Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 8 updates#2

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/production-dependencies-1c048449c6
Open

chore(deps): bump the production-dependencies group across 1 directory with 8 updates#2
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/production-dependencies-1c048449c6

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot bot commented on behalf of github Apr 4, 2026 •
edited
Loading

Bumps the production-dependencies group with 8 updates in the / directory:

Package From To
react 18.3.1 19.2.4
commander 12.1.0 14.0.3
tree-sitter 0.21.1 0.25.0
tree-sitter-python 0.21.0 0.25.0
tree-sitter-typescript 0.21.2 0.23.2
execa 8.0.1 9.6.1
glob 10.5.0 13.0.6
diff 5.2.2 8.0.4

Updates react from 18.3.1 to 19.2.4

Release notes

Sourced from react's releases.

19.2.4 (January 26th, 2026)

React Server Components

19.2.3 (December 11th, 2025)

React Server Components

19.2.2 (December 11th, 2025)

React Server Components

19.2.1 (December 3rd, 2025)

React Server Components

19.2.0 (Oct 1, 2025)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.2 release post for more information.

New React Features

  • <Activity>: A new API to hide and restore the UI and internal state of its children.
  • useEffectEvent is a React Hook that lets you extract non-reactive logic into an Effect Event.
  • cacheSignal (for RSCs) lets your know when the cache() lifetime is over.
  • React Performance tracks appear on the Performance panel’s timeline in your browser developer tools

New React DOM Features

  • Added resume APIs for partial pre-rendering with Web Streams:
  • Added resume APIs for partial pre-rendering with Node Streams:
  • Updated prerender APIs to return a postponed state that can be passed to the resume APIs.

Notable changes

  • React DOM now batches suspense boundary reveals, matching the behavior of client side rendering. This change is especially noticeable when animating the reveal of Suspense boundaries e.g. with the upcoming <ViewTransition> Component. React will batch as much reveals as possible before the first paint while trying to hit popular first-contentful paint metrics.
  • Add Node Web Streams (prerender, renderToReadableStream) to server-side-rendering APIs for Node.js
  • Use underscore instead of : IDs generated by useId

All Changes

... (truncated)

Changelog

Sourced from react's changelog.

19.2.1 (Dec 3, 2025)

React Server Components

19.2.0 (October 1st, 2025)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.2 release post for more information.

New React Features

  • <Activity>: A new API to hide and restore the UI and internal state of its children.
  • useEffectEvent is a React Hook that lets you extract non-reactive logic into an Effect Event.
  • cacheSignal (for RSCs) lets your know when the cache() lifetime is over.
  • React Performance tracks appear on the Performance panel’s timeline in your browser developer tools

New React DOM Features

  • Added resume APIs for partial pre-rendering with Web Streams:
  • Added resume APIs for partial pre-rendering with Node Streams:
  • Updated prerender APIs to return a postponed state that can be passed to the resume APIs.

Notable changes

  • React DOM now batches suspense boundary reveals, matching the behavior of client side rendering. This change is especially noticeable when animating the reveal of Suspense boundaries e.g. with the upcoming <ViewTransition> Component. React will batch as much reveals as possible before the first paint while trying to hit popular first-contentful paint metrics.
  • Add Node Web Streams (prerender, renderToReadableStream) to server-side-rendering APIs for Node.js
  • Use underscore instead of : IDs generated by useId

All Changes

React

... (truncated)

Commits

Updates commander from 12.1.0 to 14.0.3

Release notes

Sourced from commander's releases.

v14.0.3

Added

  • Release Policy document (#2462)

Changes

  • old major versions now supported for 12 months instead of just previous major version, to give predictable end-of-life date (#2462)
  • clarify typing for deprecated callback parameter to .outputHelp() (#2427)
  • simple readability improvements to README (#2465)

v14.0.2

Changed

  • improve negative number auto-detection test (#2428)
  • update (dev) dependencies

v14.0.1

Fixed

  • broken markdown link in README (#2369)

Changed

  • improve code readability by using optional chaining (#2394)
  • use more idiomatic code with object spread instead of Object.assign() (#2395)
  • improve code readability using string.endsWith() instead of string.slice() (#2396)
  • refactor .parseOptions() to process args array in-place (#2409)
  • change private variadic support routines from ._concatValue() to ._collectValue() (change code from array.concat() to array.push()) (#2410)
  • update (dev) dependencies

v14.0.0

Added

  • support for groups of options and commands in the help using low-level .helpGroup() on Option and Command, and higher -level .optionsGroup() and .commandsGroup() which can be used in chaining way to specify group title for following option s/commands (#2328)
  • support for unescaped negative numbers as option-arguments and command-arguments (#2339)
  • TypeScript: add parseArg property to Argument class (#2359)

Fixed

  • remove bogus leading space in help when option has default value but not a description (#2348)
  • .configureOutput() now makes copy of settings instead of modifying in-place, fixing side-effects (#2350)

Changed

  • Breaking: Commander 14 requires Node.js v20 or higher
  • internal refactor of Help class adding .formatItemList() and .groupItems() methods (#2328)

... (truncated)

Changelog

Sourced from commander's changelog.

[14.0.3] (2026-01-31)

Added

  • Release Policy document (#2462)

Changes

  • old major versions now supported for 12 months instead of just previous major version, to give predictable end-of-life date (#2462)
  • clarify typing for deprecated callback parameter to .outputHelp() (#2427)
  • simple readability improvements to README (#2465)

[14.0.2] (2025-10-25)

Changed

  • improve negative number auto-detection test (#2428)
  • update (dev) dependencies

[14.0.1] (2025-09-12)

Fixed

  • broken markdown link in README (#2369)

Changed

  • improve code readability by using optional chaining (#2394)
  • use more idiomatic code with object spread instead of Object.assign() (#2395)
  • improve code readability using string.endsWith() instead of string.slice() (#2396)
  • refactor .parseOptions() to process args array in-place (#2409)
  • change private variadic support routines from ._concatValue() to ._collectValue() (change code from array.concat() to array.push()) (#2410)
  • update (dev) dependencies

[14.0.0] (2025-05-18)

Added

  • support for groups of options and commands in the help using low-level .helpGroup() on Option and Command, and higher-level .optionsGroup() and .commandsGroup() which can be used in chaining way to specify group title for following options/commands (#2328)
  • support for unescaped negative numbers as option-arguments and command-arguments (#2339)
  • TypeScript: add parseArg property to Argument class (#2359)

Fixed

  • remove bogus leading space in help when option has default value but not a description (#2348)
  • .configureOutput() now makes copy of settings instead of modifying in-place, fixing side-effects (#2350)

Changed

  • Breaking: Commander 14 requires Node.js v20 or higher

... (truncated)

Commits

Updates tree-sitter from 0.21.1 to 0.25.0

Release notes

Sourced from tree-sitter's releases.

v0.22.4

Full Changelog: tree-sitter/node-tree-sitter@v0.22.3...v0.22.4

Commits

Updates tree-sitter-python from 0.21.0 to 0.25.0

Release notes

Sourced from tree-sitter-python's releases.

v0.25.0

NOTE: Download tree-sitter-python.tar.gz for the complete source code.

v0.23.6

NOTE: Download tree-sitter-python.tar.xz for the complete source code.

v0.23.5

NOTE: Download tree-sitter-python.tar.xz for the complete source code.

v0.23.4

NOTE: Download tree-sitter-python.tar.xz for the complete source code.

v0.23.3

NOTE: Download tree-sitter-python.tar.xz for the complete source code.

Commits
  • 293fdc0 0.25.0
  • 34a91a2 chore: generate
  • 8ad8a51 ci: update failing files
  • a0b84ed test: update tests
  • 1b1ca93 fix: give a higher lexical precedence to the * in except*
  • a4c106f feat: allow multiple exception expressions without parenthesis
  • 29e3bc2 refactor!: simplify exceptions
  • d8f9e69 feat: add PEP 750 template string support
  • 7ff26da feat: simplify try statement by accepting missing else/except/finally blocks
  • afdba00 build: update bindings
  • Additional commits viewable in compare view

Updates tree-sitter-typescript from 0.21.2 to 0.23.2

Release notes

Sourced from tree-sitter-typescript's releases.

v0.23.2

NOTE: Download tree-sitter-typescript.tar.xz for the complete source code.

v0.23.1

NOTE: Download tree-sitter-typescript.tar.xz for the complete source code.

Commits
  • f975a62 0.23.2
  • 61e2a77 0.23.1
  • 7bfe051 fix(rust): don't fetch files from node_modules
  • aa6c28f fix: remove glimmer tags
  • 9230875 build: move tree-sitter-javascript to dependencies
  • 14af167 chore: regenerate
  • 31725c1 build: update bindings
  • 89e0420 feat(node): support single-file executables via bun build --compile
  • 73c4447 chore: regenerate
  • 18bb23a build: update bindings
  • Additional commits viewable in compare view

Updates execa from 8.0.1 to 9.6.1

Release notes

Sourced from execa's releases.

v9.6.1

  • Fix VerboseOption type not being properly exported (#1215) 7891c39

sindresorhus/execa@v9.6.0...v9.6.1

v9.6.0

  • Update dependencies d49104a

sindresorhus/execa@v9.5.3...v9.6.0

v9.5.3

  • Fix Node 24-specific deprecation warning (#1199) 1ac5b91

sindresorhus/execa@v9.5.2...v9.5.3

v9.5.2

Bug fixes

v9.5.1

Bug fixes

v9.5.0

Features

await execa({stdout: {file: 'output.txt', append: true}})`npm run build`;

v9.4.1

Bug fixes

v9.4.0

Features

  • We've created a separate package called nano-spawn. It is similar to Execa but with fewer features, for a much smaller package size. More info.

... (truncated)

Commits

Updates glob from 10.5.0 to 13.0.6

Changelog

Sourced from glob's changelog.

changeglob

13

  • Move the CLI program out to a separate package, glob-bin. Install that if you'd like to continue using glob from the command line.

12

  • Remove the unsafe --shell option. The --shell option is now ONLY supported on known shells where the behavior can be implemented safely.

11.1

GHSA-5j98-mcp5-4vw2

  • Add the --shell option for the command line, with a warning that this is unsafe. (It will be removed in v12.)
  • Add the --cmd-arg/-g as a way to safely add positional arguments to the command provided to the CLI tool.
  • Detect commands with space or quote characters on known shells, and pass positional arguments to them safely, avoiding shell:true execution.

11.0

  • Drop support for node before v20

10.4

  • Add includeChildMatches: false option
  • Export the Ignore class

10.3

  • Add --default -p flag to provide a default pattern
  • exclude symbolic links to directories when follow and nodir are both set

10.2

  • Add glob cli

10.1

  • Return '.' instead of the empty string '' when the current working directory is returned as a match.
  • Add posix: true option to return / delimited paths, even on

... (truncated)

Commits
Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates diff from 5.2.2 to 8.0.4

Changelog

Sourced from diff's changelog.

8.0.4

  • #667 - fix another bug in diffWords when used with an Intl.Segmenter. If the text to be diffed included a combining mark after a whitespace character (i.e. roughly speaking, an accented space), diffWords would previously crash. Now this case is handled correctly.

8.0.3

  • #631 - fix support for using an Intl.Segmenter with diffWords. This has been almost completely broken since the feature was added in v6.0.0, since it would outright crash on any text that featured two consecutive newlines between a pair of words (a very common case).
  • #635 - small tweaks to tokenization behaviour of diffWords when used without an Intl.Segmenter. Specifically, the soft hyphen (U+00AD) is no longer considered to be a word break, and the multiplication and division signs (× and ÷) are now treated as punctuation instead of as letters / word characters.
  • #641 - the format of file headers in createPatch etc. patches can now be customised somewhat. It now takes a headerOptions option that can be used to disable the file headers entirely, or omit the Index: line and/or the underline. In particular, this was motivated by a request to make jsdiff patches compatible with react-diff-view, which they now are if produced with headerOptions: FILE_HEADERS_ONLY.
  • #647 and #649 - fix denial-of-service vulnerabilities in parsePatch whereby adversarial input could cause a memory-leaking infinite loop, typically crashing the calling process. Also fixed ReDOS vulnerabilities whereby adversarially-crafted patch headers could take cubic time to parse. Now, parsePatch should reliably take linear time. (Handling of headers that include the line break characters \r, \u2028, or \u2029 in non-trailing positions is also now more reasonable as side effect of the fix.)

8.0.2

  • #616 Restored compatibility of diffSentences with old Safari versions. This was broken in 8.0.0 by the introduction of a regex with a lookbehind assertion; these weren't supported in Safari prior to version 16.4.
  • #612 Improved tree shakeability by marking the built CJS and ESM packages with sideEffects: false.

8.0.1

  • #610 Fixes types for diffJson which were broken by 8.0.0. The new bundled types in 8.0.0 only allowed diffJson to be passed string arguments, but it should've been possible to pass either strings or objects (and now is). Thanks to Josh Kelley for the fix.

8.0.0

  • #580 Multiple tweaks to diffSentences:
    • tokenization no longer takes quadratic time on pathological inputs (reported as a ReDOS vulnerability by Snyk); is now linear instead
    • the final sentence in the string is now handled the same by the tokenizer regardless of whether it has a trailing punctuation mark or not. (Previously, "foo. bar." tokenized to ["foo.", " ", "bar."] but "foo. bar" tokenized to ["foo.", " bar"] - i.e. whether the space between sentences was treated as a separate token depended upon whether the final sentence had trailing punctuation or not. This was arbitrary and surprising; it is no longer the case.)
    • in a string that starts with a sentence end, like "! hello.", the "!" is now treated as a separate sentence
    • the README now correctly documents the tokenization behaviour (it was wrong before)
  • #581 - fixed some regex operations used for tokenization in diffWords taking O(n^2) time in pathological cases
  • #595 - fixed a crash in patch creation functions when handling a single hunk consisting of a very large number (e.g. >130k) of lines. (This was caused by spreading indefinitely-large arrays to .push() using .apply or the spread operator and hitting the JS-implementation-specific limit on the maximum number of arguments to a function, as shown at https://stackoverflow.com/a/56809779/1709587; thus the exact threshold to hit the error will depend on the environment in which you were running JsDiff.)
  • #596 - removed the merge function. Previously JsDiff included an undocumented function called merge that was meant to, in some sense, merge patches. It had at least a couple of serious bugs that could lead to it returning unambiguously wrong results, and it was difficult to simply "fix" because it was unclear precisely what it was meant to do. For now, the fix is to remove it entirely.
  • #591 - JsDiff's source code has been rewritten in TypeScript. This change entails the following changes for end users:

    • the diff package on npm now includes its own TypeScript type definitions. Users who previously used the @types/diff npm package from DefinitelyTyped should remove that dependency when upgrading JsDiff to v8.

      Note that the transition from the DefinitelyTyped types to JsDiff's own type definitions includes multiple fixes and also removes many exported types previously used for options arguments to diffing and patch-generation functions. (There are now different exported options types for abortable calls - ones with a timeout or maxEditLength that may give a result of undefined - and non-abortable calls.) See the TypeScript section of the README for some usage tips.

    • The Diff object is now a class. Custom extensions of Diff, as described in the "Defining custom diffing behaviors" section of the README, can therefore now be done by writing a class CustomDiff extends Diff and overriding methods, instead of the old way based on prototype inheritance. (I think code that did things the old way should still work, though!)

    • diff/lib/index.es6.js and diff/lib/index.mjs no longer exist, and the ESM version of the library is no longer bundled into a single file.

    • The ignoreWhitespace option for diffWords is no longer included in the type declarations. The effect of passing ignoreWhitespace: true has always been to make diffWords just call diffWordsWithSpace instead, which was confusing, because that behaviour doesn't seem properly described as "ignoring" whitespace at all. The property remains available to non-TypeScript applications for the sake of backwards compatibility, but TypeScript applications will now see a type error if they try to pass ignoreWhitespace: true to diffWords and should change their code to call diffWordsWithSpace instead.

    • JsDiff no longer purports to support ES3 environments. (I'm pretty sure it never truly did, despite claiming to in its README, since even the 1.0.0 release used Array.map which was added in ES5.)

  • #601 - diffJson's stringifyReplacer option behaves more like JSON.stringify's replacer argument now. In particular:
    • Each key/value pair now gets passed through the replacer once instead of twice
    • The key passed to the replacer when the top-level object is passed in as value is now "" (previously, was undefined), and the key passed with an array element is the array index as a string, like "0" or "1" (previously was whatever the key for the entire array was). Both the new behaviours match that of JSON.stringify.
  • #602 - diffing functions now consistently return undefined when called in async mode (i.e. with a callback). Previously, there was an odd quirk where they would return true if the strings being diffed were equal and undefined otherwise.

7.0.0

Just a single (breaking) bugfix, undoing a behaviour change introduced accidentally in 6.0.0:

... (truncated)

Commits

@dependabot @github
Copy link
Copy Markdown
Author

dependabot bot commented on behalf of github Apr 4, 2026

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot bot changed the title build(deps): Bump the production-dependencies group with 8 updates build(deps): bump the production-dependencies group across 1 directory with 8 updates Apr 4, 2026
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/production-dependencies-1c048449c6 branch from 72743d1 to 6bb7297 Compare April 4, 2026 19:29
@dependabot
build(deps): Bump the production-dependencies group with 8 updates
e7fe3a8 
Bumps the production-dependencies group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [react](https://github.com/facebook/react/tree/HEAD/packages/react) | `18.3.1` | `19.2.4` |
| [commander](https://github.com/tj/commander.js) | `12.1.0` | `14.0.3` |
| [tree-sitter](https://github.com/tree-sitter/node-tree-sitter) | `0.21.1` | `0.25.0` |
| [tree-sitter-python](https://github.com/tree-sitter/tree-sitter-python) | `0.21.0` | `0.25.0` |
| [tree-sitter-typescript](https://github.com/tree-sitter/tree-sitter-typescript) | `0.21.2` | `0.23.2` |
| [execa](https://github.com/sindresorhus/execa) | `8.0.1` | `9.6.1` |
| [glob](https://github.com/isaacs/node-glob) | `10.5.0` | `13.0.6` |
| [diff](https://github.com/kpdecker/jsdiff) | `5.2.2` | `8.0.4` |


Updates `react` from 18.3.1 to 19.2.4
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.4/packages/react)

Updates `commander` from 12.1.0 to 14.0.3
- [Release notes](https://github.com/tj/commander.js/releases)
- [Changelog](https://github.com/tj/commander.js/blob/master/CHANGELOG.md)
- [Commits](tj/commander.js@v12.1.0...v14.0.3)

Updates `tree-sitter` from 0.21.1 to 0.25.0
- [Release notes](https://github.com/tree-sitter/node-tree-sitter/releases)
- [Commits](tree-sitter/node-tree-sitter@v0.21.1...v0.25.0)

Updates `tree-sitter-python` from 0.21.0 to 0.25.0
- [Release notes](https://github.com/tree-sitter/tree-sitter-python/releases)
- [Commits](tree-sitter/tree-sitter-python@v0.21.0...v0.25.0)

Updates `tree-sitter-typescript` from 0.21.2 to 0.23.2
- [Release notes](https://github.com/tree-sitter/tree-sitter-typescript/releases)
- [Commits](tree-sitter/tree-sitter-typescript@v0.21.2...v0.23.2)

Updates `execa` from 8.0.1 to 9.6.1
- [Release notes](https://github.com/sindresorhus/execa/releases)
- [Commits](sindresorhus/execa@v8.0.1...v9.6.1)

Updates `glob` from 10.5.0 to 13.0.6
- [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md)
- [Commits](isaacs/node-glob@v10.5.0...v13.0.6)

Updates `diff` from 5.2.2 to 8.0.4
- [Changelog](https://github.com/kpdecker/jsdiff/blob/master/release-notes.md)
- [Commits](kpdecker/jsdiff@v5.2.2...8.0.4)

---
updated-dependencies:
- dependency-name: react
  dependency-version: 19.2.4
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: commander
  dependency-version: 14.0.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: tree-sitter
  dependency-version: 0.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: tree-sitter-python
  dependency-version: 0.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: tree-sitter-typescript
  dependency-version: 0.23.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: execa
  dependency-version: 9.6.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: glob
  dependency-version: 13.0.6
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: diff
  dependency-version: 8.0.4
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot changed the title build(deps): bump the production-dependencies group across 1 directory with 8 updates chore(deps): bump the production-dependencies group across 1 directory with 8 updates Apr 6, 2026
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/production-dependencies-1c048449c6 branch from 6bb7297 to e7fe3a8 Compare April 6, 2026 09:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants