Skip to content

chore(deps): bump the minor-and-patch group with 25 updates#33

Closed
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/minor-and-patch-0006c2cd80
Closed

chore(deps): bump the minor-and-patch group with 25 updates#33
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/minor-and-patch-0006c2cd80

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot Bot commented on behalf of github Apr 9, 2026

Bumps the minor-and-patch group with 25 updates:

Package From To
isomorphic-dompurify 3.0.0 3.8.0
prettier-plugin-tailwindcss 0.6.14 0.7.2
turbo 2.8.0 2.9.5
@auth/prisma-adapter 2.7.0 2.11.1
@tanstack/react-query 5.90.20 5.96.2
geist 1.5.1 1.7.0
immer 11.1.3 11.1.4
jspdf 4.2.0 4.2.1
nanoid 5.1.6 5.1.7
next-intl 4.8.3 4.9.0
puppeteer-core 24.37.5 24.40.0
react 19.2.4 19.2.5
@types/react 19.2.10 19.2.14
react-day-picker 9.13.0 9.14.0
react-dom 19.2.4 19.2.5
react-hook-form 7.71.1 7.72.1
resend 6.9.1 6.10.0
sanitize-html 2.17.1 2.17.2
zustand 5.0.10 5.0.12
@playwright/test 1.58.0 1.59.1
@prisma/nextjs-monorepo-workaround-plugin 7.3.0 7.7.0
@typescript-eslint/eslint-plugin 8.54.0 8.58.1
@typescript-eslint/parser 8.54.0 8.58.1
autoprefixer 10.4.23 10.4.27
postcss 8.5.6 8.5.9

Updates isomorphic-dompurify from 3.0.0 to 3.8.0

Release notes

Sourced from isomorphic-dompurify's releases.

3.8.0: Updated dependencies

Dependency updates:

  • bump jsdom from 29.0.1 to 29.0.2
  • bump @​biomejs/biome from 2.4.8 to 2.4.10
  • bump vitest from 4.1.1 to 4.1.3
  • bump lefthook from 2.1.4 to 2.1.5

3.7.1

Bug Fix

  • Fixed missing browser type declarations — browser.d.ts and browser.d.mts were not included in the 3.7.0 published package due to a race condition in the build process. This caused TS7016: Could not find a declaration file for module 'isomorphic-dompurify' errors in tsgo and TypeScript 6 when resolving through the default (browser) exports condition. (#411)

Thanks to @​asterikx and @​ElPrudi for their help with the issue.

3.7.0: TypeScript 6 compatibility

TypeScript 6 compatibility fixes:

  • Add explicit type annotation for sanitize to satisfy TS6
  • Silence baseUrl deprecation warning from tsup dts build in TS6

Dependency updates:

  • bump typescript from 5.9.3 to 6.0.2
  • bump vitest from 4.1.0 to 4.1.1

3.6.0: Updated dependencies

Dependency updates:

  • bump jsdom from 29.0.0 to 29.0.1
  • bump @​types/jsdom from 28.0.0 to 28.0.1
  • bump @​biomejs/biome from 2.4.7 to 2.4.8

3.5.1

Fix outdated build artifacts published in 3.5.0.

3.5.0: Add factory function support

What's new

Features

  • The default export is now callable as a factory function, matching the dompurify API — DOMPurify(window) now returns a new DOMPurify instance bound to the given window (#405)

Bug fixes

  • Fixed isEqualNode returning false when comparing RETURN_DOM + FORCE_BODY output against nodes from a separate JSDOM context (#405)

Thanks to @​probablykasper for helping with this release.

3.4.0: jsdom update, performance improvement and node 22 requirement update

What's Changed

  • Upgraded jsdom from 28 to 29, which fixes performance degradation in long-running processes; note that heap memory still grows over time without calling clearWindow()
  • Bumped minimum Node.js 22 requirement from 22.12.0 to 22.13.0 (LTS)
  • Added format script (biome format --write) and pre-commit hook
  • Updated dev dependencies (biome, vitest)

... (truncated)

Commits
  • 40c0ced chore(release): bump version to 3.8.0 and update dep ranges
  • 1493745 chore(deps): bump jsdom from 29.0.1 to 29.0.2
  • 772dbc8 chore(deps-dev): bump vitest from 4.1.2 to 4.1.3
  • 5c426c9 chore(deps-dev): bump lefthook from 2.1.4 to 2.1.5
  • 9532ef7 chore(deps-dev): bump @​biomejs/biome from 2.4.9 to 2.4.10
  • eff4ba9 chore(deps-dev): bump vitest from 4.1.1 to 4.1.2
  • 62e619d chore(deps-dev): bump @​biomejs/biome from 2.4.8 to 2.4.9
  • 11315f4 chore: Bumped project version.
  • 97770c7 fix: prevent race condition dropping browser type declarations
  • 8a06c60 chore: Incremented project version.
  • Additional commits viewable in compare view

Updates prettier-plugin-tailwindcss from 0.6.14 to 0.7.2

Release notes

Sourced from prettier-plugin-tailwindcss's releases.

v0.7.2

Fixed

  • Load compatible plugins sequentially to work around race conditions in Node.js (#412)
  • Fix compatibility with prettier-plugin-svelte when using Prettier v3.7+ (#418)

v0.7.1

Fixed

  • Match against correct name of dynamic attributes when using regexes (#410)

v0.7.0

Added

  • Format quotes in @source, @plugin, and @config (#387)
  • Sort in function calls in Twig (#358)
  • Sort in callable template literals (#367)
  • Sort in function calls mixed with property accesses (#367)
  • Support regular expression patterns for attributes (#405)
  • Support regular expression patterns for function names (#405)

Changed

  • Improved monorepo support by loading Tailwind CSS relative to the input file instead of prettier config file (#386)
  • Improved monorepo support by loading v3 configs relative to the input file instead of prettier config file (#386)
  • Fallback to Tailwind CSS v4 instead of v3 by default (#390)
  • Don't augment global Prettier ParserOptions and RequiredOptions types (#354)
  • Drop support for prettier-plugin-import-sort (#385)

Fixed

  • Handle quote escapes in LESS when sorting @apply (#392)
  • Fix whitespace removal inside nested concat and template expressions (#396)
Changelog

Sourced from prettier-plugin-tailwindcss's changelog.

[0.7.2] - 2025-12-01

Fixed

  • Load compatible plugins sequentially to work around race conditions in Node.js (#412)
  • Fix compatibility with prettier-plugin-svelte when using Prettier v3.7+ (#418)

[0.7.1] - 2025-10-17

Fixed

  • Match against correct name of dynamic attributes when using regexes (#410)

[0.7.0] - 2025-10-14

Added

  • Format quotes in @source, @plugin, and @config (#387)
  • Sort in function calls in Twig (#358)
  • Sort in callable template literals (#367)
  • Sort in function calls mixed with property accesses (#367)
  • Support regular expression patterns for attributes (#405)
  • Support regular expression patterns for function names (#405)

Changed

  • Improved monorepo support by loading Tailwind CSS relative to the input file instead of prettier config file (#386)
  • Improved monorepo support by loading v3 configs relative to the input file instead of prettier config file (#386)
  • Fallback to Tailwind CSS v4 instead of v3 by default (#390)
  • Don't augment global Prettier ParserOptions and RequiredOptions types (#354)
  • Drop support for prettier-plugin-import-sort (#385)

Fixed

  • Handle quote escapes in LESS when sorting @apply (#392)
  • Fix whitespace removal inside nested concat and template expressions (#396)
Commits

Updates turbo from 2.8.0 to 2.9.5

Release notes

Sourced from turbo's releases.

Turborepo v2.9.5

What's Changed

create-turbo

@​turbo/telemetry

Changelog

New Contributors

Full Changelog: vercel/turborepo@v2.9.4...v2.9.5

Turborepo v2.9.5-canary.5

Full Changelog: vercel/turborepo@v2.9.5-canary.4...v2.9.5-canary.5

Turborepo v2.9.5-canary.4

What's Changed

Changelog

Full Changelog: vercel/turborepo@v2.9.5-canary.3...v2.9.5-canary.4

Turborepo v2.9.5-canary.3

What's Changed

Changelog

Full Changelog: vercel/turborepo@v2.9.5-canary.2...v2.9.5-canary.3

Turborepo v2.9.5-canary.2

... (truncated)

Commits
  • 3d264b1 publish 2.9.5 to registry
  • ecb1040 fix: Suppress telemetry alert when running on Vercel (#12576)
  • f0e18d2 release(turborepo): 2.9.5-canary.5 (#12574)
  • 1403c9e fix: Normalize CRLF line endings in file hashing to match git (#12572)
  • 53eb059 release(turborepo): 2.9.5-canary.4 (#12571)
  • 7830df4 perf: Parallelize boundaries checking with Rayon and cache DFS traversals (...
  • 0387bad release(turborepo): 2.9.5-canary.3 (#12570)
  • 374f7a7 perf: Increase remote cache upload chunk size from 8KB to 256KB (#12568)
  • 217d486 feat: Add circular package dependency detection to boundaries (#12567)
  • 8479f02 release(turborepo): 2.9.5-canary.2 (#12566)
  • Additional commits viewable in compare view

Updates @auth/prisma-adapter from 2.7.0 to 2.11.1

Release notes

Sourced from @​auth/prisma-adapter's releases.

@​auth/prisma-adapter@​2.11.1

Other

  • @​auth/core: dependency update (8f3b2c7a)

@​auth/prisma-adapter@​2.11.0

Other

  • @​auth/core: dependency update (745751e9)

@​auth/prisma-adapter@​2.10.0

Bugfixes

  • adapters: handle P2025 errors without importing Prisma namespace (#13061) (9866f71f)

@​auth/prisma-adapter@​2.9.1

Bugfixes

  • adapter-prisma: import PrismaClientKnownRequestError for edge runtime compatibility (#12755) (c7409f3f)
Commits
Maintainer changes

This version was pushed to npm by bekacru, a new releaser for @​auth/prisma-adapter since your current version.


Updates @tanstack/react-query from 5.90.20 to 5.96.2

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.96.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.96.2
    • @​tanstack/react-query@​5.96.2

@​tanstack/react-query-next-experimental@​5.96.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.96.2

@​tanstack/react-query-persist-client@​5.96.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-persist-client-core@​5.96.2
    • @​tanstack/react-query@​5.96.2

@​tanstack/react-query@​5.96.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.96.2

@​tanstack/react-query-devtools@​5.96.1

Patch Changes

  • fix(build): exclude config files from production DTS rollup to prevent @types/node type pollution (#10358)

  • Updated dependencies []:

    • @​tanstack/query-devtools@​5.96.1
    • @​tanstack/react-query@​5.96.1

@​tanstack/react-query-next-experimental@​5.96.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.96.1

@​tanstack/react-query-persist-client@​5.96.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-persist-client-core@​5.96.1
    • @​tanstack/react-query@​5.96.1

@​tanstack/react-query@​5.96.1

Patch Changes

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.96.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.96.2

5.96.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.96.1

5.96.0

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.96.0

5.95.2

Patch Changes

  • Updated dependencies [cd5a35b]:
    • @​tanstack/query-core@​5.95.2

5.95.1

Patch Changes

  • Updated dependencies [1f1775c]:
    • @​tanstack/query-core@​5.95.1

5.95.0

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.95.0

5.94.5

Patch Changes

  • fix(*): resolve issue about excluded build directory (#10312)

  • Updated dependencies [4b6536d]:

    • @​tanstack/query-core@​5.94.5

... (truncated)

Commits
  • 5ca721f ci: Version Packages (#10379)
  • 75052a7 ci: Version Packages (#10370)
  • 73e783b ci: Version Packages (#10364)
  • 14a97b7 test(react-query): replace 'import React' with 'import * as React' in 'usePre...
  • fd8c068 test({react,preact}-query/useSuspenseQueries): merge redundant second 'descri...
  • f168555 test({react,preact,solid}-query): move 'queryClient' and 'queryCache' to 'bef...
  • afb5812 test({react,preact}-query/useSuspenseQueries): inline test helpers, remove sh...
  • 9e1bb94 test(react-query/useSuspenseQueries): remove unnecessary 'act' wrapper from b...
  • 55cee0a test({react,preact}-query/useSuspenseQueries): add test for not suspending bu...
  • 7fc6e6a test({react,preact}-query/useSuspenseQueries): add test for not suspending bu...
  • Additional commits viewable in compare view

Updates geist from 1.5.1 to 1.7.0

Release notes

Sourced from geist's releases.

geist@1.7.0

We're excited to announce a new member to our font family: Geist Pixel

It's a display typeface family featuring five unique pixel-based variants, each with a distinct visual style. It is designed for decorative use in headlines, logos, and other display contexts where a pixelated aesthetic is desired.

It includes five distinct variants, each exported separately:

Export CSS Variable Description
GeistPixelSquare --font-geist-pixel-square Square pixel shapes
GeistPixelGrid --font-geist-pixel-grid Grid-based pixel pattern
GeistPixelCircle --font-geist-pixel-circle Circular pixel shapes
GeistPixelTriangle --font-geist-pixel-triangle Triangular pixel shapes
GeistPixelLine --font-geist-pixel-line Line-based pixel pattern 
import {
  GeistPixelSquare,
  GeistPixelGrid,
  GeistPixelCircle,
  GeistPixelTriangle,
  GeistPixelLine,
} from "geist/font/pixel";
Changelog

Sourced from geist's changelog.

1.7.0

Minor Changes

  • d7ef63c: We're excited to announce a new member to our font family: Geist Pixel

    It's a display typeface family featuring five unique pixel-based variants, each with a distinct visual style. It is designed for decorative use in headlines, logos, and other display contexts where a pixelated aesthetic is desired.

    It includes five distinct variants, each exported separately:

    Export CSS Variable Description
    GeistPixelSquare --font-geist-pixel-square Square pixel shapes
    GeistPixelGrid --font-geist-pixel-grid Grid-based pixel pattern
    GeistPixelCircle --font-geist-pixel-circle Circular pixel shapes
    GeistPixelTriangle --font-geist-pixel-triangle Triangular pixel shapes
    GeistPixelLine --font-geist-pixel-line Line-based pixel pattern 
    import {
  GeistPixelSquare,
  GeistPixelGrid,
  GeistPixelCircle,
  GeistPixelTriangle,
  GeistPixelLine,
} from "geist/font/pixel";
Commits
Maintainer changes

This version was pushed to npm by vercel-release-bot, a new releaser for geist since your current version.


Updates immer from 11.1.3 to 11.1.4

Release notes

Sourced from immer's releases.

v11.1.4

11.1.4 (2026-02-10)

Bug Fixes

  • handle nested proxies after spreading and inserting into an array (90a7765)
Commits
  • cdccf1a Merge pull request #1210 from immerjs/bugfix/1209-array-plugin-nested-drafts
  • 90a7765 fix: handle nested proxies after spreading and inserting into an array
  • See full diff in compare view

Updates jspdf from 4.2.0 to 4.2.1

Release notes

Sourced from jspdf's releases.

v4.2.1

This release fixes two security issues.

What's Changed

Full Changelog: parallax/jsPDF@v4.2.0...v4.2.1

Commits

Updates nanoid from 5.1.6 to 5.1.7

Release notes

Sourced from nanoid's releases.

5.1.7

Changelog

Sourced from nanoid's changelog.

5.1.7

Commits

Updates next-intl from 4.8.3 to 4.9.0

Release notes

Sourced from next-intl's releases.

v4.9.0

4.9.0 (2026-04-01)

Features

v4.8.4

4.8.4 (2026-03-31)

Bug Fixes

Changelog

Sourced from next-intl's changelog.

4.9.0 (2026-04-01)

Features

4.8.4 (2026-03-31)

Bug Fixes

Commits
  • b65f8c4 v4.9.0
  • 02811f5 feat: Support transitionTypes on Link (#2302)
  • 722785b v4.8.4
  • 5e7bcd7 fix: Remove TypeScript peer dependency and update examples to TypeScript v6 (...
  • c9d6051 fix: Remove TypeScript peer dependency and update examples to TypeScript v6 (...
  • 5be07b6 fix: Remove TypeScript peer dependency and update examples to TypeScript v6 (...
  • 58326e7 docs: Fix typos (#2282)
  • ed19787 docs: Fix typos (#2283)
  • db51a73 docs: Fix typos in useExtracted blog post (#2279)
  • c0f494c docs: Update precompilation.mdx
  • Additional commits viewable in compare view

Updates puppeteer-core from 24.37.5 to 24.40.0

Release notes

Sourced from puppeteer-core's releases.

puppeteer-core: v24.40.0

24.40.0 (2026-03-19)

🎉 Features

  • support PUPPETEER_DANGEROUS_NO_SANDBOX environment variable (#14756) (2a8276e)

🛠️ Fixes

puppeteer-core: v24.39.1

24.39.1 (2026-03-13)

🛠️ Fixes

puppeteer-core: v24.39.0

24.39.0 (2026-03-10)

🎉 Features

🛠️ Fixes

puppeteer-core: v24.38.0

24.38.0 (2026-03-04)

🎉 Features

🛠️ Fixes

  • consider browsingContext.navigationCommitted to dispose an existing navigation (#14724) (b4e92c6)

... (truncated)

Changelog

Sourced from puppeteer-core's changelog.

24.40.0 (2026-03-19)

♻️ Chores

  • puppeteer: Synchronize puppeteer versions

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 24.39.1 to 24.40.0

🎉 Features

  • support PUPPETEER_DANGEROUS_NO_SANDBOX environment variable (#14756) (2a8276e)

🛠️ Fixes

24.39.1 (2026-03-13)

♻️ Chores

  • puppeteer: Synchronize puppeteer versions

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 24.39.0 to 24.39.1

🛠️ Fixes

24.39.0 (2026-03-10)

... (truncated)

Commits

Updates react from 19.2.4 to 19.2.5

Release notes

Sourced from react's releases.

19.2.5 (April 8th, 2026)

React Server Components

Commits

Updates @types/react from 19.2.10 to 19.2.14

Commits

Updates react-day-picker from 9.13.0 to 9.14.0

Release notes

Sourced from react-day-picker's releases.

v9.14.0

This release introduces a new resetOnSelect prop and adds support for the Hijri calendar.

Resetting Selections in Range Mode

When in range selection mode, use the new resetOnSelect prop to start a new range when a full range is already selected.

Hijri Calendar

To use the Hijri (Umm al-Qura) calendar, import DayPicker from react-day-picker/hijri:

import { DayPicker } from "react-day-picker/hijri";
export function HijriCalendar() {
return <DayPicker />;
}

Read more in the documentation and play with it in playground.

What's Changed

New Contributors

Full Changelog: gpbl/react-day-picker@v9.13.2...v9.14.0

v9.13.2

What's Changed

New Contributors

Full Changelog: gpbl/react-day-picker@v9.13.1...v9.13.2

v9.13.1

Persian calendar improvements.

What's Changed

  • feat: add narrow weekday format for Persian calendar by @​rezaaa in

@dependabot
chore(deps): bump the minor-and-patch group with 25 updates
68e0748 
Bumps the minor-and-patch group with 25 updates:

| Package | From | To |
| --- | --- | --- |
| [isomorphic-dompurify](https://github.com/kkomelin/isomorphic-dompurify) | `3.0.0` | `3.8.0` |
| [prettier-plugin-tailwindcss](https://github.com/tailwindlabs/prettier-plugin-tailwindcss) | `0.6.14` | `0.7.2` |
| [turbo](https://github.com/vercel/turborepo) | `2.8.0` | `2.9.5` |
| [@auth/prisma-adapter](https://github.com/nextauthjs/next-auth) | `2.7.0` | `2.11.1` |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.90.20` | `5.96.2` |
| [geist](https://github.com/vercel/geist-font/tree/HEAD/packages/next) | `1.5.1` | `1.7.0` |
| [immer](https://github.com/immerjs/immer) | `11.1.3` | `11.1.4` |
| [jspdf](https://github.com/parallax/jsPDF) | `4.2.0` | `4.2.1` |
| [nanoid](https://github.com/ai/nanoid) | `5.1.6` | `5.1.7` |
| [next-intl](https://github.com/amannn/next-intl) | `4.8.3` | `4.9.0` |
| [puppeteer-core](https://github.com/puppeteer/puppeteer) | `24.37.5` | `24.40.0` |
| [react](https://github.com/facebook/react/tree/HEAD/packages/react) | `19.2.4` | `19.2.5` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.10` | `19.2.14` |
| [react-day-picker](https://github.com/gpbl/react-day-picker) | `9.13.0` | `9.14.0` |
| [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) | `19.2.4` | `19.2.5` |
| [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.71.1` | `7.72.1` |
| [resend](https://github.com/resend/resend-node) | `6.9.1` | `6.10.0` |
| [sanitize-html](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html) | `2.17.1` | `2.17.2` |
| [zustand](https://github.com/pmndrs/zustand) | `5.0.10` | `5.0.12` |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.58.0` | `1.59.1` |
| [@prisma/nextjs-monorepo-workaround-plugin](https://github.com/prisma/prisma/tree/HEAD/packages/nextjs-monorepo-workaround-plugin) | `7.3.0` | `7.7.0` |
| [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.54.0` | `8.58.1` |
| [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.54.0` | `8.58.1` |
| [autoprefixer](https://github.com/postcss/autoprefixer) | `10.4.23` | `10.4.27` |
| [postcss](https://github.com/postcss/postcss) | `8.5.6` | `8.5.9` |


Updates `isomorphic-dompurify` from 3.0.0 to 3.8.0
- [Release notes](https://github.com/kkomelin/isomorphic-dompurify/releases)
- [Commits](kkomelin/isomorphic-dompurify@3.0.0...3.8.0)

Updates `prettier-plugin-tailwindcss` from 0.6.14 to 0.7.2
- [Release notes](https://github.com/tailwindlabs/prettier-plugin-tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/prettier-plugin-tailwindcss/blob/main/CHANGELOG.md)
- [Commits](tailwindlabs/prettier-plugin-tailwindcss@v0.6.14...v0.7.2)

Updates `turbo` from 2.8.0 to 2.9.5
- [Release notes](https://github.com/vercel/turborepo/releases)
- [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md)
- [Commits](vercel/turborepo@v2.8.0...v2.9.5)

Updates `@auth/prisma-adapter` from 2.7.0 to 2.11.1
- [Release notes](https://github.com/nextauthjs/next-auth/releases)
- [Commits](https://github.com/nextauthjs/next-auth/compare/@auth/prisma-adapter@2.7.0...@auth/prisma-adapter@2.11.1)

Updates `@tanstack/react-query` from 5.90.20 to 5.96.2
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.96.2/packages/react-query)

Updates `geist` from 1.5.1 to 1.7.0
- [Release notes](https://github.com/vercel/geist-font/releases)
- [Changelog](https://github.com/vercel/geist-font/blob/main/packages/next/CHANGELOG.md)
- [Commits](https://github.com/vercel/geist-font/commits/geist@1.7.0/packages/next)

Updates `immer` from 11.1.3 to 11.1.4
- [Release notes](https://github.com/immerjs/immer/releases)
- [Commits](immerjs/immer@v11.1.3...v11.1.4)

Updates `jspdf` from 4.2.0 to 4.2.1
- [Release notes](https://github.com/parallax/jsPDF/releases)
- [Changelog](https://github.com/parallax/jsPDF/blob/master/RELEASE.md)
- [Commits](parallax/jsPDF@v4.2.0...v4.2.1)

Updates `nanoid` from 5.1.6 to 5.1.7
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md)
- [Commits](ai/nanoid@5.1.6...5.1.7)

Updates `next-intl` from 4.8.3 to 4.9.0
- [Release notes](https://github.com/amannn/next-intl/releases)
- [Changelog](https://github.com/amannn/next-intl/blob/main/CHANGELOG.md)
- [Commits](amannn/next-intl@v4.8.3...v4.9.0)

Updates `puppeteer-core` from 24.37.5 to 24.40.0
- [Release notes](https://github.com/puppeteer/puppeteer/releases)
- [Changelog](https://github.com/puppeteer/puppeteer/blob/main/CHANGELOG.md)
- [Commits](puppeteer/puppeteer@puppeteer-core-v24.37.5...puppeteer-core-v24.40.0)

Updates `react` from 19.2.4 to 19.2.5
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.5/packages/react)

Updates `@types/react` from 19.2.10 to 19.2.14
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `react-day-picker` from 9.13.0 to 9.14.0
- [Release notes](https://github.com/gpbl/react-day-picker/releases)
- [Changelog](https://github.com/gpbl/react-day-picker/blob/main/CHANGELOG.md)
- [Commits](gpbl/react-day-picker@v9.13.0...v9.14.0)

Updates `react-dom` from 19.2.4 to 19.2.5
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.5/packages/react-dom)

Updates `react-hook-form` from 7.71.1 to 7.72.1
- [Release notes](https://github.com/react-hook-form/react-hook-form/releases)
- [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md)
- [Commits](react-hook-form/react-hook-form@v7.71.1...v7.72.1)

Updates `resend` from 6.9.1 to 6.10.0
- [Release notes](https://github.com/resend/resend-node/releases)
- [Commits](resend/resend-node@v6.9.1...v6.10.0)

Updates `sanitize-html` from 2.17.1 to 2.17.2
- [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md)
- [Commits](https://github.com/apostrophecms/apostrophe/commits/sanitize-html@2.17.2/packages/sanitize-html)

Updates `zustand` from 5.0.10 to 5.0.12
- [Release notes](https://github.com/pmndrs/zustand/releases)
- [Commits](pmndrs/zustand@v5.0.10...v5.0.12)

Updates `@playwright/test` from 1.58.0 to 1.59.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.58.0...v1.59.1)

Updates `@prisma/nextjs-monorepo-workaround-plugin` from 7.3.0 to 7.7.0
- [Release notes](https://github.com/prisma/prisma/releases)
- [Commits](https://github.com/prisma/prisma/commits/7.7.0/packages/nextjs-monorepo-workaround-plugin)

Updates `@types/react` from 19.2.10 to 19.2.14
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `@typescript-eslint/eslint-plugin` from 8.54.0 to 8.58.1
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.58.1/packages/eslint-plugin)

Updates `@typescript-eslint/parser` from 8.54.0 to 8.58.1
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.58.1/packages/parser)

Updates `autoprefixer` from 10.4.23 to 10.4.27
- [Release notes](https://github.com/postcss/autoprefixer/releases)
- [Changelog](https://github.com/postcss/autoprefixer/blob/main/CHANGELOG.md)
- [Commits](postcss/autoprefixer@10.4.23...10.4.27)

Updates `postcss` from 8.5.6 to 8.5.9
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.6...8.5.9)

---
updated-dependencies:
- dependency-name: isomorphic-dompurify
  dependency-version: 3.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: prettier-plugin-tailwindcss
  dependency-version: 0.7.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: turbo
  dependency-version: 2.9.5
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@auth/prisma-adapter"
  dependency-version: 2.11.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.96.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: geist
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: immer
  dependency-version: 11.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: jspdf
  dependency-version: 4.2.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: nanoid
  dependency-version: 5.1.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: next-intl
  dependency-version: 4.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: puppeteer-core
  dependency-version: 24.40.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: react
  dependency-version: 19.2.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@types/react"
  dependency-version: 19.2.14
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: react-day-picker
  dependency-version: 9.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: react-dom
  dependency-version: 19.2.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: react-hook-form
  dependency-version: 7.72.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: resend
  dependency-version: 6.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: sanitize-html
  dependency-version: 2.17.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: zustand
  dependency-version: 5.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@playwright/test"
  dependency-version: 1.59.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@prisma/nextjs-monorepo-workaround-plugin"
  dependency-version: 7.7.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@types/react"
  dependency-version: 19.2.14
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@typescript-eslint/eslint-plugin"
  dependency-version: 8.58.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@typescript-eslint/parser"
  dependency-version: 8.58.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: autoprefixer
  dependency-version: 10.4.27
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: postcss
  dependency-version: 8.5.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github
Copy link
Copy Markdown
Author

dependabot Bot commented on behalf of github Apr 9, 2026

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

aruneshwisdm added a commit that referenced this pull request Apr 10, 2026
@aruneshwisdm @claude
fix: XSS in emails, magic byte upload validation, CSP header, cron auth
ebf383f 
- Escape businessName in email layout template (Bug #27)
- Add magic byte validation for file uploads to verify content type (Bug #30)
- Add Cache-Control and X-Content-Type-Options to PDF downloads (Bug #65-66)
- Escape user values in contract email template to prevent XSS (Bug #33)
- Add Content-Security-Policy header to vercel.json (Bug #62)
- Require CRON_SECRET for demo reset in production (Bug #55)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@aruneshwisdm aruneshwisdm force-pushed the dependabot/npm_and_yarn/minor-and-patch-0006c2cd80 branch from 43111c9 to 68e0748 Compare April 10, 2026 16:46
@aruneshwisdm
Copy link
Copy Markdown
Collaborator

aruneshwisdm commented Apr 10, 2026

Closing — repository history was rewritten to remove a leaked credential. Dependabot will recreate this against the cleaned main branch.

@dependabot @github
Copy link
Copy Markdown
Author

dependabot Bot commented on behalf of github Apr 10, 2026

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/minor-and-patch-0006c2cd80 branch April 10, 2026 17:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@aruneshwisdm