Bump the development-dependencies group with 16 updates - #672
Merged
bgentry merged 2 commits intoSep 2, 2026
Merged
Conversation
Bumps the development-dependencies group with 16 updates: | Package | From | To | | --- | --- | --- | | [@faker-js/faker](https://github.com/faker-js/faker) | `10.5.0` | `10.6.0` | | [@testing-library/jest-dom](https://github.com/testing-library/jest-dom) | `7.0.0` | `7.0.1` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.1` | `26.3.0` | | [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.17` | `19.2.18` | | [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.3` | `19.2.5` | | [@vitejs/plugin-react-swc](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react-swc) | `4.3.2` | `4.3.3` | | [concurrently](https://github.com/open-cli-tools/concurrently) | `10.0.4` | `10.0.5` | | [eslint](https://github.com/eslint/eslint) | `10.8.0` | `10.9.1` | | [eslint-plugin-perfectionist](https://github.com/azat-io/eslint-plugin-perfectionist) | `5.10.0` | `5.10.1` | | [eslint-plugin-react-refresh](https://github.com/ArnaudBarre/eslint-plugin-react-refresh) | `0.5.3` | `0.5.4` | | [eslint-plugin-storybook](https://github.com/storybookjs/storybook/tree/HEAD/code/lib/eslint-plugin) | `10.5.4` | `10.5.10` | | [globals](https://github.com/sindresorhus/globals) | `17.7.0` | `17.11.0` | | [jsdom](https://github.com/jsdom/jsdom) | `29.1.1` | `30.0.1` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.65.0` | `8.68.0` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.1.5` | `8.2.2` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.10` | `4.1.11` | Updates `@faker-js/faker` from 10.5.0 to 10.6.0 - [Release notes](https://github.com/faker-js/faker/releases) - [Changelog](https://github.com/faker-js/faker/blob/next/CHANGELOG.md) - [Commits](faker-js/faker@v10.5.0...v10.6.0) Updates `@testing-library/jest-dom` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/testing-library/jest-dom/releases) - [Changelog](https://github.com/testing-library/jest-dom/blob/main/CHANGELOG.md) - [Commits](testing-library/jest-dom@v7.0.0...v7.0.1) Updates `@types/node` from 26.1.1 to 26.3.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@types/react` from 19.2.17 to 19.2.18 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `@types/react-dom` from 19.2.3 to 19.2.5 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom) Updates `@vitejs/plugin-react-swc` from 4.3.2 to 4.3.3 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react-swc/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/v4.3.3/packages/plugin-react-swc) Updates `concurrently` from 10.0.4 to 10.0.5 - [Release notes](https://github.com/open-cli-tools/concurrently/releases) - [Commits](open-cli-tools/concurrently@v10.0.4...v10.0.5) Updates `eslint` from 10.8.0 to 10.9.1 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.8.0...v10.9.1) Updates `eslint-plugin-perfectionist` from 5.10.0 to 5.10.1 - [Release notes](https://github.com/azat-io/eslint-plugin-perfectionist/releases) - [Changelog](https://github.com/azat-io/eslint-plugin-perfectionist/blob/main/changelog.md) - [Commits](azat-io/eslint-plugin-perfectionist@v5.10.0...v5.10.1) Updates `eslint-plugin-react-refresh` from 0.5.3 to 0.5.4 - [Release notes](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/releases) - [Changelog](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/blob/main/CHANGELOG.md) - [Commits](ArnaudBarre/eslint-plugin-react-refresh@v0.5.3...v0.5.4) Updates `eslint-plugin-storybook` from 10.5.4 to 10.5.10 - [Release notes](https://github.com/storybookjs/storybook/releases) - [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md) - [Commits](https://github.com/storybookjs/storybook/commits/v10.5.10/code/lib/eslint-plugin) Updates `globals` from 17.7.0 to 17.11.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](sindresorhus/globals@v17.7.0...v17.11.0) Updates `jsdom` from 29.1.1 to 30.0.1 - [Release notes](https://github.com/jsdom/jsdom/releases) - [Commits](jsdom/jsdom@v29.1.1...v30.0.1) Updates `typescript-eslint` from 8.65.0 to 8.68.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.68.0/packages/typescript-eslint) Updates `vite` from 8.1.5 to 8.2.2 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.2.2/packages/vite) Updates `vitest` from 4.1.10 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest) --- updated-dependencies: - dependency-name: "@faker-js/faker" dependency-version: 10.6.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: "@testing-library/jest-dom" dependency-version: 7.0.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: "@types/node" dependency-version: 26.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: "@types/react" dependency-version: 19.2.18 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: "@types/react-dom" dependency-version: 19.2.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: "@vitejs/plugin-react-swc" dependency-version: 4.3.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: concurrently dependency-version: 10.0.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: eslint dependency-version: 10.9.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: eslint-plugin-perfectionist dependency-version: 5.10.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: eslint-plugin-react-refresh dependency-version: 0.5.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: eslint-plugin-storybook dependency-version: 10.5.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: globals dependency-version: 17.11.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: jsdom dependency-version: 30.0.1 dependency-type: direct:development update-type: version-update:semver-major dependency-group: development-dependencies - dependency-name: typescript-eslint dependency-version: 8.68.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: vite dependency-version: 8.2.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: vitest dependency-version: 4.1.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Keep `jsdom` at 29.1.1 because 30.0.1 requires Node 24.15.0 while River UI and its CI pin 24.14.1 with strict engine checks. Regenerate the lockfile so the remaining development dependency updates can proceed without changing the runtime baseline.
bgentry
approved these changes
Sep 1, 2026
bgentry
left a comment
bgentry
left a comment
Contributor
There was a problem hiding this comment.
Codex dependency security review — approve
Reviewed base b39808b61984c7ad5b81a8a714ac21195dec269d through exact head 882158139ef52ddd89c3bb31c499bae4853d9862.
The final PR retains 15 direct development-dependency updates and deliberately keeps jsdom at 29.1.1. jsdom 30.0.1 requires Node ^24.15.0 on the Node 24 line, while River UI, CI, and the Docker builds pin 24.14.1 with engine-strict=true; the original grouped update therefore could not install. The follow-up commit restores the compatible jsdom dependency graph without altering the other upgrades.
Supply-chain review found canonical npm registry tarballs with SHA-512 integrity, stable package identities and publishers, no non-registry sources, no same-version integrity rewrites, and no added lifecycle/install scripts. Representative direct tarballs and all changed registry metadata/integrity values were checked; provenance was available and matched for the packages that publish attestations. The changed native Rolldown and Lightning CSS artifacts remain prepacked optional binaries rather than install-time downloads.
This update contains a confirmed security remediation: transitive nanoid moves from 3.3.16 to 3.3.18, fixing GHSA-2v37-7h3g-55p8 / CVE-2026-67213 (attacker-controlled zero-size generation can loop indefinitely). The focused jsdom rollback preserves that fix.
The exact final lockfile installs under the repository's pinned Node 24.14.1. Local validation passes lint, all 34 test files / 233 tests, the production build, and the Storybook build. GitHub checks for the new head are still running at review time.
Residual risk is limited to broad generated/minified changes in Faker and Vite and native Rolldown/Lightning CSS binaries that were verified by identity, metadata, provenance where available, and wrapper behavior but not independently rebuilt. Some established publishers (notably DefinitelyTyped, ESLint, globals, and Lightning CSS) retain their existing lack of npm SLSA provenance. I found no blocking security or compatibility issue in the final dependency set.
bgentry
deleted the
dependabot/npm_and_yarn/development-dependencies-cd6db00891
branch
September 2, 2026 02:04
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the development-dependencies group with 16 updates:
10.5.010.6.07.0.07.0.126.1.126.3.019.2.1719.2.1819.2.319.2.54.3.24.3.310.0.410.0.510.8.010.9.15.10.05.10.10.5.30.5.410.5.410.5.1017.7.017.11.029.1.130.0.18.65.08.68.08.1.58.2.24.1.104.1.11Updates
@faker-js/fakerfrom 10.5.0 to 10.6.0Release notes
Sourced from @faker-js/faker's releases.
... (truncated)
Changelog
Sourced from @faker-js/faker's changelog.
Commits
2cb0423chore(release): 10.6.0 (#3986)531588fchore(deps): lock file maintenance (#3923)328f018chore(deps): update eslint (#3930)a5c8bd7chore(deps): update mcr.microsoft.com/devcontainers/typescript-node:24 docker...fe3f17bchore(deps): update all non-major dependencies (#3974)ae38b18docs(lorem): document the fail default strategy for word (#3944)1ce5994fix(color): give the LCH hue its full 360 degree range (#3978)1143329fix(color): stop scaling the HSLA alpha into a percentage (#3979)a4c6757fix(vehicle): calculate VIN check digit (#3954)d68f978infra: ensure markdown rendered is only ever initialized once (#3984)Updates
@testing-library/jest-domfrom 7.0.0 to 7.0.1Release notes
Sourced from @testing-library/jest-dom's releases.
Commits
3782c78fix: declare vitest as an optional peer dependency (#733)Updates
@types/nodefrom 26.1.1 to 26.3.0Commits
Updates
@types/reactfrom 19.2.17 to 19.2.18Commits
Updates
@types/react-domfrom 19.2.3 to 19.2.5Commits
Updates
@vitejs/plugin-react-swcfrom 4.3.2 to 4.3.3Release notes
Sourced from @vitejs/plugin-react-swc's releases.
Changelog
Sourced from @vitejs/plugin-react-swc's changelog.
Commits
Updates
concurrentlyfrom 10.0.4 to 10.0.5Release notes
Sourced from concurrently's releases.
Commits
1b8cbeb10.0.5544dba0docs: make linter happy667b701deps: update several dev depsf67c57cvscode: use installed TS versiondbb5617fix: expand wildcards from package.json5 when package.json is missing (#608)9f90a1afix: correctly output non-ASCII text on Windows (#604)94415ccci: fix publishing to latest/backportUpdates
eslintfrom 10.8.0 to 10.9.1Release notes
Sourced from eslint's releases.
... (truncated)
Commits
5c8c24110.9.1a7f3b7dBuild: changelog update for 10.9.11e641c9fix: no-loss-of-precision false positive with trailing decimal point (#21251)ad74a8ddocs: add deprecation steps for EOL package versions (#21248)3c3ae53chore: update ecosystem plugins (#21249)c27bc9210.9.0fa831d9Build: changelog update for 10.9.0899dbf1chore: update github/codeql-action action to v4.37.7 (#21243)08de88efeat: handle underflow in no-loss-of-precision (#21218)9ef407adocs: use eslint.config.* wherever config file names are listed (#21216)Updates
eslint-plugin-perfectionistfrom 5.10.0 to 5.10.1Release notes
Sourced from eslint-plugin-perfectionist's releases.
Changelog
Sourced from eslint-plugin-perfectionist's changelog.
Commits
256dbbfbuild: publish v5.10.1a0c269achore: update dependencies93a267efix: take into account extended tsconfigsc9a119efix: respect ignored callback dependencies in nested calls7a35d8bfix: fix complex comments cases not being auto-fixed correctlyfbbc372fix: fix crash in typescript 7af64311docs: update statsb821520chore: update github actions1b4fd2edocs: update config count from three to fourUpdates
eslint-plugin-react-refreshfrom 0.5.3 to 0.5.4Release notes
Sourced from eslint-plugin-react-refresh's releases.
Changelog
Sourced from eslint-plugin-react-refresh's changelog.
Commits
e316617[publish] AddinstanttoallowExportNamesin Next config (#112)Updates
eslint-plugin-storybookfrom 10.5.4 to 10.5.10Release notes
Sourced from eslint-plugin-storybook's releases.
... (truncated)
Changelog
Sourced from eslint-plugin-storybook's changelog.
Commits
a2db752Bump version from "10.5.9" to "10.5.10" [skip ci]2148cddMerge pull request #35950 from storybookjs/fix/eslint-plugin-bundle-csf8f56104Bump version from "10.5.8" to "10.5.9" [skip ci]6ef7d1aBump version from "10.5.7" to "10.5.8" [skip ci]7c6fb3aBump version from "10.5.6" to "10.5.7" [skip ci]b90d14dMerge pull request #35341 from storybookjs/valentin/rolldown-dts3126f0aBump version from "10.5.5" to "10.5.6" [skip ci]c8bdb23Merge pull request #35655 from storybookjs/yann/eslint-plugin-meta05a52b7Bump version from "10.5.4" to "10.5.5" [skip ci]Updates
globalsfrom 17.7.0 to 17.11.0Release notes
Sourced from globals's releases.
Commits
8c5992717.11.061eafbfAddreact-nativeglobals (#337)7bed4af17.10.0f468407AddGM_cookieto Greasemonkey globals (#349)8e7b93517.9.05a958edUpdate globals (2026-08-01) (#348)36c765917.8.07394811Update globals (2026-07-01) (#347)Updates
jsdomfrom 29.1.1 to 30.0.1Release notes
Sourced from jsd...
Description has been truncated