Skip to content

chore(deps): bump the frontend-npm group across 1 directory with 14 updates - #1459

Open
dependabot[bot] wants to merge 4 commits into
developfrom
dependabot/npm_and_yarn/frontend/frontend-npm-2ebebc913d
Open

chore(deps): bump the frontend-npm group across 1 directory with 14 updates#1459
dependabot[bot] wants to merge 4 commits into
developfrom
dependabot/npm_and_yarn/frontend/frontend-npm-2ebebc913d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 24, 2026

Copy link
Copy Markdown
Contributor

Bumps the frontend-npm group with 14 updates in the /frontend directory:

Package From To
@base-ui/react 1.6.0 1.7.0
lucide-react 1.27.0 1.33.0
next 16.2.12 16.3.1
react-resizable-panels 4.12.2 4.12.3
uuid 14.0.1 14.0.2
vis-network 10.1.0 10.1.2
@playwright/test 1.62.0 1.62.1
@types/node 26.1.2 26.2.0
@types/react 19.2.17 19.2.18
@types/react-dom 19.2.3 19.2.4
@vitest/coverage-v8 4.1.10 4.1.11
eslint-config-next 16.2.12 16.3.1
postcss 8.5.24 8.5.26
vitest 4.1.10 4.1.11

Updates @base-ui/react from 1.6.0 to 1.7.0

Release notes

Sourced from @​base-ui/react's releases.

v1.7.0

General changes

Accordion

Alert Dialog

  • Prevent <AlertDialog.Root> from reopening after remounting with a reused handle (#5109) by @​michaldudak

Autocomplete

Avatar

Button

Checkbox

... (truncated)

Changelog

Sourced from @​base-ui/react's changelog.

v1.7.0

Aug 4, 2026

General changes

Accordion

Alert Dialog

  • Prevent <AlertDialog.Root> from reopening after remounting with a reused handle (#5109) by @​michaldudak

Autocomplete

Avatar

Button

... (truncated)

Commits
  • 254f474 [release] v1.7.0 (#5404)
  • 9222cda [meter] Format clamped values (#5409)
  • becc19a [combobox][autocomplete][select] Fix listbox separator semantics (#5399)
  • 7cc0eef [drawer] Fix click-only outside dismissal after swipe (#5392)
  • 1a2ca3c [all components] Fix canceled exit unmount (#5401)
  • 166e8ac [popups] Fix quadratic dev-mode trigger registration check (#5400)
  • 071e892 [all components] Avoid unused popup handle attachments (#5394)
  • cbc87d1 [select] Stabilize scroll arrow cleanup test (#5402)
  • 3b5715c [all components] Fix popup handle lifecycle regressions (#5387)
  • 54cfcc1 [typescript] Preserve published internals types (#5386)
  • Additional commits viewable in compare view

Updates lucide-react from 1.27.0 to 1.33.0

Release notes

Sourced from lucide-react's releases.

Version 1.33.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.32.0...1.33.0

Version 1.32.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.31.0...1.32.0

Version 1.31.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.30.0...1.31.0

Version 1.30.0

What's Changed

... (truncated)

Commits
  • 75b5516 chore(dev): upgrade ESLint to latest compatible stack (v10) (#4378)
  • 0f8d48b test(packages): updates unit test snapshots with face-slightly-smiling (#4676)
  • See full diff in compare view

Updates next from 16.2.12 to 16.3.1

Release notes

Sourced from next's releases.

v16.3.1

What's Changed

Full Changelog: vercel/next.js@v16.3.0...v16.3.1

v16.3.1-canary.26

Misc Changes

  • docs: document deploymentId build ID override and Pages Router skew in 16.2: #97645
  • Upgrade React from eb8feb71-20260814 to eafeac09-20260819: #97636
  • Turbopack: rename to use turbopack: no side effects: #94427
  • refactor: move useDynamic{Route,Search}Params to reduce snapshot churn: #97360
  • [PPF] unstable_navigation(): #96908
  • [PPF] Scaffold unstable_navigation(): #97236
  • docs: Explicit cache output description: #97548
  • Improve Cache Components sync IO migration guidance: #97572
  • [test] Use a non-native stub for the server externals list test: #97614
  • Avoid GitHub API rate limits for create-next-app examples: #97612
  • [test] Cover the prerender worker-thread backend with an addon we control: #97543
  • [test] Convert the prerender-native-module suite to local fixture packages: #97542
  • [test] Replace the turbopack-reports sqlite3 dependency with a local addon fixture: #97541
  • [test] Drop the dead sqlite3 build approval from the sharp-basic suite: #97540
  • [ci] Authenticate Turborepo remote caching with OIDC instead of a static PAT: #97590
  • Remove HmrTarget: #97253
  • Keep HMR instructions typed until serialization: #96569
  • Serialize frozen collections by value only: #96686

Credits

... (truncated)

Commits
  • 3d32eb8 v16.3.1
  • 2b4b1ec [backport] Revert i18n localization change for dynamic Pages API routes (#949...
  • 228df5f [backport] Retain fewer stale cache versions and use a TTL, plus the mtime fa...
  • 16eab3a [backport] Fix: Optimistic routing bugs leading to repeated prefetch loops (#...
  • 75548c9 [backport] Fix Nav Inspector request loop on repeat captures (#97326)
  • f6bd714 [backport] [test] Compile the middleware redirect routes up front in dev (#97...
  • 43c1c60 [16.3] [ci] Use OIDC tokens to read private preview builds (#97258)
  • 9dbb357 [backport] Encode the cache item name built by unstable_cache (#97313)
  • 323a17c [backport] Discard only cache entries that predate a tag revalidation, and re...
  • 6d67f46 [backport] Keep the dev validation worker alive across HMR updates (#97315)
  • Additional commits viewable in compare view

Updates react-resizable-panels from 4.12.2 to 4.12.3

Release notes

Sourced from react-resizable-panels's releases.

4.12.3

  • 730: Guard CSSStyleSheet construction to avoid throwing in unsupported environments (@​leo-yang-qiong)
  • 736: Bugfix: Derived Panel constraints equality check
  • 732: Bugfix: Prevent orphaned groups in "pointerup" edge case (@​waterWang)
Changelog

Sourced from react-resizable-panels's changelog.

4.12.3

  • 730: Guard CSSStyleSheet construction to avoid throwing in unsupported environments (@​leo-yang-qiong)
  • 736: Bugfix: Derived Panel constraints equality check
  • 732: Bugfix: Prevent orphaned groups in "pointerup" edge case (@​waterWang)
Commits
  • f9c4227 4.12.2 -> 4.12.3
  • 30503d1 Fix derived Panel constraints equality check (#736)
  • 30aef6a Pending CHANGELOG
  • b1d574e fix: guard CSSStyleSheet construction with adoptedStyleSheets check (#730)
  • 6649f42 fix: don't resurrect stale group entries on pointer-up commit (Fixes #729) (#...
  • See full diff in compare view

Updates uuid from 14.0.1 to 14.0.2

Release notes

Sourced from uuid's releases.

v14.0.2

14.0.2 (2026-08-18)

Bug Fixes

  • v1: carry nsecs overflow into the timestamp's high bits (#972) (6adcc1d)
  • v1: set the multicast bit on v1Bytes's own randomly-generated node (#973) (b1da338)
  • v7: align default seq formula in v7Bytes with updateV7State (#965) (a67db57)
Changelog

Sourced from uuid's changelog.

14.0.2 (2026-08-18)

Bug Fixes

  • v1: carry nsecs overflow into the timestamp's high bits (#972) (6adcc1d)
  • v1: set the multicast bit on v1Bytes's own randomly-generated node (#973) (b1da338)
  • v7: align default seq formula in v7Bytes with updateV7State (#965) (a67db57)
Commits
  • fd59f02 chore(main): release 14.0.2 (#967)
  • f3c564e docs: point the Node support permalink at the CI version matrix (#974)
  • b1da338 fix(v1): set the multicast bit on v1Bytes's own randomly-generated node (#973)
  • 6adcc1d fix(v1): carry nsecs overflow into the timestamp's high bits (#972)
  • ea83515 docs: cleanup API summary (#968)
  • ac36860 chore: pin publint version in CI (#966)
  • a67db57 fix(v7): align default seq formula in v7Bytes with updateV7State (#965)
  • See full diff in compare view

Updates vis-network from 10.1.0 to 10.1.2

Release notes

Sourced from vis-network's releases.

v10.1.2

10.1.2 (2026-08-19)

Bug Fixes

v10.1.1

10.1.1 (2026-08-07)

Bug Fixes

  • typescript: add support for TypeScript 6 alongside TypeScript 5 (#2515) (f618cd5)
Commits
  • f2584c8 fix(types): add .d.ts files for CSS (#2518)
  • f618cd5 fix(typescript): add support for TypeScript 6 alongside TypeScript 5 (#2515)
  • d8fe2c8 chore(oxc): reconfigure ignore given that gitignore is respected (#2507)
  • a319797 refactor(types): add explicit public modifiers
  • 882a6d8 chore(deps): update dependency oxfmt to v0.61.0 (#2502)
  • 0cf9ae6 chore(deps): update dependency vis-dev-utils to v7.1.1 (#2505)
  • d43537b chore(deps): update dependency postcss to v8.5.24 (#2504)
  • 7dface4 chore(deps): update dependency oxlint to v1.76.0 (#2503)
  • 576e7e0 chore(deps): update node.js to v24.18.1 (#2501)
  • 01a8370 test(cypress): migrate aways from Cypress.env(), update cypress-visual-regres...
  • Additional commits viewable in compare view

Updates @playwright/test from 1.62.0 to 1.62.1

Release notes

Sourced from @​playwright/test's releases.

v1.62.1

Bug Fixes

  • #41989 [Regression]: tsconfig "extends" bare specifier isn't resolved via node_modules walk-up like tsc (fatal since 1.62)
  • #41998 [Regression]: directory-form tsconfig project references ("path": "../pkg") fail to resolve (fatal since 1.62)
  • #41985 Accessibility snapshot drops button name when text is nested inside spans with aria-hidden SVG
  • #42000 [Regression]: page.evaluate() arg of a branded primitive type (string & { brand }) no longer type-checks since 1.62
  • #42013 [BUG]Image-type actionable elements are not presented in the snapshot.
Commits
  • 26a9e47 cherry-pick(#42043): docs: release notes for v1.62 Python, Java, and .NET (#4...
  • 0a81d5d cherry-pick(#42040): docs(release-notes): mention the isolated headless clipb...
  • 8376826 cherry-pick(#42034): fix(aria): keep icon-only clickable elements in ai snaps...
  • 66c5cc9 chore: mark v1.62.1 (#42020)
  • 9672bc3 cherry-pick(#42009): fix(types): support branded primitives in evaluate argum...
  • 4325804 cherry-pick(#41988): fix(aria): preserve names from collapsed text contributors
  • 9632f8e cherry-pick(#42005): fix(tsconfig): do not throw when "extends"/"references" ...
  • See full diff in compare view

Updates @types/node from 26.1.2 to 26.2.0

Commits

Updates @types/react from 19.2.17 to 19.2.18

Commits

Updates @types/react-dom from 19.2.3 to 19.2.4

Commits

Updates @vitest/coverage-v8 from 4.1.10 to 4.1.11

Release notes

Sourced from @​vitest/coverage-v8's releases.

v4.1.11

   🐞 Bug Fixes

    View changes on GitHub
Commits

Updates eslint-config-next from 16.2.12 to 16.3.1

Release notes

Sourced from eslint-config-next's releases.

v16.3.1

What's Changed

Full Changelog: vercel/next.js@v16.3.0...v16.3.1

v16.3.1-canary.26

Misc Changes

  • docs: document deploymentId build ID override and Pages Router skew in 16.2: #97645
  • Upgrade React from eb8feb71-20260814 to eafeac09-20260819: #97636
  • Turbopack: rename to use turbopack: no side effects: #94427
  • refactor: move useDynamic{Route,Search}Params to reduce snapshot churn: #97360
  • [PPF] unstable_navigation(): #96908
  • [PPF] Scaffold unstable_navigation(): #97236
  • docs: Explicit cache output description: #97548
  • Improve Cache Components sync IO migration guidance: #97572
  • [test] Use a non-native stub for the server externals list test: #97614
  • Avoid GitHub API rate limits for create-next-app examples: #97612
  • [test] Cover the prerender worker-thread backend with an addon we control: #97543
  • [test] Convert the prerender-native-module suite to local fixture packages: #97542
  • [test] Replace the turbopack-reports sqlite3 dependency with a local addon fixture: #97541
  • [test] Drop the dead sqlite3 build approval from the sharp-basic suite: #97540
  • [ci] Authenticate Turborepo remote caching with OIDC instead of a static PAT: #97590
  • Remove HmrTarget: #97253
  • Keep HMR instructions typed until serialization: #96569
  • Serialize frozen collections by value only: #96686

Credits

... (truncated)

Commits

…pdates

Bumps the frontend-npm group with 14 updates in the /frontend directory:

| Package | From | To |
| --- | --- | --- |
| [@base-ui/react](https://github.com/mui/base-ui/tree/HEAD/packages/react) | `1.6.0` | `1.7.0` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.27.0` | `1.33.0` |
| [next](https://github.com/vercel/next.js) | `16.2.12` | `16.3.1` |
| [react-resizable-panels](https://github.com/bvaughn/react-resizable-panels) | `4.12.2` | `4.12.3` |
| [uuid](https://github.com/uuidjs/uuid) | `14.0.1` | `14.0.2` |
| [vis-network](https://github.com/visjs/vis-network) | `10.1.0` | `10.1.2` |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.62.0` | `1.62.1` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.2` | `26.2.0` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.17` | `19.2.18` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.3` | `19.2.4` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.10` | `4.1.11` |
| [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.2.12` | `16.3.1` |
| [postcss](https://github.com/postcss/postcss) | `8.5.24` | `8.5.26` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.10` | `4.1.11` |



Updates `@base-ui/react` from 1.6.0 to 1.7.0
- [Release notes](https://github.com/mui/base-ui/releases)
- [Changelog](https://github.com/mui/base-ui/blob/master/CHANGELOG.md)
- [Commits](https://github.com/mui/base-ui/commits/v1.7.0/packages/react)

Updates `lucide-react` from 1.27.0 to 1.33.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.33.0/packages/lucide-react)

Updates `next` from 16.2.12 to 16.3.1
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.2.12...v16.3.1)

Updates `react-resizable-panels` from 4.12.2 to 4.12.3
- [Release notes](https://github.com/bvaughn/react-resizable-panels/releases)
- [Changelog](https://github.com/bvaughn/react-resizable-panels/blob/main/CHANGELOG.md)
- [Commits](bvaughn/react-resizable-panels@4.12.2...4.12.3)

Updates `uuid` from 14.0.1 to 14.0.2
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](uuidjs/uuid@v14.0.1...v14.0.2)

Updates `vis-network` from 10.1.0 to 10.1.2
- [Release notes](https://github.com/visjs/vis-network/releases)
- [Changelog](https://github.com/visjs/vis-network/blob/master/HISTORY.md)
- [Commits](visjs/vis-network@v10.1.0...v10.1.2)

Updates `@playwright/test` from 1.62.0 to 1.62.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.62.0...v1.62.1)

Updates `@types/node` from 26.1.2 to 26.2.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/react` from 19.2.17 to 19.2.18
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `@types/react-dom` from 19.2.3 to 19.2.4
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `@vitest/coverage-v8` from 4.1.10 to 4.1.11
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/coverage-v8)

Updates `eslint-config-next` from 16.2.12 to 16.3.1
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.1/packages/eslint-config-next)

Updates `postcss` from 8.5.24 to 8.5.26
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.24...8.5.26)

Updates `vitest` from 4.1.10 to 4.1.11
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest)

---
updated-dependencies:
- dependency-name: "@base-ui/react"
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-npm
- dependency-name: lucide-react
  dependency-version: 1.33.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-npm
- dependency-name: next
  dependency-version: 16.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-npm
- dependency-name: react-resizable-panels
  dependency-version: 4.12.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: frontend-npm
- dependency-name: uuid
  dependency-version: 14.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: frontend-npm
- dependency-name: vis-network
  dependency-version: 10.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: frontend-npm
- dependency-name: "@playwright/test"
  dependency-version: 1.62.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: frontend-npm
- dependency-name: "@types/node"
  dependency-version: 26.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: frontend-npm
- dependency-name: "@types/react"
  dependency-version: 19.2.18
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: frontend-npm
- dependency-name: "@types/react-dom"
  dependency-version: 19.2.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: frontend-npm
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 4.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: frontend-npm
- dependency-name: eslint-config-next
  dependency-version: 16.3.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: frontend-npm
- dependency-name: postcss
  dependency-version: 8.5.26
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: frontend-npm
- dependency-name: vitest
  dependency-version: 4.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: frontend-npm
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 24, 2026
@dependabot
dependabot Bot requested a review from seonghobae as a code owner August 24, 2026 03:00
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 24, 2026
devin-ai-integration[bot]

This comment was marked as resolved.

@github-actions

github-actions Bot commented Aug 24, 2026

Copy link
Copy Markdown
Contributor

PR governance metadata gate is not ready for 3edb8320b0288f2bba54ce7e28083164e0d51966:

  • Branch is BEHIND the base branch; update the branch and re-run checks.
  • Required check strix is FAILURE on the current head.

devin-ai-integration[bot]

This comment was marked as resolved.

@seonghobae

Copy link
Copy Markdown
Contributor

Exact-head remediation for 3edb8320b0288f2bba54ce7e28083164e0d51966:

Root cause of the hosted failures was the unupdated frontend/pnpm-workspace.yaml override: package.json and the lockfile requested PostCSS 8.5.26, while pnpm applied workspace override 8.5.24, so frozen installs failed before build. The workspace override and two lock/security contract tests now use 8.5.26.

Validation: pnpm@11.5.3 install --frozen-lockfile --ignore-scripts; frontend 435 passed, lint, typecheck, and production build; backend 1786 passed, 32 skipped; targeted dependency/security contracts 2 passed; ruff check backend; and git diff --check. The earlier hosted Strix failure remains provider-side NVIDIA 429/direct-provider evidence and is not treated as a source pass.

@seonghobae

Copy link
Copy Markdown
Contributor

Disposition for the two current informational review threads on 3edb8320b0288f2bba54ce7e28083164e0d51966: the vis-network note is cosmetic and the resolved lock is 10.1.2; the .pnpmfile.cjs exception is intentionally pinned to the reviewed PostCSS 8.5.26 contract so a future security-floor change must update the hook and lock together. The actual frozen-install defect was the workspace override, now fixed and covered by the passing install/build evidence.

@seonghobae

Copy link
Copy Markdown
Contributor

Exact-head Checks RCA: strix failed on provider infrastructure, not a source finding. The run records NVIDIA NIM HTTP 429 rate-limit responses, then a configured openai-direct/gpt-5.6-luna fallback HTTP 404; the gate correctly failed closed with no structured vulnerability report. This requires central provider/fallback remediation and a fresh exact-head scan; no source patch was applied to this dependency-only PR.

@seonghobae

seonghobae commented Aug 24, 2026

Copy link
Copy Markdown
Contributor

Strix failure triage for current head 3edb8320b0288f2bba54ce7e28083164e0d51966: the job log shows NVIDIA NIM 429 Too Many Requests, then fallback openai-direct/gpt-5.6-luna 404 page not found; the gate explicitly classified this as provider infrastructure unavailable with no authoritative report artifact. No source finding was emitted. Re-ran failed jobs through the Actions API; merge remains blocked until an exact-head authoritative Strix result and required review are available.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant