Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 11 updates - #240

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-7fc424390a
Closed

chore(deps): bump the production-dependencies group across 1 directory with 11 updates#240
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-7fc424390a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 11 updates in the / directory:

Package From To
typescript 6.0.3 7.0.2
@tanstack/virtual-core 3.17.5 3.17.6
posthog-js 1.405.3 1.406.2
@tanstack/react-virtual 3.14.7 3.14.8
react 19.2.7 19.2.8
react-dom 19.2.7 19.2.8
shadcn 4.13.1 4.14.0
@aws-sdk/client-s3 3.1091.0 3.1092.0
add-mcp 1.13.0 1.14.0
better-sqlite3 12.11.1 13.0.1
@astrojs/language-server 2.16.12 2.16.13

Updates typescript from 6.0.3 to 7.0.2

Commits
Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.


Updates @tanstack/virtual-core from 3.17.5 to 3.17.6

Release notes

Sourced from @​tanstack/virtual-core's releases.

@​tanstack/virtual-core@​3.17.6

Patch Changes

  • #1236 7ae32b5 - Stop the default scroll-adjustment heuristic from drifting the viewport when a viewport-spanning item grows. Previously any item whose top sat above the fold (itemStart < scrollOffset) had its size delta compensated on every re-measure — including a streaming chat message that spans the fold and grows at its bottom, dragging scrollTop downward token by token (#1218). Re-measurements now only compensate items that are entirely above the fold (itemStart + itemSize <= scrollOffset); growth below the anchor point leaves the scroll position untouched. First measurements (estimate→actual) still compensate any above-fold item, and a custom shouldAdjustScrollPositionOnItemSizeChange still overrides the default.
Changelog

Sourced from @​tanstack/virtual-core's changelog.

3.17.6

Patch Changes

  • #1236 7ae32b5 - Stop the default scroll-adjustment heuristic from drifting the viewport when a viewport-spanning item grows. Previously any item whose top sat above the fold (itemStart < scrollOffset) had its size delta compensated on every re-measure — including a streaming chat message that spans the fold and grows at its bottom, dragging scrollTop downward token by token (#1218). Re-measurements now only compensate items that are entirely above the fold (itemStart + itemSize <= scrollOffset); growth below the anchor point leaves the scroll position untouched. First measurements (estimate→actual) still compensate any above-fold item, and a custom shouldAdjustScrollPositionOnItemSizeChange still overrides the default.
Commits
  • 32b2f2b ci: Version Packages (#1238)
  • ef6e92a docs(virtual-core): clarify shouldAdjustScrollPositionOnItemSizeChange usage ...
  • 7ae32b5 fix(virtual-core): stop viewport-spanning item growth from drifting scroll (#...
  • See full diff in compare view

Updates posthog-js from 1.405.3 to 1.406.2

Release notes

Sourced from posthog-js's releases.

posthog-js@1.406.2

1.406.2

Patch Changes

  • #4206 a3112d9 Thanks @​posthog! - fix(surveys): stop recurring surveys re-showing off a stale internal targeting flag

    Recurring surveys could re-display and record a duplicate response when the eligibility check ran against a cached internal targeting flag before fresh flags had loaded. The display loop now waits for feature flags to actually load before trusting the internal targeting flag, and forces a flag reload after a survey is completed so the flag recomputes promptly. (2026-07-21)

posthog-js@1.406.1

1.406.1

Patch Changes

  • #4127 220fa2c Thanks @​sarmah-rup! - Don't let save_referrer overwrite a $referrer / $referring_domain that was explicitly set via posthog.register(), so registered attribution values survive pageviews in SPA and iframe contexts (2026-07-21)

posthog-js@1.406.0

1.406.0

Minor Changes

  • #4194 d39b903 Thanks @​dustinbyrne! - Move shared browser utility implementations into @posthog/browser-common and consume them directly from posthog-js. (2026-07-21)

Patch Changes

  • #4204 ba977d0 Thanks @​turnipdabeets! - Keep autocapture off when a remote config response omits autocapture_opt_out. The SDK now retains the last known server value for the missing-field case, the same as when the config fetch fails, instead of enabling autocapture. Values persisted by earlier SDK versions are still trusted; a browser holding a stale value corrects itself on the first config response that includes the field. (2026-07-21)
  • Updated dependencies [d39b903]:
    • @​posthog/browser-common@​0.2.0
Commits
  • 4f49b55 chore: update versions and lockfile [version bump]
  • a3112d9 fix(surveys): stop recurring surveys re-showing off a stale internal targetin...
  • 975bd48 chore: update versions and lockfile [version bump]
  • 220fa2c fix: don't overwrite registered $referrer with document.referrer (#4127)
  • 9df5cc0 docs(browser): use customizations entrypoint in playgrounds (#4212)
  • 32fb42b chore: update versions and lockfile [version bump]
  • ba977d0 fix: ignore missing autocapture_opt_out in remote config instead of enabling ...
  • d39b903 refactor(browser): move shared utilities to browser-common (#4194)
  • See full diff in compare view

Updates @tanstack/react-virtual from 3.14.7 to 3.14.8

Release notes

Sourced from @​tanstack/react-virtual's releases.

@​tanstack/react-virtual@​3.14.8

Patch Changes

  • #1237 aa536e7 - Fix a gap at the top of the list after an end-anchored prepend in directDomUpdates mode. The prepend grows the total size and bumps scrollOffset to the new bottom in the same pass, but the size container's height was written after _willUpdate synced the scroll position — so the browser clamped the scrollTop write to the stale (shorter) scrollHeight, leaving whitespace at the top until the next scroll. The container is now grown before the scroll sync. Only affected directDomUpdates mode (React-rendered sizers receive their height during render).

  • Updated dependencies [7ae32b5]:

    • @​tanstack/virtual-core@​3.17.6
Changelog

Sourced from @​tanstack/react-virtual's changelog.

3.14.8

Patch Changes

  • #1237 aa536e7 - Fix a gap at the top of the list after an end-anchored prepend in directDomUpdates mode. The prepend grows the total size and bumps scrollOffset to the new bottom in the same pass, but the size container's height was written after _willUpdate synced the scroll position — so the browser clamped the scrollTop write to the stale (shorter) scrollHeight, leaving whitespace at the top until the next scroll. The container is now grown before the scroll sync. Only affected directDomUpdates mode (React-rendered sizers receive their height during render).

  • Updated dependencies [7ae32b5]:

    • @​tanstack/virtual-core@​3.17.6
Commits
  • 32b2f2b ci: Version Packages (#1238)
  • aa536e7 fix(react-virtual): grow size container before scroll sync on end-anchored pr...
  • See full diff in compare view

Updates react from 19.2.7 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

Commits

Updates react-dom from 19.2.7 to 19.2.8

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

Commits

Updates shadcn from 4.13.1 to 4.14.0

Release notes

Sourced from shadcn's releases.

shadcn@4.14.0

Minor Changes

Changelog

Sourced from shadcn's changelog.

4.14.0

Minor Changes

Commits

Updates @aws-sdk/client-s3 from 3.1091.0 to 3.1092.0

Release notes

Sourced from @​aws-sdk/client-s3's releases.

v3.1092.0

3.1092.0(2026-07-21)

Documentation Changes
  • client-securityhub: Security Hub standard and control multicloud API documentation updates (2e19bf93)
New Features
  • client-redshift: Amazon Redshift - Added support for managing Query Editor V2 IAM Identity Center applications via new CreateQev2IdcApplication, DescribeQev2IdcApplications, ModifyQev2IdcApplication, and DeleteQev2IdcApplication API operations. (17507f23)
  • client-inspector2: GA date - July 21st 2026, remove Tags field from ListCodeSecurityIntegration and ListCodeSecurityScanConfiguration. (33a1778d)
  • client-emr-containers: Added support for the DeleteSecurityConfiguration API, which allows customers to delete security configurations in Amazon EMR on EKS. Also added authenticationConfiguration in securityConfigurationdata structure. (e344cea9)
  • client-redshift-data: update the workgroupArn to include EUSC partition, tests in THF Gamma and Prod no issue (4f372fc5)
  • client-invoicing: Added the SendProcurementPortalValidation and VerifyProcurementPortalValidation APIs. You can use the AWS SDKs to self-service activate your Procurement Portal Preferences created on the Billing Preferences page with a one-time-passcode (OTP) delivered to your portal. (35e023c0)
  • client-entityresolution: Add support for real time matching with AWS Entity Resolution matching workflows with advanced rule sets. (b92fd6c4)
  • client-ssm: Added a WarningMessage field to Automation along with corresponding public documentation. (7af6eb58)
  • client-timestream-influxdb: This release adds support for custom plugins in Amazon Timestream for InfluxDB. InfluxDB 3 Core and Enterprise DB parameter groups now accept a plugin repository URL and optional AWS Secrets Manager secret ARN, so the Processing Engine loads your Python plugins from a public or private repository. (ade4b969)
  • core/protocols: bytebuffer serializer and buffer deserializer for JSON (#8202) (f39955af)

For list of updated packages, view updated-packages.md in assets-3.1092.0.zip

Changelog

Sourced from @​aws-sdk/client-s3's changelog.

3.1092.0 (2026-07-21)

Note: Version bump only for package @​aws-sdk/client-s3

Commits

Updates add-mcp from 1.13.0 to 1.14.0

Release notes

Sourced from add-mcp's releases.

v1.14.0

What's Changed

  • move the default find / search registry to its new home at https://add-mcp.com/registry/api/v1/servers (label: "add-mcp registry"). The previous mcp.agent-tooling.dev URL keeps working; saved configs referencing it are migrated automatically on the next find / search run (custom labels are preserved, duplicates are deduped).

Full Changelog: neon-solutions/add-mcp@v1.13.3...v1.14.0

v1.13.3

  • show registry result install targets, such as remote MCP URLs or package names, instead of reverse-domain registry IDs in find / search selection rows.

v1.13.2

  • make find / search default to the integrations.sh registry on first run instead of prompting for an initial registry selection.

v1.13.1

  • expand the find / search registry from integrations.sh data and update registry messaging to point maintainers to integrations.sh.
Changelog

Sourced from add-mcp's changelog.

[1.14.0] - 2026-07-06

  • move the default find / search registry to its new home at https://add-mcp.com/registry/api/v1/servers (label: "add-mcp registry"). The previous mcp.agent-tooling.dev URL keeps working; saved configs referencing it are migrated automatically on the next find / search run (custom labels are preserved, duplicates are deduped).

[1.13.3] - 2026-07-06

  • show registry result install targets, such as remote MCP URLs or package names, instead of reverse-domain registry IDs in find / search selection rows.

[1.13.2] - 2026-07-06

  • make find / search default to the integrations.sh registry on first run instead of prompting for an initial registry selection.

[1.13.1] - 2026-07-05

  • expand the find / search registry from integrations.sh data and update registry messaging to point maintainers to integrations.sh.
Commits
  • 75bf1a5 Move default find registry to add-mcp.com/registry with auto-migration (#69)
  • efac078 Add add-mcp.com website: landing page + docs (Blume), /registry proxy (#68)
  • 7009543 Show install targets in find results (#67)
  • 47d7a6a default find to integrations registry (#66)
  • 055c54e chore: release v1.13.1
  • 557cd1a [codex] move integrations registry data into add-mcp (#65)
  • See full diff in compare view

Updates better-sqlite3 from 12.11.1 to 13.0.1

Release notes

Sourced from better-sqlite3's releases.

v13.0.1

Full Changelog: WiseLibs/better-sqlite3@v13.0.0...v13.0.1

Fixed a regression in parameter binding where it would be overly strict and reject plain objects from other realms (e.g., in jest tests).

v13.0.0

Version 13.0.0 marks a major milestone, as it's the first version of better-sqlite3 to run on the N-API. This means prebuilt binaries should theoretically work across different versions of Node.js and Electron, and perhaps even other runtimes like Bun. As a result, we've removed the deprecated prebuild-install dependency, and now prebuilt binaries are published directly with the better-sqlite3 code itself. If your platform/architecture doesn't have a prebuilt binary, it should compile during install as before.

What's Changed

New Contributors

Full Changelog: WiseLibs/better-sqlite3@v12.12.0...v13.0.0

v12.12.0

What's Changed

[!WARNING]

BREAKING: Starting with Electron v43, binary assets will require glibc 2.41 or higher on Linux hosts.

Full Changelog: WiseLibs/better-sqlite3@v12.11.2...v12.12.0

v12.11.2

What's Changed

Full Changelog: WiseLibs/better-sqlite3@v12.11.1...v12.11.2

Commits
  • 6efdbc5 13.0.1
  • 32ee0ab Merge remote-tracking branch 'origin/master'
  • bce8300 fixed overly strict regression in parameter binding
  • ecfe2f7 13.0.0
  • ae19080 fixed typos
  • 57d4bbb implemented Database#explain()
  • 49fd7e6 added docs for Statement#toString()
  • 1cb18ec implemented Statement#toString()
  • af60f6b updated github workflow dep versions
  • 6ffd750 fixed tests for SqliteError
  • Additional commits viewable in compare view
Install script changes

This version modifies install script that runs during installation. Review the package contents before updating.


Updates @astrojs/language-server from 2.16.12 to 2.16.13

Release notes

Sourced from @​astrojs/language-server's releases.

@​astrojs/language-server@​2.16.13

Patch Changes

Changelog

Sourced from @​astrojs/language-server's changelog.

2.16.13

Patch Changes

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the production-dependencies group across 1 director…
90bba4f 
…y with 11 updates

Bumps the production-dependencies group with 11 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [typescript](https://github.com/microsoft/TypeScript) | `6.0.3` | `7.0.2` |
| [@tanstack/virtual-core](https://github.com/TanStack/virtual/tree/HEAD/packages/virtual-core) | `3.17.5` | `3.17.6` |
| [posthog-js](https://github.com/PostHog/posthog-js) | `1.405.3` | `1.406.2` |
| [@tanstack/react-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual) | `3.14.7` | `3.14.8` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.7` | `19.2.8` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.7` | `19.2.8` |
| [shadcn](https://github.com/shadcn-ui/ui/tree/HEAD/packages/shadcn) | `4.13.1` | `4.14.0` |
| [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1091.0` | `3.1092.0` |
| [add-mcp](https://github.com/neon-solutions/add-mcp) | `1.13.0` | `1.14.0` |
| [better-sqlite3](https://github.com/WiseLibs/better-sqlite3) | `12.11.1` | `13.0.1` |
| [@astrojs/language-server](https://github.com/withastro/astro/tree/HEAD/packages/language-tools/language-server) | `2.16.12` | `2.16.13` |



Updates `typescript` from 6.0.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/commits)

Updates `@tanstack/virtual-core` from 3.17.5 to 3.17.6
- [Release notes](https://github.com/TanStack/virtual/releases)
- [Changelog](https://github.com/TanStack/virtual/blob/main/packages/virtual-core/CHANGELOG.md)
- [Commits](https://github.com/TanStack/virtual/commits/@tanstack/virtual-core@3.17.6/packages/virtual-core)

Updates `posthog-js` from 1.405.3 to 1.406.2
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.405.3...posthog-js@1.406.2)

Updates `@tanstack/react-virtual` from 3.14.7 to 3.14.8
- [Release notes](https://github.com/TanStack/virtual/releases)
- [Changelog](https://github.com/TanStack/virtual/blob/main/packages/react-virtual/CHANGELOG.md)
- [Commits](https://github.com/TanStack/virtual/commits/@tanstack/react-virtual@3.14.8/packages/react-virtual)

Updates `react` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react)

Updates `react-dom` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom)

Updates `shadcn` from 4.13.1 to 4.14.0
- [Release notes](https://github.com/shadcn-ui/ui/releases)
- [Changelog](https://github.com/shadcn-ui/ui/blob/main/packages/shadcn/CHANGELOG.md)
- [Commits](https://github.com/shadcn-ui/ui/commits/shadcn@4.14.0/packages/shadcn)

Updates `@aws-sdk/client-s3` from 3.1091.0 to 3.1092.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1092.0/clients/client-s3)

Updates `add-mcp` from 1.13.0 to 1.14.0
- [Release notes](https://github.com/neon-solutions/add-mcp/releases)
- [Changelog](https://github.com/neon-solutions/add-mcp/blob/main/CHANGELOG.md)
- [Commits](neon-solutions/add-mcp@v1.13.0...v1.14.0)

Updates `better-sqlite3` from 12.11.1 to 13.0.1
- [Release notes](https://github.com/WiseLibs/better-sqlite3/releases)
- [Commits](WiseLibs/better-sqlite3@v12.11.1...v13.0.1)

Updates `@astrojs/language-server` from 2.16.12 to 2.16.13
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/language-tools/language-server/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/language-server@2.16.13/packages/language-tools/language-server)

---
updated-dependencies:
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: "@tanstack/virtual-core"
  dependency-version: 3.17.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: posthog-js
  dependency-version: 1.406.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@tanstack/react-virtual"
  dependency-version: 3.14.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: react
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: react-dom
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: shadcn
  dependency-version: 4.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@aws-sdk/client-s3"
  dependency-version: 3.1092.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: add-mcp
  dependency-version: 1.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: better-sqlite3
  dependency-version: 13.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: "@astrojs/language-server"
  dependency-version: 2.16.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 22, 2026
@greptile-apps

greptile-apps Bot commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

PR author is in the excluded authors list.

@socket-security

socket-security Bot commented Jul 22, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addedposthog-js@​1.406.26610081100100
Added@​tanstack/​react-virtual@​3.14.81001006897100
Addedadd-mcp@​1.14.07610010096100
Added@​astrojs/​language-server@​2.16.13981008095100
Addedreact@​19.2.81001008497100
Addedshadcn@​4.14.0981009197100
Addedreact-dom@​19.2.81001009298100
Addedbetter-sqlite3@​13.0.19910010092100
Added@​aws-sdk/​client-s3@​3.1092.09910010098100
Added@​tanstack/​virtual-core@​3.17.6100100100100100

View full report

@dependabot @github

dependabot Bot commented on behalf of github Jul 24, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Jul 24, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-7fc424390a branch July 24, 2026 10:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants