Skip to content

chore(deps): bump the prod-dependencies group across 1 directory with 10 updates - #2052

Closed
dependabot[bot] wants to merge 1 commit into
betafrom
dependabot/npm_and_yarn/beta/prod-dependencies-ecf65635d1
Closed

chore(deps): bump the prod-dependencies group across 1 directory with 10 updates#2052
dependabot[bot] wants to merge 1 commit into
betafrom
dependabot/npm_and_yarn/beta/prod-dependencies-ecf65635d1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the prod-dependencies group with 10 updates in the / directory:

Package From To
@fastify/compress 9.1.0 9.2.0
@fastify/helmet 13.1.0 13.1.1
@fastify/multipart 10.1.0 10.1.1
@fastify/static 10.1.2 10.1.3
better-sqlite3 13.0.2 13.0.3
fastify 5.11.0 5.12.1
openid-client 6.8.4 6.8.7
i18next 26.3.6 26.4.0
konva 10.3.0 10.3.1
react-i18next 17.0.11 17.0.12

Updates @fastify/compress from 9.1.0 to 9.2.0

Release notes

Sourced from @​fastify/compress's releases.

v9.2.0

What's Changed

Full Changelog: fastify/fastify-compress@v9.1.1...v9.2.0

v9.1.1

What's Changed

New Contributors

Full Changelog: fastify/fastify-compress@v9.1.0...v9.1.1

Commits
  • d531951 Bumped v9.2.0
  • bb135f1 fix: unwrap fetch response before noCompress check for SSE support (#421)
  • 13616f9 chore: bump fastify/workflows/.github/workflows/plugins-ci.yml (#422)
  • 847e9ab chore: bump fastify/workflows/.github/workflows/lock-threads.yml (#423)
  • 382485b perf: compress small buffered payloads synchronously (#418)
  • 6c034ec chore(.npmrc): add min-release-age (#419)
  • 7602400 Bumped v9.1.1
  • a782a78 fix: unwrap fetch response body without losing headers and status (#420)
  • 646303a chore: bump adm-zip from 0.5.18 to 0.6.0 (#416)
  • 4c89887 chore: bump c8 from 11.0.0 to 12.0.0 (#417)
  • Additional commits viewable in compare view

Updates @fastify/helmet from 13.1.0 to 13.1.1

Release notes

Sourced from @​fastify/helmet's releases.

v13.1.1

What's Changed

Full Changelog: fastify/fastify-helmet@v13.1.0...v13.1.1

Commits
Maintainer changes

This version was pushed to npm by tony133, a new releaser for @​fastify/helmet since your current version.


Updates @fastify/multipart from 10.1.0 to 10.1.1

Release notes

Sourced from @​fastify/multipart's releases.

v10.1.1

⚠️ Security Release

What's Changed

Full Changelog: fastify/fastify-multipart@v10.1.0...v10.1.1

Commits
  • 6c4478a Bumped v10.1.1
  • 4005714 Merge commit from fork
  • 556cdb1 Merge commit from fork
  • 25e8ccb chore: bump fastify/workflows/.github/workflows/plugins-ci.yml (#640)
  • d0d77b5 chore: bump fastify/workflows/.github/workflows/lock-threads.yml (#639)
  • c8e29f7 chore(.npmrc): add min-release-age
  • 3468939 chore: bump c8 from 11.0.0 to 12.0.0 (#635)
  • a2d1367 ci: pin actions to commit-hash
  • See full diff in compare view

Updates @fastify/static from 10.1.2 to 10.1.3

Release notes

Sourced from @​fastify/static's releases.

v10.1.3

What's Changed

Full Changelog: fastify/fastify-static@v10.1.2...v10.1.3

Commits

Updates better-sqlite3 from 13.0.2 to 13.0.3

Release notes

Sourced from better-sqlite3's releases.

v13.0.3

What's Changed

Full Changelog: WiseLibs/better-sqlite3@v13.0.2...v13.0.3

Commits

Updates fastify from 5.11.0 to 5.12.1

Release notes

Sourced from fastify's releases.

v5.12.1

⚠️ Security release

What's Changed

Full Changelog: fastify/fastify@v5.12.0...v5.12.1

v5.12.0

What's Changed

Full Changelog: fastify/fastify@v5.11.3...v5.12.0

v5.11.3

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.11.2...v5.11.3

v5.11.2

What's Changed

... (truncated)

Commits

Updates openid-client from 6.8.4 to 6.8.7

Release notes

Sourced from openid-client's releases.

v6.8.7

Fixes

  • allow destructuring the claims helper (38bd8c0), references #887

v6.8.6

Fixes

  • avoid undefined user-agent in fetchProtectedResource (492c3c3), references #885

v6.8.5

Fixes

  • types: expose custom fetch duplex option (a125bc8)
  • types: use portable oauth4webapi declarations (2cab98f)

Documentation

  • improve API index tables (c6e4ae3)
  • update README.md and SECURITY.md to reflect passed EOL dates (d3721c2)
Changelog

Sourced from openid-client's changelog.

6.8.7 (2026-08-20)

Fixes

  • allow destructuring the claims helper (38bd8c0), references #887

6.8.6 (2026-08-18)

Fixes

  • avoid undefined user-agent in fetchProtectedResource (492c3c3), references #885

6.8.5 (2026-08-11)

Fixes

  • types: expose custom fetch duplex option (a125bc8)
  • types: use portable oauth4webapi declarations (2cab98f)

Documentation

  • improve API index tables (c6e4ae3)
  • update README.md and SECURITY.md to reflect passed EOL dates (d3721c2)
Commits
  • daa81c1 chore(release): 6.8.7
  • 38bd8c0 fix: allow destructuring the claims helper
  • 2f12d9a chore: cleanup after release
  • 4b2a7ab chore(release): 6.8.6
  • 492c3c3 fix: avoid undefined user-agent in fetchProtectedResource
  • 0e0539b ci: update conformance runs outputs
  • b7ac789 chore: cleanup after release
  • efb53e5 chore(release): 6.8.5
  • 4a66935 test: deflake Retry-After date assertions
  • 6b7afa3 chore: bump packages
  • Additional commits viewable in compare view

Updates i18next from 26.3.6 to 26.4.0

Release notes

Sourced from i18next's releases.

v26.4.0

  • perf: cache toResolveHierarchy results per (code, fallbackCode) pair. The hierarchy resolver runs on every t() call and calls Intl.getCanonicalLocales multiple times, which showed up prominently when profiling render-heavy UIs (e.g. virtualized data grids); with the cache the per-call cost drops from ~886 ns to ~41 ns. The cache is invalidated automatically when options.fallbackLng changes (reassignment or in-place array mutation); if you mutate other resolution-relevant options at runtime (load, lowerCaseLng, cleanCode, nonExplicitSupportedLngs), call i18next.services.languageUtils.clearCache() afterwards. Function-valued fallbackLng and per-call array/object fallbackLng options are never cached, so dynamic fallbacks keep working as before. Thanks @​equaterina (#2444).
  • chore: update all devDependencies (Babel stays on 7.x until @rollup/plugin-babel supports 8, eslint on 9.x for neostandard). Removed the unused coveralls package (CI uses the Coveralls GitHub Action) and replaced sinon with nise + vitest.spyOn in the v1 compatibility tests, which resolves all open npm audit findings (0 vulnerabilities) and should close the dependabot alerts on the lockfile.
Changelog

Sourced from i18next's changelog.

26.4.0

  • perf: cache toResolveHierarchy results per (code, fallbackCode) pair. The hierarchy resolver runs on every t() call and calls Intl.getCanonicalLocales multiple times, which showed up prominently when profiling render-heavy UIs (e.g. virtualized data grids); with the cache the per-call cost drops from ~886 ns to ~41 ns. The cache is invalidated automatically when options.fallbackLng changes (reassignment or in-place array mutation); if you mutate other resolution-relevant options at runtime (load, lowerCaseLng, cleanCode, nonExplicitSupportedLngs), call i18next.services.languageUtils.clearCache() afterwards. Function-valued fallbackLng and per-call array/object fallbackLng options are never cached, so dynamic fallbacks keep working as before. Thanks @​equaterina (#2444).
  • chore: update all devDependencies (Babel stays on 7.x until @rollup/plugin-babel supports 8, eslint on 9.x for neostandard). Removed the unused coveralls package (CI uses the Coveralls GitHub Action) and replaced sinon with nise + vitest.spyOn in the v1 compatibility tests, which resolves all open npm audit findings (0 vulnerabilities) and should close the dependabot alerts on the lockfile.
Commits

Updates konva from 10.3.0 to 10.3.1

Release notes

Sourced from konva's releases.

10.3.1

Bug Fixes

  • Path: return last point for getPointAtLength past a closed path #2053 (Yarchik)
  • Arc.getSelfRect() reports a full circle for a zero-degree clockwise arc #2054 (Alexander Kireev)
  • Shape: respect imageSmoothingEnabled for fillPatternImage #2055 (MarkXian)
  • Util: preserve alpha of the named color "transparent" #2056 (Yarchik)
  • Util: parse rgb() components written as percentages #2057 (jaybhade)
  • Util: colorToRGBA() fails to parse non-integer HSL hue #2059 (Xuepoo)
  • Line: getSelfRect wrong for multi-segment bezier and degenerate-derivative segments #2061 (Xuepoo)
  • Line: avoid NaN control points on closed tensioned lines with coincident points #2062 (rajanpanth)
  • Line: guard the zero-distance case inside getControlPoints (Anton Lavrevov)
  • Line: cover joints and near-degenerate derivatives in bezier bounds (Anton Lavrevov)
  • Path: exact getSelfRect bounds for quadratic segments (Anton Lavrevov)
  • Line: exact getSelfRect bounds for lines with a tension (Anton Lavrevov)

Code Refactoring

Performance Improvements

Continuous Integration

Commits

  • b5c7a83: Fix ValidatorFunc Type Mistake (foolishflyfox) #1998
  • ecdf162: Improve Transformer performance with many attached nodes (Anton Lavrevov)
  • 976a63a: Add Transformer perf invariant tests; widen autoDraw suspension (Anton Lavrevov)
  • 7b3cf3b: Simplify a bit (Anton Lavrevov)
  • a203de9: sandbox (Anton Lavrevov)
  • 6e4025c: clear (Anton Lavrevov)
  • b92018b: Merge branch 'master' of github.com:konvajs/konva (Anton Lavrevov)
  • bc123b3: Declare canvas and skia-canvas as optional peer dependencies (Anton Lavrevov)
  • ed1e0cc: Skip pattern smoothing sanity check on skia-canvas (Anton Lavrevov)
  • f9bd818: Report full circle for any full-turn angle in Arc.getSelfRect (Anton Lavrevov)
  • dd90ff4: Merge pull request #2054: fix Arc.getSelfRect for full-turn angles (Anton Lavrevov)
  • 4f8e1a8: color parsing fixes, fix some color values. close #2063, close #2064 (Anton Lavrevov)
  • 4ebadaf: Merge branch 'master' into fix/line-tension-nan (Anton Lavrevov) #2062
  • Line NaN bounding rect fix (Anton Lavrevov)
  • cover all unreleased changes since 10.3.0 (Anton Lavrevov)
  • c7145cc: Merge branch 'master' into fix/line-bezier-selfrect (Anton Lavrevov) #2061
  • d2b96f5: fix(Line,Path): share one exact solver for cubic bezier bounds (Anton Lavrevov)
  • 9e8a106: update CHANGELOG with new version (Anton Lavrevov)
  • fb706a2: build for 10.3.1 (Anton Lavrevov)
  • fad321d: update cdn link (Anton Lavrevov)
Changelog

Sourced from konva's changelog.

10.3.1 (2026-08-14)

  • Added hsla() support and the space-separated CSS Color 4 syntax to Konva.Util.colorToRGBA()
  • Declared canvas and skia-canvas as optional peer dependencies, so the node backends resolve under strict package managers
  • Improved Transformer performance with many attached nodes
  • Improved Text performance when a long text is resized
  • Path.getSelfRect() now solves the bounds of a cubic segment exactly instead of sampling it at 100 points. Reported boxes get slightly larger and more accurate, and the calculation is about 9 times faster
  • Line.getSelfRect() now solves the bounds of a line with a tension exactly, instead of using the box around its tension control points. Reported boxes get smaller and tighter, by about 19% of their area on a typical line
  • Path.getSelfRect() now also solves the bounds of a quadratic segment (Q, q, T and t) exactly, instead of using the box around its control points. Reported boxes get smaller and tighter
  • A tween of a color that Konva can not parse now throws a clear error
  • Fixed several wrong named color values: darkgoldenrod, floralwhite, plum, slategray, slategrey, snow and yellowgreen
  • Fixed the alpha of the named color transparent, so a tween to or from it fades again
  • Fixed rgb() colors with percentage components
  • Fixed hsl() colors with a non-integer hue or extra whitespace
  • Fixed fillPatternImage ignoring imageSmoothingEnabled
  • Fixed Arc.getSelfRect() for a zero-degree clockwise arc and for any full-turn angle
  • Fixed Path.getPointAtLength() returning undefined past the end of a closed path
  • Fixed NaN bounding rect on a closed Line with a tension and coincident points
  • Fixed getSelfRect() on a Line with bezier: true, which read only the first curve segment and could report a box of zero height
  • Fixed the ValidatorFunc type used by custom Factory validators
Commits
  • fad321d update cdn link
  • fb706a2 build for 10.3.1
  • 9e8a106 update CHANGELOG with new version
  • 4d01846 fix(Line): exact getSelfRect bounds for lines with a tension
  • 5a23ece fix(Path): exact getSelfRect bounds for quadratic segments
  • 407afa0 Merge pull request #2061 from Xuepoo/fix/line-bezier-selfrect
  • 74af42d ci: remove the formatting check
  • d2b96f5 fix(Line,Path): share one exact solver for cubic bezier bounds
  • 8282116 fix(Line): cover joints and near-degenerate derivatives in bezier bounds
  • c7145cc Merge branch 'master' into fix/line-bezier-selfrect
  • Additional commits viewable in compare view

Updates react-i18next from 17.0.11 to 17.0.12

Changelog

Sourced from react-i18next's changelog.

17.0.12

  • fix(IcuTrans): key-less icu.macro nodes (<Trans>Welcome, {name}!</Trans>, <Select>, <Plural> without i18nKey) rendered an empty string since 17.0.0. The macro now emits <IcuTrans defaultTranslation="…"> without a key and IcuTrans passed undefined to t(), which returns ''. Like Trans, IcuTrans now uses defaultTranslation as the key when i18nKey is not provided.
Commits
  • ea721fb 17.0.12
  • 6c2a71e fix(IcuTrans): use defaultTranslation as key when no i18nKey is given
  • 258c96d chore(examples): upgrade all example apps off unmaintained toolchains
  • b8677c8 chore: update dependencies to close dependabot alerts
  • aa9c92b docs: point Trans component links at the current docs (#1929)
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the prod-dependencies group across 1 directory with…
e5d7c45 
… 10 updates

Bumps the prod-dependencies group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@fastify/compress](https://github.com/fastify/fastify-compress) | `9.1.0` | `9.2.0` |
| [@fastify/helmet](https://github.com/fastify/fastify-helmet) | `13.1.0` | `13.1.1` |
| [@fastify/multipart](https://github.com/fastify/fastify-multipart) | `10.1.0` | `10.1.1` |
| [@fastify/static](https://github.com/fastify/fastify-static) | `10.1.2` | `10.1.3` |
| [better-sqlite3](https://github.com/WiseLibs/better-sqlite3) | `13.0.2` | `13.0.3` |
| [fastify](https://github.com/fastify/fastify) | `5.11.0` | `5.12.1` |
| [openid-client](https://github.com/panva/openid-client) | `6.8.4` | `6.8.7` |
| [i18next](https://github.com/i18next/i18next) | `26.3.6` | `26.4.0` |
| [konva](https://github.com/konvajs/konva) | `10.3.0` | `10.3.1` |
| [react-i18next](https://github.com/i18next/react-i18next) | `17.0.11` | `17.0.12` |



Updates `@fastify/compress` from 9.1.0 to 9.2.0
- [Release notes](https://github.com/fastify/fastify-compress/releases)
- [Commits](fastify/fastify-compress@v9.1.0...v9.2.0)

Updates `@fastify/helmet` from 13.1.0 to 13.1.1
- [Release notes](https://github.com/fastify/fastify-helmet/releases)
- [Commits](fastify/fastify-helmet@v13.1.0...v13.1.1)

Updates `@fastify/multipart` from 10.1.0 to 10.1.1
- [Release notes](https://github.com/fastify/fastify-multipart/releases)
- [Commits](fastify/fastify-multipart@v10.1.0...v10.1.1)

Updates `@fastify/static` from 10.1.2 to 10.1.3
- [Release notes](https://github.com/fastify/fastify-static/releases)
- [Commits](fastify/fastify-static@v10.1.2...v10.1.3)

Updates `better-sqlite3` from 13.0.2 to 13.0.3
- [Release notes](https://github.com/WiseLibs/better-sqlite3/releases)
- [Commits](WiseLibs/better-sqlite3@v13.0.2...v13.0.3)

Updates `fastify` from 5.11.0 to 5.12.1
- [Release notes](https://github.com/fastify/fastify/releases)
- [Commits](fastify/fastify@v5.11.0...v5.12.1)

Updates `openid-client` from 6.8.4 to 6.8.7
- [Release notes](https://github.com/panva/openid-client/releases)
- [Changelog](https://github.com/panva/openid-client/blob/main/CHANGELOG.md)
- [Commits](panva/openid-client@v6.8.4...v6.8.7)

Updates `i18next` from 26.3.6 to 26.4.0
- [Release notes](https://github.com/i18next/i18next/releases)
- [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/i18next@v26.3.6...v26.4.0)

Updates `konva` from 10.3.0 to 10.3.1
- [Release notes](https://github.com/konvajs/konva/releases)
- [Changelog](https://github.com/konvajs/konva/blob/master/CHANGELOG.md)
- [Commits](konvajs/konva@v10.3.0...10.3.1)

Updates `react-i18next` from 17.0.11 to 17.0.12
- [Changelog](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/react-i18next@v17.0.11...v17.0.12)

---
updated-dependencies:
- dependency-name: "@fastify/compress"
  dependency-version: 9.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-dependencies
- dependency-name: "@fastify/helmet"
  dependency-version: 13.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-dependencies
- dependency-name: "@fastify/multipart"
  dependency-version: 10.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-dependencies
- dependency-name: "@fastify/static"
  dependency-version: 10.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-dependencies
- dependency-name: better-sqlite3
  dependency-version: 13.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-dependencies
- dependency-name: fastify
  dependency-version: 5.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-dependencies
- dependency-name: openid-client
  dependency-version: 6.8.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-dependencies
- dependency-name: i18next
  dependency-version: 26.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-dependencies
- dependency-name: konva
  dependency-version: 10.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-dependencies
- dependency-name: react-i18next
  dependency-version: 17.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 24, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 31, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 31, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/beta/prod-dependencies-ecf65635d1 branch August 31, 2026 15:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants