Skip to content

chore: bump the all group in /web with 10 updates#990

Closed
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/web/all-326010daac
Closed

chore: bump the all group in /web with 10 updates#990
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/web/all-326010daac

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Apr 2, 2026

Bumps the all group in /web with 10 updates:

Package From To
@codemirror/view 6.40.0 6.41.0
@tanstack/react-query 5.96.0 5.96.1
@eslint-react/eslint-plugin 3.0.0 4.2.1
@playwright/test 1.59.0 1.59.1
@storybook/addon-a11y 10.3.3 10.3.4
@storybook/addon-docs 10.3.3 10.3.4
@storybook/react 10.3.3 10.3.4
@storybook/react-vite 10.3.3 10.3.4
esbuild 0.27.4 0.27.5
storybook 10.3.3 10.3.4

Updates @codemirror/view from 6.40.0 to 6.41.0

Changelog

Sourced from @​codemirror/view's changelog.

6.41.0 (2026-04-01)

Bug fixes

Fix an issue where EditorView.posAtCoords could incorrectly return a position near a higher element on the line, in mixed-font-size lines.

Expand the workaround for the Webkit bug that causes nonexistent selections to stay visible to be active on non-Safari Webkit browsers.

New features

The new EditorView.cursorScrollMargin facet can now be used to configure the extra space used when scrolling the cursor into view.

Commits
  • a0a5ed9 Mark version 6.41.0
  • c834ebf Enable the workaround for ghost selections in all forms of Webkit
  • 49d72c4 Improve posAtCoords in non-uniform height lines
  • 4935d24 Make the margin used when scrolling the cursor into view configurable
  • ed7d625 Remove duplicated slash in forum url in README
  • c3770d3 Fix forum link in readme
  • See full diff in compare view

Updates @tanstack/react-query from 5.96.0 to 5.96.1

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.96.1

Patch Changes

  • fix(build): exclude config files from production DTS rollup to prevent @types/node type pollution (#10358)

  • Updated dependencies []:

    • @​tanstack/query-devtools@​5.96.1
    • @​tanstack/react-query@​5.96.1

@​tanstack/react-query-next-experimental@​5.96.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.96.1

@​tanstack/react-query-persist-client@​5.96.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-persist-client-core@​5.96.1
    • @​tanstack/react-query@​5.96.1

@​tanstack/react-query@​5.96.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.96.1
Changelog

Sourced from @​tanstack/react-query's changelog.

5.96.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.96.1
Commits

Updates @eslint-react/eslint-plugin from 3.0.0 to 4.2.1

Release notes

Sourced from @​eslint-react/eslint-plugin's releases.

v4.2.1 (2026-04-01)

What's Changed

This release consolidates all changes since v3.0.0.

💥 Breaking Changes

New eslint-plugin-react-jsx package

A new dedicated plugin for React Flavored JSX rules has been introduced. Several rules have been migrated from eslint-plugin-react-x and eslint-plugin-react-dom to this new package:

Old Rule (react-x/) New Rule (react-jsx/) Change
jsx-key-before-spread no-key-after-spread relocated, renamed
jsx-no-comment-textnodes no-comment-textnodes relocated, renamed
no-children-prop no-children-prop relocated
no-useless-fragment no-useless-fragment relocated
Old Rule (react-dom/) New Rule (react-jsx/) Change
no-namespace no-namespace relocated

Rule prefix changes in @eslint-react/eslint-plugin

Rules from individual plugins now use a flattened naming convention when accessed through the unified @eslint-react/eslint-plugin package:

  • @eslint-react/<rule> -> @eslint-react/<rule> (no changes)
  • @eslint-react-jsx-<rule> -> @eslint-react-jsx-<rule> (no changes)
  • @eslint-react/rsc/<rule> -> @eslint-react/rsc-<rule>
  • @eslint-react/dom/<rule> -> @eslint-react/dom-<rule>
  • @eslint-react/web-api/<rule> -> @eslint-react/web-api-<rule>
  • @eslint-react/naming-convention/<rule> -> @eslint-react/naming-convention-<rule>
  • @eslint-react/debug/<rule> -> @eslint-react/debug-<rule>

Removed Rules from eslint-plugin-react-x

The following rules have been removed from eslint-plugin-react-x:

Rule Replaced by
react-x/jsx-dollar @eslint-react/kit (custom rule)
react-x/jsx-shorthand-boolean @eslint-react/kit (custom rule)
react-x/jsx-shorthand-fragment @eslint-react/kit (custom rule)
react-x/unstable-rules-of-props Recipes: custom-rules-of-props
react-x/unstable-rules-of-state Recipes: custom-rules-of-state

JSX utilities extracted from @eslint-react/core to @eslint-react/jsx

The JSX module has been extracted from @eslint-react/core into a new standalone @eslint-react/jsx package. The following exports are no longer available from @eslint-react/core:

... (truncated)

Changelog

Sourced from @​eslint-react/eslint-plugin's changelog.

v4.2.1 (2026-04-01)

This release consolidates all changes since v3.0.0.

💥 Breaking Changes

New eslint-plugin-react-jsx package

A new dedicated plugin for React Flavored JSX rules has been introduced. Several rules have been migrated from eslint-plugin-react-x and eslint-plugin-react-dom to this new package:

Old Rule (react-x/) New Rule (react-jsx/) Change
jsx-key-before-spread no-key-after-spread relocated, renamed
jsx-no-comment-textnodes no-comment-textnodes relocated, renamed
no-children-prop no-children-prop relocated
no-useless-fragment no-useless-fragment relocated
Old Rule (react-dom/) New Rule (react-jsx/) Change
no-namespace no-namespace relocated

Rule prefix changes in @eslint-react/eslint-plugin

Rules from individual plugins now use a flattened naming convention when accessed through the unified @eslint-react/eslint-plugin package:

  • @eslint-react/<rule> -> @eslint-react/<rule> (no changes)
  • @eslint-react-jsx-<rule> -> @eslint-react-jsx-<rule> (no changes)
  • @eslint-react/rsc/<rule> -> @eslint-react/rsc-<rule>
  • @eslint-react/dom/<rule> -> @eslint-react/dom-<rule>
  • @eslint-react/web-api/<rule> -> @eslint-react/web-api-<rule>
  • @eslint-react/naming-convention/<rule> -> @eslint-react/naming-convention-<rule>
  • @eslint-react/debug/<rule> -> @eslint-react/debug-<rule>

Removed Rules from eslint-plugin-react-x

The following rules have been removed from eslint-plugin-react-x:

Rule Replaced by
react-x/jsx-dollar @eslint-react/kit (custom rule)
react-x/jsx-shorthand-boolean @eslint-react/kit (custom rule)
react-x/jsx-shorthand-fragment @eslint-react/kit (custom rule)
react-x/unstable-rules-of-props Recipes: custom-rules-of-props
react-x/unstable-rules-of-state Recipes: custom-rules-of-state

JSX utilities extracted from @eslint-react/core to @eslint-react/jsx

The JSX module has been extracted from @eslint-react/core into a new standalone @eslint-react/jsx package. The following exports are no longer available from @eslint-react/core:

  • JsxInspector class — removed, replaced with standalone utility functions from @eslint-react/jsx (e.g. findAttribute, hasAttribute, getChildren, isElement, isFragmentElement, isHostElement, isJsxLike, etc.)

... (truncated)

Commits

Updates @playwright/test from 1.59.0 to 1.59.1

Release notes

Sourced from @​playwright/test's releases.

v1.59.1

Bug Fixes

  • [Windows] Reverted hiding console window when spawning browser processes, which caused regressions including broken codegen, --ui and show commands (#39990)
Commits

Updates @storybook/addon-a11y from 10.3.3 to 10.3.4

Release notes

Sourced from @​storybook/addon-a11y's releases.

v10.3.4

10.3.4

Changelog

Sourced from @​storybook/addon-a11y's changelog.

10.3.4

Commits
  • 4eff9cd Bump version from "10.3.3" to "10.3.4" [skip ci]
  • bf06f9a Merge pull request #34203 from mixelburg/fix/a11y-context-clear-timeout-on-un...
  • See full diff in compare view

Updates @storybook/addon-docs from 10.3.3 to 10.3.4

Release notes

Sourced from @​storybook/addon-docs's releases.

v10.3.4

10.3.4

Changelog

Sourced from @​storybook/addon-docs's changelog.

10.3.4

Commits

Updates @storybook/react from 10.3.3 to 10.3.4

Release notes

Sourced from @​storybook/react's releases.

v10.3.4

10.3.4

Changelog

Sourced from @​storybook/react's changelog.

10.3.4

Commits
  • 4eff9cd Bump version from "10.3.3" to "10.3.4" [skip ci]
  • 4fb52a2 Merge pull request #34393 from mixelburg/fix/docgen-resolver-tsx-fallback
  • See full diff in compare view

Updates @storybook/react-vite from 10.3.3 to 10.3.4

Release notes

Sourced from @​storybook/react-vite's releases.

v10.3.4

10.3.4

Changelog

Sourced from @​storybook/react-vite's changelog.

10.3.4

Commits
  • 4eff9cd Bump version from "10.3.3" to "10.3.4" [skip ci]
  • 4fb52a2 Merge pull request #34393 from mixelburg/fix/docgen-resolver-tsx-fallback
  • 756f6e3 Merge pull request #34335 from beeswhacks/upgrade-vite-plugin-react-docgen-ty...
  • See full diff in compare view

Updates esbuild from 0.27.4 to 0.27.5

Release notes

Sourced from esbuild's releases.

v0.27.5

  • Fix for an async generator edge case (#4401, #4417)

    Support for transforming async generators into the equivalent state machine was added in version 0.19.0. However, the generated state machine didn't work correctly when polling async generators concurrently, such as in the following code:

    async function* inner() { yield 1; yield 2 }
async function* outer() { yield* inner() }
let gen = outer()
for await (let x of [gen.next(), gen.next()]) console.log(x)

    Previously esbuild's output of the above code behaved incorrectly when async generators were transformed (such as with --supported:async-generator=false). The transformation should be fixed starting with this release.

    This fix was contributed by @​2767mr.

  • Fix a regression when metafile is enabled (#4420, #4418)

    This release fixes a regression introduced by the previous release. When metafile: true was enabled in esbuild's JavaScript API, builds with build errors were incorrectly throwing an error about an empty JSON string instead of an object containing the build errors.

  • Use define semantics for TypeScript parameter properties (#4421)

    Parameter properties are a TypeScript-specific code generation feature that converts constructor parameters into class fields when they are prefixed by certain keywords. When "useDefineForClassFields": true is present in tsconfig.json, the TypeScript compiler automatically generates class field declarations for parameter properties. Previously esbuild didn't do this, but esbuild will now do this starting with this release:

    // Original code
class Foo {
  constructor(public x: number) {}
}
// Old output (with --loader=ts)
class Foo {
constructor(x) {
this.x = x;
}
}
// New output (with --loader=ts)
class Foo {
constructor(x) {
this.x = x;
}
x;
}

  • Allow es2025 as a target in tsconfig.json (#4432)

    TypeScript recently added es2025 as a compilation target, so esbuild now supports this in the target field of tsconfig.json files, such as in the following configuration file:

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.27.5

  • Fix for an async generator edge case (#4401, #4417)

    Support for transforming async generators into the equivalent state machine was added in version 0.19.0. However, the generated state machine didn't work correctly when polling async generators concurrently, such as in the following code:

    async function* inner() { yield 1; yield 2 }
async function* outer() { yield* inner() }
let gen = outer()
for await (let x of [gen.next(), gen.next()]) console.log(x)

    Previously esbuild's output of the above code behaved incorrectly when async generators were transformed (such as with --supported:async-generator=false). The transformation should be fixed starting with this release.

    This fix was contributed by @​2767mr.

  • Fix a regression when metafile is enabled (#4420, #4418)

    This release fixes a regression introduced by the previous release. When metafile: true was enabled in esbuild's JavaScript API, builds with build errors were incorrectly throwing an error about an empty JSON string instead of an object containing the build errors.

  • Use define semantics for TypeScript parameter properties (#4421)

    Parameter properties are a TypeScript-specific code generation feature that converts constructor parameters into class fields when they are prefixed by certain keywords. When "useDefineForClassFields": true is present in tsconfig.json, the TypeScript compiler automatically generates class field declarations for parameter properties. Previously esbuild didn't do this, but esbuild will now do this starting with this release:

    // Original code
class Foo {
  constructor(public x: number) {}
}
// Old output (with --loader=ts)
class Foo {
constructor(x) {
this.x = x;
}
}
// New output (with --loader=ts)
class Foo {
constructor(x) {
this.x = x;
}
x;
}

  • Allow es2025 as a target in tsconfig.json (#4432)

    TypeScript recently added es2025 as a compilation target, so esbuild now supports this in the target field of tsconfig.json files, such as in the following configuration file:

... (truncated)

Commits

Updates storybook from 10.3.3 to 10.3.4

Release notes

Sourced from storybook's releases.

v10.3.4

10.3.4

Changelog

Sourced from storybook's changelog.

10.3.4

Commits
  • 4eff9cd Bump version from "10.3.3" to "10.3.4" [skip ci]
  • 21d37fd Merge pull request #34224 from storybookjs/chore/removeprettierrc
  • 4eb227b Build: Move prettier to oxfmt
  • ff9d121 Merge pull request #34316 from storybookjs/jeppe/fix-error-reports-on-init
  • 5bc8686 Merge pull request #34281 from storybookjs/fix-stackblitz-websocket
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore: bump the all group in /web with 10 updates
7189738 
Bumps the all group in /web with 10 updates:

| Package | From | To |
| --- | --- | --- |
| [@codemirror/view](https://github.com/codemirror/view) | `6.40.0` | `6.41.0` |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.96.0` | `5.96.1` |
| [@eslint-react/eslint-plugin](https://github.com/Rel1cx/eslint-react/tree/HEAD/packages/plugins/eslint-plugin) | `3.0.0` | `4.2.1` |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.59.0` | `1.59.1` |
| [@storybook/addon-a11y](https://github.com/storybookjs/storybook/tree/HEAD/code/addons/a11y) | `10.3.3` | `10.3.4` |
| [@storybook/addon-docs](https://github.com/storybookjs/storybook/tree/HEAD/code/addons/docs) | `10.3.3` | `10.3.4` |
| [@storybook/react](https://github.com/storybookjs/storybook/tree/HEAD/code/renderers/react) | `10.3.3` | `10.3.4` |
| [@storybook/react-vite](https://github.com/storybookjs/storybook/tree/HEAD/code/frameworks/react-vite) | `10.3.3` | `10.3.4` |
| [esbuild](https://github.com/evanw/esbuild) | `0.27.4` | `0.27.5` |
| [storybook](https://github.com/storybookjs/storybook/tree/HEAD/code/core) | `10.3.3` | `10.3.4` |


Updates `@codemirror/view` from 6.40.0 to 6.41.0
- [Changelog](https://github.com/codemirror/view/blob/main/CHANGELOG.md)
- [Commits](codemirror/view@6.40.0...6.41.0)

Updates `@tanstack/react-query` from 5.96.0 to 5.96.1
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.96.1/packages/react-query)

Updates `@eslint-react/eslint-plugin` from 3.0.0 to 4.2.1
- [Release notes](https://github.com/Rel1cx/eslint-react/releases)
- [Changelog](https://github.com/Rel1cx/eslint-react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/Rel1cx/eslint-react/commits/v4.2.1/packages/plugins/eslint-plugin)

Updates `@playwright/test` from 1.59.0 to 1.59.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.59.0...v1.59.1)

Updates `@storybook/addon-a11y` from 10.3.3 to 10.3.4
- [Release notes](https://github.com/storybookjs/storybook/releases)
- [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md)
- [Commits](https://github.com/storybookjs/storybook/commits/v10.3.4/code/addons/a11y)

Updates `@storybook/addon-docs` from 10.3.3 to 10.3.4
- [Release notes](https://github.com/storybookjs/storybook/releases)
- [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md)
- [Commits](https://github.com/storybookjs/storybook/commits/v10.3.4/code/addons/docs)

Updates `@storybook/react` from 10.3.3 to 10.3.4
- [Release notes](https://github.com/storybookjs/storybook/releases)
- [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md)
- [Commits](https://github.com/storybookjs/storybook/commits/v10.3.4/code/renderers/react)

Updates `@storybook/react-vite` from 10.3.3 to 10.3.4
- [Release notes](https://github.com/storybookjs/storybook/releases)
- [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md)
- [Commits](https://github.com/storybookjs/storybook/commits/v10.3.4/code/frameworks/react-vite)

Updates `esbuild` from 0.27.4 to 0.27.5
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](evanw/esbuild@v0.27.4...v0.27.5)

Updates `storybook` from 10.3.3 to 10.3.4
- [Release notes](https://github.com/storybookjs/storybook/releases)
- [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md)
- [Commits](https://github.com/storybookjs/storybook/commits/v10.3.4/code/core)

---
updated-dependencies:
- dependency-name: "@codemirror/view"
  dependency-version: 6.41.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.96.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: "@eslint-react/eslint-plugin"
  dependency-version: 4.2.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: all
- dependency-name: "@playwright/test"
  dependency-version: 1.59.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: "@storybook/addon-a11y"
  dependency-version: 10.3.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: "@storybook/addon-docs"
  dependency-version: 10.3.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: "@storybook/react"
  dependency-version: 10.3.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: "@storybook/react-vite"
  dependency-version: 10.3.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: esbuild
  dependency-version: 0.27.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: storybook
  dependency-version: 10.3.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file scope:web Vue 3 dashboard type:chore Maintenance, cleanup, dependency updates labels Apr 2, 2026
@dependabot dependabot bot requested a review from Aureliolo as a code owner April 2, 2026 07:31
@dependabot dependabot bot added type:chore Maintenance, cleanup, dependency updates dependencies Pull requests that update a dependency file scope:web Vue 3 dashboard labels Apr 2, 2026
@socket-security
Copy link
Copy Markdown

socket-security bot commented Apr 2, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatednpm/​@​codemirror/​view@​6.40.0 ⏵ 6.41.095 +110085 +197 +2100
Addednpm/​wrangler@​4.79.0981009296100
Updatednpm/​@​eslint-react/​eslint-plugin@​3.0.0 ⏵ 4.2.19910010096100

View full report

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 2, 2026

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Aureliolo added a commit that referenced this pull request Apr 2, 2026
@Aureliolo
chore: consolidate web dep updates (#986, #990)
e7e499d 
- lodash-es 4.17.23 -> 4.18.1 (security: prototype pollution, code injection)
- @eslint-react/eslint-plugin 3.0.0 -> 4.2.1 (major: remove stale component-hook-factories disables)
- @codemirror/view 6.40.0 -> 6.41.0
- @tanstack/react-query 5.96.0 -> 5.96.1
- @playwright/test 1.59.0 -> 1.59.1 (Windows console fix)
- @storybook/* 10.3.3 -> 10.3.4 (a11y flake fix, CSF4 Vitest fix)
- esbuild 0.27.4 -> 0.27.5
- Full lockfile refresh for transitive deps
- Document bash -c workaround for npm --prefix limitation
@Aureliolo
Copy link
Copy Markdown
Owner

Aureliolo commented Apr 2, 2026

Consolidated into #987 -- all 10 web dependency updates applied there, including @eslint-react/eslint-plugin v3->v4 migration.

@Aureliolo Aureliolo closed this Apr 2, 2026
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot bot commented on behalf of github Apr 2, 2026

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot dependabot bot deleted the dependabot/npm_and_yarn/web/all-326010daac branch April 2, 2026 07:53
@Aureliolo Aureliolo mentioned this pull request Apr 2, 2026
Merged
Aureliolo added a commit that referenced this pull request Apr 2, 2026
@dependabot @Aureliolo
chore: bump web dependencies (lodash, eslint-react v4, storybook, pla…
c344dfb 
…ywright, esbuild, codemirror) (#987)

Consolidates #986 and #990 into a single web dependency update PR.

### Security fixes (lodash 4.17.23 -> 4.18.1)
- **`_.unset` / `_.omit`**: Prototype pollution via
constructor/prototype path traversal (GHSA-f23m-r3pf-42rh)
- **`_.template`**: Code injection via imports keys
(GHSA-r5fr-rjxr-66jc, CVE-2026-4800)

### Package updates
| Package | From | To | Type |
|---------|------|----|------|
| lodash | 4.17.23 | 4.18.1 | security (transitive via inquirer) |
| lodash-es | 4.17.23 | 4.18.1 | security (transitive via lighthouse) |
| @eslint-react/eslint-plugin | 3.0.0 | 4.2.1 | major (rule prefix
flattening, removed component-hook-factories) |
| @codemirror/view | 6.40.0 | 6.41.0 | minor (posAtCoords fix,
cursorScrollMargin) |
| @tanstack/react-query | 5.96.0 | 5.96.1 | patch (DTS rollup fix) |
| @playwright/test | 1.59.0 | 1.59.1 | patch (Windows console regression
fix) |
| @storybook/* (5 pkgs) | 10.3.3 | 10.3.4 | patch (a11y flake fix, CSF4
Vitest fix) |
| esbuild | 0.27.4 | 0.27.5 | patch (metafile regression, async
generator fix) |

### Additional changes
- Full lockfile refresh for all transitive deps
- Removed 11 stale `@eslint-react/component-hook-factories` disable
comments (rule removed in v4)
- Document `bash -c` workaround for `npm --prefix` limitation in
CLAUDE.md

Closes #986

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Aurelio <19254254+Aureliolo@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Aureliolo Aureliolo Awaiting requested review from Aureliolo Aureliolo is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file scope:web Vue 3 dashboard type:chore Maintenance, cleanup, dependency updates

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Aureliolo