Skip to content

Javascript dependency: bump the web-javascript-minor-and-patch group across 1 directory with 13 updates - #10412

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/web/web-javascript-minor-and-patch-36b5d5e6c5
Open

Javascript dependency: bump the web-javascript-minor-and-patch group across 1 directory with 13 updates#10412
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/web/web-javascript-minor-and-patch-36b5d5e6c5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 11, 2026

Copy link
Copy Markdown
Contributor

Bumps the web-javascript-minor-and-patch group with 13 updates in the /web directory:

Package From To
@tanstack/react-virtual 3.14.10 3.14.11
@types/react-dom 19.2.5 19.2.7
anti-trojan-source 1.12.2 1.13.0
diff-arrays-of-objects 1.1.11 1.1.12
dompurify 3.4.14 3.4.15
ip-address 10.5.0 10.7.0
marked 18.0.11 18.0.12
postcss 8.5.26 8.5.28
react-frame-component 5.2.7 5.3.2
@testing-library/user-event 14.6.3 14.6.7
autoprefixer 10.5.4 10.5.5
typescript-eslint 8.69.0 8.70.0
webpack 5.108.4 5.110.3

Updates @tanstack/react-virtual from 3.14.10 to 3.14.11

Release notes

Sourced from @​tanstack/react-virtual's releases.

@​tanstack/react-virtual@​3.14.11

Patch Changes

  • Updated dependencies [4a0adf3]:
    • @​tanstack/virtual-core@​3.17.9
Changelog

Sourced from @​tanstack/react-virtual's changelog.

3.14.11

Patch Changes

  • Updated dependencies [4a0adf3]:
    • @​tanstack/virtual-core@​3.17.9
Commits
  • 171029d ci: Version Packages (#1269)
  • 4a0adf3 fix(virtual-core): re-issue clamped end-anchor compensation once the sizer gr...
  • See full diff in compare view

Updates @types/react-dom from 19.2.5 to 19.2.7

Commits

Updates anti-trojan-source from 1.12.2 to 1.13.0

Release notes

Sourced from anti-trojan-source's releases.

v1.13.0

1.13.0 (2026-09-08)

Features

  • Update README with video and image examples (5c95bf5)
Commits

Updates diff-arrays-of-objects from 1.1.11 to 1.1.12

Release notes

Sourced from diff-arrays-of-objects's releases.

v1.11.12

Dependency security patches

Commits

Updates dompurify from 3.4.14 to 3.4.15

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.15

  • Added better clobbering hardening when XML content is involved, thanks @​gnyselcuk
  • Added several smaller hardening and edge-case improvements, thanks @​leechristensen
  • Bumped several dependencies where possible
Commits

Updates ip-address from 10.5.0 to 10.7.0

Release notes

Sourced from ip-address's releases.

v10.7.0

What's Changed

Full Changelog: beaugunderson/ip-address@v10.6.0...v10.7.0

v10.6.0

What's Changed

Full Changelog: beaugunderson/ip-address@v10.5.1...v10.6.0

v10.5.1

Full Changelog: beaugunderson/ip-address@v10.5.0...v10.5.1

Commits
  • 2b7cab5 10.7.0
  • 87fae23 Add offset() and nextNetwork(), accept prefix-length ip6.arpa names, correct ...
  • 42c1f8b 10.6.0
  • fb12583 Add isGlobal() and pin the classifiers to the IANA special-purpose registries...
  • 38b02d7 10.5.1
  • d03e960 Merge commit from fork
  • ab3dc88 Merge commit from fork
  • See full diff in compare view

Updates marked from 18.0.11 to 18.0.12

Release notes

Sourced from marked's releases.

v18.0.12

18.0.12 (2026-09-07)

Bug Fixes

  • allow a tab before the closing sequence of an ATX heading (#4084) (4417582)
  • allow one more level of nested brackets in a link label (#4064) (37b28d8)
  • do not add a newline to an empty code block (#4073) (23b1706)
  • escape character references in autolink destinations (#4053) (8f432f0)
  • reject GFM email autolink when the domain ends in _ or - (#4063) (df57534)
  • reject invalid characters in HTML tag names (#4083) (300bb1d)
  • remove up to the fence indentation from each content line (#4074) (0244f08)
Commits
  • 24bf47c chore(release): 18.0.12 [skip ci]
  • 475ba3d chore(deps-dev): bump eslint from 10.9.1 to 10.10.0 (#4088)
  • 4417582 fix: allow a tab before the closing sequence of an ATX heading (#4084)
  • 23b1706 fix: do not add a newline to an empty code block (#4073)
  • df57534 fix: reject GFM email autolink when the domain ends in _ or - (#4063)
  • 37b28d8 fix: allow one more level of nested brackets in a link label (#4064)
  • 8f432f0 fix: escape character references in autolink destinations (#4053)
  • 44ddc31 docs: add inspect.software health badge (#4062)
  • 0244f08 fix: remove up to the fence indentation from each content line (#4074)
  • 300bb1d fix: reject invalid characters in HTML tag names (#4083)
  • Additional commits viewable in compare view

Updates postcss from 8.5.26 to 8.5.28

Release notes

Sourced from postcss's releases.

8.5.28

  • Fixes types regression.

8.5.27

Changelog

Sourced from postcss's changelog.

8.5.28

  • Fixes types regression.

8.5.27

Commits

Updates react-frame-component from 5.2.7 to 5.3.2

Release notes

Sourced from react-frame-component's releases.

v5.3.2

Patch Changes

  • f191d58: Add types condition to package.json exports to fix TypeScript resolution with TSGo and modern ESM tools

  • 1820bc3: ## Fix race condition in getMountTarget() (issue #250)

    Fixed "Cannot read properties of null" errors when initialContent changes rapidly by adding null checks for doc and doc.body in getMountTarget().

    Changes

    • src/Frame.jsx: Added null check in getMountTarget() to handle cases when iframe document is temporarily unavailable during rapid rerenders

v5.3.0

What's Changed

Add fallback to document.write() for initial frame rendering via dangerouslyUseDocWrite prop to support libraries like Repcaptcha and Google Maps that depend on the frame's location/origin.

PR #248: Add document.write() fallback (@​andrewpye)

Previous releases: https://github.com/ryanseddon/react-frame-component/releases

Changelog

Sourced from react-frame-component's changelog.

5.3.2

Patch Changes

  • f191d58: Add types condition to package.json exports to fix TypeScript resolution with TSGo and modern ESM tools

  • 1820bc3: ## Fix race condition in getMountTarget() (issue #250)

    Fixed "Cannot read properties of null" errors when initialContent changes rapidly by adding null checks for doc and doc.body in getMountTarget().

    Changes

    • src/Frame.jsx: Added null check in getMountTarget() to handle cases when iframe document is temporarily unavailable during rapid rerenders

5.3.1

Patch Changes

  • 14c215c: Fix React 19 and Vite compatibility by externalizing react/jsx-runtime

    The ESM and UMD builds were incorrectly bundling react/jsx-runtime inline from CommonJS source, which caused two issues:

    1. ESM builds contained __require("react") calls - This failed in browser ESM environments with "Could not dynamically require react" errors when using Vite.
    2. UMD builds referenced __SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED.ReactCurrentOwner - This internal API was removed in React 19, causing "Cannot read properties of undefined" errors.

    The fix adds react/jsx-runtime and react/jsx-dev-runtime to the external dependencies list in the Vite configuration. This ensures the JSX transform is loaded from the proper module format rather than being bundled inline from CJS source.

    Bundle size improvements:

    • ESM: 35.7 KB → 4.6 KB (-87%)
    • UMD: 37.9 KB → 6.8 KB (-82%)

    Fixes #280

5.3.0

Minor Changes

  • 8d922c3: Add fallback to document.write() for initial frame rendering via dangerouslyUseDocWrite prop to support libraries like Repcaptcha and Google Maps that depend on the frame's location/origin.
Commits
  • 3f4cb97 Update npm to latest for OIDC trusted publishing (#290)
  • eddb677 Revert "Update npm to latest for OIDC trusted publishing"
  • 194d769 Update npm to latest for OIDC trusted publishing
  • ed62652 Version Packages (#289)
  • fb302a0 Bump follow-redirects from 1.15.0 to 1.15.11
  • c44e385 Merge pull request #285 from ryanseddon/dependabot/npm_and_yarn/picomatch-2.3.2
  • 722560a Bump picomatch from 2.3.1 to 2.3.2
  • d6b8e30 Merge pull request #288 from ryanseddon/fix/issue-287-types-exports
  • f191d58 Add changeset
  • 1820bc3 fix: add null check in getMountTarget to prevent race condition (#286)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react-frame-component since your current version.


Updates @testing-library/user-event from 14.6.3 to 14.6.7

Release notes

Sourced from @​testing-library/user-event's releases.

v14.6.7

14.6.7 (2026-09-02)

Bug Fixes

  • normalize DataTransfer format aliases (#1326) (1e0020b)
  • feature: Add iframe support for user.keyboard typing (#1275) (1e0020b)

v14.6.6

14.6.6 (2026-08-22)

Bug Fixes

  • default pointer event pointerType to empty string instead of the string "undefined" (#1325) (71a5475)

v14.6.5

14.6.5 (2026-08-18)

Bug Fixes

  • tab retargeting if focus moved during keydown (#1296) (43efda7)

v14.6.4

14.6.4 (2026-08-11)

Bug Fixes

Commits
  • 1e0020b fix: normalize DataTransfer format aliases (#1326)
  • d4b0593 feature: Add iframe support for user.keyboard typing (#1275)
  • 71a5475 fix: default pointer event pointerType to empty string instead of the string ...
  • 43efda7 fix: tab retargeting if focus moved during keydown (#1296)
  • d7e80e3 fix: keyboard event repeat property (#1312)
  • 43d8e6c ci: remove broken npm backfill step (#1322)
  • See full diff in compare view

Updates autoprefixer from 10.5.4 to 10.5.5

Release notes

Sourced from autoprefixer's releases.

10.5.5

Changelog

Sourced from autoprefixer's changelog.

10.5.5

Commits

Updates typescript-eslint from 8.69.0 to 8.70.0

Release notes

Sourced from typescript-eslint's releases.

v8.70.0

8.70.0 (2026-09-07)

🚀 Features

  • eslint-plugin: [no-generated-empty-object-type] add rule (#12730)
  • website: generate per-page social preview cards (#12734)

🩹 Fixes

  • use stable release of pnpm 12 (#12808)
  • update pnpm to 12.3.4 and dedupe Docusaurus packages (#12829)
  • eslint-plugin: [member-ordering] don't report fields that read fields declared before them (#12729)
  • eslint-plugin: [no-unnecessary-condition] no false positive on RHS of a nested logical expression (#12728)
  • eslint-plugin: [no-deprecated] report deprecated imported values used in object shorthand properties (#12780)
  • project-service: avoid discarded tsserver logs (#12748)
  • typescript-estree: clarify the parserOptions.project error message (#12817)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.70.0 (2026-09-07)

🩹 Fixes

  • eslint-plugin: [no-deprecated] report deprecated imported values used in object shorthand properties (#12780)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits
  • 7ee7608 chore(release): publish 8.70.0
  • 4586535 fix(eslint-plugin): [no-deprecated] report deprecated imported values used in...
  • See full diff in compare view

Updates webpack from 5.108.4 to 5.110.3

Release notes

Sourced from webpack's releases.

v5.110.3

Patch Changes

v5.110.2

Patch Changes

v5.110.1

Patch Changes

... (truncated)

Changelog

Sourced from webpack's changelog.

5.110.3

Patch Changes

5.110.2

Patch Changes

5.110.1

Patch Changes

... (truncated)

Commits
  • a2d7b9c chore(release): new release (#21868)
  • d6e86c0 test(test262): assert two more errors webpack reports at build time (#21906)
  • 6a963fe fix: keep require() into a concatenation substituted and unmangled (#21905)
  • e1eb099 fix: concatenated require() in require.ensure callback or computed reques...
  • 8d1ab53 chore: escape literal NUL bytes in Compilation.js (#21904)
  • 5e6c4d7 fix(defer): evaluate async dependencies where the deferred import sits (#21902)
  • 7ea4fa3 fix: handle audited correctness edge cases (#21901)
  • c50713c fix: keep code generation data per result instead of per NormalModule (#21900)
  • ebd3be4 docs: document the post-minor stabilization week and out-of-band releases (#2...
  • 80be700 fix(config): keep the resolved optimization.minimize a boolean (#21886)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Javascript dependency: bump the web-javascript-minor-and-patch group …
2dd23e0 
…across 1 directory with 13 updates

Bumps the web-javascript-minor-and-patch group with 13 updates in the /web directory:

| Package | From | To |
| --- | --- | --- |
| [@tanstack/react-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual) | `3.14.10` | `3.14.11` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.5` | `19.2.7` |
| [anti-trojan-source](https://github.com/lirantal/anti-trojan-source) | `1.12.2` | `1.13.0` |
| [diff-arrays-of-objects](https://github.com/malcolmvr/diff-arrays-of-objects) | `1.1.11` | `1.1.12` |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.4.14` | `3.4.15` |
| [ip-address](https://github.com/beaugunderson/ip-address) | `10.5.0` | `10.7.0` |
| [marked](https://github.com/markedjs/marked) | `18.0.11` | `18.0.12` |
| [postcss](https://github.com/postcss/postcss) | `8.5.26` | `8.5.28` |
| [react-frame-component](https://github.com/ryanseddon/react-frame-component) | `5.2.7` | `5.3.2` |
| [@testing-library/user-event](https://github.com/testing-library/user-event) | `14.6.3` | `14.6.7` |
| [autoprefixer](https://github.com/postcss/autoprefixer) | `10.5.4` | `10.5.5` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.69.0` | `8.70.0` |
| [webpack](https://github.com/webpack/webpack) | `5.108.4` | `5.110.3` |



Updates `@tanstack/react-virtual` from 3.14.10 to 3.14.11
- [Release notes](https://github.com/TanStack/virtual/releases)
- [Changelog](https://github.com/TanStack/virtual/blob/main/packages/react-virtual/CHANGELOG.md)
- [Commits](https://github.com/TanStack/virtual/commits/@tanstack/react-virtual@3.14.11/packages/react-virtual)

Updates `@types/react-dom` from 19.2.5 to 19.2.7
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `anti-trojan-source` from 1.12.2 to 1.13.0
- [Release notes](https://github.com/lirantal/anti-trojan-source/releases)
- [Changelog](https://github.com/lirantal/anti-trojan-source/blob/main/RELEASE.md)
- [Commits](lirantal/anti-trojan-source@v1.12.2...v1.13.0)

Updates `diff-arrays-of-objects` from 1.1.11 to 1.1.12
- [Release notes](https://github.com/malcolmvr/diff-arrays-of-objects/releases)
- [Commits](malcolmvr/diff-arrays-of-objects@v1.1.11...v1.1.12)

Updates `dompurify` from 3.4.14 to 3.4.15
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.14...3.4.15)

Updates `ip-address` from 10.5.0 to 10.7.0
- [Release notes](https://github.com/beaugunderson/ip-address/releases)
- [Commits](beaugunderson/ip-address@v10.5.0...v10.7.0)

Updates `marked` from 18.0.11 to 18.0.12
- [Release notes](https://github.com/markedjs/marked/releases)
- [Commits](markedjs/marked@v18.0.11...v18.0.12)

Updates `postcss` from 8.5.26 to 8.5.28
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.26...8.5.28)

Updates `react-frame-component` from 5.2.7 to 5.3.2
- [Release notes](https://github.com/ryanseddon/react-frame-component/releases)
- [Changelog](https://github.com/ryanseddon/react-frame-component/blob/master/CHANGELOG.md)
- [Commits](ryanseddon/react-frame-component@v5.2.7...v5.3.2)

Updates `@testing-library/user-event` from 14.6.3 to 14.6.7
- [Release notes](https://github.com/testing-library/user-event/releases)
- [Changelog](https://github.com/testing-library/user-event/blob/main/CHANGELOG.md)
- [Commits](testing-library/user-event@v14.6.3...v14.6.7)

Updates `autoprefixer` from 10.5.4 to 10.5.5
- [Release notes](https://github.com/postcss/autoprefixer/releases)
- [Changelog](https://github.com/postcss/autoprefixer/blob/main/CHANGELOG.md)
- [Commits](postcss/autoprefixer@10.5.4...10.5.5)

Updates `typescript-eslint` from 8.69.0 to 8.70.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.70.0/packages/typescript-eslint)

Updates `webpack` from 5.108.4 to 5.110.3
- [Release notes](https://github.com/webpack/webpack/releases)
- [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack@v5.108.4...v5.110.3)

---
updated-dependencies:
- dependency-name: "@tanstack/react-virtual"
  dependency-version: 3.14.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: web-javascript-minor-and-patch
- dependency-name: "@types/react-dom"
  dependency-version: 19.2.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: web-javascript-minor-and-patch
- dependency-name: anti-trojan-source
  dependency-version: 1.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: web-javascript-minor-and-patch
- dependency-name: diff-arrays-of-objects
  dependency-version: 1.1.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: web-javascript-minor-and-patch
- dependency-name: dompurify
  dependency-version: 3.4.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: web-javascript-minor-and-patch
- dependency-name: ip-address
  dependency-version: 10.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: web-javascript-minor-and-patch
- dependency-name: marked
  dependency-version: 18.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: web-javascript-minor-and-patch
- dependency-name: postcss
  dependency-version: 8.5.28
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: web-javascript-minor-and-patch
- dependency-name: react-frame-component
  dependency-version: 5.3.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: web-javascript-minor-and-patch
- dependency-name: "@testing-library/user-event"
  dependency-version: 14.6.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: web-javascript-minor-and-patch
- dependency-name: autoprefixer
  dependency-version: 10.5.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: web-javascript-minor-and-patch
- dependency-name: typescript-eslint
  dependency-version: 8.70.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: web-javascript-minor-and-patch
- dependency-name: webpack
  dependency-version: 5.110.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: web-javascript-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the Dependencies Pull requests that update a dependency file label Sep 11, 2026
@coderabbitai

coderabbitai Bot commented Sep 11, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: cd9d30b3-d6cc-4db5-ab7c-788a319c1dd5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

Dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants