deps(deps): bump the minor-and-patch group with 36 updates

[dependabot]

Bumps the minor-and-patch group with 36 updates:

Package	From	To
@noriginmedia/norigin-spatial-navigation	3.1.0	3.2.1
@radix-ui/react-dialog	1.1.15	1.1.18
@radix-ui/react-dropdown-menu	2.1.16	2.1.19
@radix-ui/react-progress	1.1.8	1.1.11
@radix-ui/react-scroll-area	1.2.10	1.2.13
@radix-ui/react-separator	1.1.8	1.1.11
@radix-ui/react-slider	1.3.6	1.4.2
@radix-ui/react-slot	1.2.4	1.3.0
@radix-ui/react-tabs	1.1.13	1.1.16
@radix-ui/react-toast	1.2.15	1.2.18
@radix-ui/react-tooltip	1.2.8	1.2.11
@supabase/supabase-js	2.99.3	2.110.0
framer-motion	12.38.0	12.42.2
imapflow	1.3.6	1.4.6
ioredis	5.10.1	5.11.1
isomorphic-dompurify	3.12.0	3.18.0
lucide-react	1.14.0	1.23.0
mailparser	3.9.9	3.9.14
next	16.2.4	16.2.10
openai	6.36.0	6.45.0
posthog-js	1.381.0	1.396.8
react	19.2.5	19.2.7
@types/react	19.2.14	19.2.17
react-dom	19.2.5	19.2.7
resend	6.12.2	6.17.1
tailwind-merge	3.5.0	3.6.0
video.js	8.23.7	8.23.9
@playwright/test	1.60.0	1.61.1
@tailwindcss/postcss	4.2.4	4.3.2
@types/jsdom	28.0.0	28.0.3
@vitest/coverage-v8	4.1.8	4.1.10
eslint-config-next	16.2.4	16.2.10
postcss	8.5.14	8.5.16
tailwindcss	4.2.4	4.3.2
tsx	4.21.0	4.23.0
vitest	4.1.8	4.1.10

Updates @noriginmedia/norigin-spatial-navigation from 3.1.0 to 3.2.1

Release notes

Sourced from @​noriginmedia/norigin-spatial-navigation's releases.

@​noriginmedia/norigin-spatial-navigation-react@​3.2.1

Patch Changes

• 54353b0: - Add nextFocusResolver to override default behavior
• Updated dependencies [54353b0]
• Updated dependencies [54353b0]
• Updated dependencies [54353b0]
  • @​noriginmedia/norigin-spatial-navigation-core@​4.0.0

@​noriginmedia/norigin-spatial-navigation@​3.2.1

Patch Changes

• Updated dependencies [54353b0]
• Updated dependencies [54353b0]
• Updated dependencies [54353b0]
  • @​noriginmedia/norigin-spatial-navigation-core@​4.0.0
  • @​noriginmedia/norigin-spatial-navigation-react@​3.2.1

@​noriginmedia/norigin-spatial-navigation-core@​3.2.0

Minor Changes

• a18ed66: Add focusOnPresetKey init option (default true) to control whether a component is automatically focused when it is added and its focus key was already set as the current focus key (e.g. setFocus was called before the component mounted). Set it to false to disable this implicit refocus on add.

@​noriginmedia/norigin-spatial-navigation-react@​3.2.0

Minor Changes

• a18ed66: Add focusOnPresetKey init option (default true) to control whether a component is automatically focused when it is added and its focus key was already set as the current focus key (e.g. setFocus was called before the component mounted). Set it to false to disable this implicit refocus on add.

Patch Changes

• Updated dependencies [a18ed66]
  • @​noriginmedia/norigin-spatial-navigation-core@​3.2.0

@​noriginmedia/norigin-spatial-navigation@​3.2.0

Minor Changes

• a18ed66: Add focusOnPresetKey init option (default true) to control whether a component is automatically focused when it is added and its focus key was already set as the current focus key (e.g. setFocus was called before the component mounted). Set it to false to disable this implicit refocus on add.

Patch Changes

• Updated dependencies [a18ed66]
  • @​noriginmedia/norigin-spatial-navigation-core@​3.2.0
  • @​noriginmedia/norigin-spatial-navigation-react@​3.2.0

Commits

• 58b5da0 ci: Release Packages (#240)
• 54353b0 React Native TV support (#239)
• 2a0924b ci: Release Packages (#237)
• a18ed66 feat: configurable focus-on-preset-key behavior + CLAUDE.md (#236)
• 02f652b Update README.md to use latest logos (#232)
• dd47d22 Added SKILL.md for agents to use this library (#229)
• See full diff in compare view

Updates @radix-ui/react-dialog from 1.1.15 to 1.1.18

Changelog

Sourced from @​radix-ui/react-dialog's changelog.

1.1.18

• Updated dependencies: @radix-ui/react-primitive@2.1.7, @radix-ui/react-dismissable-layer@1.1.14, @radix-ui/react-focus-scope@1.1.11, @radix-ui/react-portal@1.1.13

1.1.17

• Removed dev-only warnings for dialogs when title and/or description is not rendered.
• Fixed Dismissable Layer so outside interactions stopped by extension UI overlays do not dismiss dialogs or popovers.
• Updated dependencies: @radix-ui/react-slot@1.3.0, @radix-ui/react-dismissable-layer@1.1.13, @radix-ui/react-primitive@2.1.6, @radix-ui/react-focus-scope@1.1.10, @radix-ui/react-portal@1.1.12

1.1.16

• Fixed disabled pointer events in closed dialogs
• Fixed a bug where iOS text selection and editing on HTML inputs within react-dialog were broken
• Fixed triggers referencing a non-existent element via aria-controls when their content is removed from the DOM (credit to @​dodomorandi for the original PR)
• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/react-presence@1.1.6, @radix-ui/react-slot@1.2.5, @radix-ui/react-focus-guards@1.1.4, @radix-ui/react-dismissable-layer@1.1.12, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-focus-scope@1.1.9, @radix-ui/react-id@1.1.2, @radix-ui/react-portal@1.1.11, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-controllable-state@1.2.3

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-dialog since your current version.

Updates @radix-ui/react-dropdown-menu from 2.1.16 to 2.1.19

Changelog

Sourced from @​radix-ui/react-dropdown-menu's changelog.

2.1.19

• Fixed infinite re-render loop in React 19 caused by unstable composed ref callback references.

Other updates

• Updated dependencies: @radix-ui/react-primitive@2.1.7, @radix-ui/react-menu@2.1.19

2.1.18

• Fixed a bug where menus and submenus remained open after a window loses focus.
• Updated dependencies: @radix-ui/react-menu@2.1.18, @radix-ui/react-primitive@2.1.6

2.1.17

• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/react-menu@2.1.17, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-id@1.1.2, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-controllable-state@1.2.3

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-dropdown-menu since your current version.

Updates @radix-ui/react-progress from 1.1.8 to 1.1.11

Changelog

Sourced from @​radix-ui/react-progress's changelog.

1.1.11

• Updated dependencies: @radix-ui/react-primitive@2.1.7

1.1.10

• Updated dependencies: @radix-ui/react-primitive@2.1.6

1.1.9

• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/react-context@1.1.4, @radix-ui/react-primitive@2.1.5

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-progress since your current version.

Updates @radix-ui/react-scroll-area from 1.2.10 to 1.2.13

Changelog

Sourced from @​radix-ui/react-scroll-area's changelog.

1.2.13

• Fixed infinite re-render loop in React 19 caused by unstable composed ref callback references.

Other updates

• Updated dependencies: @radix-ui/react-primitive@2.1.7

1.2.12

• Stabilized the viewport style tag unless the nonce changes.
• Fixed Duplicate index signature errors that surfaced when consuming multiple packages together.
• Updated dependencies: @radix-ui/react-primitive@2.1.6

1.2.11

• Fixed missing data-state attribute for Scroll Area scrollbars
• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/react-presence@1.1.6, @radix-ui/react-direction@1.1.2, @radix-ui/number@1.1.2, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-callback-ref@1.1.2, @radix-ui/react-use-layout-effect@1.1.2

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-scroll-area since your current version.

Updates @radix-ui/react-separator from 1.1.8 to 1.1.11

Changelog

Sourced from @​radix-ui/react-separator's changelog.

1.1.11

• Updated dependencies: @radix-ui/react-primitive@2.1.7

1.1.10

• Updated dependencies: @radix-ui/react-primitive@2.1.6

1.1.9

• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/react-primitive@2.1.5

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-separator since your current version.

Updates @radix-ui/react-slider from 1.3.6 to 1.4.2

Changelog

Sourced from @​radix-ui/react-slider's changelog.

1.4.2

• Fixed infinite re-render loop in React 19 caused by unstable composed ref callback references.

Other updates

• Updated dependencies: @radix-ui/react-primitive@2.1.7, @radix-ui/react-collection@1.1.11

1.4.1

• Fixed Duplicate index signature errors that surfaced when consuming multiple packages together.
• Updated dependencies: @radix-ui/react-primitive@2.1.6, @radix-ui/react-collection@1.1.10

1.4.0

• Added unstable ThumbProvider, ThumbTrigger, and BubbleInput parts to Slider. SliderThumb was previously a single component that implicitly rendered a hidden native input for form submission. It is now composed from these new parts, which are exposed so consumers can decouple the bubble input from the thumb (for example, to render or customize it independently) instead of relying on SliderThumb to render it implicitly. SliderThumb continues to render all three by default, so existing usage is unaffected.
• Added focusVisible for non-keyboard interactions with slider thumbs for progressively enabling styles using :focus-visible alongside programmatic focus management
• Fixed Slider focus bugs in scrollable context
• Fixed a Slider bug where very small step values made the thumbs unresponsive
• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/react-collection@1.1.9, @radix-ui/react-direction@1.1.2, @radix-ui/number@1.1.2, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-controllable-state@1.2.3, @radix-ui/react-use-layout-effect@1.1.2, @radix-ui/react-use-previous@1.1.2, @radix-ui/react-use-size@1.1.2

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-slider since your current version.

Updates @radix-ui/react-slot from 1.2.4 to 1.3.0

Changelog

Sourced from @​radix-ui/react-slot's changelog.

1.3.0

Added generic type arguments for SlotProps and createSlot

SlotProps and createSlot now accept generic type arguments to specify the type of element a slot should render, as well as its props.

const Slot = createSlot<HTMLButtonElement, MyCustomButtonProps>('Slot');

1.2.5

• Fixed infinite re-render loop in React 19 caused by Slot creating a new ref callback on every render
• Added support for nested Slottable via a render prop, so a slotted element can be wrapped while still merging Slot props and refs onto it
• Added repository.directory to all package.json files
• Improved error messages for invalid slot children
• Updated dependencies: @radix-ui/react-compose-refs@1.1.3

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-slot since your current version.

Updates @radix-ui/react-tabs from 1.1.13 to 1.1.16

Changelog

Sourced from @​radix-ui/react-tabs's changelog.

1.1.16

• Updated dependencies: @radix-ui/react-primitive@2.1.7, @radix-ui/react-roving-focus@1.1.14

1.1.15

• Updated dependencies: @radix-ui/react-primitive@2.1.6, @radix-ui/react-roving-focus@1.1.13

1.1.14

• Fixed triggers referencing a non-existent element via aria-controls when their content is removed from the DOM (credit to @​dodomorandi for the original PR)
• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/react-presence@1.1.6, @radix-ui/react-direction@1.1.2, @radix-ui/primitive@1.1.4, @radix-ui/react-context@1.1.4, @radix-ui/react-id@1.1.2, @radix-ui/react-primitive@2.1.5, @radix-ui/react-roving-focus@1.1.12, @radix-ui/react-use-controllable-state@1.2.3

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-tabs since your current version.

Updates @radix-ui/react-toast from 1.2.15 to 1.2.18

Changelog

Sourced from @​radix-ui/react-toast's changelog.

1.2.18

• Fixed infinite re-render loop in React 19 caused by unstable composed ref callback references.
• Cleared the close timer on unmount to prevent memory leaks and errors in test environments
• Updated dependencies: @radix-ui/react-primitive@2.1.7, @radix-ui/react-dismissable-layer@1.1.14, @radix-ui/react-collection@1.1.11, @radix-ui/react-portal@1.1.13, @radix-ui/react-visually-hidden@1.2.7

1.2.17

• Updated dependencies: @radix-ui/react-dismissable-layer@1.1.13, @radix-ui/react-primitive@2.1.6, @radix-ui/react-collection@1.1.10, @radix-ui/react-portal@1.1.12, @radix-ui/react-visually-hidden@1.2.6

1.2.16

• Allow to specify container for ToastAnnounce
• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/react-presence@1.1.6, @radix-ui/react-dismissable-layer@1.1.12, @radix-ui/react-collection@1.1.9, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-portal@1.1.11, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-callback-ref@1.1.2, @radix-ui/react-use-controllable-state@1.2.3, @radix-ui/react-use-layout-effect@1.1.2, @radix-ui/react-visually-hidden@1.2.5

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-toast since your current version.

Updates @radix-ui/react-tooltip from 1.2.8 to 1.2.11

Changelog

Sourced from @​radix-ui/react-tooltip's changelog.

1.2.11

• Updated dependencies: @radix-ui/react-primitive@2.1.7, @radix-ui/react-dismissable-layer@1.1.14, @radix-ui/react-popper@1.3.2, @radix-ui/react-portal@1.1.13, @radix-ui/react-visually-hidden@1.2.7

1.2.10

• Updated dependencies: @radix-ui/react-slot@1.3.0, @radix-ui/react-popper@1.3.1, @radix-ui/react-dismissable-layer@1.1.13, @radix-ui/react-primitive@2.1.6, @radix-ui/react-portal@1.1.12, @radix-ui/react-visually-hidden@1.2.6

1.2.9

• Fixed runtime error when event target is non-Node
• Fixed a Tooltip bug so that skipDelayDuration={0} works as expected. Previously, the open delay could still be skipped when moving between triggers.
• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/react-presence@1.1.6, @radix-ui/react-popper@1.3.0, @radix-ui/react-slot@1.2.5, @radix-ui/react-dismissable-layer@1.1.12, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-id@1.1.2, @radix-ui/react-portal@1.1.11, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-controllable-state@1.2.3, @radix-ui/react-visually-hidden@1.2.5

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-tooltip since your current version.

Updates @supabase/supabase-js from 2.99.3 to 2.110.0

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.110.0

2.110.0 (2026-06-30)

🚀 Features

• repo: drop Node.js 20 support (#2482)

❤️ Thank You

• Katerina Skroumpelou @​mandarini

v2.110.0-canary.0

2.110.0-canary.0 (2026-06-30)

🚀 Features

• repo: drop Node.js 20 support (#2482)

❤️ Thank You

• Katerina Skroumpelou @​mandarini

v2.109.0

2.109.0 (2026-06-30)

🚀 Features

• auth: add custom_claims_allowlist to custom providers admin API (#2473)
• realtime: add postgres_changes filter builder, new operators and select (#2463)
• storage: expose purgeCache for buckets and single objects (#2429)

🩹 Fixes

• functions: honor a caller's Content-Type override regardless of casing (#2455)
• realtime: pin @​supabase/phoenix and browser test CDN deps (#2457)
• realtime: add replication connection system message option (#2470)
• storage: keep sortBy defaults when list() is given a partial sortBy (#2454)

❤️ Thank You

• Anubhav Anand @​i-anubhav-anand
• Cemal Kılıç @​cemalkilic
• Claude Opus 4.8 (1M context)
• Filipe Cabaço @​filipecabaco
• Katerina Skroumpelou @​mandarini
• Lenny
• Rodrigo Mansueli @​mansueli

v2.108.3-canary.2

2.108.3-canary.2 (2026-06-19)

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.110.0 (2026-06-30)

🚀 Features

• repo: drop Node.js 20 support (#2482)

❤️ Thank You

• Katerina Skroumpelou @​mandarini

2.109.0 (2026-06-30)

🩹 Fixes

• realtime: pin @​supabase/phoenix and browser test CDN deps (#2457)

❤️ Thank You

• Katerina Skroumpelou @​mandarini

2.108.2 (2026-06-15)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.108.0 (2026-06-08)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.107.0 (2026-06-02)

🚀 Features

• auth: remove navigator.locks-based mutex; introduce commit guard + dispose() (#2392)
• supabase: update X-Client-Info to structured metadata format (#2359)
• realtime: allow httpSend to send binary payload (#2400)

❤️ Thank You

• Claude Sonnet 4.6
• Eduardo Gurgel
• Guilherme Souza
• Katerina Skroumpelou @​mandarini
• Omar Al Matar @​Bewinxed

2.106.2 (2026-05-25)

🩹 Fixes

• misc: add react-native export condition for Hermes-safe resolution (#2393)

... (truncated)

Commits

• c3d5e6d feat(repo): drop Node.js 20 support (#2482)
• b2e02b9 chore(release): version 2.109.0 changelogs (#2481)
• dd2d4c2 fix(realtime): pin @​supabase/phoenix and browser test CDN deps (#2457)
• a25062e chore(release): version 2.108.2 changelogs (#2449)
• b3e5f2d chore(ci): unpin realtime version (#2432)
• 76f3f02 test(auth): add passkey unit and e2e coverage (#2442)
• 65fafe5 chore(release): version 2.108.0 changelogs (#2433)
• 57014e1 chore(release): version 2.107.0 changelogs (#2421)
• 54ec2b6 feat(auth): remove navigator.locks-based mutex; introduce commit guard + disp...
• 3397c92 feat(supabase): update X-Client-Info to structured metadata format (#2359)
• Additional commits viewable in compare view

Updates framer-motion from 12.38.0 to 12.42.2

Changelog

Sourced from framer-motion's changelog.

[12.42.2] 2026-07-01

Fixed

• animateView: Cropped group layers now animate border-radius from the old to new radius.

[12.42.1] 2026-06-30

Fixed

• animateView: Old layer fade out now cancelled when defining .new().

[12.42.0] 2026-06-24

Changed

• animateView: Layers are automatically grouped to match their DOM-hierarchy. New .group(false) method opts-out.

Fixed

• animateView: Auto-crop is now aspect-ratio aware, disabling crops for matching aspect-ratios.
• animateView: Disabled automatic border-radius animation.

[12.41.0] 2026-06-23

Added

• animateView: Moves from Motion+ Early Access and alpha to main library.
• animateView: .add() resolves a CSS selector or Element to automatically generate, apply and remove view-transition-name.
• animateView: .new() and .old() configures values to animate on new and old layers.
• animateView: .layout() can set a custom transition on the size/position animation of the currently selected elements.
• animateView: Group layers now automatically crop with children set to cover, with border-radius animating from old radius to new. .crop(false) disables this behaviour.
• animateView: .class(name) tags currently selected elements with a view-transition-class as a custom CSS hook.

Fixed

• AnimatePresence: Prevent stuck exit animations when children interrupt.
• drag: Child e.stopPropagation() no longer break drag end.
• Fixing Next.js OOM on Windows when importing via motion package.
• animateLayout: Improve handling of parallel/interleaved calls.

Changed

• animateView: .enter() and .exit() now refer specifically to new and old layers where there are no matching old or new layers.
• animateView: Interrupted transition setups now return resolved animation rather than throwing.

[12.40.0] 2026-05-21

Added

... (truncated)

Commits

• 40e8756 v12.42.2
• 718ccc7 Merge pull request #3768 from motiondivision/view-cropped-corner-radius
• 19195a4 Dedupe corner-radius longhands; merge crop box/radii measurements
• 5299aa6 Resolve cropped-clip radius timing once; fix transition-option leak
• 937cdf3 Animate cropped view-transition group corner radius
• fd2d6f6 v12.42.1
• 2223d87 Hold the old layer when only a non-opacity .new() is set
• 9c84145 v12.42.0
• 60d7c72 Add view-transition group nesting and aspect-aware cropping
• 6437276 Updating
• Additional commits viewable in compare view

Updates imapflow from 1.3.6 to 1.4.6

Changelog

Sourced from imapflow's changelog.

1.4.6 (2026-07-05)

Bug Fixes

• update dependencies (@​zone-eu/mailsplit 5.4.14) (e977b7d)

1.4.5 (2026-07-05)

Bug Fixes

• update dependencies (libmime 5.4.1) (2e8fa0e)

1.4.4 (2026-07-05)

Bug Fixes

• update dependencies (nodemailer 9.0.3, iconv-lite 0.7.3) (1faf7e8)

1.4.3 (2026-06-26)

Bug Fixes

• update dependencies (libmime 5.4.0, mailsplit 5.4.13) (ae175eb)

1.4.2 (2026-06-19)

Bug Fixes

• bump nodemailer to 9.0.1 (9c46aa9)

1.4.1 (2026-06-15)

Bug Fixes

• ship refreshed dependencies (nodemailer 9, updated toolchain) (e1d36e6)

1.4.0 (2026-06-09)

Features

• add Gmail label search term to the search compiler (4b2d173)

1.3.7 (2026-06-08)

... (truncated)

Commits

• 376bcbd chore(master): release 1.4.6 [skip-ci] (#365)
• e977b7d fix: update dependencies (@​zone-eu/mailsplit 5.4.14)
• ce541bb chore(master): release 1.4.5 [skip-ci] (#364)
• 2e8fa0e fix: update dependencies (libmime 5.4.1)
• 2f27b29 chore(master): release 1.4.4 [skip-ci] (#363)
• 1faf7e8 fix: update dependencies (nodemailer 9.0.3, iconv-lite 0.7.3)
• 57cffd4 chore(master): release 1.4.3 [skip-ci] (#362)
• ae175eb fix: update dependencies (libmime 5.4.0, mailsplit 5.4.13)
• 03f6831 chore(master): release 1.4.2 [skip-ci] (#361)
• 9c46aa9 fix: bump nodemailer to 9.0.1
• Additional commits viewable in compare view

Updates ioredis from 5.10.1 to 5.11.1

Release notes

Sourced from ioredis's releases.

v5.11.1

5.11.1 (2026-06-04)

Bug Fixes

• cluster: reconnect to nodes that restart without slot changes (#2096) (c84b2ee)
• parse protocol-relative Redis URLs as TCP connections (#2125) (131ee24)

v5.11.0

5.11.0 (2026-05-26)

Bug Fixes

• prevent RangeError from string accumulation in pipeline (#2088) (defc077)
• replace deprecated url.parse() with WHATWG URL API (#2081) (0021a45), closes redis/ioredis#1747

Features

• add array commands, typings and tests (#2114) (baf68d6)
• add increx command (#2115) (37d0695)
• add Redis MSETEX support (#2111) (04a4615)
• add typed GCRA command support and functional tests (#2094) (468a802)
• add vector set command support (#2116) (b7b3def)
• Add xnack command (#2103) (187d29b)
• Add zinter zunion count (#2104) (0d510bb)
• Implement TracingChannel support (#2089) (4760e0a)

Changelog

Sourced from ioredis's changelog.

5.11.1 (2026-06-04)

Bug Fixes

• cluster: reconnect to nodes that restart without slot changes (#2096) (c84b2ee)
• parse protocol-relative Redis URLs as TCP connections (#2125) (131ee24)

5.11.0 (2026-05-26)

Bug Fixes

• prevent RangeError from string accumulation in pipeline (#2088) (defc077)
• replace deprecated url.parse() with WHATWG URL API (#2081) (0021a45), closes redis/ioredis#1747

Features

• add array commands, typings and tests (#2114) (baf68d6)
• add increx command (#2115) (37d0695)
• add Redis MSETEX support (#2111) (04a4615)
• add typed GCRA command support and functional tests (#2094) (468a802)
• add vector set command support (#2116) (b7b3def)
• Add xnack command (#2103) (187d29b)
• Add zinter zunion count (#2104) (0d510bb)
• Implement TracingChannel support (#2089) (4760e0a)

Commits

• fb224a7 chore(release): 5.11.1 [skip ci]
• 131ee24 fix: parse protocol-relative Redis URLs as TCP connections (#2125)
• c84b2ee fix(cluster): reconnect to nodes that restart without slot changes (#2096)
• 1490432 chore(release): 5.11.0 [skip ci]
• 5359d4d refactor(utils): inline defaults and isArguments helpers (#2107)
• b7b3def feat: add vector set command support (#2116)
• faa53fd ci: update Node.js and Redis test matrix (#2119)
• 37d0695 feat: add increx command (#2115)
• 612ee9d chore: update Redis 8.8 test image to custom (#2118)
• baf68d6 feat: add array commands, typings and tests (#2114)
• Additional commits viewable in compare view

Updates isomorphic-dompurify from 3.12.0 to 3.18.0

Release notes

Sourced from isomorphic-dompurify's releases.

3.18.0: Updated dependencies

• dompurify 3.4.10 -> 3.4.11
• vitest 4.1.8 -> 4.1.9
• pnpm/action-setup 6 -> 6.0.8

3.17.0: Updated dependencies

• dompurify 3.4.8 -> 3.4.10
• @​biomejs/biome 2.4.16 -> 2.5.0
• pnpm 11.4.0 -> 11.6.0

3.16.0: Updated dependencies

• dompurify 3.4.7 -> 3.4.8
• vitest 4.1.7 -> 4.1.8
• lefthook 2.1.8 -> 2.1.9

3.15.0: Updated dependencies

• dompurify 3.4.5 -> 3.4.7
• @​biomejs/biome 2.4.15 -> 2.4.16
• vitest 4.1.6 -> 4.1.7
• packageManager pnpm 11.1.3 -> 11.4.0

3.14.0: Updated dependencies

What's Changed

• chore(deps): bump dompurify from 3.4.3 to 3.4.5 by @​dependabot[bot]
• chore: Allowed esbuild and disallowed lefthook for ci.
• chore: Added homepage URL to package.json.

Full Changelog: kkomelin/isomorphic-dompurify@3.13.0...3.14.0

3.13.0: Updated dependencies

What's Changed

• chore(deps-dev): bump vitest from 4.1.5 to 4.1.6 by @​dependabot[bot] in kkomelin/isomorphic-dompurify#435
• chore(deps-dev): bump @​types/jsdom from 28.0.1 to 28.0.3 by @​dependabot[bot] in kkomelin/isomorphic-dompurify#436
• chore(deps-dev): bump @​biomejs/biome from 2.4.14 to 2.4.15 by @​dependabot[bot] in kkomelin/isomorphic-dompurify#434
• chore(deps): bump dompurify from 3.4.2 to 3.4.3 by @​dependabot[bot] in kkomelin/isomorphic-dompurify#437

Full Changelog: kkomelin/isomorphic-dompurify@3.12.0...3.13.0

Commits

• 1d5745c chore: release v3.18.0
• e1202c5 chore(deps): bump dompurify from 3.4.10 to 3.4.11
• ab9cc6b chore(deps-dev): bump vitest from 4.1.8 to 4.1.9
• 60491d6 chore(deps): bump pnpm/action-setup from 6 to 6.0.8
• 4b0f0db chore: Updated dependencies.
• 1e537bd chore(deps): bump dompurify from 3.4.8 to 3.4.9
• bee551b chore: Bump version to 3.16.0 and update dependencies.
• e03b0c0 chore(deps): bump dompurify from 3.4.7 to 3.4.8
• 86abe8b chore(deps-dev): bump lefthook from 2.1.8 to 2.1.9
• 284831c chore(deps-dev): bump vitest from 4.1.7 to 4.1.8
• Additional commits viewable in compare view

Updates lucide-react from 1.14.0 to 1.23.0

Release notes

Sourced from lucide-react's releases.

Version 1.23.0

What's Changed

• fix(docs): prevent scrollbar layout shift on icons page by @​g30r93g in lucide-icons/lucide#4500
• chore(docs): Remove certificates banner by @​ericfennis in lucide-icons/lucide#4504
• ci(repo-journal.yml): GH copilot repo summary by @​ericfennis in lucide-icons/lucide#4505
• ci(repo-journal.yml): Small fix in the workflow by @​ericfennis in lucide-icons/lucide#4508
• ci(repo-journal.yml): Switch to token by @​ericfennis in lucide-icons/lucide#4509
• feat(icons): added paper-bag icon by @​dkast in lucide-icons/lucide#4023

New Contributors

• @​g30r93g made their first contribution in lucide-icons/lucide#4500
• @​dkast made their first contribution in lucide-icons/lucide#4023

Full Changelog: lucide-icons/lucide@1.22.0...1.23.0

Version 1.22.0

What's Changed

• feat(icons): add 6 database variant icons by @​Barakudum in lucide-icons/lucide#4336
• ci(release.yml): Remove concurrency field to prevent release mess by @​ericfennis in lucide-icons/lucide#4485
• fix(docs): fix color input clipping by @​Hsiii in lucide-icons/lucide#4488
• docs(site): add Deno to installation instructions by @​bartlomieju in lucide-icons/lucide#4486
• chore(deps): bump esbuild from 0.25.12 to 0.28.1 by @​dependabot[bot] in lucide-icons/lucide#4459
• fix(docs): prevent private analytics token from blocking local dev by @​Hsiii in lucide-icons/lucide#4481
• docs(installation.md): Remove outdate next tag in installation by @​ericfennis in lucide-icons/lucide#4495
• fix(lucide-react-native): Fix context provider export by @​ericfennis in lucide-icons/lucide#4497
• fix(astro): add Astro v7 compatibility by @​iseraph-dev in

[dependabot]

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

vu1nz Security Review

0 finding(s) in PR #?

No security issues found.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	next@​16.2.10
	@​radix-ui/​react-separator@​1.1.11
	eslint-config-next@​16.2.10
	@​radix-ui/​react-progress@​1.1.11
	@​radix-ui/​react-slot@​1.2.3 ⏵ 1.3.0	+1		+1
	@​radix-ui/​react-tabs@​1.1.16
	@​radix-ui/​react-dialog@​1.1.18
	@​radix-ui/​react-dropdown-menu@​2.1.19
	@​radix-ui/​react-tooltip@​1.2.11
	@​radix-ui/​react-slider@​1.4.2
	@​radix-ui/​react-toast@​1.2.18
	@​radix-ui/​react-scroll-area@​1.2.13
	@​noriginmedia/​norigin-spatial-navigation@​3.2.1
	@​types/​jsdom@​28.0.3
	openai@​6.45.0
	@​types/​react@​19.2.17
	@​vitest/​coverage-v8@​4.1.10
	mailparser@​3.9.14
	lucide-react@​1.23.0
	postcss@​8.5.16
	tailwindcss@​4.3.2
	react@​19.2.7
	tailwind-merge@​3.6.0
	imapflow@​1.4.6
	react-dom@​19.2.7
	video.js@​8.23.9
	isomorphic-dompurify@​3.18.0
	framer-motion@​12.42.2
	resend@​6.17.1
	@​tailwindcss/​postcss@​4.3.2
	@​playwright/​test@​1.61.1
	posthog-js@​1.396.8
See 1 more rows in the dashboard

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @videojs/http-streaming is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/video.js@8.23.9 → npm/@videojs/http-streaming@3.17.5 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@videojs/http-streaming@3.17.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm @videojs/http-streaming is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/video.js@8.23.9 → npm/@videojs/http-streaming@3.17.5 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@videojs/http-streaming@3.17.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm @videojs/vhs-utils is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/video.js@8.23.9 → npm/@videojs/vhs-utils@4.1.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@videojs/vhs-utils@4.1.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Publisher changed: npm @videojs/vhs-utils is now published by essk Author: essk From: pnpm-lock.yaml → npm/video.js@8.23.9 → npm/@videojs/vhs-utils@4.1.2 ℹ Read more on: This package | This alert | What is unstable ownership? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@videojs/vhs-utils@4.1.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @zone-eu/mailsplit under EUPL-1.2 License: EUPL-1.2 - The applicable license policy does not permit this license (5) (package/LICENSE.EUPL-1.2) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/LICENSE.EUPL-1.2) License: EUPL-1.1+ - This license classifier is not allowed by the applicable policy (package/package.json) From: pnpm-lock.yaml → npm/mailparser@3.9.14 → npm/imapflow@1.4.6 → npm/@zone-eu/mailsplit@5.4.14 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@zone-eu/mailsplit@5.4.14. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Publisher changed: npm mpd-parser is now published by essk Author: essk From: pnpm-lock.yaml → npm/video.js@8.23.9 → npm/mpd-parser@1.4.0 ℹ Read more on: This package | This alert | What is unstable ownership? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/mpd-parser@1.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm playwright-core under ms-azure-data-studio License: ms-azure-data-studio - The applicable license policy does not permit this license (5) (package/ThirdPartyNotices.txt) From: pnpm-lock.yaml → npm/@playwright/test@1.61.1 → npm/playwright-core@1.61.1 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/playwright-core@1.61.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm playwright under ms-azure-data-studio License: ms-azure-data-studio - The applicable license policy does not permit this license (5) (package/ThirdPartyNotices.txt) From: pnpm-lock.yaml → npm/@playwright/test@1.61.1 → npm/playwright@1.61.1 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/playwright@1.61.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm rollup under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/LICENSE.md) From: pnpm-lock.yaml → npm/@vitejs/plugin-react@5.1.4 → npm/vitest@4.1.10 → npm/rollup@4.62.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rollup@4.62.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm node-exports-info Location: Package overview From: pnpm-lock.yaml → npm/eslint-config-next@16.2.10 → npm/node-exports-info@1.6.2 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/node-exports-info@1.6.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report