Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 17 updates - #237

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-5585177427
Closed

chore(deps): bump the production-dependencies group across 1 directory with 17 updates#237
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-5585177427

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 17 updates in the / directory:

Package From To
typescript 6.0.3 7.0.2
@astrojs/cloudflare 14.1.3 14.1.4
@hugeicons/core-free-icons 4.2.2 4.2.3
@sentry/browser 10.66.0 10.67.0
@tanstack/virtual-core 3.17.4 3.17.5
astro 7.1.1 7.1.3
posthog-js 1.404.1 1.406.2
@tanstack/react-virtual 3.14.6 3.14.7
react 19.2.7 19.2.8
react-dom 19.2.7 19.2.8
@aws-sdk/client-s3 3.1090.0 3.1092.0
@hono/node-server 2.0.10 2.0.11
@sentry/node 10.66.0 10.67.0
add-mcp 1.13.0 1.14.0
better-sqlite3 12.11.1 13.0.1
posthog-node 5.45.2 5.46.0
@astrojs/language-server 2.16.12 2.16.13

Updates typescript from 6.0.3 to 7.0.2

Commits
Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.


Updates @astrojs/cloudflare from 14.1.3 to 14.1.4

Release notes

Sourced from @​astrojs/cloudflare's releases.

@​astrojs/cloudflare@​14.1.4

Patch Changes

  • #17457 d46ecd8 Thanks @​matthewp! - Fixes a dev server crash when using Astro Actions with the Cloudflare adapter

  • Updated dependencies []:

    • @​astrojs/underscore-redirects@​1.0.3
Changelog

Sourced from @​astrojs/cloudflare's changelog.

14.1.4

Patch Changes

  • #17457 d46ecd8 Thanks @​matthewp! - Fixes a dev server crash when using Astro Actions with the Cloudflare adapter

  • Updated dependencies []:

    • @​astrojs/underscore-redirects@​1.0.3
Commits

Updates @hugeicons/core-free-icons from 4.2.2 to 4.2.3

Updates @sentry/browser from 10.66.0 to 10.67.0

Release notes

Sourced from @​sentry/browser's releases.

10.67.0

Important Changes

  • feat(sveltekit): Add support for SvelteKit 3 (#22264)

    The SvelteKit SDK now supports the pre-release of SvelteKit 3, including client-side pageload and navigation tracing and server-side native tracing, alongside continued SvelteKit 2 support. No Sentry-specific setup changes are required. The SDK detects your SvelteKit version and picks the right implementation automatically.

Other Changes

  • feat(aws-serverless): Use orchestrion aws-sdk integration under diagnostics-channel opt-in (#22143)
  • feat(cloudflare): Auto-instrument Workers AI binding via env instrumentation (#22126)
  • feat(cloudflare): Instrument Cloudflare rate limiter bindings (#22035)
  • feat(core): Instrument workers-ai-provider (#22119)
  • feat(core): Rename queryParams to urlQueryParams (#22217)
  • feat(mongodb): implement orchestrion mongodb integration (#22308)
  • feat(mongoose): implement orchestrion mongoose integration (#22202)
  • feat(node): Rewrite tedious instrumentation to orchestrion tracing channels (#22238)
  • feat(nuxt): Add _experimental.useDiagnosticsChannelInjection (#22323)
  • feat(remix): Add orchestrion-based remix instrumentation (#22244)
  • feat(replay): Allow skipping the final flush on stop() via { flush: false } (#22300)
  • feat(server-utils): Add @​opentelemetry/instrumentation-koa orchestrion integration (#22146)
  • feat(server-utils): Add orchestrion aws-sdk channel integration core (#22142)
  • feat(server-utils): Allow passing custom transforms to orchestrion (#22319)
  • feat(server-utils): Port Bedrock aws-sdk extension and add integration tests (#22166)
  • feat(server-utils): Port S3, Kinesis, DynamoDB, SecretsManager and StepFunctions aws-sdk extensions (#22164)
  • feat(server-utils): Port SQS, SNS and Lambda aws-sdk extensions with trace propagation (#22165)
  • feat(server-utils): Rewrite SentryLangChainInstrumentation to orchestrion (#22266)
  • feat(server-utils): Rewrite SentryLangGraphInstrumentation to orchestrion (#22268)
  • feat(vue): Set navigation.route.id from the route name (#22372)
  • fix(bundler): do not import type from optional peer dep (#22304)
  • fix(cloudflare): Bind Durable Object built-in handlers (#22340)
  • fix(cloudflare): Instrument custom WorkerEntrypoint RPC methods (#22310)
  • fix(cloudflare): Route DO teardown through original waitUntil (#22339)
  • fix(cloudflare): Skip spans for Cloudflare-internal Durable Object SQL queries (#22376)
  • fix(core): Prevent functionToStringIntegration from throwing on cross-origin realms (#22273)
  • fix(core): Prevent infinite recursion when console is instrumented twice (#21959)
  • fix(nextjs): Mark internal chunk frames as not in_app (#22354)
  • fix(node): Register tracer provider when OTel API global pre-exists with a different version (#22374)
  • fix(node-native): Don't drop breadcrumbs from event loop block events (#22322)
  • fix(serve-rutils): Orchestrion diagnostics for async and require (#22327)
  • fix(server-utils): Only skip loader thread (#22336)
  • fix(sveltekit): Detect SvelteKit server build via Vite Environment API (#21629)
  • fix(vercelai): Avoid double-capturing v4 tool errors in orchestrion mode (#22293)
  • fix(vue): Support pinia 4 in peer dependency range (#22324)
  • chore: Add external contributor to CHANGELOG.md (#22357)
  • chore: Add external contributor to CHANGELOG.md (#22359)

... (truncated)

Changelog

Sourced from @​sentry/browser's changelog.

10.67.0

Important Changes

  • feat(sveltekit): Add support for SvelteKit 3 (#22264)

    The SvelteKit SDK now supports the pre-release of SvelteKit 3, including client-side pageload and navigation tracing and server-side native tracing, alongside continued SvelteKit 2 support. No Sentry-specific setup changes are required. The SDK detects your SvelteKit version and picks the right implementation automatically.

Other Changes

  • feat(aws-serverless): Use orchestrion aws-sdk integration under diagnostics-channel opt-in (#22143)
  • feat(cloudflare): Auto-instrument Workers AI binding via env instrumentation (#22126)
  • feat(cloudflare): Instrument Cloudflare rate limiter bindings (#22035)
  • feat(core): Instrument workers-ai-provider (#22119)
  • feat(core): Rename queryParams to urlQueryParams (#22217)
  • feat(mongodb): implement orchestrion mongodb integration (#22308)
  • feat(mongoose): implement orchestrion mongoose integration (#22202)
  • feat(node): Rewrite tedious instrumentation to orchestrion tracing channels (#22238)
  • feat(nuxt): Add _experimental.useDiagnosticsChannelInjection (#22323)
  • feat(remix): Add orchestrion-based remix instrumentation (#22244)
  • feat(replay): Allow skipping the final flush on stop() via { flush: false } (#22300)
  • feat(server-utils): Add @​opentelemetry/instrumentation-koa orchestrion integration (#22146)
  • feat(server-utils): Add orchestrion aws-sdk channel integration core (#22142)
  • feat(server-utils): Allow passing custom transforms to orchestrion (#22319)
  • feat(server-utils): Port Bedrock aws-sdk extension and add integration tests (#22166)
  • feat(server-utils): Port S3, Kinesis, DynamoDB, SecretsManager and StepFunctions aws-sdk extensions (#22164)
  • feat(server-utils): Port SQS, SNS and Lambda aws-sdk extensions with trace propagation (#22165)
  • feat(server-utils): Rewrite SentryLangChainInstrumentation to orchestrion (#22266)
  • feat(server-utils): Rewrite SentryLangGraphInstrumentation to orchestrion (#22268)
  • feat(vue): Set navigation.route.id from the route name (#22372)
  • fix(bundler): do not import type from optional peer dep (#22304)
  • fix(cloudflare): Bind Durable Object built-in handlers (#22340)
  • fix(cloudflare): Instrument custom WorkerEntrypoint RPC methods (#22310)
  • fix(cloudflare): Route DO teardown through original waitUntil (#22339)
  • fix(cloudflare): Skip spans for Cloudflare-internal Durable Object SQL queries (#22376)
  • fix(core): Prevent functionToStringIntegration from throwing on cross-origin realms (#22273)
  • fix(core): Prevent infinite recursion when console is instrumented twice (#21959)
  • fix(nextjs): Mark internal chunk frames as not in_app (#22354)
  • fix(node): Register tracer provider when OTel API global pre-exists with a different version (#22374)
  • fix(node-native): Don't drop breadcrumbs from event loop block events (#22322)
  • fix(serve-rutils): Orchestrion diagnostics for async and require (#22327)
  • fix(server-utils): Only skip loader thread (#22336)
  • fix(sveltekit): Detect SvelteKit server build via Vite Environment API (#21629)
  • fix(vercelai): Avoid double-capturing v4 tool errors in orchestrion mode (#22293)
  • fix(vue): Support pinia 4 in peer dependency range (#22324)
  • chore: Add external contributor to CHANGELOG.md (#22357)

... (truncated)

Commits
  • a88e286 release: 10.67.0
  • db27830 Merge pull request #22382 from getsentry/prepare-release/10.67.0
  • 3c20967 meta(changelog): Update changelog for 10.67.0
  • ee99468 feat(cloudflare): Auto-instrument Workers AI binding via env instrumentation ...
  • 55bd48a feat(core): Instrument workers-ai-provider (#22119)
  • c47b449 chore(ci): Use openrouter keys for claude in ci (#22381)
  • 326fbc9 fix(cloudflare): Skip spans for Cloudflare-internal Durable Object SQL querie...
  • 8e20a26 feat(vue): Set navigation.route.id from the route name (#22372)
  • e47e5d8 feat(remix): Add orchestrion-based remix instrumentation (#22244)
  • 1e26f76 feat(mongodb): implement orchestrion mongodb integration (#22308)
  • Additional commits viewable in compare view

Updates @tanstack/virtual-core from 3.17.4 to 3.17.5

Release notes

Sourced from @​tanstack/virtual-core's releases.

@​tanstack/virtual-core@​3.17.5

Patch Changes

  • #1230 1e3b908 - Clamp the tracked scrollOffset at 0 when applying end-anchor measurement compensation and when re-anchoring in setOptions. Previously, with anchorTo: 'end' and content shorter than the viewport, items measuring smaller than their estimates drove the tracked offset negative with no scroll event to ever correct it — getDistanceFromEnd() reported a permanent phantom distance and iOS deferred measurement corrections stayed wedged forever.

  • #1235 7dcfc07 - Stop iOS-deferred scroll adjustments from replaying stale deltas after the position is already correct (#1233). On iOS WebKit the end-anchored virtualizer defers scroll compensation while the scroller is live and replays it once settled, but two cases replayed a delta whose premise no longer held:

    • Absolute scroll commands (scrollToOffset / scrollToIndex / scrollToEnd) derive their target from current measurements, so a pending deferred delta is already stale — it now invalidates the deferral instead of letting it replay and shift the list off the just-established position. Relative commands (scrollBy) keep the deferral.
    • At the end clamp with anchorTo: 'end', a row above the viewport re-measuring smaller lets the browser clamp scrollTop onto the new bottom (already the correct position); the flush now drops the stale negative compensation instead of replaying it and lifting the view off the bottom. Positive deltas still replay, since content growth above does not clamp.
Changelog

Sourced from @​tanstack/virtual-core's changelog.

3.17.5

Patch Changes

  • #1230 1e3b908 - Clamp the tracked scrollOffset at 0 when applying end-anchor measurement compensation and when re-anchoring in setOptions. Previously, with anchorTo: 'end' and content shorter than the viewport, items measuring smaller than their estimates drove the tracked offset negative with no scroll event to ever correct it — getDistanceFromEnd() reported a permanent phantom distance and iOS deferred measurement corrections stayed wedged forever.

  • #1235 7dcfc07 - Stop iOS-deferred scroll adjustments from replaying stale deltas after the position is already correct (#1233). On iOS WebKit the end-anchored virtualizer defers scroll compensation while the scroller is live and replays it once settled, but two cases replayed a delta whose premise no longer held:

    • Absolute scroll commands (scrollToOffset / scrollToIndex / scrollToEnd) derive their target from current measurements, so a pending deferred delta is already stale — it now invalidates the deferral instead of letting it replay and shift the list off the just-established position. Relative commands (scrollBy) keep the deferral.
    • At the end clamp with anchorTo: 'end', a row above the viewport re-measuring smaller lets the browser clamp scrollTop onto the new bottom (already the correct position); the flush now drops the stale negative compensation instead of replaying it and lifting the view off the bottom. Positive deltas still replay, since content growth above does not clamp.
Commits
  • 87f689a ci: Version Packages (#1231)
  • ba5c47a feat(angular-virtual): add chat example and require Angular 20 (#1228)
  • 7dcfc07 fix(virtual-core): stop iOS deferred scroll adjustments from replaying stale ...
  • 1e3b908 fix(virtual-core): clamp tracked scrollOffset at 0 in end-anchor compensation...
  • See full diff in compare view

Updates astro from 7.1.1 to 7.1.3

Release notes

Sourced from astro's releases.

astro@7.1.3

Patch Changes

  • #17427 630b382 Thanks @​astrobot-houston! - Fixes image optimization during astro build using too many parallel processes in CPU-limited containers. Builds now respect the container's CPU limit, reducing peak memory usage and avoiding out-of-memory crashes.

astro@7.1.2

Patch Changes

  • #17445 a5f7230 Thanks @​ocavue! - Updates dependency cookie to v2. Cookie values made entirely of URL-safe characters are no longer percent-encoded in Set-Cookie headers; encoded values round-trip exactly as before.

  • #17402 a89c137 Thanks @​farrosfr! - Fixes a bug where mutated Astro.locals during the request lifecycle are lost and not passed to custom error pages (404.astro/500.astro)

  • #17405 91992ef Thanks @​Araluma! - Prevents an unhandled promise rejection from the prefetch fetch fallback. In WebKit (Safari), <link rel="prefetch"> is unsupported, so prefetch uses the fetch() fallback; on a flaky connection that fetch rejects with TypeError: Load failed, and because the promise was not awaited or caught, it surfaced as an unhandled rejection to the page's global error handlers. The best-effort prefetch now swallows the failure with .catch().

Changelog

Sourced from astro's changelog.

7.1.3

Patch Changes

  • #17427 630b382 Thanks @​astrobot-houston! - Fixes image optimization during astro build using too many parallel processes in CPU-limited containers. Builds now respect the container's CPU limit, reducing peak memory usage and avoiding out-of-memory crashes.

7.1.2

Patch Changes

  • #17445 a5f7230 Thanks @​ocavue! - Updates dependency cookie to v2. Cookie values made entirely of URL-safe characters are no longer percent-encoded in Set-Cookie headers; encoded values round-trip exactly as before.

  • #17402 a89c137 Thanks @​farrosfr! - Fixes a bug where mutated Astro.locals during the request lifecycle are lost and not passed to custom error pages (404.astro/500.astro)

  • #17405 91992ef Thanks @​Araluma! - Prevents an unhandled promise rejection from the prefetch fetch fallback. In WebKit (Safari), <link rel="prefetch"> is unsupported, so prefetch uses the fetch() fallback; on a flaky connection that fetch rejects with TypeError: Load failed, and because the promise was not awaited or caught, it surfaced as an unhandled rejection to the page's global error handlers. The best-effort prefetch now swallows the failure with .catch().

Commits

Updates posthog-js from 1.404.1 to 1.406.2

Release notes

Sourced from posthog-js's releases.

posthog-js@1.406.2

1.406.2

Patch Changes

  • #4206 a3112d9 Thanks @​posthog! - fix(surveys): stop recurring surveys re-showing off a stale internal targeting flag

    Recurring surveys could re-display and record a duplicate response when the eligibility check ran against a cached internal targeting flag before fresh flags had loaded. The display loop now waits for feature flags to actually load before trusting the internal targeting flag, and forces a flag reload after a survey is completed so the flag recomputes promptly. (2026-07-21)

posthog-js@1.406.1

1.406.1

Patch Changes

  • #4127 220fa2c Thanks @​sarmah-rup! - Don't let save_referrer overwrite a $referrer / $referring_domain that was explicitly set via posthog.register(), so registered attribution values survive pageviews in SPA and iframe contexts (2026-07-21)

posthog-js@1.406.0

1.406.0

Minor Changes

  • #4194 d39b903 Thanks @​dustinbyrne! - Move shared browser utility implementations into @posthog/browser-common and consume them directly from posthog-js. (2026-07-21)

Patch Changes

  • #4204 ba977d0 Thanks @​turnipdabeets! - Keep autocapture off when a remote config response omits autocapture_opt_out. The SDK now retains the last known server value for the missing-field case, the same as when the config fetch fails, instead of enabling autocapture. Values persisted by earlier SDK versions are still trusted; a browser holding a stale value corrects itself on the first config response that includes the field. (2026-07-21)
  • Updated dependencies [d39b903]:
    • @​posthog/browser-common@​0.2.0

posthog-js@1.405.3

1.405.3

Patch Changes

  • #4200 91505ba Thanks @​pauldambra! - fix: apply the active full snapshot interval as soon as a recording trigger matches (2026-07-21)

posthog-js@1.405.2

1.405.2

Patch Changes

... (truncated)

Commits
  • 4f49b55 chore: update versions and lockfile [version bump]
  • a3112d9 fix(surveys): stop recurring surveys re-showing off a stale internal targetin...
  • 975bd48 chore: update versions and lockfile [version bump]
  • 220fa2c fix: don't overwrite registered $referrer with document.referrer (#4127)
  • 9df5cc0 docs(browser): use customizations entrypoint in playgrounds (#4212)
  • 32fb42b chore: update versions and lockfile [version bump]
  • ba977d0 fix: ignore missing autocapture_opt_out in remote config instead of enabling ...
  • d39b903 refactor(browser): move shared utilities to browser-common (#4194)
  • 9c76008 chore: update versions and lockfile [version bump]
  • 91505ba fix: reschedule replay snapshots after trigger activation (#4200)
  • Additional commits viewable in compare view

Updates @tanstack/react-virtual from 3.14.6 to 3.14.7

Release notes

Sourced from @​tanstack/react-virtual's releases.

@​tanstack/react-virtual@​3.14.7

Patch Changes

Changelog

Sourced from @​tanstack/react-virtual's changelog.

3.14.7

Patch Changes

Commits

Updates react from 19.2.7 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

Commits

Updates react-dom from 19.2.7 to 19.2.8

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

Commits

Updates @aws-sdk/client-s3 from 3.1090.0 to 3.1092.0

Release notes

Sourced from @​aws-sdk/client-s3's releases.

v3.1092.0

3.1092.0(2026-07-21)

Documentation Changes
  • client-securityhub: Security Hub standard and control multicloud API documentation updates (2e19bf93)
New Features
  • client-redshift: Amazon Redshift - Added support for managing Query Editor V2 IAM Identity Center applications via new CreateQev2IdcApplication, DescribeQev2IdcApplications, ModifyQev2IdcApplication, and DeleteQev2IdcApplication API operations. (17507f23)
  • client-inspector2: GA date - July 21st 2026, remove Tags field from ListCodeSecurityIntegration and ListCodeSecurityScanConfiguration. (33a1778d)
  • client-emr-containers: Added support for the DeleteSecurityConfiguration API, which allows customers to delete security configurations in Amazon EMR on EKS. Also added authenticationConfiguration in securityConfigurationdata structure. (e344cea9)
  • client-redshift-data: update the workgroupArn to include EUSC partition, tests in THF Gamma and Prod no issue (4f372fc5)
  • client-invoicing: Added the SendProcurementPortalValidation and VerifyProcurementPortalValidation APIs. You can use the AWS SDKs to self-service activate your Procurement Portal Preferences created on the Billing Preferences page with a one-time-passcode (OTP) delivered to your portal. (35e023c0)
  • client-entityresolution: Add support for real time matching with AWS Entity Resolution matching workflows with advanced rule sets. (b92fd6c4)
  • client-ssm: Added a WarningMessage field to Automation along with corresponding public documentation. (7af6eb58)
  • client-timestream-influxdb: This release adds support for custom plugins in Amazon Timestream for InfluxDB. InfluxDB 3 Core and Enterprise DB parameter groups now accept a plugin repository URL and optional AWS Secrets Manager secret ARN, so the Processing Engine loads your Python plugins from a public or private repository. (ade4b969)
  • core/protocols: bytebuffer serializer and buffer deserializer for JSON (#8202) (f39955af)

For list of updated packages, view updated-packages.md in assets-3.1092.0.zip

v3.1091.0

3.1091.0(2026-07-20)

Documentation Changes
  • client-organizations: Updated InvalidInputException error documentation to clarify that the service validates free-text field values against common cross-site scripting (XSS) patterns. (6ac1bf08)
  • client-marketplace-metering: For new SaaS product integrations, CustomerIdentifier is not populated in ResolveCustomer responses and is not supported in BatchMeterUsage. Use CustomerAWSAccountId and LicenseArn instead. (f1ff8983)
New Features
  • client-quicksight: Adds support for custom permissions for Triggers, allowing administrators to control user access to Schedule, Inbound Email and Quick Event triggers. (fbe7d94d)
  • client-bedrock-agentcore: Add W3C trace context headers (traceparent, tracestate, baggage) and X-Amzn-Trace-Id to InvokeHarness request for end-to-end observability propagation. Add toolResultMetadata to the streaming content block delta for MCP tool result meta delivery without oversized SSE frames. (4cf22ef3)
  • client-bedrock-agentcore-control: This release adds support for specifying a connector version on Gateway targets to pin the connector's tool schema. It also introduces web-search connector version 1.2.0, which adds agent-side domain filtering, published date range filtering, and admin-side domain allowlisting. (2c37055a)
  • client-sesv2: Amazon SES introduces three new Pricing Plans (Essentials, Pro, Enterprise), which bundle SES features under one pricing umbrella. The new PutAccountPricingAttributes API lets the user set the account's plan, while current plan retrievalif done through the new PricingAttributes field on GetAccount. (751dc8df)
  • client-mediatailor: This change adds api support for configuring ad decision server timeouts and concurrency fields on MediaTailor playback configurations (97ea965e)
  • client-inspector2: Adds Windows path support for deep inspection. Fixes tag propagation for connector CloudFormation stack operations. (2263613f)
Tests
  • middleware-sdk-route53: loosen date in path assertion (#8212) (e5225182)

For list of updated packages, view updated-packages.md in assets-3.1091.0.zip

Changelog

Sourced from @​aws-sdk/client-s3's changelog.

3.1092.0 (2026-07-21)

Note: Version bump only for package @​aws-sdk/client-s3

3.1091.0 (2026-07-20)

Note: Version bump only for package @​aws-sdk/client-s3

Commits

Updates @hono/node-server from 2.0.10 to 2.0.11

Release notes

Sourced from @​hono/node-server's releases.

v2.0.11

What's Changed

Full Changelog: honojs/node-server@v2.0.10...v2.0.11

Commits

Updates @sentry/node from 10.66.0 to 10.67.0

Release notes

Sourced from @​sentry/node's releases.

10.67.0

Important Changes

  • feat(sveltekit): Add support for SvelteKit 3 (#22264)

    The SvelteKit SDK now supports the pre-release of SvelteKit 3, including client-side pageload and navigation tracing and server-side native tracing, alongside continued SvelteKit 2 support. No Sentry-specific setup changes are required. The SDK detects your SvelteKit version and picks the right implementation automatically.

Other Changes

  • feat(aws-serverless): Use orchestrion aws-sdk integration under diagnostics-channel opt-in (#22143)
  • feat(cloudflare): Auto-instrument Workers AI binding via env instrumentation (#22126)
  • feat(cloudflare): Instrument Cloudflare rate limiter bindings (#22035)
  • feat(core): Instrument workers-ai-provider (#22119)
  • feat(core): Rename queryParams to urlQueryParams (#22217)
  • feat(mongodb): implement orchestrion mongodb integration (#22308)
  • feat(mongoose): implement orchestrion mongoose integration (#22202)
  • feat(node): Rewrite tedious instrumentation to orchestrion tracing channels (#22238)
  • feat(nuxt): Add _experimental.useDiagnosticsChannelInjection (#22323)
  • feat(remix): Add orchestrion-based remix instrumentation (#22244)
  • feat(replay): Allow skipping the final flush on stop() via { flush: false } (#22300)
  • feat(server-utils): Add @​opentelemetry/instrumentation-koa orchestrion integration (#22146)
  • feat(server-utils): Add orchestrion aws-sdk channel integration core (#22142)
  • feat(server-utils): Allow passing custom transforms to orchestrion (#22319)
  • feat(server-utils): Port Bedrock aws-sdk extension and add integration tests (#22166)
  • feat(server-utils): Port S3, Kinesis, DynamoDB, SecretsManager and StepFunctions aws-sdk extensions (#22164)
  • feat(server-utils): Port SQS, SNS and Lambda aws-sdk extensions with trace propagation (#22165)
  • feat(server-utils): Rewrite SentryLangChainInstrumentation to orchestrion (#22266)
  • feat(server-utils): Rewrite SentryLangGraphInstrumentation to orchestrion (#22268)
  • feat(vue): Set navigation.route.id from the route name (#22372)
  • fix(bundler): do not import type from optional peer dep (#22304)
  • fix(cloudflare): Bind Durable Object built-in handlers (#22340)
  • fix(cloudflare): Instrument custom WorkerEntrypoint RPC methods (#22310)
  • fix(cloudflare): Route DO teardown through original waitUntil (#22339)
  • fix(cloudflare): Skip spans for Cloudflare-internal Durable Object SQL queries (#22376)
  • fix(core): Prevent functionToStringIntegration from throwing on cross-origin realms (#22273)
  • fix(core): Prevent infinite recursion when console is instrumented twice (#21959)
  • fix(nextjs): Mark internal chunk frames as not in_app (#22354)
  • fix(node): Register tracer provider when OTel API global pre-exists with a different version (#22374)
  • fix(node-native): Don't drop breadcrumbs from event loop block events (#22322)
  • fix(serve-rutils): Orchestrion diagnostics for async and require (#22327)
  • fix(server-utils): Only skip loader thread (#22336)
  • fix(sveltekit): Detect SvelteKit server build via Vite Environment API (#21629)
  • fix(vercelai): Avoid double-capturing v4 tool errors in orchestrion mode (#22293)
  • fix(vue): Support pinia 4 in peer dependency range (#22324)
  • chore: Add external contributor to CHANGELOG.md (#22357)
  • chore: Add external contributor to CHANGELOG.md (#22359)

... (truncated)

Changelog

Sourced from @​sentry/node's changelog.

10.67.0

Important Changes

  • feat(sveltekit): Add support for SvelteKit 3 (#22264)

    The SvelteKit SDK now supports the pre-release of SvelteKit 3, including client-side pageload and navigation tracing and server-side native tracing, alongside continued SvelteKit 2 support. No Sentry-specific setup changes are required. The SDK detects your SvelteKit version and picks the right implementation automatically.

Other Changes

  • feat(aws-serverless): Use orchestrion aws-sdk integration under diagnostics-channel opt-in (

@dependabot
chore(deps): bump the production-dependencies group across 1 director…
2fb1716 
…y with 17 updates

Bumps the production-dependencies group with 17 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [typescript](https://github.com/microsoft/TypeScript) | `6.0.3` | `7.0.2` |
| [@astrojs/cloudflare](https://github.com/withastro/astro/tree/HEAD/packages/integrations/cloudflare) | `14.1.3` | `14.1.4` |
| @hugeicons/core-free-icons | `4.2.2` | `4.2.3` |
| [@sentry/browser](https://github.com/getsentry/sentry-javascript) | `10.66.0` | `10.67.0` |
| [@tanstack/virtual-core](https://github.com/TanStack/virtual/tree/HEAD/packages/virtual-core) | `3.17.4` | `3.17.5` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.1.1` | `7.1.3` |
| [posthog-js](https://github.com/PostHog/posthog-js) | `1.404.1` | `1.406.2` |
| [@tanstack/react-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual) | `3.14.6` | `3.14.7` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.7` | `19.2.8` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.7` | `19.2.8` |
| [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1090.0` | `3.1092.0` |
| [@hono/node-server](https://github.com/honojs/node-server) | `2.0.10` | `2.0.11` |
| [@sentry/node](https://github.com/getsentry/sentry-javascript) | `10.66.0` | `10.67.0` |
| [add-mcp](https://github.com/neon-solutions/add-mcp) | `1.13.0` | `1.14.0` |
| [better-sqlite3](https://github.com/WiseLibs/better-sqlite3) | `12.11.1` | `13.0.1` |
| [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.45.2` | `5.46.0` |
| [@astrojs/language-server](https://github.com/withastro/astro/tree/HEAD/packages/language-tools/language-server) | `2.16.12` | `2.16.13` |



Updates `typescript` from 6.0.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/commits)

Updates `@astrojs/cloudflare` from 14.1.3 to 14.1.4
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/cloudflare/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/cloudflare@14.1.4/packages/integrations/cloudflare)

Updates `@hugeicons/core-free-icons` from 4.2.2 to 4.2.3

Updates `@sentry/browser` from 10.66.0 to 10.67.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.66.0...10.67.0)

Updates `@tanstack/virtual-core` from 3.17.4 to 3.17.5
- [Release notes](https://github.com/TanStack/virtual/releases)
- [Changelog](https://github.com/TanStack/virtual/blob/main/packages/virtual-core/CHANGELOG.md)
- [Commits](https://github.com/TanStack/virtual/commits/@tanstack/virtual-core@3.17.5/packages/virtual-core)

Updates `astro` from 7.1.1 to 7.1.3
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.1.3/packages/astro)

Updates `posthog-js` from 1.404.1 to 1.406.2
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.404.1...posthog-js@1.406.2)

Updates `@tanstack/react-virtual` from 3.14.6 to 3.14.7
- [Release notes](https://github.com/TanStack/virtual/releases)
- [Changelog](https://github.com/TanStack/virtual/blob/main/packages/react-virtual/CHANGELOG.md)
- [Commits](https://github.com/TanStack/virtual/commits/@tanstack/react-virtual@3.14.7/packages/react-virtual)

Updates `react` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react)

Updates `react-dom` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom)

Updates `@aws-sdk/client-s3` from 3.1090.0 to 3.1092.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1092.0/clients/client-s3)

Updates `@hono/node-server` from 2.0.10 to 2.0.11
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v2.0.10...v2.0.11)

Updates `@sentry/node` from 10.66.0 to 10.67.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.66.0...10.67.0)

Updates `add-mcp` from 1.13.0 to 1.14.0
- [Release notes](https://github.com/neon-solutions/add-mcp/releases)
- [Changelog](https://github.com/neon-solutions/add-mcp/blob/main/CHANGELOG.md)
- [Commits](neon-solutions/add-mcp@v1.13.0...v1.14.0)

Updates `better-sqlite3` from 12.11.1 to 13.0.1
- [Release notes](https://github.com/WiseLibs/better-sqlite3/releases)
- [Commits](WiseLibs/better-sqlite3@v12.11.1...v13.0.1)

Updates `posthog-node` from 5.45.2 to 5.46.0
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.46.0/packages/node)

Updates `@astrojs/language-server` from 2.16.12 to 2.16.13
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/language-tools/language-server/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/language-server@2.16.13/packages/language-tools/language-server)

---
updated-dependencies:
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: "@astrojs/cloudflare"
  dependency-version: 14.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@hugeicons/core-free-icons"
  dependency-version: 4.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@sentry/browser"
  dependency-version: 10.67.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@tanstack/virtual-core"
  dependency-version: 3.17.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: astro
  dependency-version: 7.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: posthog-js
  dependency-version: 1.406.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@tanstack/react-virtual"
  dependency-version: 3.14.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: react
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: react-dom
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@aws-sdk/client-s3"
  dependency-version: 3.1092.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@hono/node-server"
  dependency-version: 2.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@sentry/node"
  dependency-version: 10.67.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: add-mcp
  dependency-version: 1.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: better-sqlite3
  dependency-version: 13.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: posthog-node
  dependency-version: 5.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@astrojs/language-server"
  dependency-version: 2.16.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 22, 2026
@greptile-apps

greptile-apps Bot commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

PR author is in the excluded authors list.

@socket-security

socket-security Bot commented Jul 22, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addedposthog-js@​1.406.26610081100100
Addedastro@​7.1.3661008798100
Added@​tanstack/​react-virtual@​3.14.71001006897100
Addedposthog-node@​5.46.07210079100100
Added@​tanstack/​virtual-core@​3.17.5991007397100
Addedadd-mcp@​1.14.07610010096100
Added@​sentry/​browser@​10.67.0791009196100
Added@​astrojs/​language-server@​2.16.13981008095100
Added@​astrojs/​cloudflare@​14.1.41001008497100
Addedreact@​19.2.81001008497100
Addedreact-dom@​19.2.81001009298100
Addedbetter-sqlite3@​13.0.19910010092100
Added@​hugeicons/​core-free-icons@​4.2.310010010094100
Added@​sentry/​node@​10.67.0981009596100
Added@​hono/​node-server@​2.0.119810010096100
Added@​aws-sdk/​client-s3@​3.1092.09910010098100

View full report

@socket-security

socket-security Bot commented Jul 22, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm @sentry/node-core is 62.0% likely obfuscated

Confidence: 0.62

Location: Package overview

From: pnpm-lock.yaml → npm/@sentry/node@10.67.0 → npm/@sentry/node-core@10.67.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@sentry/node-core@10.67.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm astro is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: apps/catalog/package.json → npm/astro@7.1.3

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/astro@7.1.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@dependabot @github

dependabot Bot commented on behalf of github Jul 22, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Jul 22, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-5585177427 branch July 22, 2026 13:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants