Skip to content

chore(deps): Bump the npm-production group across 1 directory with 4 updates - #353

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/tsworkspace/npm-production-118ddfc52b
Open

chore(deps): Bump the npm-production group across 1 directory with 4 updates#353
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/tsworkspace/npm-production-118ddfc52b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-production group with 4 updates in the /tsworkspace directory: @tanstack/react-hotkeys, @xyflow/react, express-rate-limit and lucide-react.

Updates @tanstack/react-hotkeys from 0.18.0 to 0.22.2

Release notes

Sourced from @​tanstack/react-hotkeys's releases.

@​tanstack/react-hotkeys@​0.22.2

Patch Changes

  • #234 32727ea - App hotkeys now compare hotkeys on the provider's platform. Before, providers didn't pass it to the app hotkeys store, which used the detected platform instead. On a server that meant 'linux', so isCustom from the app hotkey list could differ after hydration when a saved hotkey and its default differ only in how they name the modifier, such as Meta+S and Mod+S. findConflicts and setCustomHotkey also compared on the detected platform. The store follows changes to the provider's platform, and AppHotkeysStore.setOptions notifies subscribers once when the platform changes, after applying any new saved custom hotkeys. Saved custom hotkeys are now compared exactly, so new saved data such as Meta+S replaces Mod+S even where the two match, and stays correct if the platform changes later.

    The formatting guides and formatForDisplay's JSDoc now warn more clearly against using formatForDisplay for server-rendered labels. Use your adapter's formatter, such as useFormatForDisplay, instead, and set the provider's platform, or in Ember the scope's, from the request. Where you can't use one, such as in a React Server Component, or with Lit, Alpine, or @tanstack/hotkeys alone, pass platform to formatForDisplay.

  • Updated dependencies [32727ea]:

    • @​tanstack/hotkeys@​0.25.1

@​tanstack/react-hotkeys@​0.22.1

Patch Changes

  • #230 779b8a4 - validateHotkey and the recorder now return reason codes instead of English text, so apps write their own messages. Each error and warning from validateHotkey is a HotkeyIssue such as { reason: 'unknown-modifier', part: 'Ctl' }, and issues in a sequence carry the index of their step instead of a Step 2: prefix. A RecorderRejection keeps its reason but no longer has a built-in message. It has a message only when your validate callback returns one. The 'invalid' rejection reason is now 'whitespace'. The devtools panel lists each problem in a hotkey's details, in plain words. Console warnings and thrown errors are now one short line that starts with [hotkeys]. App hotkeys no longer warn about saved custom hotkeys with an unknown id or an invalid value; they're still dropped. setCustomHotkey with an unknown id no longer warns either. Development warnings no longer throw a ReferenceError where process is undefined, such as plain ESM loaded from a CDN.
  • Updated dependencies [779b8a4, 779b8a4, 779b8a4, 846509d]:
    • @​tanstack/hotkeys@​0.25.0
Changelog

Sourced from @​tanstack/react-hotkeys's changelog.

0.22.2

Patch Changes

  • #234 32727ea - App hotkeys now compare hotkeys on the provider's platform. Before, providers didn't pass it to the app hotkeys store, which used the detected platform instead. On a server that meant 'linux', so isCustom from the app hotkey list could differ after hydration when a saved hotkey and its default differ only in how they name the modifier, such as Meta+S and Mod+S. findConflicts and setCustomHotkey also compared on the detected platform. The store follows changes to the provider's platform, and AppHotkeysStore.setOptions notifies subscribers once when the platform changes, after applying any new saved custom hotkeys. Saved custom hotkeys are now compared exactly, so new saved data such as Meta+S replaces Mod+S even where the two match, and stays correct if the platform changes later.

    The formatting guides and formatForDisplay's JSDoc now warn more clearly against using formatForDisplay for server-rendered labels. Use your adapter's formatter, such as useFormatForDisplay, instead, and set the provider's platform, or in Ember the scope's, from the request. Where you can't use one, such as in a React Server Component, or with Lit, Alpine, or @tanstack/hotkeys alone, pass platform to formatForDisplay.

  • Updated dependencies [32727ea]:

    • @​tanstack/hotkeys@​0.25.1

0.22.1

Patch Changes

  • #230 779b8a4 - validateHotkey and the recorder now return reason codes instead of English text, so apps write their own messages. Each error and warning from validateHotkey is a HotkeyIssue such as { reason: 'unknown-modifier', part: 'Ctl' }, and issues in a sequence carry the index of their step instead of a Step 2: prefix. A RecorderRejection keeps its reason but no longer has a built-in message. It has a message only when your validate callback returns one. The 'invalid' rejection reason is now 'whitespace'. The devtools panel lists each problem in a hotkey's details, in plain words. Console warnings and thrown errors are now one short line that starts with [hotkeys]. App hotkeys no longer warn about saved custom hotkeys with an unknown id or an invalid value; they're still dropped. setCustomHotkey with an unknown id no longer warns either. Development warnings no longer throw a ReferenceError where process is undefined, such as plain ESM loaded from a CDN.
  • Updated dependencies [779b8a4, 779b8a4, 779b8a4, 846509d]:
    • @​tanstack/hotkeys@​0.25.0

0.22.0

Minor Changes

  • #225 b5e429a - Run element-target hotkeys after the framework's own key handlers in React, Svelte, Solid, and Octane. An onKeyDown handler inside the target, such as an autocomplete that closes on Escape, now runs first and can stop the hotkey. Before, the hotkey ran first and its default stopPropagation kept the key from those handlers.

    These adapters set the new afterDelegatedHandlers option, so an element target listens on its document, or on its closed shadow root. Framework handlers outside the target also run before the hotkey now. In Solid, a stop by an onKeyDown handler also skips document hotkeys, even when the hotkey registered before the first component that uses onKeyDown loaded.

Patch Changes

0.21.0

Minor Changes

  • #221 5bf96b6 - Server-rendered hotkey labels can match the user's platform.

    • detectPlatform(userAgent) detects the platform from a user agent string, such as a request's User-Agent header. null, as from a missing header, works like no argument. A new HotkeyPlatform type names the result.
    • Without a user agent, detectPlatform() returns 'linux' on Node, Deno, Bun, and Cloudflare Workers instead of the server's own OS.
    • In development, formatting a label on the server without a platform warns once.
    • Providers accept defaultOptions.platform, which is also the default platform for their hotkeys and recorders.
    • Adapters that render on the server add a formatter hook that uses the provider's platform: useFormatForDisplay (React, Preact, Octane, Vue, Ember), createFormatForDisplay (Solid), getFormatForDisplay (Svelte), and injectFormatForDisplay (Angular).
    • Angular's provideHotkeys accepts defaultOptions as a getter that runs in the injection context, so it can read the request with inject(REQUEST).

Patch Changes

  • Updated dependencies [5bf96b6]:
    • @​tanstack/hotkeys@​0.23.0

... (truncated)

Commits
  • 06ce5e3 ci: Version Packages (#235)
  • 32727ea fix: Compare app hotkeys on the provider's platform and clarify server-render...
  • dd07879 ci: Version Packages (#231)
  • ef29e7b build: Move to oxlint and oxfmt and update dependencies (#233)
  • 779b8a4 feat(hotkeys): Reject unusable hotkeys, return reason codes, and let the top ...
  • 24f618f ci: Version Packages (#224)
  • b5e429a fix: Run element-target hotkeys after framework key handlers (#225)
  • ad7f4a4 ci: Version Packages (#222)
  • 5bf96b6 feat: Render hotkey labels with the user's platform on the server (#221)
  • bf4fb9e ci: Version Packages (#220)
  • Additional commits viewable in compare view

Updates @xyflow/react from 12.12.0 to 12.12.1

Release notes

Sourced from @​xyflow/react's releases.

@​xyflow/react@​12.12.1

Patch Changes

  • #6068 7813eeb - Cancel a pending click connection when clicking the pane and call onClickConnectEnd / onclickconnectend

  • #6097 d150c38 - Don't mutate the internal selection state

  • #5650 f7cddb9 - Infer the type of pathOptions in EdgeProps from the edge type instead of using any.

  • #6090 b235ea0 - Respect nodeOrigin in isNodeIntersecting and getIntersectingNodes when you pass a node object instead of { id }

  • #6054 c7d0fcb - Disconnect the ResizeObservers when a flow unmounts

  • Updated dependencies [d150c38, 8483a2f, c7d0fcb, 9dcbd29, cba335d]:

    • @​xyflow/system@​0.0.84
Changelog

Sourced from @​xyflow/react's changelog.

12.12.1

Patch Changes

  • #6068 7813eeb - Cancel a pending click connection when clicking the pane and call onClickConnectEnd / onclickconnectend

  • #6097 d150c38 - Don't mutate the internal selection state

  • #5650 f7cddb9 - Infer the type of pathOptions in EdgeProps from the edge type instead of using any.

  • #6090 b235ea0 - Respect nodeOrigin in isNodeIntersecting and getIntersectingNodes when you pass a node object instead of { id }

  • #6054 c7d0fcb - Disconnect the ResizeObservers when a flow unmounts

  • Updated dependencies [d150c38, 8483a2f, c7d0fcb, 9dcbd29, cba335d]:

    • @​xyflow/system@​0.0.84
Commits
  • 7599c7f chore(packages): bump
  • d4bc936 Merge pull request #5650 from keepmhwn/fix/path-options-type
  • c4fdcb1 Merge pull request #6097 from xyflow/fix/internal-selection
  • 5c90af4 fix(react): cleanup internal selection handling #6096
  • 93b7a91 chore(pane): cleanup
  • 7abb6f0 Add Svelte pane cancellation and merge latest main
  • b235ea0 fix: respect flow nodeOrigin in root node intersections
  • 22388df chore(useResizeHandler): cleanup
  • 7813eeb fix(react): cancel click connections on pane click
  • c7d0fcb fix: disconnect ResizeObservers when a flow unmounts
  • See full diff in compare view

Updates express-rate-limit from 8.7.2 to 8.7.3

Release notes

Sourced from express-rate-limit's releases.

v8.7.3

You can view the changelog here.

Commits

Updates lucide-react from 1.65.0 to 1.70.0

Release notes

Sourced from lucide-react's releases.

Version 1.70.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.69.0...1.70.0

Version 1.69.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.68.0...1.69.0

Version 1.68.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.67.0...1.68.0

Version 1.67.0

What's Changed

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 10, 2026
@coderabbitai

coderabbitai Bot commented Nov 10, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 3e710f11-1b26-49e7-a0f6-a721cd6c76b9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

@dependabot
chore(deps): Bump the npm-production group across 1 directory with 4 …
d83c702 
…updates

Bumps the npm-production group with 4 updates in the /tsworkspace directory: [@tanstack/react-hotkeys](https://github.com/TanStack/hotkeys/tree/HEAD/packages/react-hotkeys), [@xyflow/react](https://github.com/xyflow/xyflow/tree/HEAD/packages/react), [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) and [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react).


Updates `@tanstack/react-hotkeys` from 0.18.0 to 0.22.2
- [Release notes](https://github.com/TanStack/hotkeys/releases)
- [Changelog](https://github.com/TanStack/hotkeys/blob/main/packages/react-hotkeys/CHANGELOG.md)
- [Commits](https://github.com/TanStack/hotkeys/commits/@tanstack/react-hotkeys@0.22.2/packages/react-hotkeys)

Updates `@xyflow/react` from 12.12.0 to 12.12.1
- [Release notes](https://github.com/xyflow/xyflow/releases)
- [Changelog](https://github.com/xyflow/xyflow/blob/main/packages/react/CHANGELOG.md)
- [Commits](https://github.com/xyflow/xyflow/commits/@xyflow/react@12.12.1/packages/react)

Updates `express-rate-limit` from 8.7.2 to 8.7.3
- [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases)
- [Commits](express-rate-limit/express-rate-limit@v8.7.2...v8.7.3)

Updates `lucide-react` from 1.65.0 to 1.70.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.70.0/packages/lucide-react)

---
updated-dependencies:
- dependency-name: "@tanstack/react-hotkeys"
  dependency-version: 0.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-production
- dependency-name: "@xyflow/react"
  dependency-version: 12.12.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-production
- dependency-name: express-rate-limit
  dependency-version: 8.7.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-production
- dependency-name: lucide-react
  dependency-version: 1.70.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore(deps): Bump the npm-production group in /tsworkspace with 4 updates chore(deps): Bump the npm-production group across 1 directory with 4 updates Nov 11, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/tsworkspace/npm-production-118ddfc52b branch from 87d3912 to d83c702 Compare November 11, 2026 12:02

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants