Repository navigation
Update non-major dependencies - #1739
Merged
Merged
Conversation
Contributor
Author
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
11.10.0→11.11.011.10.0→11.11.011.10.0→11.11.011.10.0→11.11.016.17.10→16.18.015.4.10→15.5.016.17.10→16.18.01.68.0→1.69.01.446.0→1.446.18.12.3→8.12.44.157.0→4.158.0Release Notes
getsentry/sentry-javascript (@sentry/node)
v11.11.0Compare Source
Important Changes
ref(cloudflare): Use the shared request handler wrapper (#25588)
Cloudflare Workers now use the same request handler wrapper as
Deno.serveandBun.serve. Changes for Cloudflare users:client.addressfrom theCF-Connecting-IPheader (or another forwarding header), as on the other runtimes. This followsdataCollection.userInfo, which istrueby default. To leave it out, setdataCollection: { userInfo: false }.responsecontext with the status code.captureErrors: false, it does not capture it.Set-Cookieheader of a response, as on Deno and Bun.AsyncLocalStorage(for example on Shopify Oxygen), events now also get the request URL and method.feat(nestjs): Add an option to monitor every @Cron method (#25471)
Set
monitorCronJobs: trueonnestIntegration()to send check-ins for every@Cron()method, without adding@SentryCronto each one. It's off by default. Each monitored job creates a monitor in Sentry, and monitors are billed. UseexcludeCronJobsto skip jobs by slug. Methods that also have@SentryCroncheck in once, with the slug and options passed to@SentryCron.feat(node): Add cronJobIntegration to monitor cron jobs (#25477)
Add
Sentry.cronJobIntegration()tointegrationsto send check-ins for every namedCronJobof thecronpackage (4.3+), with the job name as the monitor slug. It's off by default. Each monitored job creates a monitor in Sentry, and monitors are billed. UseexcludeJobsto skip jobs by name.Sentry.cron.instrumentCronis deprecated; usecronJobIntegrationinstead.fix(server-utils): Instrument @anthropic-ai/sdk 1.x and turn off its own OTel spans (#25750)
The Anthropic integration now instruments
@anthropic-ai/sdk1.x. Since 0.134 the SDK also records its own OpenTelemetry spans, such asanthropic.messages.create, which duplicated Sentry'sgen_aispans. Once Sentry instruments the SDK, it setsANTHROPIC_OPEN_TELEMETRY=falseto turn those spans off. To keep them, setANTHROPIC_OPEN_TELEMETRY=trueor pass theopenTelemetryoption to the Anthropic client.feat(nextjs): Mark pageloads of cached pages (#25318)
When Next.js serves a page from its cache, for example an ISR page or a
cacheComponentsshell, the pageload now has thepage.server_rendering.typeattribute. It isstaticif the whole page came from the cache, andpartially_staticif parts of it rendered for this request. Then the pageload stays connected to this request, as before. If the request that rendered the cached page was sampled, the pageload also links to it. So in Sentry, a cached page no longer looks like missing server instrumentation.Other Changes
@sentry/astro/integrationentry for the Astro integration (#25726)sourcemaps.deleteSourcemapsAfterUploadand staged uploads (#25637)applicationKeyExcludeDependenciesoption (#25818)awsLambdaWebIntegrationfor Lambda Web Functions (#25355)getSqlSpanNamefor SQL span names (#25929)getSqlQueryAttributeshelper for consistency (#25927)db.operation.nameon SQL spans (#25850)withSentryfrom@sentry/solidstart/vite(#25725)handleTunnelRequestform and reword theserveTunnelIntegrationdocs (#25844)Internal Changes
canaryVariants(#25866)36c7292to01bcb7f(#25954)requiresParentSpanin favor ofonlyIfParent(#25926)canaryVariants(#25865)nuxt-5 (tunnel-dev)e2e variant optional (#26004)Work in this release was contributed by @lazerg, @chiliec, @61465, @jpdefo, and @AyeshaWaseemAhmad. Thank you for your contributions!
lucide-icons/lucide (lucide-react)
v1.69.0: Version 1.69.0Compare Source
What's Changed
package-penicon by @ericfennis in #5154package-question-markicon by @ericfennis in #5155opacityicon by @ilyavred in #4222circle-fading-checkicon by @n2duc in #4089New Contributors
Full Changelog: lucide-icons/lucide@1.68.0...1.69.0
PostHog/posthog-js (posthog-js)
v1.446.1Compare Source
1.446.1
Patch Changes
8ddb57fThanks @marandaneto! - Fix tree shaking of unselected extensions and shared utilities when using the slim SDK.(2026-11-05)
8ddb57f]:nodejs/undici (undici)
v8.12.4Compare Source
This release fixes six vulnerabilities.
CVE-2026-116592 / GHSA-mqg3-3v4r-cm32 (high)
Undici 8.12.2 and 8.12.3 could cache the final response from a redirect chain under the original request key without applying the origin, cache policy, freshness, or
Varyrequirements of every intermediate hop. This could poison a cache or expose one user's response to another user. The fix validates every redirect hop, combines theirVaryfields, limits freshness and stale serving to the most restrictive hop, and invalidates persistent SQLite entries written by vulnerable releases.CVE-2026-120474 / GHSA-7xg3-fphp-28hg (medium)
A shared cache used with
compose(redirect(), cache())could store a credential-dependent response from a same-origin redirect under the original URL. A later authenticated or unauthenticated request could then receive another user's response. Redirected requests carryingAuthorization,Cookie, orProxy-Authorizationare no longer stored under the original alias key.CVE-2026-116630 / GHSA-5rm8-gv32-r954 (medium)
A cross-origin redirect during cache revalidation could let a
304 Not Modifiedresponse from the redirect target validate a cached response from the original origin. Undici now checks that the revalidation target matches the cached URL and that any returned validator matches the stored representation before replaying the cached body.CVE-2026-120415 / GHSA-9v6h-8rgp-m69f (medium)
The redirect interceptor did not strip credentials correctly when request headers were supplied as an array of
[name, value]pairs. With a header-normalizing interceptor outsideredirect(), credentials could be sent to a cross-origin redirect target. Undici now handles both tuple arrays and flat header arrays when removing sensitive headers.CVE-2026-120222 / GHSA-3g9m-rv3r-w5w2 (medium)
A downstream handler exception during cache replay could escape as an uncaught exception or unhandled promise rejection and terminate the process. This included
dumpsize-limit failures, excessiveContent-Encodingvalues indecompress, asynchronous cache-store failures, and cached-body replay after a304. These failures are now reported as request errors.CVE-2026-120423 / GHSA-r4pc-4jcp-7pqc (medium)
fetch()could skip Subresource Integrity verification when valid integrity metadata was separated or surrounded by ASCII whitespace other than a space, including a horizontal tab. Integrity metadata is now split on all ASCII whitespace before SHA-256, SHA-384, or SHA-512 verification.What's Changed
originis optional only for origin-bound dispatchers by @attilayener in #5994New Contributors
Full Changelog: nodejs/undici@v8.12.3...v8.12.4
cloudflare/workers-sdk (wrangler)
v4.158.0Compare Source
Minor Changes
#16186
f1d81a2Thanks @leostera! - Support local Artifacts across Wrangler, Vite, and Workers VitestSet
remote: falseon an Artifacts binding to opt into the Miniflare simulator and persistent local repositories during development. Omittedremotecontinues to use the deployed resource, with a warning that changes affect real repositories;remote: trueexplicitly selects it. When remote bindings are disabled (wrangler dev --local, or Vite'sremoteBindings: false), Artifacts bindings use the local simulator. Workers Vitest uses the local simulator whenremoteis omitted, so tests do not change real repositories by accident; setremote: trueto test against the deployed resource. Local development does not require Cloudflare credentials, but does require Git 2.32 or newer on the host.In Miniflare's own options, Artifacts bindings route like every other binding: only
dev.remote: truewith a remote proxy connection uses the deployed resource. Wrangler and Vite resolve the deployed-by-default rule, and Workers Vitest its local default, before passing options to Miniflare.Patch Changes
#16700
dc35efbThanks @cjol! - Bump bundledbrace-expansionto pick up security fixesThese packages bundle
brace-expansion(a dependency ofminimatch), and the bundled versions were affected by published advisories. The bundles now includebrace-expansion2.1.7 (from 2.0.1) and 5.0.12 (from 5.0.5). Normal glob patterns expand as before; only the pathological patterns targeted by the advisories are handled differently.#16700
dc35efbThanks @cjol! - Bump bundledfast-xml-parserfrom 4.4.1 to 4.5.5 to pick up security fixesMiniflare bundles
fast-xml-parserinto its local R2 S3 API, and Wrangler bundles it through the AWS SDK used bywrangler pipelines. Version 4.4.1 is affected by several published advisories, and 4.5.5 includes their fixes. XML handling does not change.#16700
dc35efbThanks @cjol! - Bump bundledminimatchfrom 5.1.6 to 5.1.9 to pick up security fixesThese packages bundle
minimatch, and 5.1.6 is affected by published ReDoS advisories. Version 5.1.9 includes the fixes. 5.1.8 is skipped because it broke recursive**matching, which D1'smigrations_patternrelies on.#16700 [
dc35efb](httpsConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.