build(deps): Bump jotai from 2.18.0 to 2.20.2

[dependabot]

Bumps jotai from 2.18.0 to 2.20.2.

Release notes

Sourced from jotai's releases.

v2.20.2

This release fixes a regression in some edge case introduced in v2.18.1.

What's Changed

• fix(vanilla): subscriber not notified after nested store.set and sub/unsub inside a write by @​dai-shi in pmndrs/jotai#3354

Full Changelog: pmndrs/jotai@v2.20.1...v2.20.2

v2.20.1

This release includes a few small fixes.

What's Changed

• fix(vanilla/utils/atomWithStorage): apply reviver when parsing subscription updates by @​chatman-media in pmndrs/jotai#3326
• fix(internals): throw stackoverflow errors synchronously by @​dai-shi in pmndrs/jotai#3330

New Contributors

• @​15MariamS made their first contribution in pmndrs/jotai#3321
• @​sapphi-red made their first contribution in pmndrs/jotai#3327
• @​DucMinhNe made their first contribution in pmndrs/jotai#3331
• @​chatman-media made their first contribution in pmndrs/jotai#3326

Full Changelog: pmndrs/jotai@v2.20.0...v2.20.1

v2.20.0

This release improves performance in high-throughput scenarios. Huge kudos to @​dmaskasky!

What's Changed

• breaking(internals): avoid getInternalBuildingBlock function by @​dai-shi in pmndrs/jotai#3293
• refactor(internals): Rev3 type narrowing for onMount hooks by @​dmaskasky in pmndrs/jotai#3311
• fix(internals): guard atomOnInit hook with hasOnInit by @​dmaskasky in pmndrs/jotai#3312
• refactor(internals): lazy hooks in ensureAtomState for new atom state by @​dmaskasky in pmndrs/jotai#3313

Full Changelog: pmndrs/jotai@v2.19.1...v2.20.0

v2.19.1

This release includes several small refactors to improve performance.

What's Changed

• fix(vanilla/utils/atomWithObservable): use symbol index signature to avoid 'Symbol.observable' type reference by @​sukvvon in pmndrs/jotai#3274
• refactor(internals): replace nextDeps with prevDeps by @​dmaskasky in pmndrs/jotai#3278
• refactor(internals): reduce recomputeInvalidatedAtoms overhead (performance) by @​dmaskasky in pmndrs/jotai#3284
• refactor(internals): reduce flushPending overhead (performance) by @​dmaskasky in pmndrs/jotai#3285
• fix(internals): check if atom has dependencies before doing mountDependencies work (performance) by @​dmaskasky in pmndrs/jotai#3290
• fix(internals): check if atom has onMount property before queueing processOnMount callback (performance) by @​dmaskasky in pmndrs/jotai#3291
• refactor(types): prefer no-any by @​dai-shi in pmndrs/jotai#3304

New Contributors

• @​aio39 made their first contribution in pmndrs/jotai#3277

... (truncated)

Commits

• 5c4ca26 v2.20.2
• bc273fd fix(vanilla): subscriber not notified after nested store.set and sub/unsub in...
• d8ed488 fix(workflow): ecosystem-ci (#3356)
• 937d048 fix(ci): pin downlevel-dts typescript to fix build failure (#3355)
• ddd3600 v2.20.1
• 241225c chore(deps): update dev dependencies (#3335)
• 2f233f9 chore(docs): note about stack overflow (#3332)
• 32708c8 fix(internals): throw stackoverflow errors synchronously (#3330)
• 563f059 fix(vanilla/utils/atomWithStorage): apply reviver when parsing subscription u...
• 22ae563 docs(storage): fix unbalanced parenthesis in RESET example (#3331)
• Additional commits viewable in compare view

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
brios	Ready	Preview	Aug 25, 2026 6:21am

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	jotai@​2.18.0 ⏵ 2.20.2	+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm jotai is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package.json → npm/jotai@2.20.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/jotai@2.20.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report