Skip to content

Bump the production-security group across 1 directory with 29 updates - #6

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-security-0731002611
Open

Bump the production-security group across 1 directory with 29 updates#6
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-security-0731002611

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 31, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the production-security group with 29 updates in the / directory:

Package From To
@aws-sdk/client-s3 3.1106.0 3.1160.0
@aws-sdk/s3-request-presigner 3.1106.0 3.1160.0
argon2 0.44.0 0.45.1
class-validator 0.14.3 0.15.1
express 5.2.1 5.3.0
fast-xml-parser 5.10.1 5.11.2
helmet 8.1.0 8.3.0
libphonenumber-js 1.13.10 1.13.15
nodemailer 10.1.4 10.3.1
socket.io 4.8.3 4.8.4
zod 4.6.6 4.6.7
@tanstack/react-query 5.101.4 5.105.0
@tanstack/react-query-devtools 5.101.4 5.105.0
lucide-react 1.31.0 1.64.0
next 16.4.1 16.4.3
openapi-fetch 0.15.2 0.17.0
posthog-js 1.428.7 1.442.1
react 19.2.8 19.3.1
react-aria-components 1.17.0 1.22.1
react-dom 19.2.8 19.3.1
react-hook-form 7.85.0 7.91.0
tailwind-merge 3.6.0 3.7.0
web-vitals 6.2.1 6.2.3
zustand 5.0.15 5.0.16
@heroui/react 3.2.4 3.2.7
@heroui/styles 3.2.4 3.2.7
@tanstack/react-table 9.1.2 9.3.1
radix-ui 1.6.7 1.8.1
react-aria 3.51.0 3.53.1

Updates @aws-sdk/client-s3 from 3.1106.0 to 3.1160.0

Release notes

Sourced from @​aws-sdk/client-s3's releases.

v3.1160.0

3.1160.0(2026-10-29)

New Features
  • client-cleanrooms: Adds support for the PySpark 2.0 analysis template format and for choosing the file format (CSV or Parquet) of protected job results written to Amazon S3, including in a membership's default job result configuration. (8cb4c7eb)
  • client-bedrock-agentcore-control: Adds Session Endpoint Feature on AgentCore Runtime (07ecbbc3)
  • client-wafv2: AWS WAF customers using Targeted Bot Control, ATP, or ACFP managed rule groups can now enable automatic Challenge JavaScript SDK injection. When enabled, Amazon CloudFront injects the script tag into HTML responses on your behalf, removing the need for manual integration. (d4065359)
  • client-bedrock-agentcore: Adds AgentCore Runtime session endpoint support, including sessionEndpointUrl on the InvokeAgentRuntime response (dac2f977)
  • client-lightsail: This release adds support for instance health status checks and system status checks. (5bf15ec1)
  • client-imagebuilder: This release adds support for on-demand AMI scanning with Amazon Inspector. (a1a1c3ea)
  • checksums: add xxHash and SHA-512 checksum algorithms (#8383) (3aa504f3)
  • codegen: add Smithy RPCv2 JSON protocol (#8386) (ee519d02)

For list of updated packages, view updated-packages.md in assets-3.1160.0.zip

v3.1159.0

3.1159.0(2026-10-28)

Chores
  • readability, require braces for control flow (#8389) (2a160140)
New Features
  • client-connectparticipant: Amazon Connect Participant Service now supports the optional UrlContentDisposition parameter on GetAttachment, which returns a pre-signed URL that renders a chat attachment inline in the browser instead of forcing a download. (264a9efc)
  • client-connect: Amazon Connect APIs - CreateTaskTemplate and UpdateTaskTemplate accept a new ContactHooks parameter called WrapUpFlowId to identify the flow module that runs when an agent attempts to disconnect from a task created with the template. Use this to verify an agent's work or update external case repos. (86f44373)
  • client-ec2: Amazon EC2 Capacity Manager adds supportability checks and capacity fulfillment metrics. Use GetCapacityManagerSupportabilityScores to score how well instance types and Availability Zones can support a capacity request, and GetCapacityManagerMetricData to retrieve fulfillment metrics. (2ab44578)
  • client-opensearch: This release adds APIs to simplify setting up a replication relationship between OpenSearch clusters. The APIs include new Switchover and Failover actions for planned switchovers and unplanned failovers to ensure high availability for OpenSearch in the event of disaster in a single region. (59cc8c0d)
  • client-ivs: InsertAdBreak now allows setting a customized adBreakId on a request and also adds a new field targetStartAt for a delayed ad insertion (c0656dd6)
  • client-acm: AWS Certificate Manager now supports the Automatic Certificate Management Environment (ACME) protocol in the AWS GovCloud (US-East) and AWS GovCloud (US-West) Regions. (5b43833f)
  • client-securityagent: Adds support for attaching client certificates for mutual TLS (mTLS) authentication to penetration test target endpoints via the new ClientCertificates field on Assets, enabling pentesting of endpoints that require client certificate authentication. (fe783883)
  • client-kafkaconnect: Amazon MSK Connect now supports updating a connector's custom plugin and worker configuration via the UpdateConnector API. MSK Connect checks connector and task health after the update and rolls back on failure. Each call returns an operation ARN to track with DescribeConnectorOperation. (c9a2aa5a)
  • client-artifact: Update support mode for Assurance Assistance (18fff2c6)
  • client-medialive: AWS Elemental MediaLive now supports SMPTE 2022-7 seamless protection switching for multicast inputs on MediaLive Anywhere. Support for MulticastSettings sources to add a redundant copy of the stream received on a second network interface. (d44798e5)
  • client-neptunedata: Get Storage API analyzes storage usage to identify database bloat and your storage footprint. Index Rebuild API triggers on-demand index reconstruction to eliminate bloat and restore query performance. (278cca93)
Bug Fixes
  • middleware-sdk-s3: scope S3 Express cache by identity (#8387) (7485eaac)

For list of updated packages, view updated-packages.md in assets-3.1159.0.zip

v3.1158.0

... (truncated)

Changelog

Sourced from @​aws-sdk/client-s3's changelog.

3.1160.0 (2026-10-29)

Note: Version bump only for package @​aws-sdk/client-s3

3.1159.0 (2026-10-28)

Note: Version bump only for package @​aws-sdk/client-s3

3.1158.0 (2026-10-27)

Bug Fixes

  • client-s3: isolate special character e2e test keys (#8382) (d9c091f)

3.1157.0 (2026-10-26)

Note: Version bump only for package @​aws-sdk/client-s3

3.1156.0 (2026-10-22)

Note: Version bump only for package @​aws-sdk/client-s3

3.1155.0 (2026-10-21)

Note: Version bump only for package @​aws-sdk/client-s3

... (truncated)

Commits
  • 40bf3f7 Publish v3.1160.0
  • c1fb86e Publish v3.1159.0
  • 2d08e1c Publish v3.1158.0
  • d9c091f fix(client-s3): isolate special character e2e test keys (#8382)
  • e5988ec Publish v3.1157.0
  • f9d9119 chore(codegen): sync for service default socket timeout and RPC v2 JSON (#8378)
  • 163a566 Publish v3.1156.0
  • 7c2f089 Publish v3.1155.0
  • 5f53137 chore(codegen): sync for JSON string serializer buffer fix and retryMode docs...
  • f6ff312 Publish v3.1154.0
  • Additional commits viewable in compare view

Updates @aws-sdk/s3-request-presigner from 3.1106.0 to 3.1160.0

Release notes

Sourced from @​aws-sdk/s3-request-presigner's releases.

v3.1160.0

3.1160.0(2026-10-29)

New Features
  • client-cleanrooms: Adds support for the PySpark 2.0 analysis template format and for choosing the file format (CSV or Parquet) of protected job results written to Amazon S3, including in a membership's default job result configuration. (8cb4c7eb)
  • client-bedrock-agentcore-control: Adds Session Endpoint Feature on AgentCore Runtime (07ecbbc3)
  • client-wafv2: AWS WAF customers using Targeted Bot Control, ATP, or ACFP managed rule groups can now enable automatic Challenge JavaScript SDK injection. When enabled, Amazon CloudFront injects the script tag into HTML responses on your behalf, removing the need for manual integration. (d4065359)
  • client-bedrock-agentcore: Adds AgentCore Runtime session endpoint support, including sessionEndpointUrl on the InvokeAgentRuntime response (dac2f977)
  • client-lightsail: This release adds support for instance health status checks and system status checks. (5bf15ec1)
  • client-imagebuilder: This release adds support for on-demand AMI scanning with Amazon Inspector. (a1a1c3ea)
  • checksums: add xxHash and SHA-512 checksum algorithms (#8383) (3aa504f3)
  • codegen: add Smithy RPCv2 JSON protocol (#8386) (ee519d02)

For list of updated packages, view updated-packages.md in assets-3.1160.0.zip

v3.1159.0

3.1159.0(2026-10-28)

Chores
  • readability, require braces for control flow (#8389) (2a160140)
New Features
  • client-connectparticipant: Amazon Connect Participant Service now supports the optional UrlContentDisposition parameter on GetAttachment, which returns a pre-signed URL that renders a chat attachment inline in the browser instead of forcing a download. (264a9efc)
  • client-connect: Amazon Connect APIs - CreateTaskTemplate and UpdateTaskTemplate accept a new ContactHooks parameter called WrapUpFlowId to identify the flow module that runs when an agent attempts to disconnect from a task created with the template. Use this to verify an agent's work or update external case repos. (86f44373)
  • client-ec2: Amazon EC2 Capacity Manager adds supportability checks and capacity fulfillment metrics. Use GetCapacityManagerSupportabilityScores to score how well instance types and Availability Zones can support a capacity request, and GetCapacityManagerMetricData to retrieve fulfillment metrics. (2ab44578)
  • client-opensearch: This release adds APIs to simplify setting up a replication relationship between OpenSearch clusters. The APIs include new Switchover and Failover actions for planned switchovers and unplanned failovers to ensure high availability for OpenSearch in the event of disaster in a single region. (59cc8c0d)
  • client-ivs: InsertAdBreak now allows setting a customized adBreakId on a request and also adds a new field targetStartAt for a delayed ad insertion (c0656dd6)
  • client-acm: AWS Certificate Manager now supports the Automatic Certificate Management Environment (ACME) protocol in the AWS GovCloud (US-East) and AWS GovCloud (US-West) Regions. (5b43833f)
  • client-securityagent: Adds support for attaching client certificates for mutual TLS (mTLS) authentication to penetration test target endpoints via the new ClientCertificates field on Assets, enabling pentesting of endpoints that require client certificate authentication. (fe783883)
  • client-kafkaconnect: Amazon MSK Connect now supports updating a connector's custom plugin and worker configuration via the UpdateConnector API. MSK Connect checks connector and task health after the update and rolls back on failure. Each call returns an operation ARN to track with DescribeConnectorOperation. (c9a2aa5a)
  • client-artifact: Update support mode for Assurance Assistance (18fff2c6)
  • client-medialive: AWS Elemental MediaLive now supports SMPTE 2022-7 seamless protection switching for multicast inputs on MediaLive Anywhere. Support for MulticastSettings sources to add a redundant copy of the stream received on a second network interface. (d44798e5)
  • client-neptunedata: Get Storage API analyzes storage usage to identify database bloat and your storage footprint. Index Rebuild API triggers on-demand index reconstruction to eliminate bloat and restore query performance. (278cca93)
Bug Fixes
  • middleware-sdk-s3: scope S3 Express cache by identity (#8387) (7485eaac)

For list of updated packages, view updated-packages.md in assets-3.1159.0.zip

v3.1158.0

... (truncated)

Changelog

Sourced from @​aws-sdk/s3-request-presigner's changelog.

3.1160.0 (2026-10-29)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1159.0 (2026-10-28)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1158.0 (2026-10-27)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1157.0 (2026-10-26)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1156.0 (2026-10-22)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1155.0 (2026-10-21)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1154.0 (2026-10-20)

... (truncated)

Commits

Updates argon2 from 0.44.0 to 0.45.1

Release notes

Sourced from argon2's releases.

v0.45.1

Fixes an issue with v0.45.0 where TypeScript generated types for the hash function as returning Promise<any>

Full Changelog: ranisalt/node-argon2@v0.45.0...v0.45.1

v0.45.0

What's Changed

Drops support for Node 18 and 20 (probably still works, but isn't tested)

New Contributors

Full Changelog: ranisalt/node-argon2@v0.44.0...v0.45.0

Commits
  • 786de71 fix: hash function generated types
  • e2fe33f fix: update Node.js version to latest in publish job
  • e27980f fix: revert sync to default in freebsd test
  • 3d0a0b4 fix: change npm publish to npm stage publish in release workflow
  • c61513f chore: update actions versions
  • 2bc0733 fix: revert sync to default in freebsd build
  • b012379 chore: update dependencies and devDependencies
  • d2edf4e fix(tests): add unicode flag to regex assertions in option tests
  • 0eb1db1 Apply npm fixes to package.json
  • a09b94e Fix compilation on solaris (#538)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for argon2 since your current version.


Updates class-validator from 0.14.3 to 0.15.1

Release notes

Sourced from class-validator's releases.

v0.15.1

What's Changed

Full Changelog: typestack/class-validator@v0.15.0...v0.15.1

v0.15.0

What's Changed

New Contributors

Full Changelog: typestack/class-validator@v0.14.4...v0.15.0

v0.14.4

What's Changed

Full Changelog: typestack/class-validator@v0.14.3...v0.14.4

Changelog

Sourced from class-validator's changelog.

0.15.1 (2026-02-26)

BREAKING CHANGES

  • Added options argument to IsIBAN validator (#2618), which breaks any existing usage of this decorator that pass an argument to the decorator, e.g. @IsIBAN({forbidUnknownValues: false})

Fixed

  • Updated lockfile to patch vulnerabilities (#2669)
  • Fixed a small grammatical error in the docs (#2596)

Added

  • Added validateIf option to all validators, providing a lot more flexibility in using conditional validation (#1579)
  • Added IsISO31661Numeric validator for country codes (#2657)
  • Added IsISO6391 validator for language codes (#2626)
  • Added more versions to IsUUID validator options. (#2647)

0.14.4 (2026-02-25)

  • Updated validator.js to 13.15.22 (#2649)
Commits

Updates express from 5.2.1 to 5.3.0

Release notes

Sourced from express's releases.

v5.3.0

Highlights

🐞 Bug fixes

  • Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

    Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

🚀 Improvements

  • Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

    // QUERY /reports with If-None-Match: "12345"
app.query('/reports', (req, res) => {
  res.set('ETag', '"12345"');
  res.send(results); // now responds 304 Not Modified
});

  • Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

  • When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

    app.render('index', null, callback); // now works as expected

  • Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

    res.set('Content-Type', 'text/plain; foo=bar').send('hey');
// -> Content-Type: text/plain; foo=bar; charset=utf-8

  • The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

  • Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

    res.attachment('user.html');
// before -> Content-Disposition: attachment; filename="user.html"
// after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Changelog

Sourced from express's changelog.

5.3.0

🐞 Bug fixes

  • Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

    Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

🚀 Improvements

  • Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

    // QUERY /reports with If-None-Match: "12345"
app.query('/reports', (req, res) => {
  res.set('ETag', '"12345"');
  res.send(results); // now responds 304 Not Modified
});

  • Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

  • When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

    app.render('index', null, callback); // now works as expected

  • Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

    res.set('Content-Type', 'text/plain; foo=bar').send('hey');
// -> Content-Type: text/plain; foo=bar; charset=utf-8

  • The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

  • Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

    res.attachment('user.html');
// before -> Content-Disposition: attachment; filename="user.html"
// after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express since your current version.


Updates fast-xml-parser from 5.10.1 to 5.11.2

Release notes

Sourced from fast-xml-parser's releases.

v5.11.2

What's Changed

New Contributors

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.11.1...v5.11.2

v5.11.1

What's Changed

New Contributors

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.11.0...v5.11.1

v5.11.0

What's Changed

New Contributors

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.10.1...v5.11.0

Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

5.11.2 / 2026-09-29

  • fix (#875): decode Uint8Array XML input as UTF-8 (By emme1t)
  • fix (#880) :type EntityDecoderOptions.setXmlVersion's version as a number (By Yevhenii Kotyrlo)

5.11.1 / 2026-08-27

  • fix: validator; Replace regex with a single-pass scanner for attribute tokens, eliminating quadratic behavior on long whitespace runs.

5.11.0 / 2026-08-16

  • feat: support for endIndex in node metadata (#850) [By Pavel Dranichnikov]
  • fix: don't crash on a closing tag with no matching opening tag (#861) [By Haïm Dimer]
  • fix: DOCTYPE to read SYSTEM/PUBLIC
  • deps: strnum v2.4.2

5.10.1 / 2026-07-17

  • fix: multiple DOCTYPE declarations.
  • deps: @nodable/entities for treeshaking

5.10.0 / 2026-07-11

  • upgrade:
    • xml-naming v0.3.0: cache support
    • PEM v1.6.2: sibling bug fix
    • is-unsafe v2.0.0: tree shaking

*5.9.3 / 2026-06-19

  • update strnum

*5.9.2 / 2026-06-17

  • dummy release to test changes in github action

*5.9.1 / 2026-06-17

  • dummy release to test release from github action

*5.9.0 / 2026-06-15

  • update strnum to 2.3.0
    • you can set hex, binary, enotation, infinity, unicode
  • validate unsafe HTML or XML data in doctype entities unsing 'is-unsafe' library. User can override rules by overriding EntityDecoder.

*5.8.0 / 2026-05-12

  • integrate xml-naming to validate DOCTYPE entity name and notation name (using qname becaue of backward compatibility)
    • This will consider xml-version as well. '1.0' is default
  • update strnum to 2.3.0
    • You can set octal and binary parsing which is bydeault off
  • update fast-xml-builder to 1.2.0
    • can sanitize tag names if found invalid

... (truncated)

Commits

Updates helmet from 8.1.0 to 8.3.0

Details Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 31, 2026
@dependabot
Bump the production-security group across 1 directory with 29 updates
49ee70d 
Bumps the production-security group with 29 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1106.0` | `3.1160.0` |
| [@aws-sdk/s3-request-presigner](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/packages/s3-request-presigner) | `3.1106.0` | `3.1160.0` |
| [argon2](https://github.com/ranisalt/node-argon2) | `0.44.0` | `0.45.1` |
| [class-validator](https://github.com/typestack/class-validator) | `0.14.3` | `0.15.1` |
| [express](https://github.com/expressjs/express) | `5.2.1` | `5.3.0` |
| [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | `5.10.1` | `5.11.2` |
| [helmet](https://github.com/helmetjs/helmet) | `8.1.0` | `8.3.0` |
| [libphonenumber-js](https://gitlab.com/catamphetamine/libphonenumber-js) | `1.13.10` | `1.13.15` |
| [nodemailer](https://github.com/nodemailer/nodemailer) | `10.1.4` | `10.3.1` |
| [socket.io](https://github.com/socketio/socket.io) | `4.8.3` | `4.8.4` |
| [zod](https://github.com/colinhacks/zod) | `4.6.6` | `4.6.7` |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.101.4` | `5.105.0` |
| [@tanstack/react-query-devtools](https://github.com/TanStack/query/tree/HEAD/packages/react-query-devtools) | `5.101.4` | `5.105.0` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.31.0` | `1.64.0` |
| [next](https://github.com/vercel/next.js) | `16.4.1` | `16.4.3` |
| [openapi-fetch](https://github.com/openapi-ts/openapi-typescript/tree/HEAD/packages/openapi-fetch) | `0.15.2` | `0.17.0` |
| [posthog-js](https://github.com/PostHog/posthog-js) | `1.428.7` | `1.442.1` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.8` | `19.3.1` |
| [react-aria-components](https://github.com/adobe/react-spectrum) | `1.17.0` | `1.22.1` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.8` | `19.3.1` |
| [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.85.0` | `7.91.0` |
| [tailwind-merge](https://github.com/dcastil/tailwind-merge/tree/HEAD/packages/tailwind-merge) | `3.6.0` | `3.7.0` |
| [web-vitals](https://github.com/GoogleChrome/web-vitals) | `6.2.1` | `6.2.3` |
| [zustand](https://github.com/pmndrs/zustand) | `5.0.15` | `5.0.16` |
| [@heroui/react](https://github.com/heroui-inc/heroui/tree/HEAD/packages/react) | `3.2.4` | `3.2.7` |
| [@heroui/styles](https://github.com/heroui-inc/heroui/tree/HEAD/packages/styles) | `3.2.4` | `3.2.7` |
| [@tanstack/react-table](https://github.com/TanStack/table/tree/HEAD/packages/react-table) | `9.1.2` | `9.3.1` |
| [radix-ui](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/radix-ui) | `1.6.7` | `1.8.1` |
| [react-aria](https://github.com/adobe/react-spectrum) | `3.51.0` | `3.53.1` |



Updates `@aws-sdk/client-s3` from 3.1106.0 to 3.1160.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1160.0/clients/client-s3)

Updates `@aws-sdk/s3-request-presigner` from 3.1106.0 to 3.1160.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/packages/s3-request-presigner/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1160.0/packages/s3-request-presigner)

Updates `argon2` from 0.44.0 to 0.45.1
- [Release notes](https://github.com/ranisalt/node-argon2/releases)
- [Commits](ranisalt/node-argon2@v0.44.0...v0.45.1)

Updates `class-validator` from 0.14.3 to 0.15.1
- [Release notes](https://github.com/typestack/class-validator/releases)
- [Changelog](https://github.com/typestack/class-validator/blob/develop/CHANGELOG.md)
- [Commits](typestack/class-validator@v0.14.3...v0.15.1)

Updates `express` from 5.2.1 to 5.3.0
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/master/History.md)
- [Commits](expressjs/express@v5.2.1...v5.3.0)

Updates `fast-xml-parser` from 5.10.1 to 5.11.2
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](NaturalIntelligence/fast-xml-parser@v5.10.1...v5.11.2)

Updates `helmet` from 8.1.0 to 8.3.0
- [Changelog](https://github.com/helmetjs/helmet/blob/main/CHANGELOG.md)
- [Commits](helmetjs/helmet@v8.1.0...v8.3.0)

Updates `libphonenumber-js` from 1.13.10 to 1.13.15
- [Changelog](https://gitlab.com/catamphetamine/libphonenumber-js/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/catamphetamine/libphonenumber-js/commits/v1.13.15)

Updates `nodemailer` from 10.1.4 to 10.3.1
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v10.1.4...v10.3.1)

Updates `socket.io` from 4.8.3 to 4.8.4
- [Release notes](https://github.com/socketio/socket.io/releases)
- [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md)
- [Commits](https://github.com/socketio/socket.io/compare/socket.io@4.8.3...socket.io@4.8.4)

Updates `zod` from 4.6.6 to 4.6.7
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.6.6...v4.6.7)

Updates `@tanstack/react-query` from 5.101.4 to 5.105.0
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.105.0/packages/react-query)

Updates `@tanstack/react-query-devtools` from 5.101.4 to 5.105.0
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query-devtools/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query-devtools@5.105.0/packages/react-query-devtools)

Updates `lucide-react` from 1.31.0 to 1.64.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.64.0/packages/lucide-react)

Updates `next` from 16.4.1 to 16.4.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.4.1...v16.4.3)

Updates `openapi-fetch` from 0.15.2 to 0.17.0
- [Release notes](https://github.com/openapi-ts/openapi-typescript/releases)
- [Changelog](https://github.com/openapi-ts/openapi-typescript/blob/main/packages/openapi-fetch/CHANGELOG.md)
- [Commits](https://github.com/openapi-ts/openapi-typescript/commits/openapi-fetch@0.17.0/packages/openapi-fetch)

Updates `posthog-js` from 1.428.7 to 1.442.1
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.428.7...posthog-js@1.442.1)

Updates `react` from 19.2.8 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react)

Updates `react-aria-components` from 1.17.0 to 1.22.1
- [Release notes](https://github.com/adobe/react-spectrum/releases)
- [Commits](https://github.com/adobe/react-spectrum/compare/react-aria-components@1.17.0...react-aria-components@1.22.1)

Updates `react-dom` from 19.2.8 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom)

Updates `react-hook-form` from 7.85.0 to 7.91.0
- [Release notes](https://github.com/react-hook-form/react-hook-form/releases)
- [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md)
- [Commits](react-hook-form/react-hook-form@v7.85.0...v7.91.0)

Updates `tailwind-merge` from 3.6.0 to 3.7.0
- [Release notes](https://github.com/dcastil/tailwind-merge/releases)
- [Commits](https://github.com/dcastil/tailwind-merge/commits/tailwind-merge@3.7.0/packages/tailwind-merge)

Updates `web-vitals` from 6.2.1 to 6.2.3
- [Changelog](https://github.com/GoogleChrome/web-vitals/blob/main/CHANGELOG.md)
- [Commits](GoogleChrome/web-vitals@v6.2.1...v6.2.3)

Updates `zustand` from 5.0.15 to 5.0.16
- [Release notes](https://github.com/pmndrs/zustand/releases)
- [Commits](pmndrs/zustand@v5.0.15...v5.0.16)

Updates `@heroui/react` from 3.2.4 to 3.2.7
- [Release notes](https://github.com/heroui-inc/heroui/releases)
- [Changelog](https://github.com/heroui-inc/heroui/blob/v3/packages/react/CHANGELOG.md)
- [Commits](https://github.com/heroui-inc/heroui/commits/v3.2.7/packages/react)

Updates `@heroui/styles` from 3.2.4 to 3.2.7
- [Release notes](https://github.com/heroui-inc/heroui/releases)
- [Changelog](https://github.com/heroui-inc/heroui/blob/v3/packages/styles/CHANGELOG.md)
- [Commits](https://github.com/heroui-inc/heroui/commits/v3.2.7/packages/styles)

Updates `@tanstack/react-table` from 9.1.2 to 9.3.1
- [Release notes](https://github.com/TanStack/table/releases)
- [Changelog](https://github.com/TanStack/table/blob/main/packages/react-table/CHANGELOG.md)
- [Commits](https://github.com/TanStack/table/commits/@tanstack/react-table@9.3.1/packages/react-table)

Updates `radix-ui` from 1.6.7 to 1.8.1
- [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/radix-ui/CHANGELOG.md)
- [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/radix-ui)

Updates `react-aria` from 3.51.0 to 3.53.1
- [Release notes](https://github.com/adobe/react-spectrum/releases)
- [Commits](https://github.com/adobe/react-spectrum/compare/react-aria@3.51.0...react-aria@3.53.1)

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-s3"
  dependency-version: 3.1158.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-security
- dependency-name: "@aws-sdk/s3-request-presigner"
  dependency-version: 3.1158.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-security
- dependency-name: "@heroui/react"
  dependency-version: 3.2.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-security
- dependency-name: "@heroui/styles"
  dependency-version: 3.2.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-security
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.105.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-security
- dependency-name: "@tanstack/react-query-devtools"
  dependency-version: 5.105.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-security
- dependency-name: "@tanstack/react-table"
  dependency-version: 9.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-security
- dependency-name: argon2
  dependency-version: 0.45.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-security
- dependency-name: class-validator
  dependency-version: 0.15.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-security
- dependency-name: express
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-security
- dependency-name: fast-xml-parser
  dependency-version: 5.11.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-security
- dependency-name: helmet
  dependency-version: 8.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-security
- dependency-name: libphonenumber-js
  dependency-version: 1.13.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-security
- dependency-name: lucide-react
  dependency-version: 1.63.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-security
- dependency-name: next
  dependency-version: 16.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-security
- dependency-name: nodemailer
  dependency-version: 10.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-security
- dependency-name: openapi-fetch
  dependency-version: 0.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-security
- dependency-name: posthog-js
  dependency-version: 1.441.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-security
- dependency-name: radix-ui
  dependency-version: 1.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-security
- dependency-name: react
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-security
- dependency-name: react-aria
  dependency-version: 3.53.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-security
- dependency-name: react-aria-components
  dependency-version: 1.22.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-security
- dependency-name: react-dom
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-security
- dependency-name: react-hook-form
  dependency-version: 7.91.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-security
- dependency-name: socket.io
  dependency-version: 4.8.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-security
- dependency-name: tailwind-merge
  dependency-version: 3.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-security
- dependency-name: web-vitals
  dependency-version: 6.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-security
- dependency-name: zod
  dependency-version: 4.6.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-security
- dependency-name: zustand
  dependency-version: 5.0.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-security
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title Bump the production-security group with 29 updates Bump the production-security group across 1 directory with 29 updates Nov 2, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/production-security-0731002611 branch from 2a55d13 to 49ee70d Compare November 2, 2026 02:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants