Skip to content

Bump the npm-all group across 1 directory with 15 updates#367

Closed
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/frontend/npm-all-263bef48cb
Closed

Bump the npm-all group across 1 directory with 15 updates#367
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/frontend/npm-all-263bef48cb

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 24, 2026

Bumps the npm-all group with 14 updates in the /frontend directory:

Package From To
@sentry/browser 10.49.0 10.50.0
@tanstack/react-query 5.99.0 5.100.1
@tanstack/react-router 1.168.22 1.168.23
axios 1.15.0 1.15.2
react-toastify 11.0.5 11.1.0
@tanstack/eslint-plugin-query 5.99.0 5.100.1
@tanstack/react-query-devtools 5.99.0 5.100.1
@typescript-eslint/eslint-plugin 8.58.2 8.59.0
cssnano 7.1.5 7.1.7
eslint-plugin-react-hooks 7.1.0 7.1.1
html-webpack-plugin 5.6.6 5.6.7
msw 2.13.4 2.13.5
terser-webpack-plugin 5.4.0 5.5.0
vitest 4.1.4 4.1.5

Updates @sentry/browser from 10.49.0 to 10.50.0

Release notes

Sourced from @​sentry/browser's releases.

10.50.0

Important Changes

  • feat(effect): Support v4 beta (#20394)

    The @sentry/effect integration now supports Effect v4 beta, enabling Sentry instrumentation for the latest Effect framework version. Read more in the Effect SDK readme.

  • feat(hono): Add @sentry/hono/bun for Bun runtime (#20355)

    A new @sentry/hono/bun entry point adds first-class support for running Hono applications instrumented with Sentry on the Bun runtime. Read more in the Hono SDK readme.

  • feat(replay): Add replayStart/replayEnd client lifecycle hooks (#20369)

    New replayStart and replayEnd client lifecycle hooks let you react to replay session start and end events in your application.

Other Changes

  • feat(core): Emit no_parent_span client outcomes for discarded spans requiring a parent (#20350)
  • feat(deps): Bump protobufjs from 7.5.4 to 7.5.5 (#20372)
  • feat(hono): Add runtime packages as optional peer dependencies (#20423)
  • feat(opentelemetry): Add tracingChannel utility for context propagation (#20358)
  • fix(browser): Enrich graphqlClient spans for relative URLs (#20370)
  • fix(browser): Filter implausible LCP values (#20338)
  • fix(cloudflare): Use TransformStream to keep track of streams (#20452)
  • fix(console): Re-patch console in AWS Lambda runtimes (#20337)
  • fix(core): Correct GoogleGenAIIstrumentedMethod typo in type name
  • fix(core): Handle stateless MCP wrapper transport correlation (#20293)
  • fix(hono): Remove undefined from options type (#20419)
  • fix(node): Guard against null httpVersion in outgoing request span attributes (#20430)
  • fix(node-core): Pass rejection reason instead of Promise as originalException (#20366)
  • chore: Ignore claude worktrees (#20440)
  • chore: Prevent test from creating zombie process (#20392)
  • chore: Update size-limit (#20412)
  • chore(dev-deps): Bump nx from 22.5.0 to 22.6.5 (#20458)
  • chore(e2e-tests): Use tarball symlinks for E2E tests instead of verdaccio (#20386)
  • chore(lint): Remove lint warnings (#20413)
  • chore(test): Remove empty variant tests (#20443)
  • chore(tests): Use verdaccio as node process instead of docker image (#20336)
  • docs(readme): Update usage instructions for binary scripts (#20426)
  • ref(node): Vendor undici instrumentation (#20190)
  • test(aws-serverless): Ensure aws-serverless E2E tests run locally (#20441)
  • test(aws-serverless): Split npm & layer tests (#20442)
  • test(browser): Fix flaky sessions route-lifecycle test + upgrade axios (#20197)
  • test(cloudflare): Use .makeRequestAndWaitForEnvelope to wait for envelopes (#20208)

... (truncated)

Changelog

Sourced from @​sentry/browser's changelog.

10.50.0

Important Changes

  • feat(effect): Support v4 beta (#20394)

    The @sentry/effect integration now supports Effect v4 beta, enabling Sentry instrumentation for the latest Effect framework version. Read more in the Effect SDK readme.

  • feat(hono): Add @sentry/hono/bun for Bun runtime (#20355)

    A new @sentry/hono/bun entry point adds first-class support for running Hono applications instrumented with Sentry on the Bun runtime. Read more in the Hono SDK readme.

  • feat(replay): Add replayStart/replayEnd client lifecycle hooks (#20369)

    New replayStart and replayEnd client lifecycle hooks let you react to replay session start and end events in your application.

Other Changes

  • feat(core): Emit no_parent_span client outcomes for discarded spans requiring a parent (#20350)
  • feat(deps): Bump protobufjs from 7.5.4 to 7.5.5 (#20372)
  • feat(hono): Add runtime packages as optional peer dependencies (#20423)
  • feat(opentelemetry): Add tracingChannel utility for context propagation (#20358)
  • fix(browser): Enrich graphqlClient spans for relative URLs (#20370)
  • fix(browser): Filter implausible LCP values (#20338)
  • fix(cloudflare): Use TransformStream to keep track of streams (#20452)
  • fix(console): Re-patch console in AWS Lambda runtimes (#20337)
  • fix(core): Correct GoogleGenAIIstrumentedMethod typo in type name
  • fix(core): Handle stateless MCP wrapper transport correlation (#20293)
  • fix(hono): Remove undefined from options type (#20419)
  • fix(node): Guard against null httpVersion in outgoing request span attributes (#20430)
  • fix(node-core): Pass rejection reason instead of Promise as originalException (#20366)
  • chore: Ignore claude worktrees (#20440)
  • chore: Prevent test from creating zombie process (#20392)
  • chore: Update size-limit (#20412)
  • chore(dev-deps): Bump nx from 22.5.0 to 22.6.5 (#20458)
  • chore(e2e-tests): Use tarball symlinks for E2E tests instead of verdaccio (#20386)
  • chore(lint): Remove lint warnings (#20413)
  • chore(test): Remove empty variant tests (#20443)
  • chore(tests): Use verdaccio as node process instead of docker image (#20336)
  • docs(readme): Update usage instructions for binary scripts (#20426)
  • ref(node): Vendor undici instrumentation (#20190)
  • test(aws-serverless): Ensure aws-serverless E2E tests run locally (#20441)
  • test(aws-serverless): Split npm & layer tests (#20442)
  • test(browser): Fix flaky sessions route-lifecycle test + upgrade axios (#20197)

... (truncated)

Commits
  • 785e756 release: 10.50.0
  • ed26a19 Merge pull request #20461 from getsentry/prepare-release/10.50.0
  • 7b584c4 meta(changelog): Update changelog for 10.50.0
  • 39740da test(cloudflare): Use .makeRequestAndWaitForEnvelope to wait for envelopes (#...
  • c741030 test(aws-serverless): Split npm & layer tests (#20442)
  • f97076d chore(dev-deps): Bump nx from 22.5.0 to 22.6.5 (#20458)
  • 4b4ac76 fix(node): Guard against null httpVersion in outgoing request span attribut...
  • 7569b10 fix(cloudflare): Use TransformStream to keep track of streams (#20452)
  • a4c9686 test(hono): Add E2E tests for middleware spans (#20451)
  • ff23846 chore: Ignore claude worktrees (#20440)
  • Additional commits viewable in compare view

Updates @tanstack/react-query from 5.99.0 to 5.100.1

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.100.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.100.1
    • @​tanstack/react-query@​5.100.1

@​tanstack/react-query-devtools@​5.100.0

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.100.0
    • @​tanstack/react-query@​5.100.0

@​tanstack/react-query-next-experimental@​5.100.0

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.100.0

@​tanstack/react-query-persist-client@​5.100.0

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-persist-client-core@​5.100.0
    • @​tanstack/react-query@​5.100.0

@​tanstack/react-query@​5.100.0

Patch Changes

  • Updated dependencies [6540a41]:
    • @​tanstack/query-core@​5.100.0

@​tanstack/react-query-devtools@​5.99.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.99.2
    • @​tanstack/react-query@​5.99.2

@​tanstack/react-query-next-experimental@​5.99.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.99.2

@​tanstack/react-query-persist-client@​5.99.2

Patch Changes

  • Updated dependencies []:

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.100.1

Patch Changes

  • Updated dependencies [1bb0d23]:
    • @​tanstack/query-core@​5.100.1

5.100.0

Patch Changes

  • Updated dependencies [6540a41]:
    • @​tanstack/query-core@​5.100.0

5.99.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.99.2

5.99.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.99.1
Commits
  • 2f9527e ci: Version Packages (#10568)
  • ad517e5 ci: Version Packages (#10567)
  • 6540a41 feat(core): callback for retryOnMount (#10515)
  • e236194 test(react-query/useQuery.promise): improve stability by isolating 'queryClie...
  • 59efc40 test(*): resolve 'require-await' warnings in test files (#10551)
  • cf8a765 test(react-query/useQuery): rename 'throwOnError' callback parameter to 'err'...
  • 6b6667e test(*): migrate 'test' to 'it' and enforce 'vitest/consistent-test-it' rule ...
  • a3ec7b3 ci: Version Packages (#10520)
  • 69d2757 ci: Version Packages (#10514)
  • 7ffa1ed test({react,preact,solid}-query/useQueries): fix test description from 'useQu...
  • Additional commits viewable in compare view

Updates @tanstack/react-router from 1.168.22 to 1.168.23

Changelog

Sourced from @​tanstack/react-router's changelog.

1.168.23

Patch Changes

  • fix(react-router): prevent webpack static analysis of React.use with let binding (#7182)
Commits
  • 4d66d42 ci: changeset release
  • cd91cee fix(react-router): prevent webpack static analysis of React.use with let bind...
  • See full diff in compare view

Updates axios from 1.15.0 to 1.15.2

Release notes

Sourced from axios's releases.

v1.15.2

This release delivers prototype-pollution hardening for the Node HTTP adapter, adds an opt-in allowedSocketPaths allowlist to mitigate SSRF via Unix domain sockets, fixes a keep-alive socket memory leak, and ships supply-chain hardening across CI and security docs.

🔒 Security Fixes

  • Prototype Pollution Hardening (HTTP Adapter): Hardened the Node HTTP adapter and resolveConfig/mergeConfig/validator paths to read only own properties and use null-prototype config objects, preventing polluted auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser from influencing requests. (#10779)
  • SSRF via socketPath: Rejects non-string socketPath values and adds an opt-in allowedSocketPaths config option to restrict permitted Unix domain socket paths, returning AxiosError ERR_BAD_OPTION_VALUE on mismatch. (#10777)
  • Supply-chain Hardening: Added .npmrc with ignore-scripts=true, lockfile lint CI, non-blocking reproducible build diff, scoped CODEOWNERS, expanded SECURITY.md/THREATMODEL.md with provenance verification (npm audit signatures), 60-day resolution policy, and maintainer incident-response runbook. (#10776)

🚀 New Features

  • allowedSocketPaths Config Option: New request config option (and TypeScript types) to allowlist Unix domain socket paths used by the Node http adapter; backwards compatible when unset. (#10777)

🐛 Bug Fixes

  • Keep-alive Socket Memory Leak: Installs a single per-socket error listener tracking the active request via kAxiosSocketListener/kAxiosCurrentReq, eliminating per-request listener accumulation, MaxListenersExceededWarning, and linear heap growth under concurrent or long-running keep-alive workloads (fixes #10780). (#10788)

🔧 Maintenance & Chores

  • Changelog: Updated CHANGELOG.md with v1.15.1 release notes. (#10781)

Full Changelog

v1.15.1

This release ships a coordinated set of security hardening fixes across headers, body/redirect limits, multipart handling, and XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes, test migrations, and threat-model documentation updates.

🔒 Security Fixes

  • Header Injection Hardening: Tightened validation and sanitisation across request header construction to close the header-injection attack surface. (#10749)
  • CRLF Stripping in Multipart Headers: Correctly strips CR/LF from multipart header values to prevent injection via field names and filenames. (#10758)
  • Prototype Pollution / Auth Bypass: Replaced unsafe in checks with hasOwnProperty to prevent authentication bypass via prototype pollution on config objects, with additional regression tests. (#10761, #10760)
  • withXSRFToken Truthy Bypass: Short-circuits on any truthy non-boolean value, so an ambiguous config no longer silently leaks the XSRF token cross-origin. (#10762)
  • maxBodyLength With Zero Redirects: Enforces maxBodyLength even when maxRedirects is set to 0, closing a bypass path for oversized request bodies. (#10753)
  • Streamed Response maxContentLength Bypass: Applies maxContentLength to streamed responses that previously bypassed the cap. (#10754)
  • Follow-up CVE Completion: Completes an earlier incomplete CVE fix to fully close the regression window. (#10755)

🚀 New Features

  • AI-Based Docs Translations: Initial scaffold for AI-assisted translations of the documentation site. (#10705)
  • Location Request Header Type: Adds Location to CommonRequestHeadersList for accurate typing of redirect-aware requests. (#7528)

🐛 Bug Fixes

  • FormData Handling: Removes Content-Type when no boundary is present on FormData fetch requests, supports multi-select fields, cancels request.body instead of the source stream on fetch abort, and fixes a recursion bug in form-data serialisation. (#7314, #10676, #10702, #10726)
  • HTTP Adapter: Handles socket-only request errors without leaking keep-alive listeners. (#10576)
  • Progress Events: Clamps loaded to total for computable upload/download progress events. (#7458)
  • Types: Aligns runWhen type with the runtime behaviour in InterceptorManager and makes response header keys case-insensitive. (#7529, #10677)
  • buildFullPath: Uses strict equality in the base/relative URL check. (#7252)
  • AxiosURLSearchParams Regex: Improves the regex used for param serialisation to avoid edge-case mismatches. (#10736)
  • Resilient Value Parsing: Parses out header/config values instead of throwing on malformed input. (#10687)

... (truncated)

Changelog

Sourced from axios's changelog.

v1.15.2 - April 21, 2026

This release delivers prototype-pollution hardening for the Node HTTP adapter, adds an opt-in allowedSocketPaths allowlist to mitigate SSRF via Unix domain sockets, fixes a keep-alive socket memory leak, and ships supply-chain hardening across CI and security docs.

🔒 Security Fixes

  • Prototype Pollution Hardening (HTTP Adapter): Hardened the Node HTTP adapter and resolveConfig/mergeConfig/validator paths to read only own properties and use null-prototype config objects, preventing polluted auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser from influencing requests. (#10779)
  • SSRF via socketPath: Rejects non-string socketPath values and adds an opt-in allowedSocketPaths config option to restrict permitted Unix domain socket paths, returning AxiosError ERR_BAD_OPTION_VALUE on mismatch. (#10777)
  • Supply-chain Hardening: Added .npmrc with ignore-scripts=true, lockfile lint CI, non-blocking reproducible build diff, scoped CODEOWNERS, expanded SECURITY.md/THREATMODEL.md with provenance verification (npm audit signatures), 60-day resolution policy, and maintainer incident-response runbook. (#10776)

🚀 New Features

  • allowedSocketPaths Config Option: New request config option (and TypeScript types) to allowlist Unix domain socket paths used by the Node http adapter; backwards compatible when unset. (#10777)

🐛 Bug Fixes

  • Keep-alive Socket Memory Leak: Installs a single per-socket error listener tracking the active request via kAxiosSocketListener/kAxiosCurrentReq, eliminating per-request listener accumulation, MaxListenersExceededWarning, and linear heap growth under concurrent or long-running keep-alive workloads (fixes #10780). (#10788)

🔧 Maintenance & Chores

  • Changelog: Updated CHANGELOG.md with v1.15.1 release notes. (#10781)

Full Changelog


v1.15.1 - April 19, 2026

This release ships a coordinated set of security hardening fixes across headers, body/redirect limits, multipart handling, and XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes, test migrations, and threat-model documentation updates.

🔒 Security Fixes

  • Header Injection Hardening: Tightened validation and sanitisation across request header construction to close the header-injection attack surface. (#10749)

  • CRLF Stripping in Multipart Headers: Correctly strips CR/LF from multipart header values to prevent injection via field names and filenames. (#10758)

  • Prototype Pollution / Auth Bypass: Replaced unsafe in checks with hasOwnProperty to prevent authentication bypass via prototype pollution on config objects, with additional regression tests. (#10761, #10760)

  • withXSRFToken Truthy Bypass: Short-circuits on any truthy non-boolean value, so an ambiguous config no longer silently leaks the XSRF token cross-origin. (#10762)

  • maxBodyLength With Zero Redirects: Enforces maxBodyLength even when maxRedirects is set to 0, closing a bypass path for oversized request bodies. (#10753)

  • Streamed Response maxContentLength Bypass: Applies maxContentLength to streamed responses that previously bypassed the cap. (#10754)

  • Follow-up CVE Completion: Completes an earlier incomplete CVE fix to fully close the regression window. (#10755)

🚀 New Features

  • AI-Based Docs Translations: Initial scaffold for AI-assisted translations of the documentation site. (#10705)

... (truncated)

Commits

Updates react-toastify from 11.0.5 to 11.1.0

Release notes

Sourced from react-toastify's releases.

v11.1.0

Release Notes

Features

  • CSP nonce support. <ToastContainer nonce={...}> applies the nonce to the injected <style> tag. Closes #1209.

Fixes

  • onChange fires status: 'removed' synchronously on toast.dismiss() instead of after the exit animation — observers (incl. useNotificationCenter) now see correctly ordered events. Also guards against double-onClose. Closes #1275.
  • Touch drag no longer re-pauses the toast on release — the old check compared a PointerEvent against 'touchend', which never matched. Closes #1217.
  • Vertical drag now visually moves the toast (--y gets a unit). Thanks @​janpaepke, #1277.
  • Stacked scale is clamped at 0.5, preventing zero/negative scale in deep stacks. Closes #1171, #1174.
  • Stacked container respects mobile 100vw again. Closes #1234.

Accessibility

Internal

  • Migrated to a pnpm workspace (pnpm link . no longer required for contributors). Publish layout unchanged — addon still ships inside the main package.
  • CSS now injected at mount via useStyleSheet (prerequisite for nonce).
  • Dep bumps: TypeScript 6, Vite 8, Cypress 15, React 19.2, plus the rest.
  • CI: upload-artifact v3 → v4.

Thanks to @​janpaepke, @​singhankit001, and reporters of the fixed issues.

Commits
  • 769ce82 11.1.0
  • de21958 remove year from license
  • c800992 fix: add unit to --y CSS variable to fix vertical drag
  • e4ab712 fix chicken and egg issue
  • b3bbab5 bump artifact action
  • 6d58ce4 fix: stacked toast invert size, when used as stacked
  • 50e8e42 fix: stacked container on mobile not 100vw
  • 1b2ee17 fix: dispatch 'removed' onChange event synchronously on dismiss
  • a2d376b feat: add ARIA accessibility attributes to ProgressBar
  • 8375ace fix: touch bug in onDragTransitionEnd, closes #1217
  • Additional commits viewable in compare view

Updates @tanstack/eslint-plugin-query from 5.99.0 to 5.100.1

Release notes

Sourced from @​tanstack/eslint-plugin-query's releases.

@​tanstack/eslint-plugin-query@​5.100.0

No release notes provided.

@​tanstack/eslint-plugin-query@​5.99.2

No release notes provided.

@​tanstack/eslint-plugin-query@​5.99.1

Patch Changes

  • fix(eslint-plugin-query): fix no-void-query-fn false positive on enum returns for typescript 6. (#10460)
Changelog

Sourced from @​tanstack/eslint-plugin-query's changelog.

5.100.1

5.100.0

5.99.2

5.99.1

Patch Changes

  • fix(eslint-plugin-query): fix no-void-query-fn false positive on enum returns for typescript 6. (#10460)
Commits

Updates @tanstack/react-query-devtools from 5.99.0 to 5.100.1

Release notes

Sourced from @​tanstack/react-query-devtools's releases.

@​tanstack/react-query-devtools@​5.100.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.100.1
    • @​tanstack/react-query@​5.100.1

@​tanstack/react-query-devtools@​5.100.0

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.100.0
    • @​tanstack/react-query@​5.100.0

@​tanstack/react-query-devtools@​5.99.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.99.2
    • @​tanstack/react-query@​5.99.2

@​tanstack/react-query-devtools@​5.99.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.99.1
    • @​tanstack/react-query@​5.99.1
Changelog

Sourced from @​tanstack/react-query-devtools's changelog.

5.100.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.100.1
    • @​tanstack/react-query@​5.100.1

5.100.0

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.100.0
    • @​tanstack/react-query@​5.100.0

5.99.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.99.2
    • @​tanstack/react-query@​5.99.2

5.99.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.99.1
    • @​tanstack/react-query@​5.99.1
Commits

Updates @typescript-eslint/eslint-plugin from 8.58.2 to 8.59.0

Release notes

Sourced from @​typescript-eslint/eslint-plugin's releases.

v8.59.0

8.59.0 (2026-04-20)

🚀 Features

  • eslint-plugin: [no-unnecessary-type-assertion] report more cases based on assignability (#11789)

❤️ Thank You

  • Ulrich Stark

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @​typescript-eslint/eslint-plugin's changelog.

8.59.0 (2026-04-20)

🚀 Features

  • eslint-plugin: [no-unnecessary-type-assertion] report more cases based on assignability (#11789)

❤️ Thank You

  • Ulrich Stark

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits
  • ea9ae4f chore(release): publish 8.59.0
  • cfca550 feat(eslint-plugin): [no-unnecessary-type-assertion] report more cases based ...
  • 6d599b4 chore(eslint-plugin): switch auto-generated test cases to hand-written in ret...
  • 33c8169 chore: fix cspell violations in code blocks (#12167)
  • See full diff in compare view

Updates @typescript-eslint/parser from 8.58.2 to 8.59.0

Release notes

Sourced from @​typescript-eslint/parser's releases.

v8.59.0

8.59.0 (2026-04-20)

🚀 Features

  • eslint-plugin: [no-unnecessary-type-assertion] report more cases based on assignability (#11789)

❤️ Thank You

  • Ulrich Stark

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @​typescript-eslint/parser's changelog.

8.59.0 (2026-04-20)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

Updates cssnano from 7.1.5 to 7.1.7

Release notes

Sourced from cssnano's releases.

v.7.1.7

This release is idnetical to the previous one, but is being published to ensure that the latest versions of postcss-normalize-repeat-style and postcss-normalize-positions are uploaded to the npm registry.

v7.1.6

New feature

Bug fixes

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@7.1.5...cssnano@7.1.6

Commits
  • 6afa2c9 chore: create new versions to fix missing dependencies
  • 80e57b9 Publish cssnano 7.1.6
  • 322ad33 fix: update postcss peer dependency
  • 587f28d chore: pin codecov action
  • 560b0fa chore: improve CI security
  • 0fb105b fix: update postcss
  • 3b6cf88 chore: update development deps
  • a133ac0 chore: update TypeScript
  • 730b04b fix: update autoprefixer
  • a00036c fix: update colordx
  • Additional commits viewable in compare view

Updates eslint-plugin-react-hooks from 7.1.0 to 7.1.1

Release notes

Sourced from eslint-plugin-react-hooks's releases.

eslint-plugin-react-hooks@7.1.1 (April 17, 2026)

Note: 7.1.0 accidentally removed the component-hook-factories rule, causing errors for users who referenced it in their ESLint config. This is now fixed.

  • Add deprecated no-op component-hook-factories rule for backwards compatibility. (@​mofeiZ in #36307)
Changelog

Sourced from eslint-plugin-react-hooks's changelog.

7.1.1

Note: 7.1.0 accidentally removed the component-hook-factories rule, causing errors for users who referenced it in their ESLint config. This is now fixed.

  • Add deprecated no-op component-hook-factories rule for backwards compatibility. (@​mofeiZ in #36307)
Commits

Updates html-webpack-plugin from 5.6.6 to 5.6.7

Changelog

Sourced from html-webpack-plugin's changelog.

5.6.7 (2026-04-17)

Bug Fixes

Commits
  • fdef1b4 chore(release): 5.6.7
  • c862830 fix: provide modu...

    Description has been truncated

Bumps the npm-all group with 14 updates in the /frontend directory:

| Package | From | To |
| --- | --- | --- |
| [@sentry/browser](https://github.com/getsentry/sentry-javascript) | `10.49.0` | `10.50.0` |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.99.0` | `5.100.1` |
| [@tanstack/react-router](https://github.com/TanStack/router/tree/HEAD/packages/react-router) | `1.168.22` | `1.168.23` |
| [axios](https://github.com/axios/axios) | `1.15.0` | `1.15.2` |
| [react-toastify](https://github.com/fkhadra/react-toastify) | `11.0.5` | `11.1.0` |
| [@tanstack/eslint-plugin-query](https://github.com/TanStack/query/tree/HEAD/packages/eslint-plugin-query) | `5.99.0` | `5.100.1` |
| [@tanstack/react-query-devtools](https://github.com/TanStack/query/tree/HEAD/packages/react-query-devtools) | `5.99.0` | `5.100.1` |
| [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.58.2` | `8.59.0` |
| [cssnano](https://github.com/cssnano/cssnano) | `7.1.5` | `7.1.7` |
| [eslint-plugin-react-hooks](https://github.com/facebook/react/tree/HEAD/packages/eslint-plugin-react-hooks) | `7.1.0` | `7.1.1` |
| [html-webpack-plugin](https://github.com/jantimon/html-webpack-plugin) | `5.6.6` | `5.6.7` |
| [msw](https://github.com/mswjs/msw) | `2.13.4` | `2.13.5` |
| [terser-webpack-plugin](https://github.com/webpack/terser-webpack-plugin) | `5.4.0` | `5.5.0` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.4` | `4.1.5` |



Updates `@sentry/browser` from 10.49.0 to 10.50.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.49.0...10.50.0)

Updates `@tanstack/react-query` from 5.99.0 to 5.100.1
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query-devtools@5.100.1/packages/react-query)

Updates `@tanstack/react-router` from 1.168.22 to 1.168.23
- [Release notes](https://github.com/TanStack/router/releases)
- [Changelog](https://github.com/TanStack/router/blob/main/packages/react-router/CHANGELOG.md)
- [Commits](https://github.com/TanStack/router/commits/@tanstack/react-router@1.168.23/packages/react-router)

Updates `axios` from 1.15.0 to 1.15.2
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.15.0...v1.15.2)

Updates `react-toastify` from 11.0.5 to 11.1.0
- [Release notes](https://github.com/fkhadra/react-toastify/releases)
- [Commits](fkhadra/react-toastify@v11.0.5...v11.1.0)

Updates `@tanstack/eslint-plugin-query` from 5.99.0 to 5.100.1
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/eslint-plugin-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query-devtools@5.100.1/packages/eslint-plugin-query)

Updates `@tanstack/react-query-devtools` from 5.99.0 to 5.100.1
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query-devtools/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query-devtools@5.100.1/packages/react-query-devtools)

Updates `@typescript-eslint/eslint-plugin` from 8.58.2 to 8.59.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.59.0/packages/eslint-plugin)

Updates `@typescript-eslint/parser` from 8.58.2 to 8.59.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.59.0/packages/parser)

Updates `cssnano` from 7.1.5 to 7.1.7
- [Release notes](https://github.com/cssnano/cssnano/releases)
- [Commits](https://github.com/cssnano/cssnano/compare/cssnano@7.1.5...cssnano@7.1.7)

Updates `eslint-plugin-react-hooks` from 7.1.0 to 7.1.1
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/packages/eslint-plugin-react-hooks/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/eslint-plugin-react-hooks@7.1.1/packages/eslint-plugin-react-hooks)

Updates `html-webpack-plugin` from 5.6.6 to 5.6.7
- [Release notes](https://github.com/jantimon/html-webpack-plugin/releases)
- [Changelog](https://github.com/jantimon/html-webpack-plugin/blob/main/CHANGELOG.md)
- [Commits](jantimon/html-webpack-plugin@v5.6.6...v5.6.7)

Updates `msw` from 2.13.4 to 2.13.5
- [Release notes](https://github.com/mswjs/msw/releases)
- [Changelog](https://github.com/mswjs/msw/blob/main/CHANGELOG.md)
- [Commits](mswjs/msw@v2.13.4...v2.13.5)

Updates `terser-webpack-plugin` from 5.4.0 to 5.5.0
- [Release notes](https://github.com/webpack/terser-webpack-plugin/releases)
- [Changelog](https://github.com/webpack/terser-webpack-plugin/blob/main/CHANGELOG.md)
- [Commits](webpack/terser-webpack-plugin@v5.4.0...v5.5.0)

Updates `vitest` from 4.1.4 to 4.1.5
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.5/packages/vitest)

---
updated-dependencies:
- dependency-name: "@sentry/browser"
  dependency-version: 10.50.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-all
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.100.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-all
- dependency-name: "@tanstack/react-router"
  dependency-version: 1.168.23
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-all
- dependency-name: axios
  dependency-version: 1.15.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-all
- dependency-name: react-toastify
  dependency-version: 11.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-all
- dependency-name: "@tanstack/eslint-plugin-query"
  dependency-version: 5.100.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-all
- dependency-name: "@tanstack/react-query-devtools"
  dependency-version: 5.100.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-all
- dependency-name: "@typescript-eslint/eslint-plugin"
  dependency-version: 8.59.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-all
- dependency-name: "@typescript-eslint/parser"
  dependency-version: 8.59.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-all
- dependency-name: cssnano
  dependency-version: 7.1.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-all
- dependency-name: eslint-plugin-react-hooks
  dependency-version: 7.1.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-all
- dependency-name: html-webpack-plugin
  dependency-version: 5.6.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-all
- dependency-name: msw
  dependency-version: 2.13.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-all
- dependency-name: terser-webpack-plugin
  dependency-version: 5.5.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-all
- dependency-name: vitest
  dependency-version: 4.1.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-all
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Apr 24, 2026
@sonarqubecloud
Copy link
Copy Markdown

@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github Apr 27, 2026

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Apr 27, 2026
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/frontend/npm-all-263bef48cb branch April 27, 2026 02:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants