build(deps-dev): bump the dev-dependencies group across 1 directory with 10 updates #7200

dependabot · 2025-10-29T15:19:46Z

Bumps the dev-dependencies group with 10 updates in the / directory:

Package	From	To
@types/cookie-parser	`1.4.9`	`1.4.10`
@types/express	`5.0.3`	`5.0.5`
@types/node	`24.9.1`	`24.9.2`
set-cookie-parser	`2.7.1`	`2.7.2`
vitest	`4.0.1`	`4.0.5`
@vitejs/plugin-react	`5.0.4`	`5.1.0`
eslint-plugin-react-hooks	`7.0.0`	`7.0.1`
lucide-react	`0.546.0`	`0.548.0`
react-i18next	`16.1.6`	`16.2.1`
react-router-dom	`7.9.4`	`7.9.5`

Updates @types/cookie-parser from 1.4.9 to 1.4.10

Commits

See full diff in compare view

Updates @types/express from 5.0.3 to 5.0.5

Commits

See full diff in compare view

Updates @types/node from 24.9.1 to 24.9.2

Commits

See full diff in compare view

Updates set-cookie-parser from 2.7.1 to 2.7.2

Changelog

Sourced from set-cookie-parser's changelog.

v2.7.2 - 2025-10-27

Fixed:

Prevent Object prototype pollution by malicious cookies

Removed cookie values from error logs due to their potentially sensitive nature

Commits

6e0577b 2.7.2
e828710 2.7.2 changelog
400be29 Merge pull request #71 from ExodusMovement/andrej/prototype-pollution
6d36c0c chore: add tests for forbidden keys
0857d99 revert: allow empty string cookies
43131a2 Revert "feat: allow logging cookie values if logCookieValues is set"
7423bba feat: allow logging cookie values if logCookieValues is set
ca7f865 fix: isForbiddenKey
bfd65d3 feat: harden forbidden keys
4d74d29 feat: harden against prototype pollution
Additional commits viewable in compare view

Updates vitest from 4.0.1 to 4.0.5

Release notes

Sourced from vitest's releases.

v4.0.5

   🐞 Bug Fixes

Respect ssr.noExternal when externalizing dependencies, fix Svelte and Astro - by @sheremet-va in vitest-dev/vitest#8862 (a4f86)

Allow module in --config - by @sheremet-va in vitest-dev/vitest#8864 (b9521)

browser: Allow Locator type in selectOptions element parameter - by @rzzf and @sheremet-va in vitest-dev/vitest#8848 (7ee28)

module-runner: Don't return node builtins for getBuiltins unconditionally - by @sapphi-red in vitest-dev/vitest#8863 (0e858)

pool: Rename groupId to groupOrder in error message - by @Yohannfra in vitest-dev/vitest#8856 (b9aab)

   🏎 Performance

Pass testfiles at once when --no-isolate --maxWorkers=1 - by @AriPerkkio in vitest-dev/vitest#8835 (584aa)

expect: Optimize checking the input type - by @Connormiha in vitest-dev/vitest#8840 (06968)

    View changes on GitHub

v4.0.4

   🐞 Bug Fixes

browser:

Correct typo - by @benmccann in vitest-dev/vitest#8796 (ede1f)

Publish a missing context file for webdriverio - by @sheremet-va in vitest-dev/vitest#8824 (7c7b6)

mocker:

Support mocking builtins without node: prefix - by @sheremet-va in vitest-dev/vitest#8829 (06208)

pool:

Runner's error listener causing MaxListenersExceededWarning - by @AriPerkkio in vitest-dev/vitest#8820 (d1bff)

Capture workers stdio to logger - by @AriPerkkio in vitest-dev/vitest#8809 (fb95f)

spy:

Allow classes in vi.mocked utility - by @sheremet-va in vitest-dev/vitest#8839 (f8756)

worker:

Rpc listener leak when isolate: false - by @AriPerkkio in vitest-dev/vitest#8821 (573dc)

   🏎 Performance

utils: Optimized reducer to avoid creating new objects - by @Connormiha in vitest-dev/vitest#8818 (d19ce)

    View changes on GitHub

v4.0.3

   🐞 Bug Fixes

Preserve reporter options from config when CLI reporters override them - by @Copilot and sheremet-va in vitest-dev/vitest#8794 (15552)

browser: More stable in-source testing validation - by @sheremet-va in vitest-dev/vitest#8793 (62297)

happy-dom: Support fetch globals - by @sheremet-va in vitest-dev/vitest#8791 (0fb74)

init: Use correct jsx/tsx extension - by @sheremet-va in vitest-dev/vitest#8792 (abc04)

    View changes on GitHub

v4.0.2

   🐞 Bug Fixes

... (truncated)

Commits

ed9fc71 chore: release v4.0.5
b9521e0 fix: allow module in --config (#8864)
0e858ba fix(module-runner): don't return node builtins for getBuiltins unconditiona...
a4f86f1 fix: respect ssr.noExternal when externalizing dependencies (#8862)
b9aabf4 fix(pool): rename groupId to groupOrder in error message (#8856)
584aa71 perf: pass testfiles at once when --no-isolate --maxWorkers=1 (#8835)
9b75ec5 chore: release v4.0.4
fb95fc7 fix(pool): capture workers stdio to logger (#8809)
06208d3 fix(mocker): support mocking builtins without node: prefix (#8829)
573dc06 fix(worker): rpc listener leak when isolate: false (#8821)
Additional commits viewable in compare view

Updates @vitejs/plugin-react from 5.0.4 to 5.1.0

Release notes

Sourced from @vitejs/plugin-react's releases.

[email protected]

Add @vitejs/plugin-react/preamble virtual module for SSR HMR (#890)

SSR applications can now initialize HMR runtime by importing @vitejs/plugin-react/preamble at the top of their client entry instead of manually calling transformIndexHtml. This simplifies SSR setup for applications that don't use the transformIndexHtml API.

Fix raw Rolldown support for Rolldown 1.0.0-beta.44+ (#930)

Rolldown 1.0.0-beta.44+ removed the top-level jsx option in favor of transform.jsx. This plugin now uses the transform.jsx option to support Rolldown 1.0.0-beta.44+.

Changelog

Sourced from @vitejs/plugin-react's changelog.

5.1.0 (2025-10-24)

Add @vitejs/plugin-react/preamble virtual module for SSR HMR (#890)

SSR applications can now initialize HMR runtime by importing @vitejs/plugin-react/preamble at the top of their client entry instead of manually calling transformIndexHtml. This simplifies SSR setup for applications that don't use the transformIndexHtml API.

Fix raw Rolldown support for Rolldown 1.0.0-beta.44+ (#930)

Rolldown 1.0.0-beta.44+ removed the top-level jsx option in favor of transform.jsx. This plugin now uses the transform.jsx option to support Rolldown 1.0.0-beta.44+.

Commits

3e5a374 release: [email protected]
44cbed4 fix(react): compat with newer rolldown (#930)
c54d3c6 chore(deps): update all non-major dependencies (#926)
a2d76d9 fix(deps): update all non-major dependencies (#918)
fffb7eb feat(react): expose virtual module to simplify hmr preamble setup on ssr (#890)
b79592a fix(deps): update react-related dependencies (#901)
2d239fc fix(deps): update all non-major dependencies (#896)
73be2f0 chore(deps): fix vitest > rolldown-vite dependency (#889)
407795d fix(deps): update all non-major dependencies (#887)
47db473 chore(react): fix ecosystem-ci failure (#888)
See full diff in compare view

Updates eslint-plugin-react-hooks from 7.0.0 to 7.0.1

Changelog

Sourced from eslint-plugin-react-hooks's changelog.

7.0.1

Disallowed passing inline useEffectEvent values as JSX props to guard against accidental propagation. (#34820 by @jf-eirinha)

Switch to export = so eslint-plugin-react-hooks emits correct types for consumers in Node16 ESM projects. (#34949 by @karlhorky)

Tightened the typing of configs.flat so the configs export is always defined. (#34950 by @poteto)

Fix named import runtime errors. (#34951, #34953 by @karlhorky)

Commits

See full diff in compare view

Updates lucide-react from 0.546.0 to 0.548.0

Release notes

Sourced from lucide-react's releases.

Version 0.548.0

What's Changed

feat(docs): add new package for Slint by @cnlancehu in lucide-icons/lucide#3698

docs(site): add introductions for packages in documentation by @mattheskaiser in lucide-icons/lucide#3643

Fix default prop by @ericfennis in lucide-icons/lucide#3730

feat(icons): added gamepad-directional icon by @felipeajzanetti in lucide-icons/lucide#3693

New Contributors

@cnlancehu made their first contribution in lucide-icons/lucide#3698

@mattheskaiser made their first contribution in lucide-icons/lucide#3643

@felipeajzanetti made their first contribution in lucide-icons/lucide#3693

Full Changelog: lucide-icons/lucide@0.547.0...0.548.0

Version 0.547.0

What's Changed

fix(docs): update brand logo statement link in github action by @karsa-mistmere in lucide-icons/lucide#3630

chore(deps): bump astro from 5.5.2 to 5.14.4 by @dependabot[bot] in lucide-icons/lucide#3683

fix(packages/lucide): replace elements inside \<template> (#2635) by @KhalidAlansary in lucide-icons/lucide#3576

feat(icons): added birdhouse icon by @hieu-onefold in lucide-icons/lucide#3378

New Contributors

@KhalidAlansary made their first contribution in lucide-icons/lucide#3576

@hieu-onefold made their first contribution in lucide-icons/lucide#3378

Full Changelog: lucide-icons/lucide@0.546.0...0.547.0

Commits

See full diff in compare view

Updates react-i18next from 16.1.6 to 16.2.1

Changelog

Sourced from react-i18next's changelog.

16.2.1

fix regression in v16.2.0: bindI18nStore does not work correctly 1879

16.2.0

try to address: useTranslation hook violates React's rules of hooks by conditionally calling inner hooks 1863

Commits

badbfa3 16.2.1
dc7225e fix regression in v16.2.0: bindI18nStore #1879
aa66a89 16.2.0
a080c76 address #1863 with Option 2
0c33e69 Merge branch 'try-fix-react-violation-2'
3bf5c85 use use-sync-external-store shim for useSyncExternalStore
e505cb0 try useSyncExternalStore
See full diff in compare view

Updates react-router-dom from 7.9.4 to 7.9.5

Release notes

Sourced from react-router-dom's releases.

[email protected]

Patch Changes

Updated dependencies

[email protected]

[email protected]

[email protected]

Patch Changes

Updated dependencies

[email protected]

[email protected]

Changelog

Sourced from react-router-dom's changelog.

7.9.5

Patch Changes

Updated dependencies:

[email protected]

Commits

a191812 chore: Update version for release (#14485)
74bef78 chore: Update version for release (pre) (#14469)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…ith 10 updates Bumps the dev-dependencies group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@types/cookie-parser](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/cookie-parser) | `1.4.9` | `1.4.10` | | [@types/express](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/express) | `5.0.3` | `5.0.5` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `24.9.1` | `24.9.2` | | [set-cookie-parser](https://github.com/nfriedly/set-cookie-parser) | `2.7.1` | `2.7.2` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.0.1` | `4.0.5` | | [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `5.0.4` | `5.1.0` | | [eslint-plugin-react-hooks](https://github.com/facebook/react/tree/HEAD/packages/eslint-plugin-react-hooks) | `7.0.0` | `7.0.1` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `0.546.0` | `0.548.0` | | [react-i18next](https://github.com/i18next/react-i18next) | `16.1.6` | `16.2.1` | | [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `7.9.4` | `7.9.5` | Updates `@types/cookie-parser` from 1.4.9 to 1.4.10 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/cookie-parser) Updates `@types/express` from 5.0.3 to 5.0.5 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/express) Updates `@types/node` from 24.9.1 to 24.9.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `set-cookie-parser` from 2.7.1 to 2.7.2 - [Changelog](https://github.com/nfriedly/set-cookie-parser/blob/master/CHANGELOG.md) - [Commits](nfriedly/set-cookie-parser@v2.7.1...v2.7.2) Updates `vitest` from 4.0.1 to 4.0.5 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.5/packages/vitest) Updates `@vitejs/plugin-react` from 5.0.4 to 5.1.0 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/[email protected]/packages/plugin-react) Updates `eslint-plugin-react-hooks` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/facebook/react/releases) - [Changelog](https://github.com/facebook/react/blob/main/packages/eslint-plugin-react-hooks/CHANGELOG.md) - [Commits](https://github.com/facebook/react/commits/HEAD/packages/eslint-plugin-react-hooks) Updates `lucide-react` from 0.546.0 to 0.548.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/0.548.0/packages/lucide-react) Updates `react-i18next` from 16.1.6 to 16.2.1 - [Changelog](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md) - [Commits](i18next/react-i18next@v16.1.6...v16.2.1) Updates `react-router-dom` from 7.9.4 to 7.9.5 - [Release notes](https://github.com/remix-run/react-router/releases) - [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router-dom/CHANGELOG.md) - [Commits](https://github.com/remix-run/react-router/commits/[email protected]/packages/react-router-dom) --- updated-dependencies: - dependency-name: "@types/cookie-parser" dependency-version: 1.4.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: "@types/express" dependency-version: 5.0.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: "@types/node" dependency-version: 24.9.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: set-cookie-parser dependency-version: 2.7.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: vitest dependency-version: 4.0.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: "@vitejs/plugin-react" dependency-version: 5.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: eslint-plugin-react-hooks dependency-version: 7.0.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: lucide-react dependency-version: 0.548.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: react-i18next dependency-version: 16.2.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: react-router-dom dependency-version: 7.9.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Oct 29, 2025

SamTV12345 merged commit 746d1ef into develop Oct 29, 2025
39 of 40 checks passed

SamTV12345 deleted the dependabot/npm_and_yarn/dev-dependencies-52b2dddcbf branch October 29, 2025 17:54

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

build(deps-dev): bump the dev-dependencies group across 1 directory with 10 updates #7200

build(deps-dev): bump the dev-dependencies group across 1 directory with 10 updates #7200

dependabot bot commented on behalf of github Oct 29, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

build(deps-dev): bump the dev-dependencies group across 1 directory with 10 updates #7200

build(deps-dev): bump the dev-dependencies group across 1 directory with 10 updates #7200

Conversation

dependabot bot commented on behalf of github Oct 29, 2025

v2.7.2 - 2025-10-27

v4.0.5

🐞 Bug Fixes

🏎 Performance

View changes on GitHub

v4.0.4

🐞 Bug Fixes

🏎 Performance

View changes on GitHub

v4.0.3

🐞 Bug Fixes

View changes on GitHub

v4.0.2

🐞 Bug Fixes

[email protected]

Add @vitejs/plugin-react/preamble virtual module for SSR HMR (#890)

Fix raw Rolldown support for Rolldown 1.0.0-beta.44+ (#930)

5.1.0 (2025-10-24)

Add @vitejs/plugin-react/preamble virtual module for SSR HMR (#890)

Fix raw Rolldown support for Rolldown 1.0.0-beta.44+ (#930)

7.0.1

Version 0.548.0

What's Changed

New Contributors

Version 0.547.0

What's Changed

New Contributors

16.2.1

16.2.0

[email protected]

Patch Changes

[email protected]

Patch Changes

7.9.5

Patch Changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Add `@vitejs/plugin-react/preamble` virtual module for SSR HMR (#890)

Add `@vitejs/plugin-react/preamble` virtual module for SSR HMR (#890)