Skip to content

Bump the npm group across 1 directory with 30 updates - #27

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/platform/npm-21c0fb6e21
Open

Bump the npm group across 1 directory with 30 updates#27
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/platform/npm-21c0fb6e21

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 7, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm group with 30 updates in the /platform directory:

Package From To
@inertiajs/svelte 3.9.1 3.11.0
@lucide/svelte 1.55.0 1.68.0
@rails/activestorage 8.1.400 8.1.401
@sentry/browser 11.8.0 11.10.0
@tailwindcss/vite 4.3.3 4.3.4
@tiptap/core 3.32.0 3.32.2
@tiptap/extension-heading 3.32.0 3.32.2
@tiptap/extension-image 3.32.0 3.32.2
@tiptap/extensions 3.32.0 3.32.2
@tiptap/markdown 3.32.0 3.32.2
@tiptap/pm 3.32.0 3.32.2
@tiptap/starter-kit 3.32.0 3.32.2
bits-ui 2.19.5 2.20.4
d3-scale 4.0.2 4.0.3
d3-shape 3.2.0 3.2.1
hast-util-to-html 9.0.5 9.0.6
layerchart 2.7.0 2.9.2
marked 18.1.1 18.1.3
node-datachannel 0.33.4 0.33.6
svelte 5.57.2 5.57.3
svelte-sonner 1.2.1 1.2.3
tailwindcss 4.3.3 4.3.4
three 0.184.0 0.187.0
@types/three 0.184.1 0.187.0
@slack/socket-mode 3.1.0 3.1.1
@types/dompurify 3.0.5 3.2.0
@types/node 26.6.5 26.6.6
@types/three 0.184.1 0.187.0
svelte-check 4.7.6 4.7.8
vite 8.3.4 8.3.5
vite-plugin-ruby 5.2.5 5.2.6

Updates @inertiajs/svelte from 3.9.1 to 3.11.0

Release notes

Sourced from @​inertiajs/svelte's releases.

v3.11.0

What's Changed

Full Changelog: inertiajs/inertia@v3.10.0...v3.11.0

v3.10.0

What's Changed

New Contributors

Full Changelog: inertiajs/inertia@v3.9.1...v3.10.0

Changelog

Sourced from @​inertiajs/svelte's changelog.

v3.11.0 - 2026-11-02

What's Changed

Full Changelog: inertiajs/inertia@v3.10.0...v3.11.0

v3.10.0 - 2026-10-30

What's Changed

New Contributors

Full Changelog: inertiajs/inertia@v3.9.1...v3.10.0

Commits
  • f312557 v3.11.0
  • bc9c48c [3.x] Support for Live props (#3232)
  • e3b7502 v3.10.0
  • c00d476 [3.x] Accept a nullish remember key in useForm (#3279)
  • 0a9be2d [3.x] Keep shared once props on instant visits (#3356)
  • ad93959 [3.x] Bump dependencies and drop SvelteKit from the Svelte adapter (#3365)
  • 346dd01 [3.x] Resolve relative Link and Form URLs against the current page (#3358)
  • 841a6a4 [3.x] Keep each useHttp request's AbortController, so cancel() and cancel tok...
  • d965e10 [3.x] Support the QUERY HTTP method (#3328)
  • 59e0ace [3.x] Interrupt visits served from the prefetch cache (#3360)
  • Additional commits viewable in compare view

Updates @lucide/svelte from 1.55.0 to 1.68.0

Release notes

Sourced from @​lucide/svelte's releases.

Version 1.68.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.67.0...1.68.0

Version 1.67.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.66.0...1.67.0

Version 1.66.0

What's Changed

... (truncated)

Commits
  • b196797 Update deps (#5146)
  • 7515e7c chore(deps): bump the svelte-deps group across 1 directory with 3 updates (#5...
  • 14cab02 feat(site): Add sponsor page (#5132)
  • e2c3360 chore(deps-dev): bump the testing-deps group across 1 directory with 4 update...
  • 6657faa chore(deps-dev): bump vite from 8.3.2 to 8.3.3 (#5052)
  • b85b552 chore(deps-dev): bump svelte-check (#5075)
  • 20aef31 chore(packages): Update sponsors (#5034)
  • 02eb916 feat(svelte): export __iconData and __iconNode across per-icon modules (#4936...
  • 27f0870 chore(deps-dev): bump the svelte-deps group across 1 directory with 2 updates...
  • af485d5 chore(deps-dev): bump the svelte-deps group with 2 updates (#4996)
  • See full diff in compare view

Updates @rails/activestorage from 8.1.400 to 8.1.401

Commits

Updates @sentry/browser from 11.8.0 to 11.10.0

Release notes

Sourced from @​sentry/browser's releases.

11.10.0

Important Changes

  • feat: Add a managed tunnel that the SDK derives from the DSN (#25199, #25200, #25783)

    Set tunnel: true in your browser Sentry.init call to send events through your own server. This helps when ad blockers block requests to Sentry. The browser derives the tunnel path from the DSN, so older and newer builds of your client and server always agree on the path.

    To serve the tunnel, add serveTunnelIntegration() to your server SDK. Astro, Nuxt, Nitro, React Router, Remix 3, SolidStart, SvelteKit and TanStack Start then answer tunnel requests automatically:

    // browser
Sentry.init({ dsn, tunnel: true });
// server
Sentry.init({ dsn, integrations: [Sentry.serveTunnelIntegration()] });

    If the browser uses a different DSN than the server, set serveTunnelIntegration({ allowedDsns: [browserDsn] }). For other setups, the server SDKs export handleTunnelRequestIfMatched, handleTunnelRequest, isTunnelRequest and getTunnelPath:

    app.use((req, res, next) => Sentry.handleTunnelRequestIfMatched(req, res) ?? next());

    The request option of handleTunnelRequest is deprecated and will be removed in v12.

  • feat: Make span origins spec compliant (#25602)

    Some span origins changed their names to follow the trace origin spec:

    • auto.amqplib.* is now auto.queue.amqplib.*, and auto.kafkajs.* is now auto.queue.kafkajs.*.
    • auto.vercelai.channel is now auto.ai.vercelai.
    • auto.firebase.firestore is now auto.db.firebase.firestore, and auto.firebase.functions is now auto.function.firebase.
    • auto.aws.aws_sdk is now auto.{rpc,db,queue,ai}.aws_sdk, with the category from the span op.
    • auto.aws_lambda is now auto.function.aws_serverless.
    • auto.mcp.notification is now auto.function.mcp_server.notification.
    • auto.db.cloudflare.durable_object.sql is now auto.db.cloudflare.durable_object_sql.
    • auto.http.browser.{lcp,cls,inp} is now auto.ui.browser.{lcp,cls,inp}.

    If you have ignoreSpans rules, queries or alerts on the old origins, change them to use the new origins.

  • feat(bun): Add incoming request options and request sessions to bunServerIntegration (#25580)

    bunServerIntegration now accepts the same options as denoServeIntegration: ignoreRequestBody, ignoreIncomingRequests, ignoreStaticAssets, spans, onSpanCreated, onSpanEnd, sessions and sessionFlushingDelayMS. The callbacks receive the web Request.

    Bun.serve now records a request session for each incoming request. Sessions are sent only when a release is set. To turn them off, set bunServerIntegration({ sessions: false }).

    ignoreStaticAssets defaults to true, so Bun.serve no longer creates spans for GET requests to common static assets such as favicon.ico, robots.txt or *.js files. To keep these spans, set bunServerIntegration({ ignoreStaticAssets: false }). Bun.serve spans also follow the client's tracing configuration by default, so the integration does not start spans when tracing is disabled. Errors thrown for OPTIONS and HEAD requests are now captured.

  • feat(bun): Inject debug IDs and upload source maps in sentryBunPlugin (#25670)

    sentryBunPlugin from @sentry/bun/plugin now accepts the same options as sentryEsbuildPlugin (org, project, authToken, release, sourcemaps, ...). When Bun.build writes source maps to outdir, the plugin injects the debug ID that Bun writes into each bundle, injects the release, and uploads the source maps at the end of the build. You no longer need to run sentry sourcemap inject and sentry sourcemap upload after the build.

... (truncated)

Changelog

Sourced from @​sentry/browser's changelog.

11.10.0

Important Changes

  • feat: Add a managed tunnel that the SDK derives from the DSN (#25199, #25200, #25783)

    Set tunnel: true in your browser Sentry.init call to send events through your own server. This helps when ad blockers block requests to Sentry. The browser derives the tunnel path from the DSN, so older and newer builds of your client and server always agree on the path.

    To serve the tunnel, add serveTunnelIntegration() to your server SDK. Astro, Nuxt, Nitro, React Router, Remix 3, SolidStart, SvelteKit and TanStack Start then answer tunnel requests automatically:

    // browser
Sentry.init({ dsn, tunnel: true });
// server
Sentry.init({ dsn, integrations: [Sentry.serveTunnelIntegration()] });

    If the browser uses a different DSN than the server, set serveTunnelIntegration({ allowedDsns: [browserDsn] }). For other setups, the server SDKs export handleTunnelRequestIfMatched, handleTunnelRequest, isTunnelRequest and getTunnelPath:

    app.use((req, res, next) => Sentry.handleTunnelRequestIfMatched(req, res) ?? next());

    The request option of handleTunnelRequest is deprecated and will be removed in v12.

  • feat: Make span origins spec compliant (#25602)

    Some span origins changed their names to follow the trace origin spec:

    • auto.amqplib.* is now auto.queue.amqplib.*, and auto.kafkajs.* is now auto.queue.kafkajs.*.
    • auto.vercelai.channel is now auto.ai.vercelai.
    • auto.firebase.firestore is now auto.db.firebase.firestore, and auto.firebase.functions is now auto.function.firebase.
    • auto.aws.aws_sdk is now auto.{rpc,db,queue,ai}.aws_sdk, with the category from the span op.
    • auto.aws_lambda is now auto.function.aws_serverless.
    • auto.mcp.notification is now auto.function.mcp_server.notification.
    • auto.db.cloudflare.durable_object.sql is now auto.db.cloudflare.durable_object_sql.
    • auto.http.browser.{lcp,cls,inp} is now auto.ui.browser.{lcp,cls,inp}.

    If you have ignoreSpans rules, queries or alerts on the old origins, change them to use the new origins.

  • feat(bun): Add incoming request options and request sessions to bunServerIntegration (#25580)

    bunServerIntegration now accepts the same options as denoServeIntegration: ignoreRequestBody, ignoreIncomingRequests, ignoreStaticAssets, spans, onSpanCreated, onSpanEnd, sessions and sessionFlushingDelayMS. The callbacks receive the web Request.

    Bun.serve now records a request session for each incoming request. Sessions are sent only when a release is set. To turn them off, set bunServerIntegration({ sessions: false }).

    ignoreStaticAssets defaults to true, so Bun.serve no longer creates spans for GET requests to common static assets such as favicon.ico, robots.txt or *.js files. To keep these spans, set bunServerIntegration({ ignoreStaticAssets: false }). Bun.serve spans also follow the client's tracing configuration by default, so the integration does not start spans when tracing is disabled. Errors thrown for OPTIONS and HEAD requests are now captured.

  • feat(bun): Inject debug IDs and upload source maps in sentryBunPlugin (#25670)

... (truncated)

Commits
  • 9e33660 release: 11.10.0
  • a51d938 Merge pull request #25832 from getsentry/prepare-release/11.10.0
  • 612654c meta(changelog): Update changelog for 11.10.0
  • 0455361 Merge pull request #25833 from getsentry/ab/merge-master-into-develop
  • 0e2b465 chore: Merge master into develop
  • 90a71e7 feat(server-utils): Instrument together-ai 1.x (#25823)
  • c6ac34c test(cloudflare): Bump agents and MCP SDK in cloudflare-mcp-agent e2e app (#2...
  • 6efffd8 test(remix): Cover prefetched navigations in the Remix 3 E2E app (#25829)
  • e17a480 fix(remix): Drop Remix 3 release candidates from the peer range (#25808)
  • cad66c7 test: Wire the managed tunnel by hand in Node, Cloudflare and Next.js (#25785)
  • Additional commits viewable in compare view

Updates @tailwindcss/vite from 4.3.3 to 4.3.4

Release notes

Sourced from @​tailwindcss/vite's releases.

v4.3.4

Added

  • Add @tailwindcss/turbopack, a Turbopack loader for using Tailwind CSS with Next.js (#20367)

Fixed

  • Ensure watch mode detects changes to symlinked @source files whose real paths aren't otherwise scanned (#20356)
  • Ensure variants using @scope wrap generated utilities instead of nesting inside them (#20369)
  • Ensure nested @scope rules preserve their scoping semantics when flattened (#20369)
  • Preserve declarations directly inside @scope by wrapping them in :where(:scope) (#20369)
  • Ensure generated utilities include a space in empty var() fallbacks (e.g. var(--tw-blur,) → var(--tw-blur, )) (#20373)
  • Canonicalization: convert arbitrary breakpoint and container query variants to named equivalents (e.g. max-[64rem]:flex → max-lg:flex) (#20380)
  • Prevent @tailwindcss/vite from crashing on every edit under Vite's experimental bundledDev mode (#20379)
  • Ensure @tailwindcss/oxide falls back to WASM on platforms without native bindings (#20383)
  • Extract class candidates from Ruby %w and %W literals using angle brackets or custom delimiters (e.g. %w<flex>, %w|flex|), including in Slim and Haml templates (#20387)
  • Preserve whitespace in --default(…) values in functional @utility definitions (e.g. --default(box alphabetic) no longer becomes boxalphabetic) (#20392)
  • Ensure automatic source detection respects negation-based .gitignore files (e.g. /* followed by !/… patterns) (#20397)
  • Ensure root theme('…') namespace lookups in JavaScript plugins and config files return the full namespace object instead of the value of its DEFAULT key (#20399)
  • Skip ignored directories when generating watch globs instead of walking their contents on every rebuild (#20408)
  • Drop invalid UTF-8 candidates during class detection (#20389)
  • Prevent @tailwindcss/vite from forcing full-page reloads for scanned files that Vite does not handle as modules (e.g. .php files) (#20414)
  • Canonicalization: don't merge utilities that reference different theme variables set to CSS-wide keywords like unset (#20417)
  • Don't generate utilities when a modifier is used that would otherwise be silently ignored (e.g. rounded-sm/[5], shadow-sm/foo, stroke-2/50) (#20419)
  • Preserve and, or, and not inside selectors in supports-[…] variants (e.g. supports-[selector(a:not(.foo))]:flex) (#20420)
  • Don't warn about Angular's ::ng-deep and :host-context() when optimizing CSS (#20434)
  • Don't generate CSS for candidates containing an empty additional modifier (e.g. bg-red-500/50/ and group-hover/foo//bar:flex) (#20466)
  • Ensure min-*, max-*, and container query variants with decimal values are sorted numerically (e.g. min-[40.25rem] before min-[40.5rem]) (#20512)
  • Ensure CSS comments ending with \*/ are closed correctly instead of swallowing the CSS that follows (e.g. /* C:\temp\*/) (#20508)
  • Improve style invalidation performance of group-* and peer-* variants (#20513)
  • Ensure cached compilers release their loadModule and loadStylesheet callbacks after compilation (#20531)
  • Canonicalization: preserve & when moving a pseudo-element into * or ** (e.g. [&_::before]:flex → **:[&::before]:flex) (#20550)
  • Ensure the Set.prototype.intersection polyfill in canonicalizeCandidates(…) returns the intersection instead of the first set on Node.js < 22 (#20562)
  • Canonicalization: ensure inline theme(…) alphas with more than 2 decimals migrate to a percentage modifier with the same opacity (e.g. theme(colors.red.500/.12345) → text-red-500/[12.345%], not text-red-500/[12.345]) (#20563)
  • Canonicalization: preserve inline theme(…) alphas as an arbitrary percentage when a custom --opacity-* theme value would change the opacity (e.g. theme(colors.red.500/50%) → text-red-500/[50%] with --opacity-50: 10%) (#20563)
  • Ensure the @property fallback isn't applied in Safari versions that no longer support margin-trim: inline (#20569)
  • Treat viewport units like dvmin and svi and font-relative units like cap and rex as lengths in arbitrary values (e.g. text-[10dvmin] generates font-size instead of color) (#20516)
  • Write plugin logs to stderr in tailwindcss canonicalize so they don't end up in the results on stdout (#20561)
  • Extract class shorthands on later lines when Pug text, comments, or quoted attribute values contain unbalanced brackets, or a quote that doesn't start a string (e.g. input(pattern=/"/.source)) (#20547, #20572)
  • Underline the correct occurrence of an unsupported data type in --value(…) warnings (#20554)
  • Canonicalization: prefer an existing candidate when collapsing utilities over another utility with the same default theme value (e.g. text-foreground text-primary → text-primary, not text-card-checked-border) (#20540)
  • Canonicalization: don't collapse utilities into a utility that uses another theme variable with the same default value (e.g. mt-card mb-card → my-card, not my-4) (#20574)
  • Ensure @tailwindcss/postcss rewrites relative url(…)s of stylesheets that are inlined before it runs (e.g. @imports in Vite) in optimized builds (#20576)
  • Drop nested rules that put a combinator after a pseudo-element when using pseudo-element variants (e.g. selection:* on a utility with a nested & > * rule) (#20575)
  • Don't generate CSS for arbitrary values with unbalanced parentheses or brackets (e.g. w-[calc(1px] or [--x:a[b]) (#20577)
  • Canonicalization: prevent collapse: true from taking exponentially longer when classes are linked through a utility that sets many properties (e.g. sr-only) (#20558)
  • Ensure & is substituted inside :-moz-any(…) and :-webkit-any(…) in custom variants (e.g. @custom-variant firefox (:-moz-any(&));) (#20486)
  • Ensure the standalone macOS binaries have a valid code signature, so macOS 27 no longer kills them at launch (#20578)
  • Ensure @tailwindcss/turbopack and @tailwindcss/webpack rebuild when the input CSS changes (e.g. next dev with Turbopack no longer serves the CSS of the previous edit) (#20582)
  • Canonicalization: don't drop a utility that sets a --tw-* variable when an unrelated property has the same value (e.g. link mt-4 no longer becomes mt-4 when link sets margin-top: 16px and --tw-translate-x: 16px) (#20593)

... (truncated)

Changelog

Sourced from @​tailwindcss/vite's changelog.

[4.3.4] - 2026-11-02

Added

  • Add @tailwindcss/turbopack, a Turbopack loader for using Tailwind CSS with Next.js (#20367)

Fixed

  • Ensure watch mode detects changes to symlinked @source files whose real paths aren't otherwise scanned (#20356)
  • Ensure variants using @scope wrap generated utilities instead of nesting inside them (#20369)
  • Ensure nested @scope rules preserve their scoping semantics when flattened (#20369)
  • Preserve declarations directly inside @scope by wrapping them in :where(:scope) (#20369)
  • Ensure generated utilities include a space in empty var() fallbacks (e.g. var(--tw-blur,) → var(--tw-blur, )) (#20373)
  • Canonicalization: convert arbitrary breakpoint and container query variants to named equivalents (e.g. max-[64rem]:flex → max-lg:flex) (#20380)
  • Prevent @tailwindcss/vite from crashing on every edit under Vite's experimental bundledDev mode (#20379)
  • Ensure @tailwindcss/oxide falls back to WASM on platforms without native bindings (#20383)
  • Extract class candidates from Ruby %w and %W literals using angle brackets or custom delimiters (e.g. %w<flex>, %w|flex|), including in Slim and Haml templates (#20387)
  • Preserve whitespace in --default(…) values in functional @utility definitions (e.g. --default(box alphabetic) no longer becomes boxalphabetic) (#20392)
  • Ensure automatic source detection respects negation-based .gitignore files (e.g. /* followed by !/… patterns) (#20397)
  • Ensure root theme('…') namespace lookups in JavaScript plugins and config files return the full namespace object instead of the value of its DEFAULT key (#20399)
  • Skip ignored directories when generating watch globs instead of walking their contents on every rebuild (#20408)
  • Drop invalid UTF-8 candidates during class detection (#20389)
  • Prevent @tailwindcss/vite from forcing full-page reloads for scanned files that Vite does not handle as modules (e.g. .php files) (#20414)
  • Canonicalization: don't merge utilities that reference different theme variables set to CSS-wide keywords like unset (#20417)
  • Don't generate utilities when a modifier is used that would otherwise be silently ignored (e.g. rounded-sm/[5], shadow-sm/foo, stroke-2/50) (#20419)
  • Preserve and, or, and not inside selectors in supports-[…] variants (e.g. supports-[selector(a:not(.foo))]:flex) (#20420)
  • Don't warn about Angular's ::ng-deep and :host-context() when optimizing CSS (#20434)
  • Don't generate CSS for candidates containing an empty additional modifier (e.g. bg-red-500/50/ and group-hover/foo//bar:flex) (#20466)
  • Ensure min-*, max-*, and container query variants with decimal values are sorted numerically (e.g. min-[40.25rem] before min-[40.5rem]) (#20512)
  • Ensure CSS comments ending with \*/ are closed correctly instead of swallowing the CSS that follows (e.g. /* C:\temp\*/) (#20508)
  • Improve style invalidation performance of group-* and peer-* variants (#20513)
  • Ensure cached compilers release their loadModule and loadStylesheet callbacks after compilation (#20531)
  • Canonicalization: preserve & when moving a pseudo-element into * or ** (e.g. [&_::before]:flex → **:[&::before]:flex) (#20550)
  • Ensure the Set.prototype.intersection polyfill in canonicalizeCandidates(…) returns the intersection instead of the first set on Node.js < 22 (#20562)
  • Canonicalization: ensure inline theme(…) alphas with more than 2 decimals migrate to a percentage modifier with the same opacity (e.g. theme(colors.red.500/.12345) → text-red-500/[12.345%], not text-red-500/[12.345]) (#20563)
  • Canonicalization: preserve inline theme(…) alphas as an arbitrary percentage when a custom --opacity-* theme value would change the opacity (e.g. theme(colors.red.500/50%) → text-red-500/[50%] with --opacity-50: 10%) (#20563)
  • Ensure the @property fallback isn't applied in Safari versions that no longer support margin-trim: inline (#20569)
  • Treat viewport units like dvmin and svi and font-relative units like cap and rex as lengths in arbitrary values (e.g. text-[10dvmin] generates font-size instead of color) (#20516)
  • Write plugin logs to stderr in tailwindcss canonicalize so they don't end up in the results on stdout (#20561)
  • Extract class shorthands on later lines when Pug text, comments, or quoted attribute values contain unbalanced brackets, or a quote that doesn't start a string (e.g. input(pattern=/"/.source)) (#20547, #20572)
  • Underline the correct occurrence of an unsupported data type in --value(…) warnings (#20554)
  • Canonicalization: prefer an existing candidate when collapsing utilities over another utility wit...

    Description has been truncated

@dependabot
Bump the npm group across 1 directory with 30 updates
bd9f727 
Bumps the npm group with 30 updates in the /platform directory:

| Package | From | To |
| --- | --- | --- |
| [@inertiajs/svelte](https://github.com/inertiajs/inertia/tree/HEAD/packages/svelte) | `3.9.1` | `3.11.0` |
| [@lucide/svelte](https://github.com/lucide-icons/lucide/tree/HEAD/packages/svelte) | `1.55.0` | `1.68.0` |
| [@rails/activestorage](https://github.com/rails/rails) | `8.1.400` | `8.1.401` |
| [@sentry/browser](https://github.com/getsentry/sentry-javascript) | `11.8.0` | `11.10.0` |
| [@tailwindcss/vite](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite) | `4.3.3` | `4.3.4` |
| [@tiptap/core](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/core) | `3.32.0` | `3.32.2` |
| [@tiptap/extension-heading](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-heading) | `3.32.0` | `3.32.2` |
| [@tiptap/extension-image](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-image) | `3.32.0` | `3.32.2` |
| [@tiptap/extensions](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension) | `3.32.0` | `3.32.2` |
| [@tiptap/markdown](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/markdown) | `3.32.0` | `3.32.2` |
| [@tiptap/pm](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/pm) | `3.32.0` | `3.32.2` |
| [@tiptap/starter-kit](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/starter-kit) | `3.32.0` | `3.32.2` |
| [bits-ui](https://github.com/huntabyte/bits-ui) | `2.19.5` | `2.20.4` |
| [d3-scale](https://github.com/d3/d3-scale) | `4.0.2` | `4.0.3` |
| [d3-shape](https://github.com/d3/d3-shape) | `3.2.0` | `3.2.1` |
| [hast-util-to-html](https://github.com/syntax-tree/hast-util-to-html) | `9.0.5` | `9.0.6` |
| [layerchart](https://github.com/techniq/layerchart) | `2.7.0` | `2.9.2` |
| [marked](https://github.com/markedjs/marked) | `18.1.1` | `18.1.3` |
| [node-datachannel](https://github.com/murat-dogan/node-datachannel) | `0.33.4` | `0.33.6` |
| [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) | `5.57.2` | `5.57.3` |
| [svelte-sonner](https://github.com/wobsoriano/svelte-sonner) | `1.2.1` | `1.2.3` |
| [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.3.3` | `4.3.4` |
| [three](https://github.com/mrdoob/three.js) | `0.184.0` | `0.187.0` |
| [@types/three](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/three) | `0.184.1` | `0.187.0` |
| [@slack/socket-mode](https://github.com/slackapi/node-slack-sdk) | `3.1.0` | `3.1.1` |
| [@types/dompurify](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/dompurify) | `3.0.5` | `3.2.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.5` | `26.6.6` |
| [@types/three](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/three) | `0.184.1` | `0.187.0` |
| [svelte-check](https://github.com/sveltejs/language-tools) | `4.7.6` | `4.7.8` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.3.4` | `8.3.5` |
| [vite-plugin-ruby](https://github.com/ElMassimo/vite_ruby) | `5.2.5` | `5.2.6` |



Updates `@inertiajs/svelte` from 3.9.1 to 3.11.0
- [Release notes](https://github.com/inertiajs/inertia/releases)
- [Changelog](https://github.com/inertiajs/inertia/blob/3.x/CHANGELOG.md)
- [Commits](https://github.com/inertiajs/inertia/commits/v3.11.0/packages/svelte)

Updates `@lucide/svelte` from 1.55.0 to 1.68.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.68.0/packages/svelte)

Updates `@rails/activestorage` from 8.1.400 to 8.1.401
- [Release notes](https://github.com/rails/rails/releases)
- [Commits](https://github.com/rails/rails/commits)

Updates `@sentry/browser` from 11.8.0 to 11.10.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@11.8.0...11.10.0)

Updates `@tailwindcss/vite` from 4.3.3 to 4.3.4
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.4/packages/@tailwindcss-vite)

Updates `@tiptap/core` from 3.32.0 to 3.32.2
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/main/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/HEAD/packages/core)

Updates `@tiptap/extension-heading` from 3.32.0 to 3.32.2
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/main/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/HEAD/packages/extension-heading)

Updates `@tiptap/extension-image` from 3.32.0 to 3.32.2
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/main/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/HEAD/packages/extension-image)

Updates `@tiptap/extensions` from 3.32.0 to 3.32.2
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Commits](https://github.com/ueberdosis/tiptap/commits/HEAD/packages/extension)

Updates `@tiptap/markdown` from 3.32.0 to 3.32.2
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/main/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/HEAD/packages/markdown)

Updates `@tiptap/pm` from 3.32.0 to 3.32.2
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/main/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/HEAD/packages/pm)

Updates `@tiptap/starter-kit` from 3.32.0 to 3.32.2
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/main/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/HEAD/packages/starter-kit)

Updates `bits-ui` from 2.19.5 to 2.20.4
- [Release notes](https://github.com/huntabyte/bits-ui/releases)
- [Commits](https://github.com/huntabyte/bits-ui/compare/bits-ui@2.19.5...bits-ui@2.20.4)

Updates `d3-scale` from 4.0.2 to 4.0.3
- [Release notes](https://github.com/d3/d3-scale/releases)
- [Commits](d3/d3-scale@v4.0.2...v4.0.3)

Updates `d3-shape` from 3.2.0 to 3.2.1
- [Release notes](https://github.com/d3/d3-shape/releases)
- [Commits](d3/d3-shape@v3.2.0...v3.2.1)

Updates `hast-util-to-html` from 9.0.5 to 9.0.6
- [Release notes](https://github.com/syntax-tree/hast-util-to-html/releases)
- [Commits](syntax-tree/hast-util-to-html@9.0.5...9.0.6)

Updates `layerchart` from 2.7.0 to 2.9.2
- [Release notes](https://github.com/techniq/layerchart/releases)
- [Commits](https://github.com/techniq/layerchart/compare/layerchart@2.7.0...layerchart@2.9.2)

Updates `marked` from 18.1.1 to 18.1.3
- [Release notes](https://github.com/markedjs/marked/releases)
- [Commits](markedjs/marked@v18.1.1...v18.1.3)

Updates `node-datachannel` from 0.33.4 to 0.33.6
- [Release notes](https://github.com/murat-dogan/node-datachannel/releases)
- [Commits](murat-dogan/node-datachannel@v0.33.4...v0.33.6)

Updates `svelte` from 5.57.2 to 5.57.3
- [Release notes](https://github.com/sveltejs/svelte/releases)
- [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/svelte/commits/svelte@5.57.3/packages/svelte)

Updates `svelte-sonner` from 1.2.1 to 1.2.3
- [Release notes](https://github.com/wobsoriano/svelte-sonner/releases)
- [Changelog](https://github.com/wobsoriano/svelte-sonner/blob/main/CHANGELOG.md)
- [Commits](wobsoriano/svelte-sonner@v1.2.1...v1.2.3)

Updates `tailwindcss` from 4.3.3 to 4.3.4
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.4/packages/tailwindcss)

Updates `three` from 0.184.0 to 0.187.0
- [Release notes](https://github.com/mrdoob/three.js/releases)
- [Commits](https://github.com/mrdoob/three.js/commits)

Updates `@types/three` from 0.184.1 to 0.187.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/three)

Updates `@slack/socket-mode` from 3.1.0 to 3.1.1
- [Release notes](https://github.com/slackapi/node-slack-sdk/releases)
- [Commits](https://github.com/slackapi/node-slack-sdk/compare/@slack/socket-mode@3.1.0...@slack/socket-mode@3.1.1)

Updates `@types/dompurify` from 3.0.5 to 3.2.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/dompurify)

Updates `@types/node` from 26.6.5 to 26.6.6
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/three` from 0.184.1 to 0.187.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/three)

Updates `svelte-check` from 4.7.6 to 4.7.8
- [Release notes](https://github.com/sveltejs/language-tools/releases)
- [Commits](https://github.com/sveltejs/language-tools/compare/svelte-check@4.7.6...svelte-check@4.7.8)

Updates `vite` from 8.3.4 to 8.3.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.5/packages/vite)

Updates `vite-plugin-ruby` from 5.2.5 to 5.2.6
- [Commits](https://github.com/ElMassimo/vite_ruby/compare/vite-plugin-ruby@5.2.5...vite-plugin-ruby@5.2.6)

---
updated-dependencies:
- dependency-name: "@inertiajs/svelte"
  dependency-version: 3.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@lucide/svelte"
  dependency-version: 1.68.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@rails/activestorage"
  dependency-version: 8.1.401
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@sentry/browser"
  dependency-version: 11.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@tailwindcss/vite"
  dependency-version: 4.3.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@tiptap/core"
  dependency-version: 3.32.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@tiptap/extension-heading"
  dependency-version: 3.32.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@tiptap/extension-image"
  dependency-version: 3.32.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@tiptap/extensions"
  dependency-version: 3.32.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@tiptap/markdown"
  dependency-version: 3.32.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@tiptap/pm"
  dependency-version: 3.32.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@tiptap/starter-kit"
  dependency-version: 3.32.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: bits-ui
  dependency-version: 2.20.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: d3-scale
  dependency-version: 4.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: d3-shape
  dependency-version: 3.2.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: hast-util-to-html
  dependency-version: 9.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: layerchart
  dependency-version: 2.9.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: marked
  dependency-version: 18.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: node-datachannel
  dependency-version: 0.33.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: svelte
  dependency-version: 5.57.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: svelte-sonner
  dependency-version: 1.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: tailwindcss
  dependency-version: 4.3.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: three
  dependency-version: 0.187.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@types/three"
  dependency-version: 0.187.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@slack/socket-mode"
  dependency-version: 3.1.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@types/dompurify"
  dependency-version: 3.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@types/node"
  dependency-version: 26.6.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@types/three"
  dependency-version: 0.187.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: svelte-check
  dependency-version: 4.7.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: vite
  dependency-version: 8.3.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: vite-plugin-ruby
  dependency-version: 5.2.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 7, 2026
@socket-security

socket-security Bot commented Nov 7, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatednpm/​@​types/​dompurify@​3.0.5 ⏵ 3.2.010010038 -3250 -29100
Updatednpm/​node-datachannel@​0.33.4 ⏵ 0.33.699100100 +192 -170
Updatednpm/​@​inertiajs/​svelte@​3.9.1 ⏵ 3.11.098 +310072 +198 +1100
Updatednpm/​@​tiptap/​pm@​3.32.0 ⏵ 3.32.2991007499100
Updatednpm/​@​tiptap/​extension-heading@​3.32.0 ⏵ 3.32.2100 +110074 +199100
Updatednpm/​@​tiptap/​starter-kit@​3.32.0 ⏵ 3.32.29910075100 +1100
Updatednpm/​d3-scale@​4.0.2 ⏵ 4.0.310010076 -2488100
Updatednpm/​@​tiptap/​extension-image@​3.32.0 ⏵ 3.32.21001007699100
Updatednpm/​layerchart@​2.7.0 ⏵ 2.9.29810076 +196 +1100
Updatednpm/​d3-shape@​3.2.0 ⏵ 3.2.110010077 -2388100
Updatednpm/​@​tiptap/​extensions@​3.32.0 ⏵ 3.32.21001007999100
Updatednpm/​@​tiptap/​markdown@​3.32.0 ⏵ 3.32.210010079 +1100 +1100
Updatednpm/​@​types/​three@​0.184.1 ⏵ 0.187.0100 +110080 +192100
Updatednpm/​@​lucide/​svelte@​1.55.0 ⏵ 1.68.0100 +110097 -196 +180
Updatednpm/​marked@​18.1.1 ⏵ 18.1.3100100100 +197 -180
Updatednpm/​@​types/​node@​26.6.5 ⏵ 26.6.6100 +110081 +195100
Updatednpm/​@​tiptap/​core@​3.32.0 ⏵ 3.32.2100 +110081 +199100
Updatednpm/​vite@​8.3.4 ⏵ 8.3.599 +110082 +198100
Updatednpm/​@​sentry/​browser@​11.8.0 ⏵ 11.10.09910083 +296100
Updatednpm/​tailwindcss@​4.3.3 ⏵ 4.3.4100 +110084 +198100
Updatednpm/​svelte@​5.57.2 ⏵ 5.57.388 +110087 +198100
Updatednpm/​vite-plugin-ruby@​5.2.5 ⏵ 5.2.61001008893 +1100
Updatednpm/​hast-util-to-html@​9.0.5 ⏵ 9.0.699 +1100100 +188 +2100
Updatednpm/​@​tailwindcss/​vite@​4.3.3 ⏵ 4.3.41001008998100
Updatednpm/​bits-ui@​2.19.5 ⏵ 2.20.4100 +110091 +196100
Updatednpm/​svelte-sonner@​1.2.1 ⏵ 1.2.3100 +110010092 +3100
Updatednpm/​three@​0.184.0 ⏵ 0.187.098 +11009892 -1100
Updatednpm/​svelte-check@​4.7.6 ⏵ 4.7.89910010095100
Updatednpm/​@​slack/​socket-mode@​3.1.0 ⏵ 3.1.199 +110010095 +5100
Updatednpm/​@​rails/​activestorage@​8.1.400 ⏵ 8.1.40110010010096100

View full report

@socket-security

socket-security Bot commented Nov 7, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority Alert  (click "▶" to expand/collapse) Action
Low priority
Low adoption: npm d3-geo-polygon

Location: Package overview

From: platform/package-lock.json → npm/layerchart@2.9.2 → npm/d3-geo-polygon@2.0.1

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/d3-geo-polygon@2.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn
Low priority
Low adoption: npm @node-datachannel/linux-x64-gnu

Location: Package overview

From: platform/package-lock.json → npm/node-datachannel@0.33.6 → npm/@node-datachannel/linux-x64-gnu@0.33.6

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@node-datachannel/linux-x64-gnu@0.33.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn
Low priority
Deprecated by its maintainer: npm @types/dompurify

Reason: This is a stub types definition. dompurify provides its own type definitions, so you do not need this installed.

From: platform/package-lock.json → npm/@types/dompurify@3.2.0

ℹ Read more on: This package | This alert | What is a deprecated package?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Research the state of the package and determine if there are non-deprecated versions that can be used, or if it should be replaced with a new, supported solution.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@types/dompurify@3.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn

View full report

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants