Skip to content

Update npm non-major dependencies#33246

Draft
renovate[bot] wants to merge 1 commit intodevelopfrom
renovate/npm-minor-patch
Draft

Update npm non-major dependencies#33246
renovate[bot] wants to merge 1 commit intodevelopfrom
renovate/npm-minor-patch

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Apr 21, 2026

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@formatjs/intl-segmenter 12.2.112.2.2 age confidence
@microsoft/api-extractor (source) 7.56.07.58.5 age confidence
@sentry/browser (source) 10.47.010.49.0 age confidence
@typescript-eslint/parser (source) 8.58.08.58.2 age confidence
dotenv 17.4.017.4.2 age confidence
jsrsasign (source) 11.1.111.1.3 age confidence
knip (source) 6.3.06.4.1 age confidence
mailpit-api (source) 1.7.01.9.0 age confidence
maplibre-gl (source) 5.22.05.23.0 age confidence
posthog-js (source) 1.364.71.369.3 age confidence
prettier (source) 3.8.13.8.3 age confidence
stylelint (source) 17.6.017.8.0 age confidence
wait-on 9.0.49.0.5 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.


Release Notes

formatjs/formatjs (@​formatjs/intl-segmenter)

v12.2.2

Compare Source

microsoft/rushstack (@​microsoft/api-extractor)

v7.58.5

Compare Source

Sat, 18 Apr 2026 03:47:10 GMT

Version update only

v7.58.4

Compare Source

Sat, 18 Apr 2026 00:15:16 GMT

Patches
  • Bump semver.

v7.58.3

Compare Source

Fri, 17 Apr 2026 15:14:57 GMT

Patches
  • Remove dependecy on lodash.

v7.58.2

Compare Source

Thu, 09 Apr 2026 00:15:07 GMT

Version update only

v7.58.1

Compare Source

Sat, 04 Apr 2026 00:14:00 GMT

Patches

v7.58.0

Compare Source

Wed, 01 Apr 2026 15:13:38 GMT

Minor changes
  • Upgrade the bundled compiler engine to TypeScript 5.9.3

v7.57.8

Compare Source

Tue, 31 Mar 2026 15:14:14 GMT

Version update only

v7.57.7

Compare Source

Mon, 09 Mar 2026 15:14:07 GMT

Patches
  • Bump minimatch version from 10.2.1 to 10.2.3 to address CVE-2026-27903.

v7.57.6

Compare Source

Wed, 25 Feb 2026 21:39:42 GMT

Patches

v7.57.5

Compare Source

Wed, 25 Feb 2026 00:34:29 GMT

Version update only

v7.57.4

Compare Source

Tue, 24 Feb 2026 01:13:27 GMT

Version update only

v7.57.3

Compare Source

Mon, 23 Feb 2026 00:42:21 GMT

Patches
  • Add missing "./extends/*.json" to the package.json "exports" field so that "@​microsoft/api-extractor/extends/tsdoc-base.json" is importable.

v7.57.2

Compare Source

Fri, 20 Feb 2026 16:14:49 GMT

Patches
  • Bump minimatch from 10.1.2 to 10.2.1

v7.57.1

Compare Source

Fri, 20 Feb 2026 00:15:03 GMT

Patches
  • Add "node" condition before "import" in the "exports" map so that Node.js uses the CJS output (which handles extensionless imports), while bundlers still use ESM via "import". Fixes #​5644.

v7.57.0

Compare Source

Thu, 19 Feb 2026 00:04:52 GMT

Minor changes
  • Normalize package layout. CommonJS is now under lib-commonjs, DTS is now under lib-dts, and ESM is now under lib-esm. Imports to lib still work as before, handled by the "exports" field in package.json.

v7.56.3

Compare Source

Sat, 07 Feb 2026 01:13:26 GMT

Patches
  • Upgrade lodash dependency from ~4.17.15 to ~4.17.23.

v7.56.2

Compare Source

Wed, 04 Feb 2026 20:42:47 GMT

Patches
  • Update minimatch dependency from 10.0.3 to 10.1.2

v7.56.1

Compare Source

Wed, 04 Feb 2026 16:13:27 GMT

Version update only

getsentry/sentry-javascript (@​sentry/browser)

v10.49.0

Compare Source

Important Changes
  • feat(browser): Add View Hierarchy integration (#​14981)

    A new viewHierarchyIntegration captures the DOM structure when an error occurs, providing a snapshot of the page state for debugging. Enable it in your Sentry configuration:

    import * as Sentry from '@​sentry/browser';
    
    Sentry.init({
      dsn: '__DSN__',
      integrations: [Sentry.viewHierarchyIntegration()],
    });
  • feat(cloudflare): Split alarms into multiple traces and link them (#​19373)

    Durable Object alarms now create separate traces for each alarm invocation, with proper linking between related alarms for better observability.

  • feat(cloudflare): Enable RPC trace propagation with enableRpcTracePropagation (#​19991, #​20345)

    A new enableRpcTracePropagation option enables automatic trace propagation for Cloudflare RPC calls via .fetch(), ensuring distributed traces flow correctly across service bindings.

  • feat(core): Add enableTruncation option to AI integrations (#​20167, #​20181, #​20182, #​20183, #​20184)

    All AI integrations (OpenAI, Anthropic, Google GenAI, LangChain, LangGraph) now support an enableTruncation option to control whether large AI inputs/outputs are truncated.

  • feat(opentelemetry): Vendor AsyncLocalStorageContextManager (#​20243)

    The OpenTelemetry context manager is now vendored internally, reducing external dependencies and ensuring consistent behavior across environments.

Other Changes
  • feat(core): Export a reusable function to add tracing headers (#​20076)
  • feat(core): Expose rewriteSources top level option (#​20142)
  • feat(deps): bump defu from 6.1.4 to 6.1.6 (#​20104)
  • feat(node-native): Add support for V8 v14 (Node v25+) (#​20125)
  • feat(node): Include global scope for eventLoopBlockIntegration (#​20108)
  • fix(core, node): Support loading Express options lazily (#​20211)
  • fix(core): Set conversation_id only on gen_ai spans (#​20274)
  • fix(core): Use ai.operationId for Vercel AI V6 operation name mapping (#​20285)
  • fix(deno): Avoid inferring invalid span op from Deno tracer (#​20128)
  • fix(deno): Handle reader.closed rejection from releaseLock() in streaming (#​20187)
  • fix(nextjs): Preserve directive prologues in turbopack loaders (#​20103)
  • fix(nextjs): Skip custom browser tracing setup for bot user agents (#​20263)
  • fix(opentelemetry): Use WeakRef for context stored on scope to prevent memory leak (#​20328)
  • fix(replay): Use live click attributes in breadcrumbs (#​20262)
Internal Changes
  • chore: Add PR review reminder workflow (#​20175)
  • chore: Fix lint warnings (#​20250)
  • chore(bugbot): Add rules to flag test-flake-provoking patterns (#​20192)
  • chore(ci): Bump actions/cache to v5 and actions/download-artifact to v7 (#​20249)
  • chore(ci): Bump dorny/paths-filter from v3.0.1 to v4.0.1 (#​20251)
  • chore(ci): Remove codecov steps from jobs that produce no coverage/JUnit data (#​20244)
  • chore(ci): Remove craft changelog preview (#​20271)
  • chore(ci): Remove node-overhead GitHub Action (#​20246)
  • chore(ci): Replace pr-labels-action with native GitHub expressions (#​20252)
  • chore(ci): Skip flaky issue creation for optional tests (#​20288)
  • chore(deps-dev): Bump @​sveltejs/kit from 2.53.3 to 2.57.1 (#​20216)
  • chore(deps-dev): Bump vite from 7.2.0 to 7.3.2 in /dev-packages/e2e-tests/test-applications/tanstackstart-react (#​20107)
  • chore(deps): Bump axios from 1.13.5 to 1.15.0 (#​20180)
  • chore(deps): Bump axios from 1.13.5 to 1.15.0 in /dev-packages/e2e-tests/test-applications/nestjs-basic (#​20179)
  • chore(deps): Bump hono from 4.12.7 to 4.12.12 (#​20118)
  • chore(deps): Bump hono from 4.12.7 to 4.12.12 in /dev-packages/e2e-tests/test-applications/cloudflare-hono (#​20119)
  • chore(deps): Bump next from 16.1.7 to 16.2.3 in nextjs-16-cf-workers (#​20289)
  • chore(size-limit): Bump failing size limit scenario (#​20186)
  • ci: Add automatic flaky test detector (#​18684)
  • ci: Extract test names for flaky test issues (#​20298)
  • ci: Remove Docker container for Verdaccio package publishing (#​20329)
  • fix(ci): Prevent command injection in ci-metadata workflow (#​19899)
  • fix(e2e-tests): Remove flaky navigation breadcrumb assertions from parameterized-routes tests (#​20202)
  • fix(e2e): Add op check to waitForTransaction in React Router e2e tests (#​20193)
  • fix(node-integration-tests): Fix flaky kafkajs test race condition (#​20189)
  • ref(core): Add registry in Vercel ai integration (#​20098)
  • ref(core): Automatically disable truncation when span streaming is enabled in Anthropic AI integration (#​20228)
  • ref(core): Automatically disable truncation when span streaming is enabled in Google GenAI integration (#​20229)
  • ref(core): Automatically disable truncation when span streaming is enabled in LangChain integration (#​20230)
  • ref(core): Automatically disable truncation when span streaming is enabled in LangGraph integration (#​20231)
  • ref(core): Automatically disable truncation when span streaming is enabled in OpenAI integration (#​20227)
  • ref(core): Automatically disable truncation when span streaming is enabled in Vercel AI integration (#​20232)
  • ref(core): Merge embeddings operations constants (#​20095)
  • ref(core): Remove unused constants from vercel-ai-attributes.ts (#​20096)
  • ref(nextjs): Refactor findInjectionIndexAfterDirectives for better readability (#​20310)
  • ref(opentelemetry): Replace @opentelemetry/resources with inline getSentryResource() (#​20327)
  • test: Fix flaky ANR test by increasing blocking duration (#​20239)
  • test(bun): Add bun integration test folder (#​20286)
  • test(cloudflare): Skip flaky durableobject-spans test (#​20282)
  • test(openai): Use multi-message scenario in no-truncation test (#​20194)
  • test(react): Remove duplicated test mock (#​20200)
  • tests(ai): Fix streaming+truncation integration tests across AI integrations (#​20326)

Bundle size 📦

Path Size
@​sentry/browser 25.18 KB
@​sentry/browser - with treeshaking flags 23.71 KB
@​sentry/browser (incl. Tracing) 42.59 KB
@​sentry/browser (incl. Tracing + Span Streaming) 44.26 KB
@​sentry/browser (incl. Tracing, Profiling) 47.37 KB
@​sentry/browser (incl. Tracing, Replay) 80.8 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags 70.55 KB
@​sentry/browser (incl. Tracing, Replay with Canvas) 85.38 KB
@​sentry/browser (incl. Tracing, Replay, Feedback) 97.34 KB
@​sentry/browser (incl. Feedback) 41.59 KB
@​sentry/browser (incl. sendFeedback) 29.74 KB
@​sentry/browser (incl. FeedbackAsync) 34.62 KB
@​sentry/browser (incl. Metrics) 26.44 KB
@​sentry/browser (incl. Logs) 26.57 KB
@​sentry/browser (incl. Metrics & Logs) 27.24 KB
@​sentry/react 26.89 KB
@​sentry/react (incl. Tracing) 44.81 KB
@​sentry/vue 29.89 KB
@​sentry/vue (incl. Tracing) 44.38 KB
@​sentry/svelte 25.2 KB
CDN Bundle 27.79 KB
CDN Bundle (incl. Tracing) 43.64 KB
CDN Bundle (incl. Logs, Metrics) 29.13 KB
CDN Bundle (incl. Tracing, Logs, Metrics) 44.7 KB
CDN Bundle (incl. Replay, Logs, Metrics) 67.12 KB
CDN Bundle (incl. Tracing, Replay) 79.74 KB
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) 80.79 KB
CDN Bundle (incl. Tracing, Replay, Feedback) 85.13 KB
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) 86.17 KB
CDN Bundle - uncompressed 81.17 KB
CDN Bundle (incl. Tracing) - uncompressed 130.51 KB
CDN Bundle (incl. Logs, Metrics) - uncompressed 85.22 KB
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed 133.84 KB
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed 205.7 KB
CDN Bundle (incl. Tracing, Replay) - uncompressed 244.99 KB
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed 248.31 KB
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed 257.6 KB
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed 260.91 KB
@​sentry/nextjs (client) 47.28 KB
@​sentry/sveltekit (client) 43.02 KB
@​sentry/node-core 56.58 KB
@​sentry/node 170.68 KB
@​sentry/node - without tracing 95.57 KB
@​sentry/aws-serverless 112.42 KB

v10.48.0

Compare Source

typescript-eslint/typescript-eslint (@​typescript-eslint/parser)

v8.58.2

Compare Source

🩹 Fixes
  • remove tsbuildinfo cache file from published packages (#​12187)
❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.58.1

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

motdotla/dotenv (dotenv)

v17.4.2

Compare Source

v17.4.1

Compare Source

kjur/jsrsasign (jsrsasign)

v11.1.3: Security Fix

Compare Source

  • Changes from 11.1.2 to 11.1.3 (2026-Apr-18)
    • base64x.js
      • timingSafeEqual and timingSafeEqualImpl added
    • jws.js
      • modified to use timingSafeEqual for HS* signature verification
    • Security fixes:
    • bugfix
      • jws.js
        • wrong thumbprint calculation for symmetric key (KJUR.jws.JWS.getJWKthumbprint)
          reported in issue #​656 by @​e3stpavel

v11.1.2: Security Fix

Compare Source

  • Changes from 11.1.1 to 11.1.2 (2026-Apr-12)
    • Security fixes:
      • HIGH: wrong random for for Node.JS >= 19 and modern browsers (ext/rng.js SecureRandom)
        reported by Bronson Yen of Calif.io and @​Kr0emer #​655.
      • HIGH: ASN.1 Parser Infinite Loop (asn1hex.js)
        getChildIdx fix to avoid infinite loop reported by Koda Reef.
      • HIGH: DSA Universal Signature Forgery (dsa.js)
        FIPS 186-4 section 4.7 wrong boundary checking in verifyWithMessageHash
        reported by Koda Reef, Nicholas Carlini and @​Kr0emer.
      • ASN1HEX.getChildIdx DoS (asn1hex.js)
        getChildIdx may raise DoS because of lacking value length check
        reported by Yt(yutengsun) and Franciny S Roj.
      • missing JWS crit header parameter validation (jws.js)
        as reported by Franciny S Roj.
        Thank you indeed for those vulnerability reports and/or patches.
webpro-nl/knip (knip)

v6.4.1: Release 6.4.1

Compare Source

v6.4.0: Release 6.4.0

Compare Source

v6.3.1: Release 6.3.1

Compare Source

mpspahr/mailpit-api (mailpit-api)

v1.9.0

Compare Source

What's Changed

Improvements

  • Added optional third parameter to the MailpitClient constructor that accepts Axios configuration options CreateAxiosDefaults minus baseURL, auth, and validateStatus.

Maintenance

  • Updated dependency

Full Changelog: mpspahr/mailpit-api@v1.8.2...v1.9.0

v1.8.2

Compare Source

What's Changed

Maintenance

  • Updated dependencies

Full Changelog: mpspahr/mailpit-api@v1.8.1...v1.8.2

v1.8.1

Compare Source

What's Changed

New Contributors

Full Changelog: mpspahr/mailpit-api@v1.8.0...v1.8.1

v1.8.0

Compare Source

What's Changed

Improvements

  • Implemented two helper methods, waitForMessage and waitForMessages, to wait for specific message(s) and/or message count.
  • Update the WebSocket implementation to improve compatibility across environments

Fixes

  • Correctly allow calling setReadStatus with no parameters
  • Improve WebSocket connections to ensure that the Node.js process can exit cleanly without hanging

Maintenance

  • Updated dependencies

Full Changelog: mpspahr/mailpit-api@v1.7.2...v1.8.0

v1.7.2

Compare Source

What's Changed

Fixes

  • Switched WebSocket import to use the partysocket/ws subpath to resolve a compatibility issue affecting CommonJS consumers.

Maintenance

  • Updated dependencies

Full Changelog: mpspahr/mailpit-api@v1.7.1...v1.7.2

v1.7.1

Compare Source

What's Changed

Improvements

Updated MailpitSpamAssassinResponse to account for spamAssassinCheck() returning an error resulting in Rules set to null

Maintenance

Updated dependencies

Full Changelog: mpspahr/mailpit-api@v.1.7.0...v1.7.1

maplibre/maplibre-gl-js (maplibre-gl)

v5.23.0

Compare Source

✨ Features and improvements
  • Add touchZoomRotate.setZoomRate() and touchZoomRotate.setZoomThreshold() to customize touch zoom speed and pinch sensitivity (#​7271)
  • Improve ability to communicate with imported scripts in workers and use makeRequest in workres as well (#​7451) (by @​HarelM)
  • Allow opacity and opacityWhenCovered in Marker and MarkerOptions to accept number in addition to string, and add maplibregl-marker-covered CSS class to Marker element when covered by 3D terrain or a globe (#​7433) (by @​YuChunTsao)
  • perf: add a bench for terrain rendering and fix _demMatrixCache lookup being wasted cycles by actually using the cache (#​7400) (by @​CommanderStorm)
🐞 Bug fixes
  • Fix polygon text label placement drifting far from center for convex polygons at high zoom due to coordinate rounding in geojson-vt (#​7380) (by @​CommanderStorm)
  • Ensure that a successful ArrayBuffer response from a custom protocol that is null/undefined is set to an empty ArrayBuffer (#​7427) (by @​neodescis)
  • Fix error in _contextRestored when map was initialized without a style (#​7432) (by @​mvanhorn)
  • Fix issue with the cache used for zoomLevelsToOverscale feature (#​7450) (by @​HarelM)
  • Update stylelint and fix old issues with the CSS (mainly change rgb to use spaces) (#​7365) (by @​HarelM)
PostHog/posthog-js (posthog-js)

v1.369.3

Compare Source

1.369.3

Patch Changes

v1.369.2

Compare Source

1.369.2

Patch Changes

v1.369.1

Compare Source

1.369.1

Patch Changes
  • #​3393 85ae4d9 Thanks @​haacked! - Exclude active feature flag payloads from event properties
    (2026-04-16)

  • #​3392 00cd1ce Thanks @​haacked! - Fix unnecessary persisted config and activation properties (including product tours, surveys, and session recording config) added to captured events
    (2026-04-16)

  • Updated dependencies []:

v1.369.0

Compare Source

1.369.0

Minor Changes
Patch Changes

v1.368.2

Compare Source

1.368.2

Patch Changes

v1.368.1

Compare Source

1.368.1

Patch Changes
  • #​3379 d7c71b1 Thanks @​dmarticus! - Fix bootstrapped feature flags being overwritten by partial /flags response when advanced_only_evaluate_survey_feature_flags is enabled
    (2026-04-14)
  • Updated dependencies []:

v1.368.0

Compare Source

1.368.0

Minor Changes
Patch Changes

v1.367.0

Compare Source

1.367.0

Minor Changes
Patch Changes

v1.366.2


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Dependencies Pull requests that update a dependency file T-Task Tasks for the team like planning

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants