Skip to content

chore(deps): Bump the minor-and-patch group across 1 directory with 12 updates - #225

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/bun/minor-and-patch-e9014f5fb2
Closed

chore(deps): Bump the minor-and-patch group across 1 directory with 12 updates#225
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/bun/minor-and-patch-e9014f5fb2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 12 updates in the / directory:

Package From To
zod 4.4.3 4.6.7
@types/node 26.5.1 26.6.5
three 0.186.0 0.186.1
@modelcontextprotocol/sdk 1.30.0 1.32.1
react 19.3.0 19.3.1
react-dom 19.3.0 19.3.1
@sveltejs/vite-plugin-svelte 7.3.0 7.3.1
svelte 5.57.0 5.57.2
@vue/test-utils 2.5.0 2.5.1
vue 3.5.42 3.5.44
@modelcontextprotocol/ext-apps 2.0.0 2.0.3
@playwright/test 1.63.0 1.64.1

Updates zod from 4.4.3 to 4.6.7

Release notes

Sourced from zod's releases.

v4.6.7

Commits:

  • b500a2ee95134f81d74da7911d7378dd2853d042 4.6.7

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

  • 0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini
  • 9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales
  • 34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note
  • 74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)
  • b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors
  • 8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze
  • bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles
  • c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)
  • a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)
  • a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)
  • 529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6
  • 9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why

v4.6.5

Commits:

  • d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post
  • f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
  • de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)
  • 56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)
  • ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"
  • cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""
  • 0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5
  • 59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

  • d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)
  • ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)
  • 2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
  • f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

  • 413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged
  • 75d63ee1 docs: show only the .properties() method form in the 4.6 post
  • 46da9572 docs: match the error-message examples to what the parsers emit

... (truncated)

Commits
  • b500a2e 4.6.7
  • 9c21983 ci: stage at verbose so a failed OIDC token exchange says why
  • 529f78d 4.6.6
  • a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
  • a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
  • c42596b release: hold the run on the release-approval environment until the staged ve...
  • bacad51 docs: square the Code for Japan logo to match the other bronze tiles
  • 8fb2faf docs: crop the Code for Japan logo and list it first in bronze
  • b2ef983 docs: add Code for Japan to bronze sponsors
  • 74304ce release: stage npm versions instead of publishing them (#6622)
  • Additional commits viewable in compare view

Updates @types/node from 26.5.1 to 26.6.5

Commits

Updates three from 0.186.0 to 0.186.1

Commits

Updates @modelcontextprotocol/sdk from 1.30.0 to 1.32.1

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.32.1

What's Changed

Full Changelog: modelcontextprotocol/typescript-sdk@1.32.0...1.32.1

1.32.0

Upgrade notes

  • Redirects: the HTTP client transports now follow a redirect only when it stays on the same origin (same scheme, host and port; http to https on the same host is allowed). A deployment whose endpoint redirects to another host or port either configures the final URL or sets redirectPolicy: 'follow' on StreamableHTTPClientTransport or SSEClientTransport. In browsers, a redirected request fails unless that option is set.
  • New options, both off unless you set them: maxToolInputElements on McpServer limits the number of array elements and object members in a tool call's arguments. expectedResource on requireBearerAuth accepts only tokens issued for this server (the token's audience).

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@1.31.0...1.32.0

1.31.0

Upgrade notes

  • Stored OAuth tokens and client information now include an issuer field. Storage that rejects unknown fields needs to allow it.
  • Pass expectedIssuer when constructing ClientCredentialsProvider, PrivateKeyJwtProvider or StaticPrivateKeyJwtProvider. Constructing them without it is deprecated.

What's Changed

Full Changelog: modelcontextprotocol/typescript-sdk@1.30.1...1.31.0

1.30.1

What's Changed

New Contributors

... (truncated)

Commits
  • ff07b00 chore: bump version to 1.32.1 (#2954)
  • 8a74d50 [v1.x] docs: point the README at v2 and say what v1.x supports (#2942)
  • a8cf503 [v1.x] docs: state the principles in CLAUDE.md (#2939)
  • 32549b0 chore: bump version to 1.32.0 (#2935)
  • 588d51d [v1.x] test(e2e): cover tools/call and prompts/get without arguments (#2931)
  • 5a0724d [v1.x] feat(auth): add expectedResource to requireBearerAuth (#2930)
  • 0ca0b62 [v1.x] fix(server): accept tools/call and prompts/get requests that omit argu...
  • fd26801 [v1.x] feat(server): add maxToolInputElements option to limit the number of e...
  • 727075b [v1.x] fix(tasks): keep tasks of the in-memory task store within the session ...
  • 0ff6377 [v1.x] examples: close idle sessions and cap the session map (#2914)
  • Additional commits viewable in compare view

Updates react from 19.3.0 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

Commits

Updates react-dom from 19.3.0 to 19.3.1

Release notes

Sourced from react-dom's releases.

19.3.1 (October 14th, 2026)

React Server Components

Commits

Updates @sveltejs/vite-plugin-svelte from 7.3.0 to 7.3.1

Release notes

Sourced from @​sveltejs/vite-plugin-svelte's releases.

@​sveltejs/vite-plugin-svelte@​7.3.1

Patch Changes

  • fix: inject the inspector into the client under Vite+ on pnpm, where the realpathed client module has no vite/ segment before dist/ (#1373)
Changelog

Sourced from @​sveltejs/vite-plugin-svelte's changelog.

7.3.1

Patch Changes

  • fix: inject the inspector into the client under Vite+ on pnpm, where the realpathed client module has no vite/ segment before dist/ (#1373)
Commits

Updates svelte from 5.57.0 to 5.57.2

Release notes

Sourced from svelte's releases.

svelte@5.57.2

Patch Changes

  • fix: don't create async deriveds for a component destroyed while waiting for its top-level await (#18931)

  • fix: prevent untracked derived reads from retaining disconnected dependencies (#18829)

  • fix: error if {:else} is followed by another {:else} or {:else if ...} (#18900)

  • fix: avoid tracking SvelteURLSearchParams during URL updates (#18791)

  • fix: restore hydration state when custom element attribute updates throw (#18467)

  • fix: attach event handlers that are assigned after a top-level await in production (#18933)

  • fix: flush anything pending before invoking flushSync callback function (#18878)

  • fix: preserve location information for await wrappers (#18859)

  • fix: keep a reactive assignment with no dependencies when migrate cannot turn it into a declaration (#18817)

  • fix: don't hang migrate on a declaration that shares a line with its script tag (#18816)

  • fix: prevent duplicate subscriptions when reconnecting deriveds (#18899)

  • fix: recover when an unexpected node replaces a nested boundary comment during hydration (#18925)

  • fix: print {#await} blocks that only have a pending branch (#18908)

  • fix: don't warn about a redundant link role on <area> elements without an href (#18872)

  • fix: don't throw state_unsafe_mutation when the focused element is removed while bind:activeElement is used (#18921)

  • fix: don't overwrite an unchanged spread value, preserving incomplete number input (#18864)

  • fix: read batch-local array on each-block commit (#18879)

  • fix: error at compile time when a declaration in a snippet redeclares one of its parameters (#18842)

  • fix: error when using let: directives on a component with a children snippet (#18873)

  • fix: ignore stale boundary reset callbacks (#18886)

  • fix: handle deferred transitions aborted before initialization (#18776)

  • fix: prevent hydration mismatch recovery from being intercepted by error boundaries (#18841)

  • fix: preserve dynamic element connections during hydration (#18855)

svelte@5.57.1

... (truncated)

Changelog

Sourced from svelte's changelog.

5.57.2

Patch Changes

  • fix: don't create async deriveds for a component destroyed while waiting for its top-level await (#18931)

  • fix: prevent untracked derived reads from retaining disconnected dependencies (#18829)

  • fix: error if {:else} is followed by another {:else} or {:else if ...} (#18900)

  • fix: avoid tracking SvelteURLSearchParams during URL updates (#18791)

  • fix: restore hydration state when custom element attribute updates throw (#18467)

  • fix: attach event handlers that are assigned after a top-level await in production (#18933)

  • fix: flush anything pending before invoking flushSync callback function (#18878)

  • fix: preserve location information for await wrappers (#18859)

  • fix: keep a reactive assignment with no dependencies when migrate cannot turn it into a declaration (#18817)

  • fix: don't hang migrate on a declaration that shares a line with its script tag (#18816)

  • fix: prevent duplicate subscriptions when reconnecting deriveds (#18899)

  • fix: recover when an unexpected node replaces a nested boundary comment during hydration (#18925)

  • fix: print {#await} blocks that only have a pending branch (#18908)

  • fix: don't warn about a redundant link role on <area> elements without an href (#18872)

  • fix: don't throw state_unsafe_mutation when the focused element is removed while bind:activeElement is used (#18921)

  • fix: don't overwrite an unchanged spread value, preserving incomplete number input (#18864)

  • fix: read batch-local array on each-block commit (#18879)

  • fix: error at compile time when a declaration in a snippet redeclares one of its parameters (#18842)

  • fix: error when using let: directives on a component with a children snippet (#18873)

  • fix: ignore stale boundary reset callbacks (#18886)

  • fix: handle deferred transitions aborted before initialization (#18776)

  • fix: prevent hydration mismatch recovery from being intercepted by error boundaries (#18841)

  • fix: preserve dynamic element connections during hydration (#18855)

... (truncated)

Commits
  • 10fdca7 Version Packages (#18858)
  • c580b38 fix: prevent duplicate derived subscriptions on reconnect (#18899)
  • 3f885e3 fix: don't throw state_unsafe_mutation when the focused element is removed wi...
  • fe4fb46 fix: error if {:else} is followed by another {:else} or {:else if ...} ...
  • 179f66b fix: don't create async deriveds for a component destroyed while waiting for ...
  • 79a0c0d fix: attach event handlers that are assigned after a top-level await in pro...
  • 14136f8 fix: print {#await} blocks that only have a pending branch (#18908)
  • 5cbdd34 fix: recover when an unexpected node replaces a nested boundary comment (#18925)
  • 7e83327 fix: avoid tracking SvelteURLSearchParams during URL updates (#18791)
  • 020242d fix: ensure hydration state restoration for custom element attribute updates ...
  • Additional commits viewable in compare view

Updates @vue/test-utils from 2.5.0 to 2.5.1

Release notes

Sourced from @​vue/test-utils's releases.

v2.5.1

What's Changed

New Contributors

Full Changelog: vuejs/test-utils@v2.5.0...v2.5.1

Commits

Updates vue from 3.5.42 to 3.5.44

Release notes

Sourced from vue's releases.

v3.5.44

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.43

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Changelog

Sourced from vue's changelog.

3.5.44 (2026-10-13)

Bug Fixes

  • compat: expose _setupProxy for Vue 2.7 compiled script setup (fix #11164) (#15618) (f08059d)
  • compiler-core: parenthesise v-for key in v-memo cache guard (#15724) (d084b90), closes #15723
  • compiler-dom: correctly stringify 0 and false in v-html (#15571) (9f3b437)
  • compiler-dom: inject transition persisted for v-show in production (#15783) (89cb272)
  • compiler-sfc: error when defineModel prop options reference a destructured prop (#15604) (38012a5), closes #15602
  • custom-element: skip mounting an async custom element removed while its component loads (#15777) (0f8e7b4), closes #15775
  • hydration: observe children of a display: contents root in hydrateOnVisible (#15773) (7f688e8)
  • KeepAlive: unmount pruned current component when its vnode was cloned on mount (#15711) (92798ac), closes #15710
  • reactivity: avoid mutating native array iterators (#15703) (7f9d45d), closes #15643
  • reactivity: do not track deps in watcher callbacks run inside another effect (#15782) (db00fe9), closes #5009
  • reactivity: once watcher should stop when its callback throws (#15755) (ae4bd94)
  • reactivity: preserve shallow collection semantics (#15793) (b600466), closes #15792
  • runtime-core: detect new prop keys when comparing full props (#15634) (702fa61), closes #15632
  • runtime-core: keep async placeholder for block patching and pending component updates (#15554) (05ec25f), closes #15551
  • runtime-core: only flush jobs queued by the root render itself (#15757) (0bea14b), closes #6728
  • runtime-core: render nothing for an invalid v-for range in production (#15742) (ad19e7d)
  • runtime-dom: preserve v-show display for unchanged style strings (#15794) (c0a6d3f)
  • runtime-dom: treat playsinline as a boolean attribute (#15627) (a084e44)
  • server-renderer: propagate async setup errors (#15857) (6930374), closes #15716
  • ssr: honor falsy vnode content overrides (#15769) (c11c5c8)
  • suspense: mount resolved async component with its own namespace (#15640) (2a086a2), closes #15639
  • suspense: skip rendering async components unmounted while pending (4ab865a)
  • teleport: move targetStart and keep children before targetAnchor (#15818) (d3c6e02), closes #15817
  • transition-group: measure nested groups against their moving outer item (#15848) (1936c87), closes #5385 #1531
  • transition: handle comment-wrapped component roots (#15853) (ff35014), closes #6080 #5500

3.5.43 (2026-09-17)

Bug Fixes

  • compiler-sfc: ignore comment delimiters inside strings and url() when parsing css vars (#15548) (2fde323)
  • compiler-sfc: prepend semicolon for await in switch case (#15498) (9a1df69), closes #15495
  • compiler-sfc: restore await scope when leaving nested blocks (5409708), closes #15465
  • compiler-sfc: reuse parsed parent configs across tsconfig walks (fix #15478) (#15480) (d6febaa)
  • hydration: run leave hooks for hydration placeholders (#15431) (5dda192)
  • reactivity: preserve readonly wrappers in array copy methods (#15469) (599f35b)
  • runtime-core: unmount v-once children after parent rerenders (#15435) (d720338)
  • shared: handle circular references in looseEqual (#15499) (718f782), closes #15496
  • shared: preserve comment-like text in style values (#15471) (b9456cb)
  • suspense: don't drop nested suspense patches during hydration (#15429) (76d42dc)
  • suspense: keep the boundary pending while its branch is patched (#15411) (bfcfe9e), closes #7506
  • suspense: patch a hydrating boundary's pending branch in place (#15432) (2cde6f7)
  • suspense: unmount the DOM an interrupted async component claimed (#15430) (fb9b45c)
  • types: keep optional props when a runtime prop uses a generic PropType (#15523) (243aabc), closes #9546
Commits

Updates @modelcontextprotocol/ext-apps from 2.0.0 to 2.0.3

Release notes

Sourced from @​modelcontextprotocol/ext-apps's releases.

v2.0.3

What's Changed

Patch release. No changes to the @modelcontextprotocol/ext-apps library itself; the fixes are in the example packages, so that a fresh install of each published package resolves a dependency tree that passes vulnerability and supply-chain scans.

Security

  • @modelcontextprotocol/server-basic-solid now depends on solid-js 1.9.15 instead of the exact 1.9.10, which pulled in seroval 1.3 (open advisories, fixed in 1.5.3). The root overrides that pinned seroval are removed, and the lockfile is refreshed with npm audit fix (patch and minor updates only, npm audit reports 0 vulnerabilities). by @​ochafik in #793
  • @modelcontextprotocol/server-pdf now depends on the exact @cantoo/pdf-lib 2.6.5 instead of ^2.6.5. The range resolved to 2.11.x, which the repository never tests and which added dependencies with open-ended ranges (culori, node-html-better-parser) that supply-chain scanners flag. by @​ochafik in #792

2.0.2 already pinned pdfjs-dist to 5.4.530 for server-pdf (#789).

Full Changelog: modelcontextprotocol/ext-apps@v2.0.2...v2.0.3

v2.0.2

What's Changed

Patch release. No changes to the @modelcontextprotocol/ext-apps library itself; the fix is in the @modelcontextprotocol/server-pdf example package.

Security

  • @modelcontextprotocol/server-pdf now depends on the exact pdfjs-dist 5.4.530 instead of ^5.0.0. The range let a fresh install resolve pdfjs-dist 5.6.83 or later (currently 5.7.284), which is affected by GHSA-hq66-cqwq-w95j (arbitrary JavaScript execution when opening a crafted PDF). 5.4.530 is outside the affected range and is the version the repository already tests against. Node support is unchanged. by @​ochafik in #789

Full Changelog: modelcontextprotocol/ext-apps@v2.0.1...v2.0.2

v2.0.1

What's Changed

Patch release. No changes to the @modelcontextprotocol/ext-apps library itself; the fixes are in the example servers, which are published as their own packages (including @modelcontextprotocol/server-pdf).

Bug fixes

  • Example servers no longer crash at startup on Node older than 20.11. They computed their dist directory from import.meta.filename / import.meta.dirname, which only exist from Node 20.11, so on Node 18 and 20.0 to 20.10 the module threw TypeError: Cannot read properties of undefined (reading 'endsWith') at load, before the server could answer initialize. All 21 affected servers and the quickstart now derive the path from import.meta.url with fileURLToPath. No behaviour change on Node 20.11+. Affected the published @modelcontextprotocol/server-pdf 1.7.5 and 2.0.0. by @​ochafik in #787
  • engines.node: ">=20" is now declared on the 21 published example packages, matching the root package and the README.

CI

  • The build now also runs the pdf-server MCPB bundle on Node 20.0.0, so this regression fails the build. #787
  • The dependency isolation check adds the ES2022.Error lib to its consumer projects. @modelcontextprotocol/client 2.1.0's typings reference ErrorOptions, so a project compiling with skipLibCheck: false and a lib older than ES2022 needs the same. #788

Packaging

  • repository.url uses the canonical git+https://github.com/modelcontextprotocol/ext-apps.git form in all manifests, which removes the "repository.url" was normalized warning from every publish job. by @​ochafik in #773

Full Changelog: modelcontextprotocol/ext-apps@v2.0.0...v2.0.1

Commits
  • 82221c0 Bump version to 2.0.3 (#794)
  • f20a1ff Update dependencies to clear npm audit findings (#793)
  • c9e00bd Pin @​cantoo/pdf-lib to 2.6.5 in pdf-server (#792)
  • fe9a9f1 Bump version to 2.0.2
  • 7bc2c5c Pin pdfjs-dist to 5.4.530 in pdf-server
  • a523ab3 Fix dependency isolation check against @​modelcontextprotocol/client 2.1
  • b0ddf50 Bump version to 2.0.1
  • 8e1b3bd Fix example servers crashing at startup on Node older than 20.11
  • 6d9bdc7 Merge pull request #773 from modelcontextprotocol/repo-url-fix
  • 2be172d Use the canonical git+https form for repository.url
  • See full diff in compare view

Updates @playwright/test from 1.63.0 to 1.64.1

Release notes

Sourced from @​playwright/test's releases.

v1.64.1

Bug Fixes

  • #43247 [Bug]: _electron.launch intermittently loses a packaged app's first window since 1.64.0
  • #43242 [Regression]: Chromium 155+ aborts a preflighted cross-origin redirect whenever any route is registered (net::ERR_ABORTED)

v1.64.0

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');
for (const tool of await page.webmcp.tools())
console.log(tool.name, tool.description);
const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-d...

Description has been truncated

@dependabot
chore(deps): Bump the minor-and-patch group across 1 directory with 1…
000b08a 
…2 updates

Bumps the minor-and-patch group with 12 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.6.7` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.5.1` | `26.6.5` |
| [three](https://github.com/mrdoob/three.js) | `0.186.0` | `0.186.1` |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.30.0` | `1.32.1` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.3.0` | `19.3.1` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.3.0` | `19.3.1` |
| [@sveltejs/vite-plugin-svelte](https://github.com/sveltejs/vite-plugin-svelte/tree/HEAD/packages/vite-plugin-svelte) | `7.3.0` | `7.3.1` |
| [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) | `5.57.0` | `5.57.2` |
| [@vue/test-utils](https://github.com/vuejs/test-utils) | `2.5.0` | `2.5.1` |
| [vue](https://github.com/vuejs/core) | `3.5.42` | `3.5.44` |
| [@modelcontextprotocol/ext-apps](https://github.com/modelcontextprotocol/ext-apps) | `2.0.0` | `2.0.3` |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.63.0` | `1.64.1` |



Updates `zod` from 4.4.3 to 4.6.7
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.4.3...v4.6.7)

Updates `@types/node` from 26.5.1 to 26.6.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `three` from 0.186.0 to 0.186.1
- [Release notes](https://github.com/mrdoob/three.js/releases)
- [Commits](https://github.com/mrdoob/three.js/commits)

Updates `@modelcontextprotocol/sdk` from 1.30.0 to 1.32.1
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@1.30.0...1.32.1)

Updates `react` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react)

Updates `react-dom` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom)

Updates `@sveltejs/vite-plugin-svelte` from 7.3.0 to 7.3.1
- [Release notes](https://github.com/sveltejs/vite-plugin-svelte/releases)
- [Changelog](https://github.com/sveltejs/vite-plugin-svelte/blob/main/packages/vite-plugin-svelte/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/vite-plugin-svelte/commits/@sveltejs/vite-plugin-svelte@7.3.1/packages/vite-plugin-svelte)

Updates `svelte` from 5.57.0 to 5.57.2
- [Release notes](https://github.com/sveltejs/svelte/releases)
- [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/svelte/commits/svelte@5.57.2/packages/svelte)

Updates `@vue/test-utils` from 2.5.0 to 2.5.1
- [Release notes](https://github.com/vuejs/test-utils/releases)
- [Commits](vuejs/test-utils@v2.5.0...v2.5.1)

Updates `vue` from 3.5.42 to 3.5.44
- [Release notes](https://github.com/vuejs/core/releases)
- [Changelog](https://github.com/vuejs/core/blob/main/CHANGELOG.md)
- [Commits](vuejs/core@v3.5.42...v3.5.44)

Updates `@modelcontextprotocol/ext-apps` from 2.0.0 to 2.0.3
- [Release notes](https://github.com/modelcontextprotocol/ext-apps/releases)
- [Changelog](https://github.com/modelcontextprotocol/ext-apps/blob/main/RELEASES.md)
- [Commits](modelcontextprotocol/ext-apps@v2.0.0...v2.0.3)

Updates `@playwright/test` from 1.63.0 to 1.64.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.63.0...v1.64.1)

---
updated-dependencies:
- dependency-name: zod
  dependency-version: 4.6.7
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@types/node"
  dependency-version: 26.6.5
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: three
  dependency-version: 0.186.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.32.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: react
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: react-dom
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@sveltejs/vite-plugin-svelte"
  dependency-version: 7.3.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: svelte
  dependency-version: 5.57.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@vue/test-utils"
  dependency-version: 2.5.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: vue
  dependency-version: 3.5.44
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@modelcontextprotocol/ext-apps"
  dependency-version: 2.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@playwright/test"
  dependency-version: 1.64.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 19, 2026
@korya

korya commented Oct 22, 2026

Copy link
Copy Markdown
Member

@dependabot rebase

@dependabot @github

dependabot Bot commented on behalf of github Oct 22, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 22, 2026
@dependabot
dependabot Bot deleted the dependabot/bun/minor-and-patch-e9014f5fb2 branch October 22, 2026 16:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@korya