Skip to content

build(deps): bump the production-minor-patch group across 1 directory with 3 updates - #2293

Closed
dependabot[bot] wants to merge 1 commit into
developmentfrom
dependabot/npm_and_yarn/saiku-ui/production-minor-patch-76727aa215
Closed

build(deps): bump the production-minor-patch group across 1 directory with 3 updates#2293
dependabot[bot] wants to merge 1 commit into
developmentfrom
dependabot/npm_and_yarn/saiku-ui/production-minor-patch-76727aa215

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-minor-patch group with 3 updates in the /saiku-ui directory: @lucide/svelte, bits-ui and dompurify.

Updates @lucide/svelte from 1.52.0 to 1.61.0

Release notes

Sourced from @​lucide/svelte's releases.

Version 1.61.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.60.0...1.61.0

Version 1.60.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.59.0...1.60.0

Version 1.59.0

What's Changed

Full Changelog: lucide-icons/lucide@1.58.0...1.59.0

Version 1.58.0

What's Changed

... (truncated)

Commits
  • 02eb916 feat(svelte): export __iconData and __iconNode across per-icon modules (#4936...
  • 27f0870 chore(deps-dev): bump the svelte-deps group across 1 directory with 2 updates...
  • af485d5 chore(deps-dev): bump the svelte-deps group with 2 updates (#4996)
  • See full diff in compare view

Updates bits-ui from 2.19.5 to 2.20.0

Release notes

Sourced from bits-ui's releases.

bits-ui@2.20.0

Minor Changes

  • feat(RadioGroup): set autocomplete="off" on the hidden input by default to discourage browser autofill, and add an autocomplete prop to RadioGroup.Root to override it (#2198)

Patch Changes

  • fix(Calendar): fall back to the default placeholder when spread props are reassigned and placeholder is not bound, preventing Cannot read properties of undefined (reading 'set'). Also applies to RangeCalendar, DatePicker, DateRangePicker, DateRangeField, TimeField, and TimeRangeField. (#2226)

  • fix(Select): open the trigger on a click that no pointer press precedes (detail: 0), such as element.click() or a VoiceOver activation in Safari (#2227)

  • fix(Calendar/RangeCalendar): prevent weekday headers, heading, and cell labels from shifting by a day when using a ZonedDateTime in a time zone ahead of the local one (#2215)

  • fix(Collapsible/Accordion): prevent content mounted open from playing its open animation (#2209)

  • fix(Command): skip deferred root work after Command.Root is destroyed (#2210)

  • fix(Command): scroll the first item into view when items aren't grouped (#2003)

  • fix(DatePicker): respect preventDefault() in Content's onOpenAutoFocus so the calendar day is not auto-focused (also applies to DateRangePicker) (#2219)

  • fix: prevent content from flashing visible for a frame after its exit animation when Svelte async mode is enabled (#2193)

  • fix(Select/Combobox/DropdownMenu): don't open the trigger when it's disabled by an ancestor <fieldset disabled> (#2214)

  • fix(body-scroll-lock): restore body pointer-events as soon as the last lock is released so clicks right after a layer closes aren't lost (#2221)

  • fix(FocusScope): keep focus on elements inside an open shadow root nested in the scope (e.g. a web component's <input>) instead of treating it as escaping the trap (#2223)

  • fix(FocusScope): prevent page scroll when auto-focusing on open, trapping focus, and restoring focus on close (#2217)

  • fix(LinkPreview): always remove the document pointerup listener registered while open. When the content node wasn't attached yet, the open watcher returned early before its cleanup, so the listener was never unsubscribed and kept firing after the preview closed or unmounted. (#2194)

  • fix(NavigationMenu): only register a NavigationMenu.Content's dismiss/escape layers while it is open so closed forceMount content no longer closes the open item on inside clicks or steals escape focus (#2218)

  • fix(Command): item selection logic (#2074)

  • fix: call onOpenChangeComplete with true after content opens and its animations finish, not only on close (#2199)

  • fix(HiddenInput): keep hidden form inputs in sync with component state after a form reset. A native form reset now restores the current value instead of clearing the input, so setting a value right after form.reset() (e.g. SvelteKit use:enhance's update()) is no longer lost. Applies to RadioGroup, Select, Combobox, Checkbox, Switch, RatingGroup, and the date/time fields (#1942) (#2212)

  • fix(DateField): reset the segments when value is cleared externally after a date was typed in (#2196)

  • fix(Select/Combobox): highlight the selected item on open when its value is an empty string, and allow selecting it with Enter in Combobox (#2213)

  • fix(Tabs, Accordion, ToggleGroup, RadioGroup, Toolbar, Menubar): ignore the items and triggers of a nested root of the same kind during keyboard navigation, so arrow keys, Home, End and wrapping stay within the outer group (#2190)

  • Resume a paused focus scope when it registers again, so a menu whose trigger sits in a tooltip moves focus into its content when opened. (#2201)

  • fix(DismissibleLayer): close an open layer when a second outside pointerdown lands within its 10ms dismissal debounce. The second event replaced the pending one and was judged against the newly opened layer, so rapidly right clicking across ContextMenu triggers left earlier menus open. (#2229)

... (truncated)

Commits
  • cd055a1 Version Packages (#2183)
  • b95a872 fix(Select, Combobox, DropdownMenu): ignore triggers disabled by fieldset (#2...
  • 06607e8 fix(Command): item selection logic (#2074)
  • 2bc8b32 fix(Select): stop the scroll button auto scroll when the content closes (#2197)
  • f7b36d3 fix: preserve weekday during calendar vertical navigation (#2230)
  • 9a0693b fix(Tabs, Accordion): ignore nested root triggers in keyboard navigation (#2190)
  • 1f9557d fix(Calendar): fall back to default placeholder when spread props are reassig...
  • 9937505 fix(Select): keep aligning the highlighted item while the content settles (#2...
  • 3132f5a fix: call onOpenChangeComplete when opening content (#2199)
  • 3c70c53 feat(RadioGroup): add autocomplete prop and disable browser autofill on the...
  • Additional commits viewable in compare view

Updates dompurify from 3.4.16 to 3.4.17

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.17

  • Fixed an issue with IN_PLACE, SAFE_FOR_TEMPLATES and shadow roots, thanks @​manus-pi
  • Fixed IN_PLACE handling of nodes that hooks or custom elements tough during sanitization, thanks @​uttej-badwane
  • Fixed the SMIL attributeName guard in XHTML mode, thanks @​Koukyosyumei
  • Hardened several smaller edge cases (namespaces, literal-text elements, isValidAttribute()), thanks @​artiphishell
  • Added a purify-edge test runner as a compatibility check, thanks @​anzal1
  • Clarified the IN_PLACE documentation in the README about possible risks
  • Updated several dependencies
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the production-minor-patch group across 1 directory…
3fe399d 
… with 3 updates

Bumps the production-minor-patch group with 3 updates in the /saiku-ui directory: [@lucide/svelte](https://github.com/lucide-icons/lucide/tree/HEAD/packages/svelte), [bits-ui](https://github.com/huntabyte/bits-ui) and [dompurify](https://github.com/cure53/DOMPurify).


Updates `@lucide/svelte` from 1.52.0 to 1.61.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.61.0/packages/svelte)

Updates `bits-ui` from 2.19.5 to 2.20.0
- [Release notes](https://github.com/huntabyte/bits-ui/releases)
- [Commits](https://github.com/huntabyte/bits-ui/compare/bits-ui@2.19.5...bits-ui@2.20.0)

Updates `dompurify` from 3.4.16 to 3.4.17
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.16...3.4.17)

---
updated-dependencies:
- dependency-name: "@lucide/svelte"
  dependency-version: 1.61.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: bits-ui
  dependency-version: 2.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: dompurify
  dependency-version: 3.4.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file npm Dependabot: npm ecosystem (saiku-ui) labels Oct 25, 2026
@github-actions github-actions Bot added area/ui area/design-system risk/high Change risk tier: high (see docs/risk-tiers.md) labels Oct 25, 2026
@spicule-hive

spicule-hive Bot commented Oct 25, 2026

Copy link
Copy Markdown
3fe399d

ℹ️ Sentinel notice — informational; author is trusted (allow-listed bot), merge is not blocked

Hive flagged this PR (author @dependabot[bot], head 3fe399d62b40) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

  • sensitive_path — changes 2 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
    • saiku-ui/package-lock.json
    • saiku-ui/package.json

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

@dependabot @github

dependabot Bot commented on behalf of github Nov 1, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Nov 1, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/saiku-ui/production-minor-patch-76727aa215 branch November 1, 2026 01:44
@github-actions

github-actions Bot commented Nov 1, 2026

Copy link
Copy Markdown

PR acceptance metric

Acceptance rate: 87.4% — 423 merged / 484 decided PRs (16 still open, excluded from the denominator).

Metric Value
Acceptance rate 87.4%
Accepted / rejected / open 423 / 61 / 16
Median time to first review (merged) 0.5 h
Median time to merge (merged) 1.1 h
Median time open (decided) 1.3 h
Mean review rounds on merged PRs 1.0
Authors with at least one merged PR 6
Author Merged Rejected Acceptance
buggtb 198 19 91.2%
juanresendiz813 124 1 99.2%
app/dependabot 92 36 71.9%
app/spicule-hive 6 1 85.7%
oiacub1 2 0 100.0%
Prithvi1994 1 0 100.0%
laborima 0 3 0.0%
spicule-hive-bot 0 1 0.0%

Generated by scripts/pr-metrics.mjs — see docs/metrics.md.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

area/design-system area/ui dependencies Pull requests that update a dependency file npm Dependabot: npm ecosystem (saiku-ui) risk/high Change risk tier: high (see docs/risk-tiers.md)

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants