Skip to content

build(deps): bump the frontend-deps group across 1 directory with 27 updates - #118

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/frontend/frontend-deps-b2fec619b8
Closed

build(deps): bump the frontend-deps group across 1 directory with 27 updates#118
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/frontend/frontend-deps-b2fec619b8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the frontend-deps group with 26 updates in the /frontend directory:

Package From To
@radix-ui/react-dialog 1.1.19 1.1.23
@radix-ui/react-dropdown-menu 2.1.20 2.1.24
@radix-ui/react-label 2.1.11 2.1.15
@radix-ui/react-select 2.3.3 2.3.7
@tanstack/react-query 5.101.2 5.102.6
@tanstack/react-virtual 3.14.6 3.14.10
@tiptap/extension-link 3.28.0 3.30.5
@tiptap/extension-placeholder 3.28.0 3.30.5
@tiptap/react 3.28.0 3.30.5
@tiptap/starter-kit 3.28.0 3.30.5
axios 1.18.1 1.20.0
dompurify 3.4.12 3.4.14
i18next 26.3.6 26.4.0
lucide-react 1.25.0 1.34.0
react 19.2.7 19.2.8
@types/react 19.2.17 19.2.18
react-dom 19.2.7 19.2.8
@types/react-dom 19.2.3 19.2.5
react-grid-layout 2.2.3 2.2.4
react-i18next 17.0.10 17.0.12
react-router-dom 7.18.1 7.18.2
recharts 3.9.2 3.10.1
zustand 5.0.14 5.0.15
@types/node 26.1.1 26.4.0
@vitejs/plugin-react 6.0.3 6.1.0
vite 8.1.5 8.2.2

Updates @radix-ui/react-dialog from 1.1.19 to 1.1.23

Changelog

Sourced from @​radix-ui/react-dialog's changelog.

1.1.23

  • Reverted breaking changes that caused compatibility issues with React Server Components.
  • Updated dependencies: @radix-ui/react-compose-refs@1.1.5, @radix-ui/react-context@1.2.2, @radix-ui/react-dismissable-layer@1.1.19, @radix-ui/react-focus-guards@1.1.6, @radix-ui/react-focus-scope@1.1.16, @radix-ui/react-id@1.1.4, @radix-ui/react-portal@1.1.17, @radix-ui/react-presence@1.1.10, @radix-ui/react-primitive@2.1.10, @radix-ui/react-slot@1.3.3, @radix-ui/react-use-controllable-state@1.2.6, @radix-ui/react-use-layout-effect@1.1.4

1.1.22

  • Updated dependencies: @radix-ui/react-slot@1.3.2, @radix-ui/react-primitive@2.1.9, @radix-ui/react-dismissable-layer@1.1.18, @radix-ui/react-focus-scope@1.1.15, @radix-ui/react-portal@1.1.16

1.1.21

  • Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation.
  • Updated dependencies: @radix-ui/primitive@1.1.7, @radix-ui/react-compose-refs@1.1.4, @radix-ui/react-context@1.2.1, @radix-ui/react-dismissable-layer@1.1.17, @radix-ui/react-focus-guards@1.1.5, @radix-ui/react-focus-scope@1.1.14, @radix-ui/react-id@1.1.3, @radix-ui/react-portal@1.1.15, @radix-ui/react-presence@1.1.9, @radix-ui/react-primitive@2.1.8, @radix-ui/react-slot@1.3.1, @radix-ui/react-use-controllable-state@1.2.5, @radix-ui/react-use-layout-effect@1.1.3

1.1.20

  • Fixed broken ARIA references in Dialogs where a title or description elements are not rendered.
  • Improved tree-shaking so bundlers can drop unused components. Component parts are now marked /* @__PURE__ */ and use named render functions instead of Component.displayName = ... assignments, which previously prevented dead-code elimination with some bundlers.
  • Updated dependencies: @radix-ui/react-dismissable-layer@1.1.16, @radix-ui/react-focus-scope@1.1.13, @radix-ui/react-portal@1.1.14, @radix-ui/react-presence@1.1.8, @radix-ui/react-use-controllable-state@1.2.4, @radix-ui/primitive@1.1.6, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.2.0, @radix-ui/react-focus-guards@1.1.4, @radix-ui/react-id@1.1.2, @radix-ui/react-primitive@2.1.7, @radix-ui/react-slot@1.3.0, @radix-ui/react-use-layout-effect@1.1.2
Commits

Updates @radix-ui/react-dropdown-menu from 2.1.20 to 2.1.24

Changelog

Sourced from @​radix-ui/react-dropdown-menu's changelog.

2.1.24

  • Reverted breaking changes that caused compatibility issues with React Server Components.
  • Updated dependencies: @radix-ui/react-compose-refs@1.1.5, @radix-ui/react-context@1.2.2, @radix-ui/react-id@1.1.4, @radix-ui/react-menu@2.1.24, @radix-ui/react-primitive@2.1.10, @radix-ui/react-use-controllable-state@1.2.6

2.1.23

  • Updated dependencies: @radix-ui/react-menu@2.1.23, @radix-ui/react-primitive@2.1.9

2.1.22

  • Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation.
  • Updated dependencies: @radix-ui/primitive@1.1.7, @radix-ui/react-compose-refs@1.1.4, @radix-ui/react-context@1.2.1, @radix-ui/react-id@1.1.3, @radix-ui/react-menu@2.1.22, @radix-ui/react-primitive@2.1.8, @radix-ui/react-use-controllable-state@1.2.5

2.1.21

  • Improved tree-shaking so bundlers can drop unused components. Component parts are now marked /* @__PURE__ */ and use named render functions instead of Component.displayName = ... assignments, which previously prevented dead-code elimination with some bundlers.
  • Updated dependencies: @radix-ui/react-menu@2.1.21, @radix-ui/react-use-controllable-state@1.2.4, @radix-ui/primitive@1.1.6, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.2.0, @radix-ui/react-id@1.1.2, @radix-ui/react-primitive@2.1.7
Commits

Updates @radix-ui/react-label from 2.1.11 to 2.1.15

Changelog

Sourced from @​radix-ui/react-label's changelog.

2.1.15

  • Reverted breaking changes that caused compatibility issues with React Server Components.
  • Updated dependencies: @radix-ui/react-primitive@2.1.10

2.1.14

  • Updated dependencies: @radix-ui/react-primitive@2.1.9

2.1.13

  • Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation.
  • Updated dependencies: @radix-ui/react-primitive@2.1.8

2.1.12

  • Improved tree-shaking so bundlers can drop unused components. Component parts are now marked /* @__PURE__ */ and use named render functions instead of Component.displayName = ... assignments, which previously prevented dead-code elimination with some bundlers.
  • Updated dependencies: @radix-ui/react-primitive@2.1.7
Commits

Updates @radix-ui/react-select from 2.3.3 to 2.3.7

Changelog

Sourced from @​radix-ui/react-select's changelog.

2.3.7

  • Reverted breaking changes that caused compatibility issues with React Server Components.
  • Updated dependencies: @radix-ui/react-collection@1.1.15, @radix-ui/react-compose-refs@1.1.5, @radix-ui/react-context@1.2.2, @radix-ui/react-direction@1.1.4, @radix-ui/react-dismissable-layer@1.1.19, @radix-ui/react-focus-guards@1.1.6, @radix-ui/react-focus-scope@1.1.16, @radix-ui/react-id@1.1.4, @radix-ui/react-popper@1.3.7, @radix-ui/react-portal@1.1.17, @radix-ui/react-presence@1.1.10, @radix-ui/react-primitive@2.1.10, @radix-ui/react-slot@1.3.3, @radix-ui/react-use-callback-ref@1.1.4, @radix-ui/react-use-controllable-state@1.2.6, @radix-ui/react-use-layout-effect@1.1.4, @radix-ui/react-use-previous@1.1.4, @radix-ui/react-visually-hidden@1.2.11

2.3.6

  • Updated dependencies: @radix-ui/react-slot@1.3.2, @radix-ui/react-collection@1.1.14, @radix-ui/react-primitive@2.1.9, @radix-ui/react-dismissable-layer@1.1.18, @radix-ui/react-focus-scope@1.1.15, @radix-ui/react-popper@1.3.6, @radix-ui/react-portal@1.1.16, @radix-ui/react-visually-hidden@1.2.10

2.3.5

  • Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation.
  • Updated dependencies: @radix-ui/number@1.1.3, @radix-ui/primitive@1.1.7, @radix-ui/react-collection@1.1.13, @radix-ui/react-compose-refs@1.1.4, @radix-ui/react-context@1.2.1, @radix-ui/react-direction@1.1.3, @radix-ui/react-dismissable-layer@1.1.17, @radix-ui/react-focus-guards@1.1.5, @radix-ui/react-focus-scope@1.1.14, @radix-ui/react-id@1.1.3, @radix-ui/react-popper@1.3.5, @radix-ui/react-portal@1.1.15, @radix-ui/react-presence@1.1.9, @radix-ui/react-primitive@2.1.8, @radix-ui/react-slot@1.3.1, @radix-ui/react-use-callback-ref@1.1.3, @radix-ui/react-use-controllable-state@1.2.5, @radix-ui/react-use-layout-effect@1.1.3, @radix-ui/react-use-previous@1.1.3, @radix-ui/react-visually-hidden@1.2.9

2.3.4

  • Improved tree-shaking so bundlers can drop unused components. Component parts are now marked /* @__PURE__ */ and use named render functions instead of Component.displayName = ... assignments, which previously prevented dead-code elimination with some bundlers.
  • Updated dependencies: @radix-ui/react-popper@1.3.4, @radix-ui/react-dismissable-layer@1.1.16, @radix-ui/react-focus-scope@1.1.13, @radix-ui/react-portal@1.1.14, @radix-ui/react-presence@1.1.8, @radix-ui/react-visually-hidden@1.2.8, @radix-ui/react-use-controllable-state@1.2.4, @radix-ui/primitive@1.1.6, @radix-ui/number@1.1.2, @radix-ui/react-collection@1.1.12, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.2.0, @radix-ui/react-direction@1.1.2, @radix-ui/react-focus-guards@1.1.4, @radix-ui/react-id@1.1.2, @radix-ui/react-primitive@2.1.7, @radix-ui/react-slot@1.3.0, @radix-ui/react-use-callback-ref@1.1.2, @radix-ui/react-use-layout-effect@1.1.2, @radix-ui/react-use-previous@1.1.2
Commits

Updates @radix-ui/react-slot from 1.3.0 to 1.3.3

Changelog

Sourced from @​radix-ui/react-slot's changelog.

1.3.2, 1.3.3

  • Reverted breaking changes that caused compatibility issues with React Server Components.

1.3.1

  • Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation.
  • Updated dependencies: @radix-ui/primitive@1.1.7, @radix-ui/react-compose-refs@1.1.4
Commits

Updates @tanstack/react-query from 5.101.2 to 5.102.6

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.102.6

Patch Changes

  • Updated dependencies [ac2b612]:
    • @​tanstack/react-query@​5.102.6
    • @​tanstack/query-devtools@​5.102.6

@​tanstack/react-query-next-experimental@​5.102.6

Patch Changes

  • Updated dependencies [ac2b612]:
    • @​tanstack/react-query@​5.102.6

@​tanstack/react-query-persist-client@​5.102.6

Patch Changes

  • Updated dependencies [ac2b612]:
    • @​tanstack/react-query@​5.102.6
    • @​tanstack/query-persist-client-core@​5.102.6

@​tanstack/react-query@​5.102.6

Patch Changes

  • #11305 ac2b612 - fix(react-query): throw falsy errors from useQueries and useSuspenseQueries to the error boundary

  • Updated dependencies []:

    • @​tanstack/query-core@​5.102.6

@​tanstack/react-query-devtools@​5.102.5

Patch Changes

  • Updated dependencies [ef1eff1]:
    • @​tanstack/query-devtools@​5.102.5
    • @​tanstack/react-query@​5.102.5

@​tanstack/react-query-next-experimental@​5.102.5

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.102.5

@​tanstack/react-query-persist-client@​5.102.5

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-persist-client-core@​5.102.5
    • @​tanstack/react-query@​5.102.5

@​tanstack/react-query@​5.102.5

Patch Changes

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.102.6

Patch Changes

  • #11305 ac2b612 - fix(react-query): throw falsy errors from useQueries and useSuspenseQueries to the error boundary

  • Updated dependencies []:

    • @​tanstack/query-core@​5.102.6

5.102.5

Patch Changes

  • Updated dependencies [578e5c2]:
    • @​tanstack/query-core@​5.102.5

5.102.4

Patch Changes

  • Updated dependencies [a05df6a]:
    • @​tanstack/query-core@​5.102.4

5.102.3

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.102.3

5.102.2

Patch Changes

  • Updated dependencies [80fbf73]:
    • @​tanstack/query-core@​5.102.2

5.102.1

Patch Changes

  • Updated dependencies [134890d]:
    • @​tanstack/query-core@​5.102.1

5.102.0

Minor Changes

  • #10668 e674826 - react-query: update usePrefetchQuery and usePrefetchInfiniteQuery to use queryClient.query and queryClient.infiniteQuery

... (truncated)

Commits

Updates @tanstack/react-virtual from 3.14.6 to 3.14.10

Release notes

Sourced from @​tanstack/react-virtual's releases.

@​tanstack/react-virtual@​3.14.10

Patch Changes

@​tanstack/react-virtual@​3.14.9

Patch Changes

  • Updated dependencies [a5417b4]:
    • @​tanstack/virtual-core@​3.17.7

@​tanstack/react-virtual@​3.14.8

Patch Changes

  • #1237 aa536e7 - Fix a gap at the top of the list after an end-anchored prepend in directDomUpdates mode. The prepend grows the total size and bumps scrollOffset to the new bottom in the same pass, but the size container's height was written after _willUpdate synced the scroll position — so the browser clamped the scrollTop write to the stale (shorter) scrollHeight, leaving whitespace at the top until the next scroll. The container is now grown before the scroll sync. Only affected directDomUpdates mode (React-rendered sizers receive their height during render).

  • Updated dependencies [7ae32b5]:

    • @​tanstack/virtual-core@​3.17.6

@​tanstack/react-virtual@​3.14.7

Patch Changes

Changelog

Sourced from @​tanstack/react-virtual's changelog.

3.14.10

Patch Changes

3.14.9

Patch Changes

  • Updated dependencies [a5417b4]:
    • @​tanstack/virtual-core@​3.17.7

3.14.8

Patch Changes

  • #1237 aa536e7 - Fix a gap at the top of the list after an end-anchored prepend in directDomUpdates mode. The prepend grows the total size and bumps scrollOffset to the new bottom in the same pass, but the size container's height was written after _willUpdate synced the scroll position — so the browser clamped the scrollTop write to the stale (shorter) scrollHeight, leaving whitespace at the top until the next scroll. The container is now grown before the scroll sync. Only affected directDomUpdates mode (React-rendered sizers receive their height during render).

  • Updated dependencies [7ae32b5]:

    • @​tanstack/virtual-core@​3.17.6

3.14.7

Patch Changes

Commits
  • e9874f0 ci: Version Packages (#1247)
  • b4a76ca fix(marko-virtual): consolidate Marko e2e into one in-package app, fix test (...
  • deca524 ci: Version Packages (#1240)
  • 32b2f2b ci: Version Packages (#1238)
  • aa536e7 fix(react-virtual): grow size container before scroll sync on end-anchored pr...
  • 87f689a ci: Version Packages (#1231)
  • ba5c47a feat(angular-virtual): add chat example and require Angular 20 (#1228)
  • See full diff in compare view

Updates @tiptap/extension-link from 3.28.0 to 3.30.5

Release notes

Sourced from @​tiptap/extension-link's releases.

v3.30.5

@​tiptap/core

Patch Changes

  • Fix a denial-of-service risk where crafted block or inline Markdown attributes could consume excessive CPU and block the browser or server event loop.

v3.30.4

@​tiptap/core

Patch Changes

  • Prevent untrusted HTML attributes from changing an object's prototype when merged with mergeAttributes.

v3.30.3

@​tiptap/extension-text-style

Patch Changes

  • Unsetting one text style inside a blockquote no longer removes the other text styles in it.

@​tiptap/extension-youtube

Patch Changes

  • YouTube live URLs (/live/<id>) now embed the video.

@​tiptap/core

Patch Changes

  • Fix JSX runtime to properly render nested sibling elements by spreading children arrays into DOMOutputSpec

@​tiptap/react

Patch Changes

  • Fix ReactNodeViewRenderer crash when contentComponent is not available

@​tiptap/ai-toolkit

Minor Changes

  • Add the AiInsertReveal extension (@tiptap/ai-toolkit/streaming-reveal) to fade in text as the AI streams it into a collaborative document.

v3.30.2

@​tiptap/core

Patch Changes

... (truncated)

Changelog

Sourced from @​tiptap/extension-link's changelog.

3.30.5

Patch Changes

  • Updated dependencies [d0d499b]
    • @​tiptap/core@​3.30.5
    • @​tiptap/pm@​3.30.5

3.30.4

Patch Changes

  • Updated dependencies [01d7af8]
    • @​tiptap/core@​3.30.4
    • @​tiptap/pm@​3.30.4

3.30.3

Patch Changes

  • Updated dependencies [965a880]
    • @​tiptap/core@​3.30.3
    • @​tiptap/pm@​3.30.3

3.30.2

Patch Changes

  • Updated dependencies [3dffed5]
  • Updated dependencies [214a140]
    • @​tiptap/core@​3.30.2
    • @​tiptap/pm@​3.30.2

3.30.1

Patch Changes

  • Updated dependencies [abc8828]
    • @​tiptap/core@​3.30.1
    • @​tiptap/pm@​3.30.1

3.30.0

Patch Changes

  • Updated dependencies [0247d39]
  • Updated dependencies [58a8953]
  • Updated dependencies [51909d3]
  • Updated dependencies [3099eef]
    • @​tiptap/core@​3.30.0

... (truncated)

Commits
  • b0c188b chore(release): release new stable release (#8261)
  • 55f59e4 chore(release): release new stable release (#8260)
  • db790a7 chore(release): release new stable release (#8216)
  • f434577 chore: migrate over to vite+ for tooling (#8151)
  • cef2c9a chore(release): release new stable release (#8190)
  • 4c4933d chore(release): release new stable release (#8181)
  • 7901bc2 chore(release): release new stable release (#8142)
  • 2036090 test(extension-link): guard non-link click selection with enableClickSelectio...
  • 5158212 chore(release): release new stable release (#8132)
  • 896564a chore(release): release new stable release (#8128)
  • Additional commits viewable in compare view

Updates @tiptap/extension-placeholder from 3.28.0 to 3.30.5

Release notes

Sourced from @​tiptap/extension-placeholder's releases.

v3.30.5

@​tiptap/core

Patch Changes

  • Fix a denial-of-service risk where crafted block or inline Markdown attributes could consume excessive CPU and block the browser or server event loop.

v3.30.4

@​tiptap/core

Patch Changes

  • Prevent untrusted HTML attributes from changing an object's prototype when merged with mergeAttributes.

v3.30.3

@​tiptap/extension-text-style

Patch Changes

  • Unsetting one text style inside a blockquote no longer removes the other text styles in it.

@​tiptap/extension-youtube

Patch Changes

  • YouTube live URLs (/live/<id>) now embed the video.

@​tiptap/core

Patch Changes

  • Fix JSX runtime to properly render nested sibling elements by spreading children arrays into DOMOutputSpec

@​tiptap/react

Patch Changes

  • Fix ReactNodeViewRenderer crash when contentComponent is not available

@​tiptap/ai-toolkit

Minor Changes

  • Add the AiInsertReveal extension (@tiptap/ai-toolkit/streaming-reveal) to fade in text as the AI streams it into a collaborative document.

v3.30.2

@​tiptap/core

Patch Changes

... (truncated)

Changelog

Sourced from @​tiptap/extension-placeholder's changelog.

3.30.5

Patch Changes

  • @​tiptap/extensions@​3.30.5

3.30.4

Patch Changes

  • @​tiptap/extensions@​3.30.4

3.30.3

Patch Changes

  • @​tiptap/extensions@​3.30.3

3.30.2

Patch Changes

  • @​tiptap/extensions@​3.30.2

3.30.1

Patch Changes

  • @​tiptap/extensions@​3.30.1

3.30.0

Patch Changes

  • @​tiptap/extensions@​3.30.0

3.29.2

Patch Changes

  • @​tiptap/extensions@​3.29.2

3.29.1

Patch Changes

  • @​tiptap/extensions@​3.29.1

3.29.0

... (truncated)

Commits

Updates @tiptap/react from 3.28.0 to 3.30.5

Release notes

Sourced from @​tiptap/react's releases.

v3.30.5

@​tiptap/core

Patch Changes

  • Fix a denial-of-service risk where crafted block or inline Markdown attributes could consume excessive CPU and block the browser or server event loop.

v3.30.4

@​tiptap/core

Patch Changes

  • Prevent untrusted HTML attributes from changing an object's prototype when merged with mergeAttributes.

v3.30.3

@​tiptap/extension-text-style

Patch Changes

  • Unsetting one text style inside a blockquote no longer removes the other text styles in it.

@​tiptap/extension-youtube

Patch Changes

  • YouTube live URLs (/live/<id>) now embed the video.

@​tiptap/core

Patch Changes

  • Fix JSX runtime to properly render nested sibling elements by spreading children arrays into DOMOutputSpec

@​tiptap/react

Patch Changes

  • Fix ReactNodeViewRenderer crash when contentComponent is not available

@​tiptap/ai-toolkit

Minor Changes

  • Add the AiInsertReveal extension (@tiptap/ai-toolkit/streaming-reveal) to fade in text as the AI streams it into a collaborative document.

v3.30.2

@​tiptap/core

Patch Changes

... (truncated)

Changelog

Sourced from @​tiptap/react's changelog.

3.30.5

Patch Changes

  • Updated dependencies [d0d499b]
    • @​tiptap/core@​3.30.5
    • @​tiptap/pm@​3.30.5

3.30.4

Patch Changes

  • Updated dependencies [01d7af8]
    • @​tiptap/core@​3.30.4
    • @​tiptap/pm@​3.30.4

3.30.3

Patch Changes

  • 1cb7ad3: Fix ReactNodeViewRenderer crash when contentComponent is not available
  • Updated dependencies [965a880]
    • @​tiptap/core@​3.30.3
    • @​tiptap/pm@​3.30.3

3.30.2

Patch Changes

  • Updated dependencies [3dffed5]
  • Updated dependencies [214a140]
    • @​tiptap/core@​3.30.2
    • @​tiptap/pm@​3.30.2

3.30.1

Patch Changes

  • Updated dependencies [abc8828]
    • @​tiptap/core@​3.30.1
    • @​tiptap/pm@​3.30.1

3.30.0

Minor Changes

  • 3099eef: New Decorations API

    Finally the decorations API is here! Even though Decorations itself are nothing new in ProseMirror, the new API makes it much easier to use them in Tiptap without leaving your extensions.

... (truncated)

Commits
  • b0c188b chore(release): release new stable release (#8261)
  • 55f59e4 chore(release): release new stable release (#8260)
  • db790a7 chore(release): release new stable release (#8216)
  • f434577 chore: migrate over to vite+ for tooling (#8151)
  • 1cb7ad3 fix(react): prevent crash when ReactNodeViewRenderer returns early (#7670)
  • cef2c9a chore(release): release new stable release (#8190)
  • 4c4933d chore(release): release new stable release (#8181)
  • 7901bc2 chore(release): release new stable release (#8142)
  • 3099eef feat(core): add Decorations API with framework widget renderers (#7902)
  • 31e176c fix(react): avoid stale position when syncing node view selection (#8165)
  • Additional commits viewable in compare view

Updates @tiptap/starter-kit from 3.28.0 to 3.30.5

Release notes

Sourced from @​tiptap/starter-kit's releases.

v3.30.5

@​tiptap/core

Patch Changes

  • Fix a denial-of-service risk where crafted block or inline Markdown attributes could consume excessive CPU and block the browser or server event loop.

v3.30.4

@​tiptap/core

Patch Changes

  • Prevent untrusted HTML attributes from changing an object's prototype when merged with mergeAttributes.

v3.30.3

@​tiptap/extension-text-style

Patch Changes

  • Unsetting one text style inside a blockquote no longer removes the other text styles in it.

@​tiptap/extension-youtube

Patch Changes

  • YouTube live URLs (/live/<id>) now embed the video.

@​tiptap/core

Patch Changes

  • Fix JSX runtime to properly render nested sibling elements by spreading children arrays into DOMOutputSpec

@​tiptap/react

Patch Changes

  • Fix ReactNodeViewRenderer crash when contentComponent is not available

@​tiptap/ai-toolkit

Minor Changes

  • Add the AiInsertReveal extension (@tiptap/ai-toolkit/streaming-reveal) to fade in text as the AI streams it into a collaborative document.

v3.30.2

@​tiptap/core

Patch Changes

... (truncated)

Changelog

Sourced from @​tiptap/starter-kit's changelog.

3.30.5

Patch Changes

  • Updated dependencies [d0d499b]
    • @​tiptap/core@​3.30.5
    • @​tiptap/extension-blockquote@​3.30.5
    • @​tiptap/extension-bold@​3.30.5
    • @​tiptap/extension-code@​3.30.5
    • @​tiptap/extension-code-block@​3.30.5
    • @​tiptap/extension-document@​3.30.5
    • @​tiptap/extension-hard-break@​3.30.5
    • @​tiptap/extension-heading@​3.30.5
    • @​tiptap/extension-horizontal-rule@​3.30.5
    • @​tiptap/extension-italic@​3.30.5
    • @​tiptap/extension-link@​3.30.5
    • @​tiptap/extension-list@​3.30.5
    • @​tiptap/extension-paragraph@​3.30.5
    • @​tiptap/extension-strike@​3.30.5
    • @​tiptap/extension-text@​3.30.5
    • @​tiptap/extension-underline@​3.30.5
    • @​tiptap/extensions@​3.30.5
    • @​tiptap/extension-list-item@​3.30.5
    • @​tiptap/extension-list-keymap@​3.30.5
    • @​tiptap/extension-bullet-list@​3.30.5
    • @​tiptap/extension-ordered-list@​3.30.5
    • @​tiptap/extension-dropcursor@​3.30.5
    • @​tiptap/extension-gapcursor@​3.30.5
    • @​tiptap/pm@​3.30.5

3.30.4

Patch Changes

  • Updated dependencies [01d7af8]
    • @​tiptap/core@​3.30.4
    • @​tiptap/extension-blockquote@​3.30.4
    • @​tiptap/extension-bold@​3.30.4
    • @​tiptap/extension-code@​3.30.4
    • @​tiptap/extension-code-block@​3.30.4
    • @​tiptap/extension-document@​3.30.4
    • @​tiptap/extension-hard-break@​3.30.4
    • @​tiptap/extension-heading@​3.30.4
    • @​tiptap/extension-horizontal-rule@​3.30.4
    • @​tiptap/extension-italic@​3.30.4
    • @​tiptap/extension-link@​3.30.4
    • @​tiptap/extension-list@​3.30.4
    • @​tiptap/extension-paragraph@​3.30.4
    • @​tiptap/extension-strike@​3.30.4
    • @​tiptap/extension-text@​3.30.4

... (truncated)

Commits

Updates axios from 1.18.1 to 1.20.0

Release notes

Sourced from axios's releases.

v1.20.0 — August 19, 2026

This release hardens runtime option handling, adds RFC 9110 status-code aliases, fixes Node.js and XHR reliability issues, and refreshes project tooling and documentation.

⚠️ Breaking Changes & Deprecations

  • HTTP Status Naming: Added ContentTooLarge (413) and UnprocessableContent (422), while retaining PayloadTooLarge and UnprocessableEntity as backward-compatible deprecated aliases. (#11082)

🔒 Security Fixes

  • Runtime Option Handling: Hardened behavioral configuration reads against shared and foreign prototype pollution and normalized unsafe interceptor replacement objects. This also clarifies Fetch redirect and custom implementation behavior, HTTP/2 DNS and proxy handling, CIDR-based NO_PROXY matching, and malformed data URI rejection; see the PR for documented compatibility effects. (#11141)

🐛 Bug Fixes

  • Interceptor Lifecycle: Prevented unbounded handler-array growth by trimming trailing ejected interceptors without changing iteration semantics, and kept interceptor operations safe when the public handlers field is nullish. (#11087, #11118)
  • Request Error Preservation: Prevented custom Error.prepareStackTrace implementations that return non-string values from replacing the original request failure with an unrelated TypeError. (#11109)
  • XHR Reliability: Navigation-canceled requests now reject with ECONNABORTED instead of resolving with status 0, while successful downloads flush their final progress callback during the live loadend dispatch. (#11094, #11121)
  • Node.js Socket Memory: Removed request-context retention from per-socket error listeners, preventing completed response data from being pinned for the lifetime of pooled keep-alive sockets. (#11091)
  • Core Methods and HTTP Errors: Prevented structural method-header buckets from leaking into outgoing headers, standardized invalid DNS lookup and httpVersion failures as AxiosError.ERR_BAD_OPTION_VALUE, and corrected the timeoutErrorMessage merge strategy. (#11096)

🔧 Maintenance & Chores

  • Dependencies: Updated fast-uri, postcss, js-yaml, mocha, development-tooling groups, and GitHub Actions dependencies. (#11092, #11098, #11099,

…updates

Bumps the frontend-deps group with 26 updates in the /frontend directory:

| Package | From | To |
| --- | --- | --- |
| [@radix-ui/react-dialog](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/dialog) | `1.1.19` | `1.1.23` |
| [@radix-ui/react-dropdown-menu](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/dropdown-menu) | `2.1.20` | `2.1.24` |
| [@radix-ui/react-label](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/label) | `2.1.11` | `2.1.15` |
| [@radix-ui/react-select](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/select) | `2.3.3` | `2.3.7` |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.101.2` | `5.102.6` |
| [@tanstack/react-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual) | `3.14.6` | `3.14.10` |
| [@tiptap/extension-link](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-link) | `3.28.0` | `3.30.5` |
| [@tiptap/extension-placeholder](https://github.com/ueberdosis/tiptap/tree/HEAD/packages-deprecated/extension-placeholder) | `3.28.0` | `3.30.5` |
| [@tiptap/react](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/react) | `3.28.0` | `3.30.5` |
| [@tiptap/starter-kit](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/starter-kit) | `3.28.0` | `3.30.5` |
| [axios](https://github.com/axios/axios) | `1.18.1` | `1.20.0` |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.4.12` | `3.4.14` |
| [i18next](https://github.com/i18next/i18next) | `26.3.6` | `26.4.0` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.25.0` | `1.34.0` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.7` | `19.2.8` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.17` | `19.2.18` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.7` | `19.2.8` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.3` | `19.2.5` |
| [react-grid-layout](https://github.com/STRML/react-grid-layout) | `2.2.3` | `2.2.4` |
| [react-i18next](https://github.com/i18next/react-i18next) | `17.0.10` | `17.0.12` |
| [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `7.18.1` | `7.18.2` |
| [recharts](https://github.com/recharts/recharts) | `3.9.2` | `3.10.1` |
| [zustand](https://github.com/pmndrs/zustand) | `5.0.14` | `5.0.15` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.1` | `26.4.0` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.3` | `6.1.0` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.1.5` | `8.2.2` |



Updates `@radix-ui/react-dialog` from 1.1.19 to 1.1.23
- [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/dialog/CHANGELOG.md)
- [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/dialog)

Updates `@radix-ui/react-dropdown-menu` from 2.1.20 to 2.1.24
- [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/dropdown-menu/CHANGELOG.md)
- [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/dropdown-menu)

Updates `@radix-ui/react-label` from 2.1.11 to 2.1.15
- [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/label/CHANGELOG.md)
- [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/label)

Updates `@radix-ui/react-select` from 2.3.3 to 2.3.7
- [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/select/CHANGELOG.md)
- [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/select)

Updates `@radix-ui/react-slot` from 1.3.0 to 1.3.3
- [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/slot/CHANGELOG.md)
- [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/slot)

Updates `@tanstack/react-query` from 5.101.2 to 5.102.6
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.102.6/packages/react-query)

Updates `@tanstack/react-virtual` from 3.14.6 to 3.14.10
- [Release notes](https://github.com/TanStack/virtual/releases)
- [Changelog](https://github.com/TanStack/virtual/blob/main/packages/react-virtual/CHANGELOG.md)
- [Commits](https://github.com/TanStack/virtual/commits/@tanstack/react-virtual@3.14.10/packages/react-virtual)

Updates `@tiptap/extension-link` from 3.28.0 to 3.30.5
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.30.5/packages/extension-link/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.30.5/packages/extension-link)

Updates `@tiptap/extension-placeholder` from 3.28.0 to 3.30.5
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.30.5/packages-deprecated/extension-placeholder/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.30.5/packages-deprecated/extension-placeholder)

Updates `@tiptap/react` from 3.28.0 to 3.30.5
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.30.5/packages/react/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.30.5/packages/react)

Updates `@tiptap/starter-kit` from 3.28.0 to 3.30.5
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.30.5/packages/starter-kit/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.30.5/packages/starter-kit)

Updates `axios` from 1.18.1 to 1.20.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.18.1...v1.20.0)

Updates `dompurify` from 3.4.12 to 3.4.14
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.12...3.4.14)

Updates `i18next` from 26.3.6 to 26.4.0
- [Release notes](https://github.com/i18next/i18next/releases)
- [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/i18next@v26.3.6...v26.4.0)

Updates `lucide-react` from 1.25.0 to 1.34.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.34.0/packages/lucide-react)

Updates `react` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react)

Updates `@types/react` from 19.2.17 to 19.2.18
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `react-dom` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom)

Updates `@types/react-dom` from 19.2.3 to 19.2.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `react-grid-layout` from 2.2.3 to 2.2.4
- [Release notes](https://github.com/STRML/react-grid-layout/releases)
- [Changelog](https://github.com/react-grid-layout/react-grid-layout/blob/master/CHANGELOG.md)
- [Commits](react-grid-layout/react-grid-layout@2.2.3...v2.2.4)

Updates `react-i18next` from 17.0.10 to 17.0.12
- [Changelog](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/react-i18next@v17.0.10...v17.0.12)

Updates `react-router-dom` from 7.18.1 to 7.18.2
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/react-router-dom@7.18.2/packages/react-router-dom/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.18.2/packages/react-router-dom)

Updates `recharts` from 3.9.2 to 3.10.1
- [Release notes](https://github.com/recharts/recharts/releases)
- [Changelog](https://github.com/recharts/recharts/blob/main/CHANGELOG.md)
- [Commits](recharts/recharts@v3.9.2...v3.10.1)

Updates `zustand` from 5.0.14 to 5.0.15
- [Release notes](https://github.com/pmndrs/zustand/releases)
- [Commits](pmndrs/zustand@v5.0.14...v5.0.15)

Updates `@types/node` from 26.1.1 to 26.4.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/react` from 19.2.17 to 19.2.18
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `@types/react-dom` from 19.2.3 to 19.2.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `@vitejs/plugin-react` from 6.0.3 to 6.1.0
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.0/packages/plugin-react)

Updates `vite` from 8.1.5 to 8.2.2
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.2.2/packages/vite)

---
updated-dependencies:
- dependency-name: "@radix-ui/react-dialog"
  dependency-version: 1.1.23
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: frontend-deps
- dependency-name: "@radix-ui/react-dropdown-menu"
  dependency-version: 2.1.24
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: frontend-deps
- dependency-name: "@radix-ui/react-label"
  dependency-version: 2.1.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: frontend-deps
- dependency-name: "@radix-ui/react-select"
  dependency-version: 2.3.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: frontend-deps
- dependency-name: "@radix-ui/react-slot"
  dependency-version: 1.3.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: frontend-deps
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.102.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-deps
- dependency-name: "@tanstack/react-virtual"
  dependency-version: 3.14.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: frontend-deps
- dependency-name: "@tiptap/extension-link"
  dependency-version: 3.30.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-deps
- dependency-name: "@tiptap/extension-placeholder"
  dependency-version: 3.30.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-deps
- dependency-name: "@tiptap/react"
  dependency-version: 3.30.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-deps
- dependency-name: "@tiptap/starter-kit"
  dependency-version: 3.30.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-deps
- dependency-name: axios
  dependency-version: 1.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-deps
- dependency-name: dompurify
  dependency-version: 3.4.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: frontend-deps
- dependency-name: i18next
  dependency-version: 26.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-deps
- dependency-name: lucide-react
  dependency-version: 1.34.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-deps
- dependency-name: react
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: frontend-deps
- dependency-name: "@types/react"
  dependency-version: 19.2.18
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: frontend-deps
- dependency-name: react-dom
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: frontend-deps
- dependency-name: "@types/react-dom"
  dependency-version: 19.2.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: frontend-deps
- dependency-name: react-grid-layout
  dependency-version: 2.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: frontend-deps
- dependency-name: react-i18next
  dependency-version: 17.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: frontend-deps
- dependency-name: react-router-dom
  dependency-version: 7.18.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: frontend-deps
- dependency-name: recharts
  dependency-version: 3.10.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-deps
- dependency-name: zustand
  dependency-version: 5.0.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: frontend-deps
- dependency-name: "@types/node"
  dependency-version: 26.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: frontend-deps
- dependency-name: "@types/react"
  dependency-version: 19.2.18
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: frontend-deps
- dependency-name: "@types/react-dom"
  dependency-version: 19.2.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: frontend-deps
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: frontend-deps
- dependency-name: vite
  dependency-version: 8.2.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: frontend-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 1, 2026
WolfTasks pushed a commit that referenced this pull request Sep 6, 2026
…26-14456)

The backend-docker Trivy gate blocks on CVE-2026-14456 (HIGH) in openssl
and libssl3 3.5.7-r0, shipped by the eclipse-temurin Alpine base layer.
Alpine already ships the patched 3.5.8-r0, so extend the existing
`apk upgrade` line rather than chasing a new base-image digest.

Verified by building the image locally:
  before: openssl-3.5.7-r0 / libssl3-3.5.7-r0
  after:  openssl-3.5.8-r0 / libssl3-3.5.8-r0

Pre-existing failure, not introduced by the tomcat bump — backend-docker
was already red on PRs #118 and #120.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
WolfTasks pushed a commit that referenced this pull request Sep 6, 2026
…GH CVEs)

The frontend-docker Trivy gate blocks on nine HIGH CVEs in the nginx
Alpine base layer:

  libuuid   2.42.1-r0 -> 2.42.3-r1  CVE-2026-78408/78409/78410, -76642,
                                    CVE-2026-53612/53613/53614
  libssl3   3.5.7-r0  -> 3.5.8-r0   CVE-2026-14456
  libcrypto3 3.5.7-r0 -> 3.5.8-r0   CVE-2026-14456

CVE-2026-14456 is the same openssl flaw already patched in
backend/Dockerfile; Alpine names the packages differently in the nginx
image (libcrypto3 rather than openssl).

Extends the existing `apk upgrade` line, consistent with the libexpat /
c-ares / curl entries already there.

This gate was previously masked: frontend-docker depends on
frontend-build, which was failing on the nanoid advisory, so the job was
skipped rather than run. It was already red on PR #118.

Verified by running the exact apk upgrade line against the pinned base
image digest — all targets reached (libuuid resolves to 2.42.3-r1, newer
than the 2.42.3-r0 named in the advisories).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
WolfTasks added a commit that referenced this pull request Sep 6, 2026
…locks nightly + CI) (#123)

* fix(security): bump tomcat-embed 10.1.55 -> 10.1.59 (3 CRITICAL CVEs)

Nightly Trivy scan has been failing since 2026-09-03 on three CRITICAL
auth-bypass CVEs in org.apache.tomcat.embed:tomcat-embed-core 10.1.55:

  CVE-2026-68525  FORM authentication bypass -> unauthorized resource access
  CVE-2026-65905  DIGEST authenticator replay -> authentication bypass
  CVE-2026-65182  security constraint bypass (improper access control)

tomcat-embed-core is transitive-only (Spring Boot BOM -> starter-tomcat),
so Dependabot's direct-only security update could not patch it and failed
with security_update_dependency_not_found. Spring Boot 3.5.16 is already
the latest 3.5.x and still pins 10.1.55, so a BOM property override is the
fix -- same pattern as the existing jackson/logback/postgresql overrides.

The advisories name 10.1.58 as the fixed version, but that release was
never published to Maven Central (404); 10.1.59 is the first available
release carrying the fixes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(ci): upgrade openssl/libssl3 to 3.5.8-r0 in backend image (CVE-2026-14456)

The backend-docker Trivy gate blocks on CVE-2026-14456 (HIGH) in openssl
and libssl3 3.5.7-r0, shipped by the eclipse-temurin Alpine base layer.
Alpine already ships the patched 3.5.8-r0, so extend the existing
`apk upgrade` line rather than chasing a new base-image digest.

Verified by building the image locally:
  before: openssl-3.5.7-r0 / libssl3-3.5.7-r0
  after:  openssl-3.5.8-r0 / libssl3-3.5.8-r0

Pre-existing failure, not introduced by the tomcat bump — backend-docker
was already red on PRs #118 and #120.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(ci): bump nanoid 3.3.16 -> 3.3.18 (GHSA-2v37-7h3g-55p8)

The frontend npm-audit gate blocks on GHSA-2v37-7h3g-55p8 (high): custom
generators can loop indefinitely when size is zero. nanoid is a dev-only
transitive of postcss (`^3.3.12`), so the 3.3.18 patch fits the existing
range — no postcss major bump needed.

`node .github/scripts/audit-gate.mjs` passes locally and `npm run build`
is green.

Also normalises a pre-existing drift: package-lock.json still carried
project version 1.0.13 while package.json is at 1.0.15 (the v1.0.15
release bumped package.json only). package.json itself is untouched.

Pre-existing failure, not introduced by the tomcat bump — frontend-build
was already red on PR #120.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(ci): upgrade libssl3/libcrypto3 + libuuid in frontend image (9 HIGH CVEs)

The frontend-docker Trivy gate blocks on nine HIGH CVEs in the nginx
Alpine base layer:

  libuuid   2.42.1-r0 -> 2.42.3-r1  CVE-2026-78408/78409/78410, -76642,
                                    CVE-2026-53612/53613/53614
  libssl3   3.5.7-r0  -> 3.5.8-r0   CVE-2026-14456
  libcrypto3 3.5.7-r0 -> 3.5.8-r0   CVE-2026-14456

CVE-2026-14456 is the same openssl flaw already patched in
backend/Dockerfile; Alpine names the packages differently in the nginx
image (libcrypto3 rather than openssl).

Extends the existing `apk upgrade` line, consistent with the libexpat /
c-ares / curl entries already there.

This gate was previously masked: frontend-docker depends on
frontend-build, which was failing on the nanoid advisory, so the job was
skipped rather than run. It was already red on PR #118.

Verified by running the exact apk upgrade line against the pinned base
image digest — all targets reached (libuuid resolves to 2.42.3-r1, newer
than the 2.42.3-r0 named in the advisories).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

---------

Co-authored-by: Wolfgang Kozian <kozian.wolfgang@gmail.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
@dependabot @github

dependabot Bot commented on behalf of github Sep 6, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 6, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/frontend/frontend-deps-b2fec619b8 branch September 6, 2026 01:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants