (#7427) (by @​neodescis)
  • Fix error in _contextRestored when map was initialized without a style (#7432) (by @​mvanhorn)
  • Fix issue with the cache used for zoomLevelsToOverscale feature (#7450) (by @​HarelM)
  • Update stylelint and fix old issues with the CSS (mainly change rgb to use spaces) (#7365) (by @​HarelM)

v5.22.0

✨ Features and improvements

  • Make line-cap, line-miter-limit, and line-round-limit data-driven properties, allowing per-feature values (#7351) (by @​CommanderStorm)
  • GPU performance optimization: early culling of transparent symbols in vertex shaders (#7364) (by @​xavierjs)
  • Add example showing how to measure map performance using built-in events (load, idle, render) (#7077) (by @​CommanderStorm)
  • UX: Clarify error message language so if layout and paint properties are confused in setPaintProperty or setLayoutProperty (#6954) (by @​Willjfield and @​CommanderStorm)

🐞 Bug fixes

  • Fix startup crash caused by a stale async style load completing after the style was cleared or replaced (#7377)
  • Make fitBounds and fitScreenCoordinates respect the zoomSnap map option by snapping the zoom level down to keep bounds fully visible (#7332 (by @​CommanderStorm)
  • Make jumpTo, easeTo, and flyTo respect the zoomSnap map option by snapping the zoom level to the nearest valid increment (#7333 (by @​CommanderStorm)
  • Fix setState crash when switching styles while globe projection is active (#7314) (by @​ashwinuae)
  • Prevent crashes when calling map.remove() immediately after creation by canceling in-flight style URL loads (#7368) (by @​CommanderStorm)
  • Fixed symbol collision flickering by adding tolerance to GridIndex AABB comparison (#7360) (by @​kkokkoejong)
  • Fix fitBounds ignoring maxZoom option in vertical-perspective projection (#7372) (by @​CommanderStorm)
  • Prevent stale async style loads from completing after style clear (#7378) (by @​Lievesley)
  • Fix broken example for fill-pattern (#7326) (by @​k-yle)

... (truncated)

Changelog

Sourced from maplibre-gl's changelog.

5.24.0

✨ Features and improvements

  • GPU performance optimization: Render halo and glyph in a single pass (-40% Time Reduction) (#7436) (by @​xavierjs)
  • Optimize matrix inversions and reduce GPU stalls (#7367) (by @​xavierjs)
  • Add example showing how to measure map performance using built-in events (load, idle, render) (#7077) (by @​CommanderStorm)

🐞 Bug fixes

5.23.0

✨ Features and improvements

  • Add touchZoomRotate.setZoomRate() and touchZoomRotate.setZoomThreshold() to customize touch zoom speed and pinch sensitivity (#7271) (by @​itisyb)
  • Improve ability to communicate with imported scripts in workers and use makeRequest in workres as well (#7451) (by @​HarelM)
  • Allow opacity and opacityWhenCovered in Marker and MarkerOptions to accept number in addition to string, and add maplibregl-marker-covered CSS class to Marker element when covered by 3D terrain or a globe (#7433) (by @​YuChunTsao)
  • perf: add a bench for terrain rendering and fix _demMatrixCache lookup being wasted cycles by actually using the cache (#7400) (by @​CommanderStorm)

🐞 Bug fixes

  • Fix polygon text label placement drifting far from center for convex polygons at high zoom due to coordinate rounding in geojson-vt (#7380) (by @​CommanderStorm)
  • Ensure that a successful ArrayBuffer response from a custom protocol that is null/undefined is set to an empty ArrayBuffer (#7427) (by @​neodescis)
  • Fix error in _contextRestored when map was initialized without a style (#7432) (by @​mvanhorn)
  • Fix issue with the cache used for zoomLevelsToOverscale feature (#7450) (by @​HarelM)
  • Update stylelint and fix old issues with the CSS (mainly change rgb to use spaces) (#7365) (by @​HarelM)

5.22.0

✨ Features and improvements

  • Make line-cap, line-miter-limit, and line-round-limit data-driven properties, allowing per-feature values (#7351) (by @​CommanderStorm)
  • GPU performance optimization: early culling of transparent symbols in vertex shaders (#7364) (by @​xavierjs)
  • Add example showing how to measure map performance using built-in events (load, idle, render) (#7077) (by @​CommanderStorm)
  • UX: Clarify error message language so if layout and paint properties are confused in setPaintProperty or setLayoutProperty (#6954) (by @​Willjfield and @​CommanderStorm)

🐞 Bug fixes

  • Fix startup crash caused by a stale async style load completing after the style was cleared or replaced (#7377)
  • Make fitBounds and fitScreenCoordinates respect the zoomSnap map option by snapping the zoom level down to keep bounds fully visible (#7332 (by @​CommanderStorm)
  • Make jumpTo, easeTo, and flyTo respect the zoomSnap map option by snapping the zoom level to the nearest valid increment (#7333 (by @​CommanderStorm)
  • Fix setState crash when switching styles while globe projection is active (#7314) (by @​ashwinuae)
  • Prevent crashes when calling map.remove() immediately after creation by canceling in-flight style URL loads (#7368) (by @​CommanderStorm)
  • Fixed symbol collision flickering by adding tolerance to GridIndex AABB comparison (#7360) (by @​kkokkoejong)
  • Fix fitBounds ignoring maxZoom option in vertical-perspective projection (#7372) (by @​CommanderStorm)
  • Prevent stale async style loads from completing after style clear (#7378) (by @​Lievesley)
  • Fix broken example for fill-pattern (#7326) (by @​k-yle)

... (truncated)

Commits
  • fd31bd8 Bump js version to 5.24.0 (#7509)
  • 859e6fa chore(deps-dev): bump rollup from 4.60.1 to 4.60.2 (#7508)
  • 1401f2d chore(deps): bump actions/setup-node from 6.3.0 to 6.4.0 (#7507)
  • 57f77d3 chore(deps): bump dependabot/fetch-metadata from 3.0.0 to 3.1.0 (#7506)
  • 1d3c3f4 Update PR template to include AI policy confirmation (#7505)
  • b30f011 docs: Improve documentation for MapOptions hash parameter (#7503)
  • d1614ef chore(deps-dev): bump devtools-protocol from 0.0.1616338 to 0.0.1617013 (#7504)
  • d44f14b Fix author attribution for touchZoomRotate features (#7502)
  • 018c3a0 Symbol SDF Performance Optimization: Render Halo and Glyph in a Single Pass (...
  • 38f6798 chore(deps-dev): bump diff from 8.0.4 to 9.0.0 (#7497)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for maplibre-gl since your current version.


Updates web-vitals from 5.1.0 to 5.2.0

Changelog

Sourced from web-vitals's changelog.

v5.2.0 (2026-03-25)

  • Replace filter()[0] with find() for better performance (#658)
  • Use queueMicrotask for microtask scheduling (#660)
  • Simplify the event and LoAF entry clean up logic (#662)
  • Remove obsolete FID polyfill types (#675)
  • Use LargestContentfulPaint.id as fallback when element is removed from DOM (#676)
  • Fix bug for onLCP when attached late (#697)
  • FHandle initially hidden pages and onLCP registered on visibility change (#698)
  • Ensure we clear idle callbacks in whenIdleOrHidden (#707)
  • Limit pending events to conserve memory (#710)
  • Add includeProcessedEventEntries option (#714)
  • Reduce bundle size by refactoring (#713)
Commits
Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates zustand from 5.0.9 to 5.0.12

Release notes

Sourced from zustand's releases.

v5.0.12

Two small fixes.

What's Changed

New Contributors

Full Changelog: pmndrs/zustand@v5.0.11...v5.0.12

v5.0.11

This release includes small improvements in middleware thanks to contributors.

What's Changed

New Contributors

Full Changelog: pmndrs/zustand@v5.0.10...v5.0.11

v5.0.10

This version includes a fix to the persist middleware for an edge case.

What's Changed

New Contributors

... (truncated)

Commits

Updates @playwright/test from 1.58.0 to 1.59.1

Release notes

Sourced from @​playwright/test's releases.

v1.59.1

Bug Fixes

  • [Windows] Reverted hiding console window when spawning browser processes, which caused regressions including broken codegen, --ui and show commands (#39990)

v1.59.0

🎬 Screencast

New page.screencast API provides a unified interface for capturing page content with:

  • Screencast recordings
  • Action annotations
  • Visual overlays
  • Real-time frame capture
  • Agentic video receipts

Screencast recording — record video with precise start/stop control, as an alternative to the recordVideo option:

await page.screencast.start({ path: 'video.webm' });
// ... perform actions ...
await page.screencast.stop();

Action annotations — enable built-in visual annotations that highlight interacted elements and display action titles during recording:

await page.screencast.showActions({ position: 'top-right' });

screencast.showActions() accepts position ('top-left', 'top', 'top-right', 'bottom-left', 'bottom', 'bottom-right'), duration (ms per annotation), and fontSize (px). Returns a disposable to stop showing actions.

Action annotations can also be enabled in test fixtures via the video option:

// playwright.config.ts
export default defineConfig({
  use: {
    video: {
      mode: 'on',
      show: {
        actions: { position: 'top-left' },
        test: { position: 'top-right' },
      },
</tr></table>

... (truncated)

Commits
  • d466ac5 chore: mark v1.59.1 (#40005)
  • 530e7e5 cherry-pick(#4004): fix(cli): kill-all should kill dashboard
  • 9aa216c cherry-pick(#39994): Revert "fix(windows): hide console window when spawning ...
  • 01b2b15 cherry-pick(#39980): chore: more release notes fixes
  • a5cb6c9 cherry-pick(#39972): chore: expose browser.bind and browser.unbind APIs
  • 99a17b5 cherry-pick(#39975): chore: support opening .trace files via .link indirection
  • 43607c3 cherry-pick(#39974): chore(webkit): update Safari user-agent version to 26.4
  • 62cabe1 cherry-pick(#39969): chore(npm): include all *.md from lib (#39970)
  • 0c65a75 cherry-pick(#39968): chore: screencast.showActions api
  • f04155b cherry-pick(#39958): chore: release notes for langs v1.59
  • Additional commits viewable in compare view

Updates @testing-library/react from 16.3.0 to 16.3.2

Release notes

Sourced from @​testing-library/react's releases.

v16.3.2

16.3.2 (2026-01-19)

Bug Fixes

  • Update 'onCaughtError' type inference in 'RenderOptions' to work with React v19 (#1438) (f32bd1b)

v16.3.1

16.3.1 (2025-12-15)

Bug Fixes

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​testing-library/react since your current version.


Updates @types/maplibre-gl from 1.13.2 to 1.14.0

Commits

Updates @vitest/coverage-v8 from 4.0.18 to 4.1.5

Release notes

Sourced from @​vitest/coverage-v8's releases.

v4.1.5

   🚀 Experimental Features

   🐞 Bug Fixes

@dependabot
chore(deps)(deps): bump the web-dependencies group across 1 directory…
dacb306 
… with 19 updates

Bumps the web-dependencies group with 16 updates in the /web directory:

| Package | From | To |
| --- | --- | --- |
| [i18next-browser-languagedetector](https://github.com/i18next/i18next-browser-languageDetector) | `8.2.0` | `8.2.1` |
| [livekit-client](https://github.com/livekit/client-sdk-js) | `2.16.0` | `2.18.8` |
| [maplibre-gl](https://github.com/maplibre/maplibre-gl-js) | `5.14.0` | `5.24.0` |
| [web-vitals](https://github.com/GoogleChrome/web-vitals) | `5.1.0` | `5.2.0` |
| [zustand](https://github.com/pmndrs/zustand) | `5.0.9` | `5.0.12` |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.58.0` | `1.59.1` |
| [@testing-library/react](https://github.com/testing-library/react-testing-library) | `16.3.0` | `16.3.2` |
| [@types/maplibre-gl](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/maplibre-gl) | `1.13.2` | `1.14.0` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.0.18` | `4.1.5` |
| [autoprefixer](https://github.com/postcss/autoprefixer) | `10.4.22` | `10.5.0` |
| [axe-core](https://github.com/dequelabs/axe-core) | `4.11.1` | `4.11.4` |
| [eslint-plugin-react-hooks](https://github.com/facebook/react/tree/HEAD/packages/eslint-plugin-react-hooks) | `7.0.1` | `7.1.1` |
| [eslint-plugin-react-refresh](https://github.com/ArnaudBarre/eslint-plugin-react-refresh) | `0.4.24` | `0.5.2` |
| [msw](https://github.com/mswjs/msw) | `2.12.7` | `2.14.2` |
| [postcss](https://github.com/postcss/postcss) | `8.5.6` | `8.5.13` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.49.0` | `8.59.1` |



Updates `i18next-browser-languagedetector` from 8.2.0 to 8.2.1
- [Changelog](https://github.com/i18next/i18next-browser-languageDetector/blob/master/CHANGELOG.md)
- [Commits](i18next/i18next-browser-languageDetector@v8.2.0...v8.2.1)

Updates `livekit-client` from 2.16.0 to 2.18.8
- [Release notes](https://github.com/livekit/client-sdk-js/releases)
- [Changelog](https://github.com/livekit/client-sdk-js/blob/main/CHANGELOG.md)
- [Commits](livekit/client-sdk-js@v2.16.0...v2.18.8)

Updates `maplibre-gl` from 5.14.0 to 5.24.0
- [Release notes](https://github.com/maplibre/maplibre-gl-js/releases)
- [Changelog](https://github.com/maplibre/maplibre-gl-js/blob/main/CHANGELOG.md)
- [Commits](maplibre/maplibre-gl-js@v5.14.0...v5.24.0)

Updates `web-vitals` from 5.1.0 to 5.2.0
- [Changelog](https://github.com/GoogleChrome/web-vitals/blob/main/CHANGELOG.md)
- [Commits](GoogleChrome/web-vitals@v5.1.0...v5.2.0)

Updates `zustand` from 5.0.9 to 5.0.12
- [Release notes](https://github.com/pmndrs/zustand/releases)
- [Commits](pmndrs/zustand@v5.0.9...v5.0.12)

Updates `@playwright/test` from 1.58.0 to 1.59.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.58.0...v1.59.1)

Updates `@testing-library/react` from 16.3.0 to 16.3.2
- [Release notes](https://github.com/testing-library/react-testing-library/releases)
- [Changelog](https://github.com/testing-library/react-testing-library/blob/main/CHANGELOG.md)
- [Commits](testing-library/react-testing-library@v16.3.0...v16.3.2)

Updates `@types/maplibre-gl` from 1.13.2 to 1.14.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/maplibre-gl)

Updates `@vitest/coverage-v8` from 4.0.18 to 4.1.5
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.5/packages/coverage-v8)

Updates `@vitest/ui` from 4.0.18 to 4.1.5
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.5/packages/ui)

Updates `autoprefixer` from 10.4.22 to 10.5.0
- [Release notes](https://github.com/postcss/autoprefixer/releases)
- [Changelog](https://github.com/postcss/autoprefixer/blob/main/CHANGELOG.md)
- [Commits](postcss/autoprefixer@10.4.22...10.5.0)

Updates `axe-core` from 4.11.1 to 4.11.4
- [Release notes](https://github.com/dequelabs/axe-core/releases)
- [Changelog](https://github.com/dequelabs/axe-core/blob/develop/CHANGELOG.md)
- [Commits](dequelabs/axe-core@v4.11.1...v4.11.4)

Updates `eslint-plugin-react-hooks` from 7.0.1 to 7.1.1
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/packages/eslint-plugin-react-hooks/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/eslint-plugin-react-hooks@7.1.1/packages/eslint-plugin-react-hooks)

Updates `eslint-plugin-react-refresh` from 0.4.24 to 0.5.2
- [Release notes](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/releases)
- [Changelog](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/blob/main/CHANGELOG.md)
- [Commits](ArnaudBarre/eslint-plugin-react-refresh@v0.4.24...v0.5.2)

Updates `msw` from 2.12.7 to 2.14.2
- [Release notes](https://github.com/mswjs/msw/releases)
- [Changelog](https://github.com/mswjs/msw/blob/main/CHANGELOG.md)
- [Commits](mswjs/msw@v2.12.7...v2.14.2)

Updates `playwright` from 1.58.0 to 1.59.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.58.0...v1.59.1)

Updates `postcss` from 8.5.6 to 8.5.13
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.6...8.5.13)

Updates `typescript-eslint` from 8.49.0 to 8.59.1
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.59.1/packages/typescript-eslint)

Updates `vitest` from 4.0.18 to 4.1.5
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.5/packages/vitest)

---
updated-dependencies:
- dependency-name: i18next-browser-languagedetector
  dependency-version: 8.2.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: web-dependencies
- dependency-name: livekit-client
  dependency-version: 2.18.8
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: web-dependencies
- dependency-name: maplibre-gl
  dependency-version: 5.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: web-dependencies
- dependency-name: web-vitals
  dependency-version: 5.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: web-dependencies
- dependency-name: zustand
  dependency-version: 5.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: web-dependencies
- dependency-name: "@playwright/test"
  dependency-version: 1.59.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: web-dependencies
- dependency-name: "@testing-library/react"
  dependency-version: 16.3.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: web-dependencies
- dependency-name: "@types/maplibre-gl"
  dependency-version: 1.14.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: web-dependencies
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 4.1.5
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: web-dependencies
- dependency-name: "@vitest/ui"
  dependency-version: 4.1.5
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: web-dependencies
- dependency-name: autoprefixer
  dependency-version: 10.5.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: web-dependencies
- dependency-name: axe-core
  dependency-version: 4.11.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: web-dependencies
- dependency-name: eslint-plugin-react-hooks
  dependency-version: 7.1.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: web-dependencies
- dependency-name: eslint-plugin-react-refresh
  dependency-version: 0.5.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: web-dependencies
- dependency-name: msw
  dependency-version: 2.14.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: web-dependencies
- dependency-name: playwright
  dependency-version: 1.59.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: web-dependencies
- dependency-name: postcss
  dependency-version: 8.5.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: web-dependencies
- dependency-name: typescript-eslint
  dependency-version: 8.59.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: web-dependencies
- dependency-name: vitest
  dependency-version: 4.1.5
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: web-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github
Copy link
Copy Markdown
Author

dependabot Bot commented on behalf of github May 4, 2026

Labels

The following labels could not be found: frontend, npm, security. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label May 4, 2026
@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 4, 2026

NPM Vulnerability Scan Results - e2e

Severity Count
Critical 0
High 1
Moderate 0
Low 1
Total 2
Click to see details 
# npm audit report

path-to-regexp  <0.1.13
Severity: high
path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters - https://github.com/advisories/GHSA-37ch-88jc-xwx2
fix available via `npm audit fix`
node_modules/path-to-regexp

qs  6.7.0 - 6.14.1
qs's arrayLimit bypass in comma parsing allows denial of service - https://github.com/advisories/GHSA-w7fw-mjwx-w883
fix available via `npm audit fix`
node_modules/qs

2 vulnerabilities (1 low, 1 high)

To address all issues, run:
  npm audit fix

@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 4, 2026

NPM Vulnerability Scan Results - web

Severity Count
Critical 0
High 5
Moderate 3
Low 0
Total 8
Click to see details 
# npm audit report

ajv  <6.14.0
Severity: moderate
ajv has ReDoS when using `$data` option - https://github.com/advisories/GHSA-2g4f-4pwh-qvx6
fix available via `npm audit fix`
node_modules/ajv

brace-expansion  <1.1.13
Severity: moderate
brace-expansion: Zero-step sequence causes process hang and memory exhaustion - https://github.com/advisories/GHSA-f886-m6hf-6m8v
fix available via `npm audit fix`
node_modules/brace-expansion

i18next-http-backend  <3.0.5
Severity: moderate
 i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns - https://github.com/advisories/GHSA-q89c-q3h5-w34g
fix available via `npm audit fix`
node_modules/i18next-http-backend

lodash-es  <=4.17.23
Severity: high
lodash vulnerable to Code Injection via `_.template` imports key names - https://github.com/advisories/GHSA-r5fr-rjxr-66jc
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - https://github.com/advisories/GHSA-f23m-r3pf-42rh
fix available via `npm audit fix`
node_modules/lodash-es

minimatch  <=3.1.3
Severity: high
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern - https://github.com/advisories/GHSA-3ppc-4f35-3m26
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments - https://github.com/advisories/GHSA-7r86-cg39-jmmj
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions - https://github.com/advisories/GHSA-23c5-xmqv-rm74
fix available via `npm audit fix`
node_modules/minimatch

picomatch  <=2.3.1 || 4.0.0 - 4.0.3
Severity: high
Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching - https://github.com/advisories/GHSA-3v7f-55p6-f55p
Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching - https://github.com/advisories/GHSA-3v7f-55p6-f55p
Picomatch has a ReDoS vulnerability via extglob quantifiers - https://github.com/advisories/GHSA-c2c7-rcm5-vvqj
Picomatch has a ReDoS vulnerability via extglob quantifiers - https://github.com/advisories/GHSA-c2c7-rcm5-vvqj
fix available via `npm audit fix`
node_modules/picomatch
node_modules/rollup-plugin-visualizer/node_modules/picomatch
node_modules/tinyglobby/node_modules/picomatch
node_modules/vite/node_modules/picomatch
node_modules/vitest/node_modules/picomatch

rollup  4.0.0 - 4.58.0
Severity: high
Rollup 4 has Arbitrary File Write via Path Traversal - https://github.com/advisories/GHSA-mw96-cpmx-2vgc
fix available via `npm audit fix`
node_modules/rollup

vite  7.0.0 - 7.3.1
Severity: high
Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling - https://github.com/advisories/GHSA-4w7w-66w2-5vf9
Vite: `server.fs.deny` bypassed with queries - https://github.com/advisories/GHSA-v2wj-q39q-566r
Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket - https://github.com/advisories/GHSA-p9ff-h696-f583
fix available via `npm audit fix`
node_modules/vite

8 vulnerabilities (3 moderate, 5 high)

To address all issues, run:
  npm audit fix

@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 4, 2026

Docker Image Scan Results - Dockerfile.indexer

Image: subcults-indexer:scan

Severity Count
Critical 1
High 6
Medium 5
Low 1
Total 13
Click to see details 

Report Summary

┌──────────────────────────────────────┬──────────┬─────────────────┬─────────┐
│                Target                │   Type   │ Vulnerabilities │ Secrets │
├──────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ subcults-indexer:scan (debian 12.13) │  debian  │        0        │    -    │
├──────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ app/indexer                          │ gobinary │       13        │    -    │
└──────────────────────────────────────┴──────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.70/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


app/indexer (gobinary)
======================
Total: 13 (LOW: 1, MEDIUM: 5, HIGH: 6, CRITICAL: 1)

┌──────────────────────────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬────────────────┬─────────────────────────────────────────────────────────────┐
│                           Library                            │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version  │                            Title                            │
├──────────────────────────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼────────────────┼─────────────────────────────────────────────────────────────┤
│ go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptrace- │ CVE-2026-39882 │ MEDIUM   │ fixed  │ v1.24.0           │ 1.43.0         │ OpenTelemetry-Go is the Go implementation of OpenTelemetry. │
│ http                                                         │                │          │        │                   │                │ Prior to 1 ...                                              │
│                                                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-39882                  │
├──────────────────────────────────────────────────────────────┼────────────────┼──────────┤        ├───────────────────┼────────────────┼─────────────────────────────────────────────────────────────┤
│ go.opentelemetry.io/otel/sdk                                 │ CVE-2026-24051 │ HIGH     │        │ v1.38.0           │ 1.40.0         │ OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution │
│                                                              │                │          │        │                   │                │ via PATH Hijacking                                          │
│                                                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-24051                  │
│                                                              ├────────────────┤          │        │                   ├────────────────┼─────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39883 │          │        │                   │ 1.43.0         │ opentelemetry-go: BSD kenv command not using absolute path  │
│                                                              │                │          │        │                   │                │ enables PATH hijacking                                      │
│                                                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-39883                  │
├──────────────────────────────────────────────────────────────┼────────────────┼──────────┤        ├───────────────────┼────────────────┼─────────────────────────────────────────────────────────────┤
│ google.golang.org/grpc                                       │ CVE-2026-33186 │ CRITICAL │        │ v1.77.0           │ 1.79.3         │ google.golang.org/grpc/grpc-go:                             │
│                                                              │                │          │        │                   │                │ google.golang.org/grpc/authz: gRPC-Go: Authorization bypass │
│                                                              │                │          │        │                   │                │ due to improper HTTP/2 path validation                      │
│                                                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-33186                  │
├──────────────────────────────────────────────────────────────┼────────────────┼──────────┤        ├───────────────────┼────────────────┼─────────────────────────────────────────────────────────────┤
│ stdlib                                                       │ CVE-2026-25679 │ HIGH     │        │ v1.24.13          │ 1.25.8, 1.26.1 │ net/url: Incorrect parsing of IPv6 host literals in net/url │
│                                                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-25679                  │
│                                                              ├────────────────┤          │        │                   ├────────────────┼─────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-32280 │          │        │                   │ 1.25.9, 1.26.2 │ crypto/x509: crypto/tls: golang: Go: Denial of Service      │
│                                                              │                │          │        │                   │                │ vulnerability in certificate chain building...              │
│                                                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-32280                  │
│                                                              ├────────────────┤          │        │                   │                ├─────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-32281 │          │        │                   │                │ crypto/x509: golang: Go crypto/x509: Denial of Service via  │
│                                                              │                │          │        │                   │                │ inefficient certificate chain validation...                 │
│                                                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-32281                  │
│                                                              ├────────────────┤          │        │                   │                ├─────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-32283 │          │        │                   │                │ If one side of the TLS connection sends multiple key update │
│                                                              │                │          │        │                   │                │ messages...                                                 │
│                                                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-32283                  │
│                                                              ├────────────────┼──────────┤        │                   ├────────────────┼─────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-27142 │ MEDIUM   │        │                   │ 1.25.8, 1.26.1 │ html/template: URLs in meta content attribute actions are   │
│                                                              │                │          │        │                   │                │ not escaped in html/template...                             │
│                                                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-27142                  │
│                                                              ├────────────────┤          │        │                   ├────────────────┼─────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-32282 │          │        │                   │ 1.25.9, 1.26.2 │ golang: internal/syscall/unix: Root.Chmod can follow        │
│                                                              │                │          │        │                   │                │ symlinks out of the root                                    │
│                                                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-32282                  │
│                                                              ├────────────────┤          │        │                   │                ├─────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-32288 │          │        │                   │                │ archive/tar: golang: Go's archive/tar package: Denial of    │
│                                                              │                │          │        │                   │                │ Service via maliciously-crafted archive                     │
│                                                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-32288                  │
│                                                              ├────────────────┤          │        │                   │                ├─────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-32289 │          │        │                   │                │ html/template: golang: html/template: Cross-Site Scripting  │
│                                                              │                │          │        │                   │                │ (XSS) via improper context and brace depth...               │
│                                                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-32289                  │
│                                                              ├────────────────┼──────────┤        │                   ├────────────────┼─────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-27139 │ LOW      │        │                   │ 1.25.8, 1.26.1 │ os: FileInfo can escape from a Root in golang os module     │
│                                                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-27139                  │
└──────────────────────────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴────────────────┴─────────────────────────────────────────────────────────────┘

@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 4, 2026

Docker Image Scan Results - Dockerfile.frontend

Image: subcults-frontend:scan

Severity Count
Critical 0
High 2
Medium 5
Low 3
Total 10
Click to see details 

Report Summary

┌────────────────────────────────────────┬────────┬─────────────────┬─────────┐
│                 Target                 │  Type  │ Vulnerabilities │ Secrets │
├────────────────────────────────────────┼────────┼─────────────────┼─────────┤
│ subcults-frontend:scan (alpine 3.19.9) │ alpine │       10        │    -    │
└────────────────────────────────────────┴────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.70/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


subcults-frontend:scan (alpine 3.19.9)
======================================
Total: 10 (LOW: 3, MEDIUM: 5, HIGH: 2, CRITICAL: 0)

┌───────────────┬────────────────┬──────────┬────────┬──────────────────────┬──────────────────────┬──────────────────────────────────────────────────────────────┐
│    Library    │ Vulnerability  │ Severity │ Status │  Installed Version   │    Fixed Version     │                            Title                             │
├───────────────┼────────────────┼──────────┼────────┼──────────────────────┼──────────────────────┼──────────────────────────────────────────────────────────────┤
│ busybox       │ CVE-2024-58251 │ MEDIUM   │ fixed  │ 1.36.1-r20           │ 1.36.1-r21           │ In netstat in BusyBox through 1.37.0, local users can launch │
│               │                │          │        │                      │                      │ of networ...                                                 │
│               │                │          │        │                      │                      │ https://avd.aquasec.com/nvd/cve-2024-58251                   │
│               ├────────────────┼──────────┤        │                      │                      ├──────────────────────────────────────────────────────────────┤
│               │ CVE-2025-46394 │ LOW      │        │                      │                      │ In tar in BusyBox through 1.37.0, a TAR archive can have     │
│               │                │          │        │                      │                      │ filenames...                                                 │
│               │                │          │        │                      │                      │ https://avd.aquasec.com/nvd/cve-2025-46394                   │
├───────────────┼────────────────┼──────────┤        │                      │                      ├──────────────────────────────────────────────────────────────┤
│ busybox-binsh │ CVE-2024-58251 │ MEDIUM   │        │                      │                      │ In netstat in BusyBox through 1.37.0, local users can launch │
│               │                │          │        │                      │                      │ of networ...                                                 │
│               │                │          │        │                      │                      │ https://avd.aquasec.com/nvd/cve-2024-58251                   │
│               ├────────────────┼──────────┤        │                      │                      ├──────────────────────────────────────────────────────────────┤
│               │ CVE-2025-46394 │ LOW      │        │                      │                      │ In tar in BusyBox through 1.37.0, a TAR archive can have     │
│               │                │          │        │                      │                      │ filenames...                                                 │
│               │                │          │        │                      │                      │ https://avd.aquasec.com/nvd/cve-2025-46394                   │
├───────────────┼────────────────┼──────────┤        ├──────────────────────┼──────────────────────┼──────────────────────────────────────────────────────────────┤
│ musl          │ CVE-2026-40200 │ HIGH     │        │ 1.2.4_git20230717-r5 │ 1.2.4_git20230717-r6 │ musl: musl libc: Arbitrary code execution and denial of      │
│               │                │          │        │                      │                      │ service via stack-based...                                   │
│               │                │          │        │                      │                      │ https://avd.aquasec.com/nvd/cve-2026-40200                   │
│               ├────────────────┼──────────┤        │                      │                      ├──────────────────────────────────────────────────────────────┤
│               │ CVE-2026-6042  │ MEDIUM   │        │                      │                      │ musl libc: GB18030 4-byte Decoder: musl libc: Denial of      │
│               │                │          │        │                      │                      │ Service via inefficient...                                   │
│               │                │          │        │                      │                      │ https://avd.aquasec.com/nvd/cve-2026-6042                    │
├───────────────┼────────────────┼──────────┤        │                      │                      ├──────────────────────────────────────────────────────────────┤
│ musl-utils    │ CVE-2026-40200 │ HIGH     │        │                      │                      │ musl: musl libc: Arbitrary code execution and denial of      │
│               │                │          │        │                      │                      │ service via stack-based...                                   │
│               │                │          │        │                      │                      │ https://avd.aquasec.com/nvd/cve-2026-40200                   │
│               ├────────────────┼──────────┤        │                      │                      ├──────────────────────────────────────────────────────────────┤
│               │ CVE-2026-6042  │ MEDIUM   │        │                      │                      │ musl libc: GB18030 4-byte Decoder: musl libc: Denial of      │
│               │                │          │        │                      │                      │ Service via inefficient...                                   │
│               │                │          │        │                      │                      │ https://avd.aquasec.com/nvd/cve-2026-6042                    │
├───────────────┼────────────────┤          │        ├──────────────────────┼──────────────────────┼──────────────────────────────────────────────────────────────┤
│ ssl_client    │ CVE-2024-58251 │          │        │ 1.36.1-r20           │ 1.36.1-r21           │ In netstat in BusyBox through 1.37.0, local users can launch │
│               │                │          │        │                      │                      │ of networ...                                                 │
│               │                │          │        │                      │                      │ https://avd.aquasec.com/nvd/cve-2024-58251                   │
│               ├────────────────┼──────────┤        │                      │                      ├──────────────────────────────────────────────────────────────┤
│               │ CVE-2025-46394 │ LOW      │        │                      │                      │ In tar in BusyBox through 1.37.0, a TAR archive can have     │
│               │                │          │        │                      │                      │ filenames...                                                 │
│               │                │          │        │                      │                      │ https://avd.aquasec.com/nvd/cve-2025-46394                   │
└───────────────┴────────────────┴──────────┴────────┴──────────────────────┴──────────────────────┴──────────────────────────────────────────────────────────────┘

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants