build(deps): bump the prod-minor-patch group with 6 updates by dependabot[bot] · Pull Request #181 · dx-corp/kestrel

dependabot · 2026-09-22T13:59:57Z

Bumps the prod-minor-patch group with 6 updates:

Package	From	To
@ax-llm/ax	`24.0.17`	`24.0.20`
@tanstack/react-router	`1.170.35`	`1.170.38`
framer-motion	`13.2.0`	`13.4.0`
lucide-react	`1.45.0`	`1.47.0`
tailwind-merge	`3.6.0`	`3.7.0`
zod	`4.6.2`	`4.6.5`

Updates @ax-llm/ax from 24.0.17 to 24.0.20

Release notes

Sourced from @ax-llm/ax's releases.

Release 24.0.20

What's Changed

feat(axir): add Typesafe parity and complete MCP WebSocket support by @dosco in ax-llm/ax#663

chore: release v24.0.20 by @dosco in ax-llm/ax#664

Full Changelog: ax-llm/ax@24.0.19...24.0.20

Release 24.0.19

What's Changed

fix(mcp): clean pending WebSocket requests by @pacocartones in ax-llm/ax#654

docs(website): explain Ax benefits and core strengths by @dosco in ax-llm/ax#659

feat(typesafe): support Jev decisions, native scoring, and value descriptions by @dosco in ax-llm/ax#661

chore: release v24.0.19 by @dosco in ax-llm/ax#662

Full Changelog: ax-llm/ax@24.0.18...24.0.19

Release 24.0.18

What's Changed

fix(apicall): remove the abort-signal listener on every apiCall exit path by @pacocartones in ax-llm/ax#645

fix(event): remove the abort-signal listener when a clock sleep settles by @pacocartones in ax-llm/ax#647

fix(security): redact sensitive headers in verbose API request logs by @pacocartones in ax-llm/ax#646

AxIR: add portable cancellation parity by @dosco in ax-llm/ax#648

feat(ai): add Meta Muse support through existing Ax APIs by @dosco in ax-llm/ax#649

feat(ai): add Gemini 3.8 Flash and preserve tool-call IDs by @dosco in ax-llm/ax#650

feat: add Astra sessions and begin AxIR parity by @dosco in ax-llm/ax#651

feat: preserve native files through AxIR provider routing by @dosco in ax-llm/ax#652

feat: extend AxIR Astra sessions and concurrent flows by @dosco in ax-llm/ax#653

fix: preserve MCP contexts through child agents across languages by @dosco in ax-llm/ax#655

fix: propagate MCP cancellation across generated runtimes by @dosco in ax-llm/ax#656

fix: complete Astra session parity across generated languages by @dosco in ax-llm/ax#657

chore: release v24.0.18 by @dosco in ax-llm/ax#658

Full Changelog: ax-llm/ax@24.0.17...24.0.18

Changelog

Sourced from @ax-llm/ax's changelog.

24.0.20 (2026-09-18)

Features

axir: add Typesafe parity and complete MCP WebSocket support (#663) (a95d736)

24.0.19 (2026-09-17)

Features

typesafe: support Jev decisions, native scoring, and value descriptions (#661) (e58a9ed)

Bug Fixes

mcp: clean pending WebSocket requests (#654) (259bccf)

24.0.18 (2026-09-09)

Features

add Astra sessions and begin AxIR parity (#651) (48eec33)

ai: add Gemini 3.8 Flash and preserve tool-call IDs (#650) (5f0e470)

ai: add Meta Muse support through existing Ax APIs (#649) (3e5fd36)

extend AxIR Astra sessions and concurrent flows (#653) (0a943e2)

preserve native files through AxIR provider routing (#652) (4590b14)

Bug Fixes

apicall: remove user abort listener on all non-abort exit paths (#645) (2034b04), closes #632

complete Astra session parity across generated languages (#657) (5ef03af)

event: clear timer and remove abort listener on normal sleep path (#647) (039f1d7)

preserve MCP contexts through child agents across languages (#655) (27b8e31)

propagate MCP invocation cancellation across generated runtimes (#656) (db7ce0c)

security: redact sensitive headers in verbose API request logs (#646) (b2d974b)

24.0.18 (2026-09-09)

Features

add Astra sessions and begin AxIR parity (#651) (48eec33)

ai: add Gemini 3.8 Flash and preserve tool-call IDs (#650) (5f0e470)

ai: add Meta Muse support through existing Ax APIs (#649) (3e5fd36)

extend AxIR Astra sessions and concurrent flows (#653) (0a943e2)

preserve native files through AxIR provider routing (#652) (4590b14)

Bug Fixes

apicall: remove user abort listener on all non-abort exit paths (#645) (2034b04), closes #632

complete Astra session parity across generated languages (#657) (5ef03af)

event: clear timer and remove abort listener on normal sleep path (#647) (039f1d7)

... (truncated)

Commits

5c43344 chore: release v24.0.20 (#664)
a95d736 feat(axir): add Typesafe parity and complete MCP WebSocket support (#663)
c67219e chore: release v24.0.19 (#662)
e58a9ed feat(typesafe): support Jev decisions, native scoring, and value descriptions...
3951b05 docs(website): explain Ax benefits and core strengths on homepage (#659)
259bccf fix(mcp): clean pending WebSocket requests (#654)
f7d8514 chore: release v24.0.18 (#658)
5ef03af fix: complete Astra session parity across generated languages (#657)
db7ce0c fix: propagate MCP invocation cancellation across generated runtimes (#656)
27b8e31 fix: preserve MCP contexts through child agents across languages (#655)
Additional commits viewable in compare view

Updates @tanstack/react-router from 1.170.35 to 1.170.38

Release notes

Sourced from @tanstack/react-router's releases.

@tanstack/react-router@1.170.38

Patch Changes

Updated dependencies [cecae54, 0103578, ce10dcd, 84936cc, bbd2336]:

@tanstack/router-core@1.171.32

@tanstack/react-router@1.170.37

Patch Changes

#8418 e561fa1 - deepEqual now takes its flags as positional arguments — deepEqual(a, b, partial?, explicitUndefined?) — instead of an options object. The router's hot callers (Link option stabilization and active-state checks, matchRoute) no longer allocate an options object per comparison, and the comparator reads two booleans instead of a polymorphic object. explicitUndefined replaces ignoreUndefined: false. deepEqual is an internal helper; it stays exported for compatibility of two-argument calls.

#8419 a1c8d1a - resolvePath (internal helper) now takes positional arguments — resolvePath(base, to, trailingSlash?, cache?) — so buildLocation and matchRoute no longer allocate an options object per path resolution.

#8204 cbbfbe3 - Stream large deferred SSR hydration payloads through a backpressure-aware router transport, fail known setup errors before response creation, and close cancelled or expired transforms safely.

Start now cancels discarded middleware and HEAD response bodies, including plain streams and derived branches.

Server-function raw streams share one ordered response. Arbitrary or sequential consumption can require potentially unbounded buffering of unread data on the client. Cancelling one raw stream discards it locally, while aborting the whole call cancels the response and server work. Consume streams concurrently, cancel unused streams promptly, or use separate calls when independent backpressure is required. A raw stream that exceeds its unread-byte limit now fails alone; sibling streams and the JSON result keep flowing.

The JSON wire shape of a RawStream server-function argument changed. Clients and servers must run matching versions for requests that pass a RawStream.

The frame-protocol constants (FRAME_TYPE_*, MAX_FRAME_PAYLOAD_SIZE, MAX_FRAMED_STREAMS) moved from the @tanstack/start-client-core root to the @tanstack/start-client-core/client-rpc subpath.

Router requests whose Accept header allows neither text/html nor */* now receive 406 Not Acceptable instead of 500.

Framework adapters share the body <Scripts> composition (getSsrBodyScriptParts, composeSsrBodyScripts) and the eager HTML response wrapper (renderSsrHtmlResponse) from @tanstack/router-core.

Solid SSR now emits one document type and renders late lazy errors through route boundaries. A Solid <Await> without a fallback no longer holds the streamed shell; it renders inside the nearest <Suspense> boundary like React and Vue, and now renders falsy resolved values.

Static server functions decode cached RawStream values with the client deserializer plugins.

SSR Query integrations now keep request cleanup and stream ownership aligned with the router lifecycle.

#8420 8e164d2 - useLinkProps no longer calls through an internal wrapper. The host element Link renders on is an @internal overload parameter that is stripped from the published declarations, so the public useLinkProps(options, forwardedRef?) signature is unchanged.

Updated dependencies [bc80866, e561fa1, cbbfbe3, a1c8d1a, cbbfbe3, a0b2ad9, 1ca361b]:

@tanstack/router-core@1.171.31

@tanstack/react-router@1.170.36

Patch Changes

#8390 b747fb8 - Keep the Link location cache out of server bundles: buildLocation only creates, reads and writes it when isServer is false. Render React Links on the server without the extra prop copies and the forwarded-ref hook. Link SSR rendering is 20-40% faster in the Link benchmarks and the React Start SSR request loop about 7% faster.

React activeProps and inactiveProps now follow one precedence rule on every link, including links whose destination is blocked for using a disallowed scheme: state props override element props, ref and event handlers, while href, disabled and target stay controlled by the router. Previously a blocked link ignored a ref or handler from its inactive props.

React Link and useLinkProps split router options from element props with one key set on the client and the server. Element props pass through as given: external links forward them verbatim, falsy values included, and useLinkProps now returns children for router-controlled links as it already did for external ones.

#8324 6387d58 - Reuse hydration snapshot getters to avoid unnecessary store-instance effect updates when Links and other hydration-aware components rerender.

#8318 9b2adaf - Allow active and inactive Link props to override base element props in React and Solid while preserving class/style merging. Keep React's href, target, and disabled values controlled by routing options. Preserve Vue object and nested-array class bindings, including reactive updates and server rendering, without mutating cached bindings during VNode normalization.

... (truncated)

Changelog

Sourced from @tanstack/react-router's changelog.

1.170.38

Patch Changes

Updated dependencies [cecae54, 0103578, ce10dcd, 84936cc, bbd2336]:

@tanstack/router-core@1.171.32

1.170.37

Patch Changes

#8418 e561fa1 - deepEqual now takes its flags as positional arguments — deepEqual(a, b, partial?, explicitUndefined?) — instead of an options object. The router's hot callers (Link option stabilization and active-state checks, matchRoute) no longer allocate an options object per comparison, and the comparator reads two booleans instead of a polymorphic object. explicitUndefined replaces ignoreUndefined: false. deepEqual is an internal helper; it stays exported for compatibility of two-argument calls.

#8419 a1c8d1a - resolvePath (internal helper) now takes positional arguments — resolvePath(base, to, trailingSlash?, cache?) — so buildLocation and matchRoute no longer allocate an options object per path resolution.

#8204 cbbfbe3 - Stream large deferred SSR hydration payloads through a backpressure-aware router transport, fail known setup errors before response creation, and close cancelled or expired transforms safely.

Start now cancels discarded middleware and HEAD response bodies, including plain streams and derived branches.

Server-function raw streams share one ordered response. Arbitrary or sequential consumption can require potentially unbounded buffering of unread data on the client. Cancelling one raw stream discards it locally, while aborting the whole call cancels the response and server work. Consume streams concurrently, cancel unused streams promptly, or use separate calls when independent backpressure is required. A raw stream that exceeds its unread-byte limit now fails alone; sibling streams and the JSON result keep flowing.

The JSON wire shape of a RawStream server-function argument changed. Clients and servers must run matching versions for requests that pass a RawStream.

The frame-protocol constants (FRAME_TYPE_*, MAX_FRAME_PAYLOAD_SIZE, MAX_FRAMED_STREAMS) moved from the @tanstack/start-client-core root to the @tanstack/start-client-core/client-rpc subpath.

Router requests whose Accept header allows neither text/html nor */* now receive 406 Not Acceptable instead of 500.

Framework adapters share the body <Scripts> composition (getSsrBodyScriptParts, composeSsrBodyScripts) and the eager HTML response wrapper (renderSsrHtmlResponse) from @tanstack/router-core.

Solid SSR now emits one document type and renders late lazy errors through route boundaries. A Solid <Await> without a fallback no longer holds the streamed shell; it renders inside the nearest <Suspense> boundary like React and Vue, and now renders falsy resolved values.

Static server functions decode cached RawStream values with the client deserializer plugins.

SSR Query integrations now keep request cleanup and stream ownership aligned with the router lifecycle.

#8420 8e164d2 - useLinkProps no longer calls through an internal wrapper. The host element Link renders on is an @internal overload parameter that is stripped from the published declarations, so the public useLinkProps(options, forwardedRef?) signature is unchanged.

Updated dependencies [bc80866, e561fa1, cbbfbe3, a1c8d1a, cbbfbe3, a0b2ad9, 1ca361b]:

@tanstack/router-core@1.171.31

1.170.36

Patch Changes

#8390 b747fb8 - Keep the Link location cache out of server bundles: buildLocation only creates, reads and writes it when isServer is false. Render React Links on the server without the extra prop copies and the forwarded-ref hook. Link SSR rendering is 20-40% faster in the Link benchmarks and the React Start SSR request loop about 7% faster.

React activeProps and inactiveProps now follow one precedence rule on every link, including links whose destination is blocked for using a disallowed scheme: state props override element props, ref and event handlers, while href, disabled and target stay controlled by the router. Previously a blocked link ignored a ref or handler from its inactive props.

React Link and useLinkProps split router options from element props with one key set on the client and the server. Element props pass through as given: external links forward them verbatim, falsy values included, and useLinkProps now returns children for router-controlled links as it already did for external ones.

... (truncated)

Commits

84bde66 ci: Version Packages (#8457)
de023a7 ci: Version Packages (#8429)
cbbfbe3 optimize streaming (#8204)
8e164d2 refactor(react-router): drop the useLinkProps pass-through wrapper (#8420)
e561fa1 perf(router-core): pass deepEqual flags positionally (#8418)
6954a37 ci: Version Packages (#8355)
92719bd perf(react-router): memoize Link and forward refs without an effect (#8405)
d740d8b perf(react-router): fewer hooks per Link (#8404)
f2ff324 refactor(react-router): one key set and one assembly path for Link props (#8401)
b747fb8 perf(router): keep the location cache client-only and slim Link SSR (#8390)
Additional commits viewable in compare view

Updates framer-motion from 13.2.0 to 13.4.0

Changelog

Sourced from framer-motion's changelog.

[13.4.0] 2026-09-14

Added

AnimateView: View transitions for React 19.3, built on React's ViewTransition.

[13.3.0] 2026-09-14

Added

Hooks for Motion Editor.

Changed

springValue/useSpring: 80% reduction in time when retargeting.

animate: 10% smaller.

animate: 20% reduction in startup time.

animate: 10% reduction in per-frame JS.

frame: Frame scheduling 10% faster.

Fixed

animate: Fixed path drawing calculations.

Commits

a6ea2f9 v13.4.0
d6ef844 Changelog
75c4dcf Merge pull request #3824 from motiondivision/codex/react-animate-view
a5a7856 Co-locate AnimateView layer animation in framer-motion
5c8bc09 Keep AnimateView group morph with custom values; gate view tests in Playwright
12018e8 Add AnimateView via motion/react-animate-view
939c267 Updating changelog
16cf742 Latest
49f1fe1 v13.3.0
f777c92 Updating changelog
Additional commits viewable in compare view

Updates lucide-react from 1.45.0 to 1.47.0

Release notes

Sourced from lucide-react's releases.

Version 1.47.0

What's Changed

feat(icons): add lambda icon by @UbaidUllah9962 in lucide-icons/lucide#4017

feat(icons): delegated faucet icon from lab by @karsa-mistmere in lucide-icons/lucide#4764

feat(icons): added door-closed-package icon by @karsa-mistmere in lucide-icons/lucide#4814

feat(icons): added 'nepali-rupee' icon by @sarajdhakal in lucide-icons/lucide#4608

feat(icons): added tube-lotion icon by @AlecRust in lucide-icons/lucide#4029

feat(icons): Added cupcake icon by @briz123 in lucide-icons/lucide#3000

feat(icons): added square-dashed-x icon by @EthanHazel in lucide-icons/lucide#4535

feat(icons): add rotate-cw-clock icon by @gkkconan in lucide-icons/lucide#3979

fix(icons): remove path from save-off by @HPRILLER in lucide-icons/lucide#4848

fix(icons): changed calendar-chevrons-right by @karsa-mistmere in lucide-icons/lucide#4865

fix(icons): changed broccoli icon by @jguddas in lucide-icons/lucide#4871

feat(icons): added square-dashed-plus by @psjdev in lucide-icons/lucide#4849

New Contributors

@UbaidUllah9962 made their first contribution in lucide-icons/lucide#4017

@sarajdhakal made their first contribution in lucide-icons/lucide#4608

@AlecRust made their first contribution in lucide-icons/lucide#4029

@gkkconan made their first contribution in lucide-icons/lucide#3979

@HPRILLER made their first contribution in lucide-icons/lucide#4848

@psjdev made their first contribution in lucide-icons/lucide#4849

Full Changelog: lucide-icons/lucide@1.46.0...1.47.0

Version 1.46.0

What's Changed

feat(icons): Added new icons: clef-g, clef-f and clef-c by @rrod497 in lucide-icons/lucide#4083

chore(deps-dev): bump astro from 7.3.0 to 7.3.2 in the astro-deps group by @dependabot[bot] in lucide-icons/lucide#4860

feat(icons): added monitor-pc icon by @karsa-mistmere in lucide-icons/lucide#4791

Full Changelog: lucide-icons/lucide@1.45.0...1.46.0

Commits

See full diff in compare view

Updates tailwind-merge from 3.6.0 to 3.7.0

Release notes

Sourced from tailwind-merge's releases.

tailwind-merge@3.7.0

New Features

Prepare some upcoming changes by @dcastil in dcastil/tailwind-merge#713

Theme getters returned by fromTheme now expose the theme key they read as a themeKey property, so tooling can identify the referenced theme scale without calling the getter.

Release tags now include the package name, starting with tailwind-merge@3.7.0.

Bug Fixes

Fix arbitrary values using color() or light-dark() being classified as lengths instead of colors by @ddussi in dcastil/tailwind-merge#712

Fix bare bg-conic not merging with other background image classes by @dcastil in dcastil/tailwind-merge#708

Fix columns-auto not conflicting with other columns classes by @dcastil in dcastil/tailwind-merge#707

Fix container sizes like inline-2xl not merging by @dcastil in dcastil/tailwind-merge#706

Fix max-h-none missing in max-h class group by @mutewinter in dcastil/tailwind-merge#704

Fix axis shorthands like px not overriding logical sides like ps by @dcastil in dcastil/tailwind-merge#705

Fix leading-none being removed when the leading theme scale is overridden by @chatman-media in dcastil/tailwind-merge#689

Fix deprecated shadow-inner being classified as shadow color instead of shadow by @dcastil in dcastil/tailwind-merge#703

Documentation

Add Deno to install instructions by @bartlomieju in dcastil/tailwind-merge#687

Add missing text-shadow theme key to configuration docs by @dcastil in dcastil/tailwind-merge@3e6d208

Other

Switch package manager from yarn to pnpm by @dcastil in dcastil/tailwind-merge#680

Harden CI security by @dcastil in dcastil/tailwind-merge#679

Full Changelog: v3.6.0...v3.7.0

Thanks to @brandonmcconnell, @manavm1990, @langy, @roboflow, @syntaxfm, @getsentry, @codecov, a private sponsor, @openclaw, @sourcegraph, @cesarvcanal, @CasperKristiansson, @jbisasky, @frontendmasters and more via @thnxdev for sponsoring tailwind-merge! ❤️

Commits

511d68a tailwind-merge@3.7.0
2461127 Release tooling: Pass the namespaced tag prefix and commit message to pnpm's ...
9d41508 add changelog for tailwind-merge@3.7.0
c78a80f Configurator: Reuse runtime lookups during pruning
49c317d Monorepo: Fix contributing link and include package coverage
7b565ca Configurator: prune a generated config to a project's used classes (core step)
d83e013 Releases: auto-re-pin tag-pinned links on every version bump
b71fd41 Docs: pin every in-repo file link to a release tag instead of main
ee29441 Docs: point the ThemeObject JSDoc link at the packaged docs location
9521b10 Releases: per-package pipeline with namespaced tags
Additional commits viewable in compare view

Updates zod from 4.6.2 to 4.6.5

Release notes

Sourced from zod's releases.

v4.6.5

Commits:

d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post

f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections

de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)

56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)

ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"

cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""

0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5

59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)

ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)

2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump

f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged

75d63ee1 docs: show only the .properties() method form in the 4.6 post

46da9572 docs: match the error-message examples to what the parsers emit

Commits

59bbc03 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump
0f3f5ee 4.6.5
cc4cd4e Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, ref...
ca0229a Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed w...
56222cd feat(instanceof): key the .properties() shape off the instance type (#6600)
de65a5c docs: lead the properties section with the check and add a Zod Mini tab (#6598)
f1448f7 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
d2b135c docs: add the 4.6.x patch highlights to the 4.6 post
2bb0871 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
743aedb 4.6.4
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the prod-minor-patch group with 6 updates: | Package | From | To | | --- | --- | --- | | [@ax-llm/ax](https://github.com/ax-llm/ax) | `24.0.17` | `24.0.20` | | [@tanstack/react-router](https://github.com/TanStack/router/tree/HEAD/packages/react-router) | `1.170.35` | `1.170.38` | | [framer-motion](https://github.com/motiondivision/motion) | `13.2.0` | `13.4.0` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.45.0` | `1.47.0` | | [tailwind-merge](https://github.com/dcastil/tailwind-merge/tree/HEAD/packages/tailwind-merge) | `3.6.0` | `3.7.0` | | [zod](https://github.com/colinhacks/zod) | `4.6.2` | `4.6.5` | Updates `@ax-llm/ax` from 24.0.17 to 24.0.20 - [Release notes](https://github.com/ax-llm/ax/releases) - [Changelog](https://github.com/ax-llm/ax/blob/main/CHANGELOG.md) - [Commits](ax-llm/ax@24.0.17...24.0.20) Updates `@tanstack/react-router` from 1.170.35 to 1.170.38 - [Release notes](https://github.com/TanStack/router/releases) - [Changelog](https://github.com/TanStack/router/blob/main/packages/react-router/CHANGELOG.md) - [Commits](https://github.com/TanStack/router/commits/@tanstack/react-router@1.170.38/packages/react-router) Updates `framer-motion` from 13.2.0 to 13.4.0 - [Changelog](https://github.com/motiondivision/motion/blob/main/CHANGELOG.md) - [Commits](motiondivision/motion@v13.2.0...v13.4.0) Updates `lucide-react` from 1.45.0 to 1.47.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.47.0/packages/lucide-react) Updates `tailwind-merge` from 3.6.0 to 3.7.0 - [Release notes](https://github.com/dcastil/tailwind-merge/releases) - [Commits](https://github.com/dcastil/tailwind-merge/commits/tailwind-merge@3.7.0/packages/tailwind-merge) Updates `zod` from 4.6.2 to 4.6.5 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.6.2...v4.6.5) --- updated-dependencies: - dependency-name: "@ax-llm/ax" dependency-version: 24.0.20 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-minor-patch - dependency-name: "@tanstack/react-router" dependency-version: 1.170.38 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-minor-patch - dependency-name: framer-motion dependency-version: 13.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-patch - dependency-name: lucide-react dependency-version: 1.47.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-patch - dependency-name: tailwind-merge dependency-version: 3.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-patch - dependency-name: zod dependency-version: 4.6.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-09-22T14:00:22Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
lucide-react@1.45.0 ⏵ 1.47.0	⁺¹	⁺¹
tailwind-merge@3.6.0 ⏵ 3.7.0	⁺¹	⁺¹
@tanstack/react-router@1.170.35 ⏵ 1.170.38	⁺¹
@ax-llm/ax@24.0.17 ⏵ 24.0.20	⁺¹	⁺¹
zod@4.6.2 ⏵ 4.6.5
framer-motion@13.2.0 ⏵ 13.4.0	⁺¹	⁺¹	⁺²

View full report

dependabot · 2026-09-29T13:54:58Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update JavaScript code labels Sep 22, 2026

dependabot Bot closed this Sep 29, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/prod-minor-patch-e196f19973 branch September 29, 2026 13:55

Navigation Menu

Repository navigation

build(deps): bump the prod-minor-patch group with 6 updates - #181

build(deps): bump the prod-minor-patch group with 6 updates#181
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/prod-minor-patch-e196f19973

dependabot Bot commented on behalf of github Sep 22, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Sep 22, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release 24.0.20

What's Changed

Release 24.0.19

What's Changed

Release 24.0.18

What's Changed

24.0.20 (2026-09-18)

Features

24.0.19 (2026-09-17)

Features

Bug Fixes

24.0.18 (2026-09-09)

Features

Bug Fixes

24.0.18 (2026-09-09)

Features

Bug Fixes

@​tanstack/react-router@​1.170.38

Patch Changes

@​tanstack/react-router@​1.170.37

Patch Changes

@​tanstack/react-router@​1.170.36

Patch Changes

1.170.38

Patch Changes

1.170.37

Patch Changes

1.170.36

Patch Changes

[13.4.0] 2026-09-14

Added

[13.3.0] 2026-09-14

Added

Changed

Fixed

Version 1.47.0

What's Changed

New Contributors

Version 1.46.0

What's Changed

tailwind-merge@3.7.0

New Features

Bug Fixes

Documentation

Other

v4.6.5

Commits:

v4.6.4

v4.6.3

Uh oh!

socket-security Bot commented Sep 22, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Sep 22, 2026 •

edited

Loading

`@tanstack/react-router@1`.170.38

`@tanstack/react-router@1`.170.37

`@tanstack/react-router@1`.170.36