Skip to content

Bump the dependencies group with 7 updates#217

Merged
laymonage merged 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-dc74e91a5f
May 23, 2026
Merged

Bump the dependencies group with 7 updates#217
laymonage merged 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-dc74e91a5f

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 23, 2026

Bumps the dependencies group with 7 updates:

Package From To
@tanstack/react-virtual 3.13.24 3.13.25
astro 6.3.3 6.3.7
date-fns 4.1.0 4.3.0
takumi-js 1.1.2 1.4.0
@types/react 19.2.14 19.2.15
lefthook 2.1.6 2.1.8
sass-embedded 1.99.0 1.100.0

Updates @tanstack/react-virtual from 3.13.24 to 3.13.25

Release notes

Sourced from @​tanstack/react-virtual's releases.

@​tanstack/react-virtual@​3.13.25

Patch Changes

  • Replace the useReducer(() => ({}), {}) force-rerender pattern with an (#1168) incrementing number counter. Same semantics (every dispatch changes the reducer state, forcing a render); zero per-dispatch object allocation. Trivial individual cost, but eliminates one steady-state GC source on scroll-heavy apps.
  • Updated dependencies [99355ad, 99355ad, 99355ad, 99355ad, 99355ad, 99355ad, 99355ad]:
    • @​tanstack/virtual-core@​3.15.0
Changelog

Sourced from @​tanstack/react-virtual's changelog.

3.13.25

Patch Changes

  • Replace the useReducer(() => ({}), {}) force-rerender pattern with an (#1168) incrementing number counter. Same semantics (every dispatch changes the reducer state, forcing a render); zero per-dispatch object allocation. Trivial individual cost, but eliminates one steady-state GC source on scroll-heavy apps.
  • Updated dependencies [99355ad, 99355ad, 99355ad, 99355ad, 99355ad, 99355ad, 99355ad]:
    • @​tanstack/virtual-core@​3.15.0
Commits
  • 949180b ci: Version Packages (#1169)
  • 99355ad perf: virtual-core rewrite for mount/measure-storm, plus iOS Safari handling ...
  • 3374977 chore(angular-virtual)!: upgrade Angular to v19 (#1158)
  • See full diff in compare view

Updates astro from 6.3.3 to 6.3.7

Release notes

Sourced from astro's releases.

astro@6.3.7

Patch Changes

  • #16821 9c76b12 Thanks @​astrobot-houston! - Fixes request body handling in the Node adapter when req.body is a Buffer, Uint8Array, or ArrayBuffer. Previously, binary body data was incorrectly JSON-stringified (producing {"type":"Buffer","data":[...]}) instead of being passed through directly. This affected libraries like serverless-http that set req.body to a Buffer.

  • #16785 de96360 Thanks @​astrobot-houston! - Fixes vite.build.minify, vite.build.sourcemap, and vite.build.rollupOptions.output (e.g. compact) being ignored for client-side builds. These top-level Vite build options are now properly forwarded to the client environment, with environment-specific overrides (vite.environments.client.build.*) taking priority when set.

  • #16819 b5dd8f1 Thanks @​astrobot-houston! - Fixes custom elements in MDX files bypassing the renderer pipeline. Custom elements (tags containing hyphens like <my-element>) in .mdx files are now routed through registered renderers for SSR, matching the behavior of .astro files. If no renderer claims the element, it falls back to rendering as raw HTML.

  • #16808 765896c Thanks @​ematipico! - Fixes dynamic routes returning 400 Bad Request when the URL contains a literal % character, such as paths built with encodeURIComponent('%?.pdf')

  • #16804 90d2aca Thanks @​jp-knj! - Fixes a v6 regression where astro:i18n could not be imported from client <script> blocks.

astro@6.3.6

Patch Changes

  • #16774 8f77583 Thanks @​astrobot-houston! - Fixes markdown images with empty alt text (![](https://github.com/withastro/astro/tree/HEAD/packages/astro/blob/HEAD/image.jpg)) in content collections dropping the alt attribute entirely. The alt="" attribute is now correctly preserved in the rendered HTML output, which is important for accessibility (indicating decorative images).

  • #16776 3d10b5e Thanks @​matthewp! - Fixes HMR serving stale content when components are passed as props via getStaticPaths()

  • #16784 7453860 Thanks @​ematipico! - Improved the printing of the build time if it goes over the 60 seconds.

  • #16665 3dbbcee Thanks @​Princesseuh! - Fixes remote SVG sources erroring with dangerouslyProcessSVG after the v6.3 SVG-processing gate. The default Sharp service now resolves the output format from the source up-front when it can (URL extension, data: MIME, ESM metadata), and from the actual buffer at request time when it can't, so SVG sources pass through untouched without needing to set image.dangerouslyProcessSVG: true or an explicit format="svg".

    The error message has also been updated to point at format="svg" as the simpler workaround when an SVG source is encountered without dangerouslyProcessSVG enabled.

  • #16777 1754b91 Thanks @​matthewp! - Fixes HMR serving stale content for dynamically imported components through barrel files

  • #16730 068d924 Thanks @​harshagarwalnyu! - Fixes an issue where the file() content loader did not generate a valid JSON Schema for collections whose JSON or YAML data is a top-level array instead of an object.

astro@6.3.5

Patch Changes

  • #16771 07c8805 Thanks @​ematipico! - Fixes position prop on <Image> and <Picture> components breaking Content Security Policy (CSP).

  • #16593 50924ce Thanks @​yanthomasdev! - Improves error messages with more consistent and correct writing.

  • #16757 5d661cd Thanks @​astrobot-houston! - Fixes dev server serving stale content when SSR-only modules change (e.g. .astro files outside the project root in a monorepo, or dynamically imported components).

    Previously, the astro:hmr-reload plugin returned an empty array after detecting SSR-only module changes, which prevented Vite's updateModules from propagating the invalidation to the SSR module runner. The runner's evaluated module cache stayed stale, so subsequent requests continued returning old content.

    Now the plugin returns the SSR-only modules so Vite can process them through updateModules, which properly invalidates the module runner's cache and ensures fresh content on the next request.

astro@6.3.4

Patch Changes

  • #16723 0f10bfe Thanks @​matthewp! - Adds fetchFile option to experimental.advancedRouting to customize or disable the entrypoint file

    export default defineConfig({

... (truncated)

Changelog

Sourced from astro's changelog.

6.3.7

Patch Changes

  • #16821 9c76b12 Thanks @​astrobot-houston! - Fixes request body handling in the Node adapter when req.body is a Buffer, Uint8Array, or ArrayBuffer. Previously, binary body data was incorrectly JSON-stringified (producing {"type":"Buffer","data":[...]}) instead of being passed through directly. This affected libraries like serverless-http that set req.body to a Buffer.

  • #16785 de96360 Thanks @​astrobot-houston! - Fixes vite.build.minify, vite.build.sourcemap, and vite.build.rollupOptions.output (e.g. compact) being ignored for client-side builds. These top-level Vite build options are now properly forwarded to the client environment, with environment-specific overrides (vite.environments.client.build.*) taking priority when set.

  • #16819 b5dd8f1 Thanks @​astrobot-houston! - Fixes custom elements in MDX files bypassing the renderer pipeline. Custom elements (tags containing hyphens like <my-element>) in .mdx files are now routed through registered renderers for SSR, matching the behavior of .astro files. If no renderer claims the element, it falls back to rendering as raw HTML.

  • #16808 765896c Thanks @​ematipico! - Fixes dynamic routes returning 400 Bad Request when the URL contains a literal % character, such as paths built with encodeURIComponent('%?.pdf')

  • #16804 90d2aca Thanks @​jp-knj! - Fixes a v6 regression where astro:i18n could not be imported from client <script> blocks.

6.3.6

Patch Changes

  • #16774 8f77583 Thanks @​astrobot-houston! - Fixes markdown images with empty alt text (![](https://github.com/withastro/astro/blob/main/packages/astro/image.jpg)) in content collections dropping the alt attribute entirely. The alt="" attribute is now correctly preserved in the rendered HTML output, which is important for accessibility (indicating decorative images).

  • #16776 3d10b5e Thanks @​matthewp! - Fixes HMR serving stale content when components are passed as props via getStaticPaths()

  • #16784 7453860 Thanks @​ematipico! - Improved the printing of the build time if it goes over the 60 seconds.

  • #16665 3dbbcee Thanks @​Princesseuh! - Fixes remote SVG sources erroring with dangerouslyProcessSVG after the v6.3 SVG-processing gate. The default Sharp service now resolves the output format from the source up-front when it can (URL extension, data: MIME, ESM metadata), and from the actual buffer at request time when it can't, so SVG sources pass through untouched without needing to set image.dangerouslyProcessSVG: true or an explicit format="svg".

    The error message has also been updated to point at format="svg" as the simpler workaround when an SVG source is encountered without dangerouslyProcessSVG enabled.

  • #16777 1754b91 Thanks @​matthewp! - Fixes HMR serving stale content for dynamically imported components through barrel files

  • #16730 068d924 Thanks @​harshagarwalnyu! - Fixes an issue where the file() content loader did not generate a valid JSON Schema for collections whose JSON or YAML data is a top-level array instead of an object.

6.3.5

Patch Changes

  • #16771 07c8805 Thanks @​ematipico! - Fixes position prop on <Image> and <Picture> components breaking Content Security Policy (CSP).

  • #16593 50924ce Thanks @​yanthomasdev! - Improves error messages with more consistent and correct writing.

  • #16757 5d661cd Thanks @​astrobot-houston! - Fixes dev server serving stale content when SSR-only modules change (e.g. .astro files outside the project root in a monorepo, or dynamically imported components).

    Previously, the astro:hmr-reload plugin returned an empty array after detecting SSR-only module changes, which prevented Vite's updateModules from propagating the invalidation to the SSR module runner. The runner's evaluated module cache stayed stale, so subsequent requests continued returning old content.

    Now the plugin returns the SSR-only modules so Vite can process them through updateModules, which properly invalidates the module runner's cache and ensures fresh content on the next request.

6.3.4

Patch Changes

... (truncated)

Commits
  • c8e5a94 [ci] release (#16805)
  • 9c76b12 fix(node): pass through Buffer and Uint8Array bodies in makeRequestBody inste...
  • bd755f8 [ci] format
  • b5dd8f1 fix(jsx): route custom elements in MDX through the renderer pipeline for SSR ...
  • 1c8dcc8 [ci] format
  • de96360 fix(build): respect vite.build.minify, sourcemap, and rollup output options f...
  • f4fdb5a [ci] format
  • 765896c fix: improver double encoding check (#16808)
  • 90d2aca fix: support i18n on the client (#16804)
  • 223a843 [ci] release (#16775)
  • Additional commits viewable in compare view

Updates date-fns from 4.1.0 to 4.3.0

Release notes

Sourced from date-fns's releases.

v4.3.0

Kudos to @​ImRodry and @​puneetdixit200 for their contributions.

Fixed

v4.2.1

Fixed

  • Fixed type definitions missing in v4.2.0 due to TypeScript misconfiguration.

v4.2.0

This is a minor release in all senses, it only includes documentation updates (first of many) that points to the new You Don't Need date-fns* page.

* Not really

Changed

  • Added Temporal API references to the JSDoc annotations of add, addBusinessDays, and addDays.
Commits

Updates takumi-js from 1.1.2 to 1.4.0

Release notes

Sourced from takumi-js's releases.

takumi-js@1.4.0

Patch Changes

  • Updated dependencies [e83ab19]
  • Updated dependencies [1d5daed]
    • @​takumi-rs/helpers@​1.4.0
    • @​takumi-rs/core@​1.4.0
    • @​takumi-rs/wasm@​1.4.0

takumi-js@1.3.0

Patch Changes

  • @​takumi-rs/core@​1.3.0
  • @​takumi-rs/wasm@​1.3.0
  • @​takumi-rs/helpers@​1.3.0

takumi-js@1.2.1

Patch Changes

  • @​takumi-rs/core@​1.2.1
  • @​takumi-rs/wasm@​1.2.1
  • @​takumi-rs/helpers@​1.2.1
Changelog

Sourced from takumi-js's changelog.

1.4.0

Patch Changes

  • Updated dependencies [e83ab19]
  • Updated dependencies [1d5daed]
    • @​takumi-rs/helpers@​1.4.0
    • @​takumi-rs/core@​1.4.0
    • @​takumi-rs/wasm@​1.4.0

1.3.0

Patch Changes

  • @​takumi-rs/core@​1.3.0
  • @​takumi-rs/wasm@​1.3.0
  • @​takumi-rs/helpers@​1.3.0

1.2.1

Patch Changes

  • @​takumi-rs/core@​1.2.1
  • @​takumi-rs/wasm@​1.2.1
  • @​takumi-rs/helpers@​1.2.1

1.2.0

Patch Changes

  • @​takumi-rs/core@​1.2.0
  • @​takumi-rs/wasm@​1.2.0
  • @​takumi-rs/helpers@​1.2.0
Commits

Updates @types/react from 19.2.14 to 19.2.15

Commits

Updates lefthook from 2.1.6 to 2.1.8

Release notes

Sourced from lefthook's releases.

v2.1.8

Changelog

  • 488a5f99a5a496e5837f757f8ce3e6c6d1415792 fix: do not warn if local hooks path is equal to default hooks path (#1421)

v2.1.7

Changelog

  • f415a9d3fce1d4f6af62622cf96c72e04ecf7bd3 chore: go mod tidy
  • cf4ab9ea4580f5aeb0d4b61d4dd169533e5bb0c9 fix: always restore unstaged changes (#1416)
  • 4c0e000d6fe9f35f42efefb9263b0b4cb5dfbd49 fix: apply stage_fixed only if it is safe (#1418)
  • 76aa843ef5ceb6970f61cd2ff28d16dd2ec82272 fix: linter, sacrifice optimization for readability
  • 9d53c36ed9a26d3bf66e341a9650a0ecac9b6a37 fix: separate fallback push branch from pathspecs (#1396)
  • 22c9f773cf93b59005bd244c5b00caab2947a755 fix: try to always restore unstaged changes (#1417)
  • 37d83986d8e6d6bf6792f57e22e7cbb1a9e28064 fix: use contrast colors (#1420)
  • eb1064d0b8c6248627960bea1abf6891db5a21b1 refactor: add new logger without a global state (#1385)
Changelog

Sourced from lefthook's changelog.

2.1.8 (2026-05-19)

  • fix: do not warn if local hooks path is equal to default hooks path (#1421) by @​mrexox

2.1.7 (2026-05-19)

Commits
  • 9e75b21 2.1.8: reduce warning for core.hooksPath if it matches the default
  • 488a5f9 fix: do not warn if local hooks path is equal to default hooks path (#1421)
  • b5c8310 2.1.7: restore unstaged changes when possible
  • 37d8398 fix: use contrast colors (#1420)
  • 4c0e000 fix: apply stage_fixed only if it is safe (#1418)
  • 22c9f77 fix: try to always restore unstaged changes (#1417)
  • cf4ab9e fix: always restore unstaged changes (#1416)
  • f415a9d chore: go mod tidy
  • eb1064d refactor: add new logger without a global state (#1385)
  • 76aa843 fix: linter, sacrifice optimization for readability
  • Additional commits viewable in compare view

Updates sass-embedded from 1.99.0 to 1.100.0

Changelog

Sourced from sass-embedded's changelog.

1.100.0

  • Writing two compound selectors adjacent to one another without any whitespace between them, such as [class]a, is now deprecated. This was always an error in CSS and Sass only supported it by mistake.

    See the Sass website for details.

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the dependencies group with 7 updates
cb1cf72 
Bumps the dependencies group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [@tanstack/react-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual) | `3.13.24` | `3.13.25` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `6.3.3` | `6.3.7` |
| [date-fns](https://github.com/date-fns/date-fns) | `4.1.0` | `4.3.0` |
| [takumi-js](https://github.com/kane50613/takumi/tree/HEAD/takumi-js) | `1.1.2` | `1.4.0` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.14` | `19.2.15` |
| [lefthook](https://github.com/evilmartians/lefthook) | `2.1.6` | `2.1.8` |
| [sass-embedded](https://github.com/sass/embedded-host-node) | `1.99.0` | `1.100.0` |


Updates `@tanstack/react-virtual` from 3.13.24 to 3.13.25
- [Release notes](https://github.com/TanStack/virtual/releases)
- [Changelog](https://github.com/TanStack/virtual/blob/main/packages/react-virtual/CHANGELOG.md)
- [Commits](https://github.com/TanStack/virtual/commits/@tanstack/react-virtual@3.13.25/packages/react-virtual)

Updates `astro` from 6.3.3 to 6.3.7
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@6.3.7/packages/astro)

Updates `date-fns` from 4.1.0 to 4.3.0
- [Release notes](https://github.com/date-fns/date-fns/releases)
- [Commits](date-fns/date-fns@v4.1.0...v4.3.0)

Updates `takumi-js` from 1.1.2 to 1.4.0
- [Release notes](https://github.com/kane50613/takumi/releases)
- [Changelog](https://github.com/kane50613/takumi/blob/master/takumi-js/CHANGELOG.md)
- [Commits](https://github.com/kane50613/takumi/commits/takumi-js@1.4.0/takumi-js)

Updates `@types/react` from 19.2.14 to 19.2.15
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `lefthook` from 2.1.6 to 2.1.8
- [Release notes](https://github.com/evilmartians/lefthook/releases)
- [Changelog](https://github.com/evilmartians/lefthook/blob/master/CHANGELOG.md)
- [Commits](evilmartians/lefthook@v2.1.6...v2.1.8)

Updates `sass-embedded` from 1.99.0 to 1.100.0
- [Changelog](https://github.com/sass/embedded-host-node/blob/main/CHANGELOG.md)
- [Commits](sass/embedded-host-node@1.99.0...1.100.0)

---
updated-dependencies:
- dependency-name: "@tanstack/react-virtual"
  dependency-version: 3.13.25
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: astro
  dependency-version: 6.3.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: date-fns
  dependency-version: 4.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: takumi-js
  dependency-version: 1.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: "@types/react"
  dependency-version: 19.2.15
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: lefthook
  dependency-version: 2.1.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: sass-embedded
  dependency-version: 1.100.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels May 23, 2026
@vercel
Copy link
Copy Markdown

vercel Bot commented May 23, 2026 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
isle Ready Ready Preview, Comment May 23, 2026 7:54am

@laymonage laymonage merged commit 5bde386 into main May 23, 2026
3 checks passed
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/dependencies-dc74e91a5f branch May 23, 2026 09:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@laymonage laymonage laymonage approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@laymonage