Skip to content

chore(deps): bump the production group with 12 updates - #2273

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/production-9454692570
Open

chore(deps): bump the production group with 12 updates#2273
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/production-9454692570

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 9, 2026

Copy link
Copy Markdown
Contributor

Bumps the production group with 12 updates:

Package From To
@platformatic/kafka 2.14.0 2.15.0
@tanstack/react-virtual 3.14.24 3.14.26
@xyflow/react 12.12.0 12.12.1
framer-motion 14.9.0 14.9.1
geist 1.9.0 1.9.1
hyparquet-compressors 1.1.2 1.1.3
lucide-react 1.65.0 1.69.0
mongodb 7.7.0 7.8.0
mssql 12.7.13 12.7.14
next 16.4.3 16.4.5
openid-client 6.8.8 6.8.9
react-resizable-panels 4.15.2 4.18.1

Updates @platformatic/kafka from 2.14.0 to 2.15.0

Release notes

Sourced from @​platformatic/kafka's releases.

v2.15.0

What's Changed

New Contributors

Full Changelog: platformatic/kafka@v2.14.0...v2.15.0

Commits
  • 83af802 chore: Bumped v2.15.0.
  • 951a65b Catch All Connection Errors (#464)
  • 2ef3c32 fix: Removed duplicate child messages from joinGroup errors. (#477)
  • 5d7e7df fix(network): fail and reset pending requests when the connection closes (#475)
  • cc7a467 fix(admin): tolerate partition metadata errors when listing topics (#461)
  • b63b4ee fix(consumer): preserve offsets when filtering aborted transactions (#470)
  • a1f97e5 chore: Fixed artifact uploading. (#469)
  • ca45477 fix(network): emit closing event when requests time out (#468)
  • cbe18fb feat: keep-alive and idle-timeout options for broker connections (#452)
  • cd6d19b fix(consumer): keep an inflight rejoin from reviving a closed consumer (#466)
  • Additional commits viewable in compare view

Updates @tanstack/react-virtual from 3.14.24 to 3.14.26

Release notes

Sourced from @​tanstack/react-virtual's releases.

@​tanstack/react-virtual@​3.14.26

Patch Changes

@​tanstack/react-virtual@​3.14.25

Patch Changes

  • Updated dependencies [9d7ff67]:
    • @​tanstack/virtual-core@​3.19.10
Changelog

Sourced from @​tanstack/react-virtual's changelog.

3.14.26

Patch Changes

3.14.25

Patch Changes

  • Updated dependencies [9d7ff67]:
    • @​tanstack/virtual-core@​3.19.10
Commits

Updates @xyflow/react from 12.12.0 to 12.12.1

Release notes

Sourced from @​xyflow/react's releases.

@​xyflow/react@​12.12.1

Patch Changes

  • #6068 7813eeb - Cancel a pending click connection when clicking the pane and call onClickConnectEnd / onclickconnectend

  • #6097 d150c38 - Don't mutate the internal selection state

  • #5650 f7cddb9 - Infer the type of pathOptions in EdgeProps from the edge type instead of using any.

  • #6090 b235ea0 - Respect nodeOrigin in isNodeIntersecting and getIntersectingNodes when you pass a node object instead of { id }

  • #6054 c7d0fcb - Disconnect the ResizeObservers when a flow unmounts

  • Updated dependencies [d150c38, 8483a2f, c7d0fcb, 9dcbd29, cba335d]:

    • @​xyflow/system@​0.0.84
Changelog

Sourced from @​xyflow/react's changelog.

12.12.1

Patch Changes

  • #6068 7813eeb - Cancel a pending click connection when clicking the pane and call onClickConnectEnd / onclickconnectend

  • #6097 d150c38 - Don't mutate the internal selection state

  • #5650 f7cddb9 - Infer the type of pathOptions in EdgeProps from the edge type instead of using any.

  • #6090 b235ea0 - Respect nodeOrigin in isNodeIntersecting and getIntersectingNodes when you pass a node object instead of { id }

  • #6054 c7d0fcb - Disconnect the ResizeObservers when a flow unmounts

  • Updated dependencies [d150c38, 8483a2f, c7d0fcb, 9dcbd29, cba335d]:

    • @​xyflow/system@​0.0.84
Commits
  • 7599c7f chore(packages): bump
  • d4bc936 Merge pull request #5650 from keepmhwn/fix/path-options-type
  • c4fdcb1 Merge pull request #6097 from xyflow/fix/internal-selection
  • 5c90af4 fix(react): cleanup internal selection handling #6096
  • 93b7a91 chore(pane): cleanup
  • 7abb6f0 Add Svelte pane cancellation and merge latest main
  • b235ea0 fix: respect flow nodeOrigin in root node intersections
  • 22388df chore(useResizeHandler): cleanup
  • 7813eeb fix(react): cancel click connections on pane click
  • c7d0fcb fix: disconnect ResizeObservers when a flow unmounts
  • See full diff in compare view

Updates framer-motion from 14.9.0 to 14.9.1

Changelog

Sourced from framer-motion's changelog.

[14.9.1] 2026-11-04

Added

  • Ensure accelerated transform animations finish correctly.
  • AnimatePresence: Fix exit never starting when a child mounts already exiting.
  • AnimatePresence: Fix exit stuck after an open layoutId card switches to another item.
  • Ensure accelerated animations are cleaned up in WebKit.
Commits
  • 6be4a29 v14.9.1
  • 4216b2f Updating changelog
  • 30b1051 Latest
  • a2c76b9 Raise the motion/remix size limit to 49.2 kB
  • e945386 Keep the timeline running on the drag-animate test page
  • 625e6af Merge pull request #4035 from motiondivision/claude/project-thread-fx11r9
  • 405ebe2 Merge pull request #4043 from motiondivision/claude/project-thread-8iynk0
  • e835b8f Merge pull request #4045 from motiondivision/claude/project-thread-cb06bn
  • cc43fef Merge pull request #4050 from motiondivision/claude/project-thread-5hniaw
  • 0a0584b Keep values when an element is shown again only to exit
  • Additional commits viewable in compare view

Updates geist from 1.9.0 to 1.9.1

Changelog

Sourced from geist's changelog.

1.9.1

Patch Changes

  • bace39d: Update Geist Serif to 1.002: adds ^ ¢ £, and the variable font is now named "Geist Serif" (was "Geist Serif VF").
Commits

Updates hyparquet-compressors from 1.1.2 to 1.1.3

Changelog

Sourced from hyparquet-compressors's changelog.

[1.1.3]

  • Fix gzip FEXTRA length offset (#3)
Commits

Updates lucide-react from 1.65.0 to 1.69.0

Release notes

Sourced from lucide-react's releases.

Version 1.69.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.68.0...1.69.0

Version 1.68.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.67.0...1.68.0

Version 1.67.0

What's Changed

New Contributors

... (truncated)

Commits

Updates mongodb from 7.7.0 to 7.8.0

Release notes

Sourced from mongodb's releases.

v7.8.0

7.8.0 (2026-10-30)

The MongoDB Node.js team is pleased to announce version 7.8.0 of the mongodb package!

Release Notes

[!WARNING]
Node Driver versions from v6.11.0 and from v7.0.0 before v7.8.0 (this release) are affected by a security issue related to the use of the experimental timeoutMS feature where connection pool desynchronization after operation timeout can expose other users' data (CVE-2026-119179). Users are encouraged to discontinue the use of timeoutMS as soon as possible.

[!WARNING] Node Driver versions from v3.3.3 before v7.8.0 (this release) are affected by a security issue concerning the verification of host names returned by SRV lookups, which could allow an attacker in control of the DNS response to redirect the driver to a host outside the user's domain. Users using SRV records are encouraged to upgrade to v7.8.0 as soon as possible.

timeoutMS is deprecated and now a no-op

[!WARNING] timeoutMS and timeoutMode are deprecated and have no effect starting in this release. They are still accepted and will not throw, but operations will no longer time out because of them. They are slated for removal in a future release.

Use the per-stage timeouts instead: serverSelectionTimeoutMS, waitQueueTimeoutMS, socketTimeoutMS, and maxTimeMS for server-side execution.

Configurable SRV host validation

This release adds two new methods of validating DNS:

  1. srvAllowedHostsSuffix - A host name suffix that every host returned by the SRV lookup must end with. This option can be configured on the client or the connection string.
  2. srvHostValidator - A synchronous function that decides whether a host returned by the SRV lookup may be used. This option can only be configured on the client. This function must accept a string and has to return a boolean; returning anything else, including the Promise returned by an async function, will result in an error.

[!WARNING] Modifying the default SRV domain name validation can create vulnerabilities.

SRV host names are now compared in a normalized form (case-insensitively, without a trailing dot, and with internationalized names in xn-- form). Connection strings whose SRV host name differs in case from the host names returned by DNS, such as mongodb+srv://TEST1.TEST.BUILD.10GEN.CC, previously failed SRV verification and now connect.

zstd compression no longer requires @mongodb-js/zstd on Node.js 22.15.0+

The driver now uses Node.js' built-in zstd implementation when it is available. On older Node.js versions it continues to use @mongodb-js/zstd, so no changes are needed for existing setups.

Thanks to @​axelonet for the original contribution!

Distinguish between command-level options and index-level options when creating indexes

Before:

// Index options and command options were on the same object
await collection.createIndex(
  { email: 1 },
  {
    // index options
    unique: true,
    name: 'email_unique',
    // command options
    commitQuorum: 'majority',
</tr></table>

... (truncated)

Changelog

Sourced from mongodb's changelog.

7.8.0 (2026-10-30)

Features

  • NODE-6893: Distinguish between command-level options and index-level options when creating indexes (#5012) (ca0e451)
  • NODE-7097: use Node.js built-in zstd when available (#5073) (b7eb8fd)
  • NODE-7657: remove @​experimental tags from no-longer-experimental features (#5058) (694a848)
  • NODE-7830: add srvAllowedHostsSuffix and srvHostValidator options (#5065) (19e2d3b)
  • NODE-7958: make timeoutMS a no-op and deprecate it (#5085) (8345fe1)

Bug Fixes

  • NODE-7643: preserve $meta direction in [field, direction] sort pair (#4988) (16136bb)
  • NODE-7659: key unordered bulk insertedIds by originating operation index (#4989) (df513cf)
  • NODE-7764: use $eq to match file IDs in GridFS queries (#5068) (218b6d7)
  • NODE-7881: hello command is compressed (#5072) (399045a)
Commits
  • c406cab chore(main): release 7.8.0 (#5070)
  • 9c54464 docs: remove timeoutMS from experimental features (#5087)
  • 8345fe1 feat(NODE-7958): make timeoutMS a no-op and deprecate it (#5085)
  • 853ff46 ci(NODE-7963): pin node v26 in ci (#5086)
  • 19e2d3b feat(NODE-7830): add srvAllowedHostsSuffix and srvHostValidator options (#5065)
  • b7eb8fd feat(NODE-7097): use Node.js built-in zstd when available (#5073)
  • 2a13e4b chore(NODE-6984): skip flaky CSOT test (#5079)
  • 399045a fix(NODE-7881): hello command is compressed (#5072)
  • ef6f6f3 chore(NODE-7833): 'latest' server binary behind s3 (#5074)
  • 16136bb fix(NODE-7643): preserve $meta direction in [field, direction] sort pair (#4988)
  • Additional commits viewable in compare view

Updates mssql from 12.7.13 to 12.7.14

Release notes

Sourced from mssql's releases.

v12.7.14

12.7.14 (2026-11-04)

Bug Fixes

  • add context to connection pool timeouts (c5d2cde)
Commits
  • 6589a7e Merge pull request #1952 from lfariabr/fix/pool-acquire-timeout-context
  • 355d307 test: check the stack carries the pool timeout context
  • c5d2cde fix: add context to connection pool timeouts
  • eedcf77 Merge pull request #1951 from tediousjs/dependabot/npm_and_yarn/multi-2dcf508078
  • 9d97af9 chore(deps): bump @​azure/msal-node and @​azure/identity
  • 9100c63 Merge pull request #1950 from tediousjs/dependabot/github_actions/tediousjs/s...
  • cd6a112 chore(deps): bump tediousjs/setup-sqlserver from 4.0.1 to 4.1.1
  • 9fc1edb Merge pull request #1949 from tediousjs/dependabot/npm_and_yarn/fast-uri-3.1.9
  • 71e6c1c chore(deps-dev): bump fast-uri from 3.1.7 to 3.1.9
  • See full diff in compare view

Updates next from 16.4.3 to 16.4.5

Release notes

Sourced from next's releases.

v16.4.5

This release contains security fixes for the following advisories:

Moderate

v16.4.4

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. The announced security released for November will be published tomorrow.

Core Changes

  • [lts-active] test: disable the reads fallback params after a client navigation deployment test (#100668)
  • [lts-active] Reload on missed Turbopack startup CSS updates (#100619)
  • [lts-active] Revert "Optimize strict module factory chunks (#98421)" (#100866)
  • [lts-active] Emit the Turbopack shared-runtime bootstrap in the PPR resume so it gets the CSP nonce (#100907)
  • [lts-active] [ci] Pin deploy test deployments to Node.js 22.x (#100886)
  • [lts-active] fix(analyze): use route summaries as the analyzer route index (#100974)
  • [lts-active] Use fast-jwt instead of jsonwebtoken (#100885)

Credits

Huge thanks to @​icyJoseph, @​mischnic, @​wbinnssmith, @​lukesandberg, and @​eps1lon for helping!

Commits
  • 4e5335a v16.4.5
  • 809be72 [lts-active] Strip internal middleware cookie headers from edge responses (#282)
  • 2842833 [lts-active] Fix stale compressed framing for forwarded fetch responses (#281)
  • 6596840 [lts-active] [use cache] Fix cache key when binary args are used (#280)
  • 18eeffb [lts-active] Fix shared shell poisoning from request-supplied placeholder par...
  • e66e656 [lts-active] [next/image] Fix false-positive AVIF/HEIC detection (#278)
  • d605874 [lts-active] Fix unstable_cache leaking cold 'use cache' fills across roo...
  • 80c96ed [lts-active] Fix outer 'use cache' entries reused across root param values ...
  • b175f52 v16.4.4
  • ba4a4c1 [lts-active] Use fast-jwt instead of jsonwebtoken (#100885)
  • Additional commits viewable in compare view

Updates openid-client from 6.8.8 to 6.8.9

Release notes

Sourced from openid-client's releases.

v6.8.9

Fixes

  • types: support exactOptionalPropertyTypes (91f3005), closes #903
Changelog

Sourced from openid-client's changelog.

6.8.9 (2026-11-02)

Fixes

  • types: support exactOptionalPropertyTypes (91f3005), closes #903
Commits
  • 0f4fcb6 chore(release): 6.8.9
  • 501102a chore: bump packages
  • 91f3005 fix(types): support exactOptionalPropertyTypes
  • 63b2fac ci: add trigger-ci pushes
  • bf05393 build(deps-dev): bump workerd in /tap/workerd
  • 81d30e2 build(deps-dev): bump electron from 44.9.1 to 45.1.0 in /tap/electron
  • bd81b1b build(deps): bump the actions group with 4 updates
  • 43d3022 build(deps-dev): bump @​playwright/test from 1.63.0 to 1.64.1
  • ca1ceb7 build(deps-dev): bump electron
  • f396c7f test: address conformance suite v5.3.2 failures
  • Additional commits viewable in compare view

Updates react-resizable-panels from 4.15.2 to 4.18.1

Release notes

Sourced from react-resizable-panels's releases.

4.18.1

  • Fix the free space in a Workspace tabset's tab list (returned by useTabListFreeSpace and getTabListFreeSpace, reported to subscribeToTabListFreeSpace listeners, and set as the --tab-list-free-space custom property) not changing once the tab list is squeezed to 0px, e.g. beside a toolbar that doesn't shrink. It now keeps going down as the header's content overflows the header, and is updated when the header or its toolbar changes size.
  • Fix Workspace interactions in right-to-left layouts (e.g. within dir="rtl"): dragging a tab within its tab list inserts it where it's dropped, arrow keys move focus to the tab on that side (ArrowLeft moves to the next tab), and dropping a tab or tabset onto the left or right edge of a tabset puts it on that side of the screen. The left and right regions passed to moveTab and moveTabset are sides of the screen too. A tab list's data-overflow-start and data-overflow-end attributes are also set correctly while it's scrolled. - #791

4.18.0

  • Add the normalizeWorkspaceModel function, which checks and tidies a model the same way the defaultModel prop does (e.g. removing empty tabsets and fixing selections), and returns null if the value isn't a model (e.g. corrupt saved data). Its mapTab option replaces each saved tab with the app's current version (or removes it, by returning null), so layouts saved by older versions of an app can be restored.
  • Add the free space in each tabset's tab list (the space its tabs don't use; negative once they overflow), e.g. for a toolbar that moves items into an overflow menu when the header runs out of room. It's returned by the new useTabListFreeSpace hook and getTabListFreeSpace imperative method, reported to listeners added with the new subscribeToTabListFreeSpace method (e.g. from a toolbar rendered outside of the Workspace), and set as the tab list's --tab-list-free-space custom property. All of them are updated before the browser paints.
  • Fix Workspace tabsets being shown at their collapsed sizes with their content still rendered (and reported as expanded by useParentTabsetState) when the model's sizes don't fit the tabsets' minimum sizes, e.g. a model saved in a wider window, a workspace that's made narrower, or expandTabset shrinking a sibling below its minimum. Tabsets are now shown within their minimum and maximum sizes (rather than collapsed, when there's room), and tabsets that still have to be collapsed to fit are shown (and reported) as collapsed; the new isCollapsedToFit value (returned by useParentTabsetState) tells them apart from tabsets collapsed in the model (e.g. to hide an "expand" button, since they can't be expanded until they fit). The model isn't changed, so the tabsets are shown as the model has them again once they fit.
  • Add maxWidth and maxHeight to Workspace tabsets (and updateTabset), which limit how large a tabset's content area can be resized (e.g. a sidebar that can only grow so wide). Like minimum sizes, they must use absolute units. A maximum only applies if something else can take up the rest of its split (e.g. another tabset without a maximum); otherwise it's ignored, with a warning in development.
  • The default Workspace tabset drag preview now shows the number of other tabs being dragged after the selected tab's title (e.g. "One (+2)"). Tabsets with one tab, and workspaces with a renderDragPreview or renderTabsetDragPreview prop, show the same preview as before. - #789

4.17.0

  • Add dragging whole tabsets within a Workspace. A tabset is dragged by the empty space in its header, or by a TabsetDragHandle (or any element with a data-tabset-drag-handle attribute) when it has one. Dropping a tabset onto the edge of another tabset moves it there; dropping it onto another tabset's center or tab list moves its tabs into that tabset. Tabsets with the keepWhenEmpty flag can only be moved, not merged. Tabsets can't be dragged when they have the new disableDrag flag or contain a tab that does. - #785
    • The new moveTabset imperative method, renderTabsetDragPreview prop, and isDragDisabled value (returned by useParentTabsetState) support tabset dragging. A tabset being dragged has a data-tabset-dragging attribute, and the drag preview has a data-drag-type attribute ("tab" or "tabset").
    • disableDrop is called for each tab in a dragged tabset, with the target each tab would be dropped at, so existing restrictions apply to tabset drags too. The new tabset argument is set while a whole tabset is dragged.
  • Add collapsible tabsets to Workspace. A tabset with the new collapsible flag can be collapsed to just its header (e.g. a bottom panel, or a sidebar that collapses to a vertical strip of tabs), by dragging a separator past its minimum size (like a collapsible Panel) or with the new collapseTabset and expandTabset methods; clicking a tab in a collapsed tabset expands it. Whether a tabset is collapsed is saved in the model (collapsed), and its size is the size it expands to. - #787
    • useParentTabset returns collapse, expand, and isCollapsed functions, and useParentTabsetState returns isCollapsed and isCollapsible values (e.g. for a collapse button in a tabset's toolbar). Elements within a collapsed tabset have a data-tabset-collapsed attribute.
    • onModelChanged reports the new "collapse" and "expand" reasons.
  • Add the Workspace tabRemovalSelectionBehavior prop, which chooses the tab that's selected when the selected tab is closed (or dragged to another tabset): the tab after it ("adjacent", the default), or the tabset's most recently selected tab ("recent", like an IDE's editor groups). In "recent" mode, each tabset's recently selected tabs are saved in the model (TabsetNode.recentTabIds). - #786

[!WARNING] The tab argument passed to disableDrop may now be undefined, when a tabset without tabs (one with the keepWhenEmpty flag) is dragged. Functions that read tab (e.g. tab.data) should check for this first.

4.16.1

  • Add a split entry to the Workspace classNames and styles props, for each split's Group (which now also has data-split and data-split-id attributes). Its CSS gap adds space between tabsets, and counts toward their minimum sizes like separators do. - #783
  • Fix dragging a Workspace separator ending after moving a few pixels (most often when resizing tabsets stacked vertically, or tabsets with tabs on the left or right). The size of each tabset's header, which counts toward its minimum size, could change by a pixel as the tabset was resized, because it was measured as the difference of two rounded sizes; that re-registered the tabset's panel, which interrupted the drag. It is now measured from exact sizes. - #782
  • Fix Workspace tabsets and splits rendering their model node ids as element ids, which could match other elements on the page (e.g. a tabset with the id "root" matched an application's <div id="root">, and its styles) or the elements of another workspace with the same model. Their elements' ids are now unique within the page. - #784
  • Fix pressing a tab at the edge of a tabset, in a Workspace without separators, both resizing the tabset and dragging the tab. Resizing takes priority, as it does for other elements at the edges of panels. - #784

4.16.0

  • Add Workspace component, for layouts of tabsets that ...

    Description has been truncated

@dependabot
chore(deps): bump the production group with 12 updates
206ba3f 
Bumps the production group with 12 updates:

| Package | From | To |
| --- | --- | --- |
| [@platformatic/kafka](https://github.com/platformatic/kafka) | `2.14.0` | `2.15.0` |
| [@tanstack/react-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual) | `3.14.24` | `3.14.26` |
| [@xyflow/react](https://github.com/xyflow/xyflow/tree/HEAD/packages/react) | `12.12.0` | `12.12.1` |
| [framer-motion](https://github.com/motiondivision/motion) | `14.9.0` | `14.9.1` |
| [geist](https://github.com/vercel/geist-font/tree/HEAD/packages/next) | `1.9.0` | `1.9.1` |
| [hyparquet-compressors](https://github.com/hyparam/hyparquet-compressors) | `1.1.2` | `1.1.3` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.65.0` | `1.69.0` |
| [mongodb](https://github.com/mongodb/node-mongodb-native) | `7.7.0` | `7.8.0` |
| [mssql](https://github.com/tediousjs/node-mssql) | `12.7.13` | `12.7.14` |
| [next](https://github.com/vercel/next.js) | `16.4.3` | `16.4.5` |
| [openid-client](https://github.com/panva/openid-client) | `6.8.8` | `6.8.9` |
| [react-resizable-panels](https://github.com/bvaughn/react-resizable-panels) | `4.15.2` | `4.18.1` |


Updates `@platformatic/kafka` from 2.14.0 to 2.15.0
- [Release notes](https://github.com/platformatic/kafka/releases)
- [Commits](platformatic/kafka@v2.14.0...v2.15.0)

Updates `@tanstack/react-virtual` from 3.14.24 to 3.14.26
- [Release notes](https://github.com/TanStack/virtual/releases)
- [Changelog](https://github.com/TanStack/virtual/blob/main/packages/react-virtual/CHANGELOG.md)
- [Commits](https://github.com/TanStack/virtual/commits/@tanstack/react-virtual@3.14.26/packages/react-virtual)

Updates `@xyflow/react` from 12.12.0 to 12.12.1
- [Release notes](https://github.com/xyflow/xyflow/releases)
- [Changelog](https://github.com/xyflow/xyflow/blob/main/packages/react/CHANGELOG.md)
- [Commits](https://github.com/xyflow/xyflow/commits/@xyflow/react@12.12.1/packages/react)

Updates `framer-motion` from 14.9.0 to 14.9.1
- [Changelog](https://github.com/motiondivision/motion/blob/main/CHANGELOG.md)
- [Commits](motiondivision/motion@v14.9.0...v14.9.1)

Updates `geist` from 1.9.0 to 1.9.1
- [Release notes](https://github.com/vercel/geist-font/releases)
- [Changelog](https://github.com/vercel/geist-font/blob/main/packages/next/CHANGELOG.md)
- [Commits](https://github.com/vercel/geist-font/commits/v1.9.1/packages/next)

Updates `hyparquet-compressors` from 1.1.2 to 1.1.3
- [Changelog](https://github.com/hyparam/hyparquet-compressors/blob/master/CHANGELOG.md)
- [Commits](hyparam/hyparquet-compressors@v1.1.2...v1.1.3)

Updates `lucide-react` from 1.65.0 to 1.69.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.69.0/packages/lucide-react)

Updates `mongodb` from 7.7.0 to 7.8.0
- [Release notes](https://github.com/mongodb/node-mongodb-native/releases)
- [Changelog](https://github.com/mongodb/node-mongodb-native/blob/main/HISTORY.md)
- [Commits](mongodb/node-mongodb-native@v7.7.0...v7.8.0)

Updates `mssql` from 12.7.13 to 12.7.14
- [Release notes](https://github.com/tediousjs/node-mssql/releases)
- [Changelog](https://github.com/tediousjs/node-mssql/blob/master/CHANGELOG.txt)
- [Commits](tediousjs/node-mssql@v12.7.13...v12.7.14)

Updates `next` from 16.4.3 to 16.4.5
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.4.3...v16.4.5)

Updates `openid-client` from 6.8.8 to 6.8.9
- [Release notes](https://github.com/panva/openid-client/releases)
- [Changelog](https://github.com/panva/openid-client/blob/main/CHANGELOG.md)
- [Commits](panva/openid-client@v6.8.8...v6.8.9)

Updates `react-resizable-panels` from 4.15.2 to 4.18.1
- [Release notes](https://github.com/bvaughn/react-resizable-panels/releases)
- [Changelog](https://github.com/bvaughn/react-resizable-panels/blob/main/CHANGELOG.md)
- [Commits](bvaughn/react-resizable-panels@4.15.2...4.18.1)

---
updated-dependencies:
- dependency-name: "@platformatic/kafka"
  dependency-version: 2.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: "@tanstack/react-virtual"
  dependency-version: 3.14.26
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: "@xyflow/react"
  dependency-version: 12.12.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: framer-motion
  dependency-version: 14.9.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: geist
  dependency-version: 1.9.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: hyparquet-compressors
  dependency-version: 1.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: lucide-react
  dependency-version: 1.69.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: mongodb
  dependency-version: 7.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: mssql
  dependency-version: 12.7.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: next
  dependency-version: 16.4.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: openid-client
  dependency-version: 6.8.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: react-resizable-panels
  dependency-version: 4.18.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Dependency version updates label Nov 9, 2026
@socket-security

socket-security Bot commented Nov 9, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatednpm/​next@​16.4.3 ⏵ 16.4.56210090 +19970
Updatednpm/​@​tanstack/​react-virtual@​3.14.24 ⏵ 3.14.261001006998 +1100
Updatednpm/​lucide-react@​1.65.0 ⏵ 1.69.0100 +110097 -296 +180
Updatednpm/​openid-client@​6.8.8 ⏵ 6.8.98410010091 +2100
Updatednpm/​hyparquet-compressors@​1.1.2 ⏵ 1.1.31001009988 +6100
Updatednpm/​geist@​1.9.0 ⏵ 1.9.1100 +110010096 +190
Updatednpm/​@​xyflow/​react@​12.12.0 ⏵ 12.12.19910010092100
Updatednpm/​mongodb@​7.7.0 ⏵ 7.8.09510010098100
Updatednpm/​react-resizable-panels@​4.15.2 ⏵ 4.18.199 +1100100 +196 +1100
Updatednpm/​framer-motion@​14.9.0 ⏵ 14.9.198 +1100100 +198100
Updatednpm/​mssql@​12.7.13 ⏵ 12.7.1410010010098 -1100
Updatednpm/​@​platformatic/​kafka@​2.14.0 ⏵ 2.15.09910010098 -2100

View full report

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Dependency version updates

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants