Skip to content

build(deps): bump the production-dependencies group across 1 directory with 6 updates - #16

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-fda869f580
Open

build(deps): bump the production-dependencies group across 1 directory with 6 updates#16
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-fda869f580

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 24, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the production-dependencies group with 6 updates in the / directory:

Package From To
@azure/identity 4.13.1 4.13.2
lucide-react 0.441.0 0.577.0
mammoth 1.12.0 1.12.1
openai 7.4.0 7.5.0
react-hook-form 7.84.0 7.86.0
tsx 4.23.9 4.23.12

Updates @azure/identity from 4.13.1 to 4.13.2

Changelog

Sourced from @​azure/identity's changelog.

4.13.2 (2026-08-12)

Other Changes

  • Bumped the minimum @azure/msal-node dependency to ^5.1.5 so installs no longer resolve older 5.1.x versions that pull in the vulnerable uuid@8.3.0 transitive dependency. #39569
  • Replaced shell-based developer credential commands with safe, structured process execution. #39279
  • Migrated platform-specific module resolution to #platform/* imports. #38309
Commits
  • ffeacaf Migrate @​azure/identity from polyfillSuffix to #platform/* imports
  • 3ec2003 [core] Add safe child process execution
  • 1f7253a Update package.json
  • 4b6cf67 Update test expectation
  • 14350c8 Format packages
  • 4fd7288 Update all missing configuration files
  • 8490453 [Identity] Bump @​azure/msal-node to ^5.1.5 to drop vulnerable uuid transitive...
  • d96ae18 Identity GA 4.13.1
  • a46a830 [ESLint] Restore no-unassigned-vars recommended rule to error (#39460)
  • 5316d04 [core] Add safe child process execution (#39279)
  • Additional commits viewable in compare view

Updates lucide-react from 0.441.0 to 0.577.0

Release notes

Sourced from lucide-react's releases.

Version 0.577.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@0.576.0...0.577.0

Version 0.576.0

What's Changed

Full Changelog: lucide-icons/lucide@0.575.0...0.576.0

Version 0.575.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@0.573.0...0.575.0

Version 0.574.0

What's Changed

New Contributors

... (truncated)

Commits
  • f6c0d06 chore(deps): bump rollup from 4.53.3 to 4.59.0 (#4106)
  • 67c0485 feat(scripts): added helper script to automatically update OpenCollective bac...
  • b6ed43d feat(packages): Added aria-hidden fallback for decorative icons to all packag...
  • 076e0bb chore(dependencies): Update dependencies (#3809)
  • 80d6f73 fix(icons): Rename fingerprint icon to fingerprint-pattern (#3767)
  • 1cfb3ff chore(deps-dev): bump vite from 6.3.5 to 6.3.6 (#3611)
  • e71198d chore: icon alias improvements (#2861)
  • 3e644fd chore(scripts): Refactor scripts to typescript (#3316)
  • 19fa01b build(deps-dev): bump vite from 6.3.2 to 6.3.4 (#3181)
  • 03eb862 use implicit return in react package (#2325)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for lucide-react since your current version.


Updates mammoth from 1.12.0 to 1.12.1

Changelog

Sourced from mammoth's changelog.

1.12.1

  • Fix: on Windows, when an image's content type includes a backslash in the subpart, files may be written outside of the directory set by --output-dir.

  • Detect and ignore numbering levels that use numStyleLink to refer to themselves.

Commits
  • e3b9cec Bump version to 1.12.1
  • c69ea62 Ignore numbering levels that use numStyleLink to refer to themselves
  • fbf5e22 Check image content type for backslashes
  • 1a495a9 Add note on performance
  • ee59684 Remove donations section
  • See full diff in compare view

Updates openai from 7.4.0 to 7.5.0

Release notes

Sourced from openai's releases.

v7.5.0

7.5.0 (2026-08-17)

Features

  • add Bedrock Runtime endpoint support (SDK-290) (#2348) (4a199af)
  • api: add new Daybreak and gpt-5.6-cyber model identifiers (9a38e63)
  • api: add new Daybreak and gpt-5.6-cyber model identifiers (#2278) (9a38e63)
  • api: Add ServiceTier and ImageDetail types (#2364) (602d481)
  • api: add WebSocket stream IDs (#2314) (156a8db)
  • api: add workload identity access token issued event (#2307) (322a5b1)
  • api: deprecate Sora video APIs (#2313) (4424b40)
  • api: Ultrafast tier, structured MCP and websocket errors, separate websocket events (#2332) (a3deafb)

Bug Fixes

  • api: clarify audio upload metadata requirements (#2279) (34ecf3f)
  • audio: prevent microphone leaks and playback pipe deadlocks (#2339) (1c692fe)
  • audio: reject ffplay spawn errors (#2012) (6d42d4d)
  • auth: reject redirects during workload identity token exchange (#2321) (240385e)
  • auth: reject unsafe workload-identity token expirations (#2345) (1f0349d)
  • avoid TypeError in toFile for Responses without a URL (#2311) (3313f54)
  • await webhook verification in README examples (#2302) (0fe7ad0)
  • azure: honor explicit browser denial for Entra token providers (#2328) (9d47510)
  • azure: preserve model-to-deployment mapping for images.edit (#1918) (6c207c6)
  • azure: prevent API-key disclosure across HTTP redirects (#2320) (f36c418)
  • azure: prevent deployment path traversal (#2337) (a9d9d41)
  • bedrock: safely sign inherited query parameter names (#2375) (3f8d5cc)
  • chat: support custom tool calls in parser and ChatCompletionStream (#2023) (6fa9152)
  • client: handle empty JSON response body without content-length (#1998) (b6447e9)
  • configure Bash for pnpm scripts on Windows (#2330) (f5a0ad1)
  • deps: remediate Dependabot and fixture vulnerabilities (#2282) (783da8f)
  • embedding: response type for base64 encoding format (#1554) (ef69801)
  • export AzureClientOptions (#1760) (511bf6d), closes #1735
  • export workload identity helpers from openai/auth (#2344) (af8f14f)
  • fail ecosystem CI when live credentials are missing (#2349) (a47dc75)
  • format: restore formatting for generated SDK files (#2089) (6d69d4b)
  • harden runTools against inherited function names (#2333) (f4496d1)
  • honor defaultHeaders null for helper method header (#1857) (8eab09a)
  • include items for strict Zod v3 any arrays (#2357) (4c32089)
  • isolate Vercel ecosystem tests per request (#2359) (2831290)
  • keep streamed Responses output text linear and canonical (#2354) (6827a40)
  • lint: recognize Castiron-generated headers (#2124) (cf6237f)
  • lint: restore generated SDK lint rules (#2126) (6b8162c)
  • parse empty chat content when present (#2331) (53dd723)
  • parser: recognize raw json_schema response format in auto-parsing checks (#2015) (fbd2541)
  • pass file batch helper options through (#1855) (05ce028)
  • preserve File-like metadata in toFile (#1883) (ba1a781)

... (truncated)

Changelog

Sourced from openai's changelog.

7.5.0 (2026-08-17)

Features

  • add Bedrock Runtime endpoint support (SDK-290) (#2348) (4a199af)
  • api: add new Daybreak and gpt-5.6-cyber model identifiers (9a38e63)
  • api: add new Daybreak and gpt-5.6-cyber model identifiers (#2278) (9a38e63)
  • api: Add ServiceTier and ImageDetail types (#2364) (602d481)
  • api: add WebSocket stream IDs (#2314) (156a8db)
  • api: add workload identity access token issued event (#2307) (322a5b1)
  • api: deprecate Sora video APIs (#2313) (4424b40)
  • api: Ultrafast tier, structured MCP and websocket errors, separate websocket events (#2332) (a3deafb)

Bug Fixes

  • api: clarify audio upload metadata requirements (#2279) (34ecf3f)
  • audio: prevent microphone leaks and playback pipe deadlocks (#2339) (1c692fe)
  • audio: reject ffplay spawn errors (#2012) (6d42d4d)
  • auth: reject redirects during workload identity token exchange (#2321) (240385e)
  • auth: reject unsafe workload-identity token expirations (#2345) (1f0349d)
  • avoid TypeError in toFile for Responses without a URL (#2311) (3313f54)
  • await webhook verification in README examples (#2302) (0fe7ad0)
  • azure: honor explicit browser denial for Entra token providers (#2328) (9d47510)
  • azure: preserve model-to-deployment mapping for images.edit (#1918) (6c207c6)
  • azure: prevent API-key disclosure across HTTP redirects (#2320) (f36c418)
  • azure: prevent deployment path traversal (#2337) (a9d9d41)
  • bedrock: safely sign inherited query parameter names (#2375) (3f8d5cc)
  • chat: support custom tool calls in parser and ChatCompletionStream (#2023) (6fa9152)
  • client: handle empty JSON response body without content-length (#1998) (b6447e9)
  • configure Bash for pnpm scripts on Windows (#2330) (f5a0ad1)
  • deps: remediate Dependabot and fixture vulnerabilities (#2282) (783da8f)
  • embedding: response type for base64 encoding format (#1554) (ef69801)
  • export AzureClientOptions (#1760) (511bf6d), closes #1735
  • export workload identity helpers from openai/auth (#2344) (af8f14f)
  • fail ecosystem CI when live credentials are missing (#2349) (a47dc75)
  • format: restore formatting for generated SDK files (#2089) (6d69d4b)
  • harden runTools against inherited function names (#2333) (f4496d1)
  • honor defaultHeaders null for helper method header (#1857) (8eab09a)
  • include items for strict Zod v3 any arrays (#2357) (4c32089)
  • isolate Vercel ecosystem tests per request (#2359) (2831290)
  • keep streamed Responses output text linear and canonical (#2354) (6827a40)
  • lint: recognize Castiron-generated headers (#2124) (cf6237f)
  • lint: restore generated SDK lint rules (#2126) (6b8162c)
  • parse empty chat content when present (#2331) (53dd723)
  • parser: recognize raw json_schema response format in auto-parsing checks (#2015) (fbd2541)
  • pass file batch helper options through (#1855) (05ce028)
  • preserve File-like metadata in toFile (#1883) (ba1a781)
  • preserve skill upload paths without buffering native files (#2303) (30b9c41)

... (truncated)

Commits
  • 5b96016 release: 7.5.0 (#2087)
  • bfcccad fix(security): prevent Bedrock bearer credential disclosure across redirects ...
  • 3f8d5cc fix(bedrock): safely sign inherited query parameter names (#2375)
  • 16172a4 chore(deps-dev): bump oxfmt from 0.61.0 to 0.62.0 (#2373)
  • 6320b64 chore(deps-dev): bump ts-jest from 29.4.11 to 29.4.12 (#2374)
  • b49b227 chore(deps-dev): bump webpack from 5.108.4 to 5.109.2 in /ecosystem-tests/ts-...
  • 2cc57c3 chore(deps-dev): bump @​aws-sdk/credential-provider-node from 3.972.77 to 3.97...
  • 6983363 chore(deps-dev): bump @​cloudflare/workers-types from 5.20260804.1 to 5.202608...
  • 50db5db chore(deps-dev): bump @​types/node from 24.12.4 to 26.2.0 (#2370)
  • 7259f9f chore(deps-dev): bump html-webpack-plugin from 5.6.7 to 5.6.8 in /ecosystem-t...
  • Additional commits viewable in compare view

Updates react-hook-form from 7.84.0 to 7.86.0

Release notes

Sourced from react-hook-form's releases.

Version 7.86.0

✨ Features

🐞 Fixes

  • Fix useWatch returning stale values when the watched name changes to null. (#13668)
  • Fix unregister keepDirty behavior. (#13669)
  • Fix setValues for fields registered under object or array values. (#13667)
  • Fix Controller notifications for field array item roots. (#13665)
  • Fix validation state checks. (#13661)
  • Fix setCustomValidity with criteriaMode: 'all'. (#13655)
  • Fix File, Blob, and FileList handling in flatten. (#13652)
  • Fix stale errors and touched state after updating a field array item. (#13650)
  • Fix stale field names leaking into persisted formState. (#13649)

🚀 Performance

  • Improve createFormControl performance. (#13648)
  • Improve cloneObject performance.
  • Avoid unnecessary value cloning in unregister. (#13662)
  • Improve performance in onChange-heavy workloads.

🧹 Chores & Refactoring

  • Remove unnecessary any usage. (#13660)
  • Improve TypeScript handling around checkbox values. (#13659)
  • Improve UUID generation. (#13658)
  • Clean up repository structure and APIs. (#13657)
  • Remove unreachable revalidation logic in useFieldArray. (#13654)

Thanks to @​dfedoryshchev, @​zigzagdev, @​official-burak, @​Jaybhade, @​candymask0712, and @​bluebill1049 for their contributions! 🎉

Version 7.85.0

✨ Improvements

  • support React <Activity /> (#13633)

🐞 Fixes

  • fix min/max validation being skipped for valueAsDate fields (#13646)
  • fix field array root errors being lost during append, prepend, insert, and remove (#13645)
  • fix stale renders recreating field array paths after field array actions (#13644)
  • fix useWatch preferring form defaultValues over the hook's own defaultValue (#13635)
  • fix setValue emitting duplicate values state notifications (#13637)
  • fix TypeScript getFieldState error resolution for field paths (#13632)

🏗️ Chores

... (truncated)

Changelog

Sourced from react-hook-form's changelog.

[7.86.0] - 2026-08-22

Added

  • Type-safe getErrors method

Performance

  • Improve createFormControl
  • Improve clone object check
  • Avoid cloning values in unregister without subscribers

Fixed

  • Field array update leaving stale errors and touched state at the updated index
  • flatten discarding File and Blob values instead of treating them as leaf nodes
  • validateField not passing the field error to setCustomValidity when criteriaMode is all
  • hasValidation treating falsy but valid values (min: 0, max: 0, minLength: 0, maxLength: 0, required: '') as no validation
  • setValue targeting a nested leaf not notifying a Controller registered on a field array item root
  • setValues not updating fields registered under an object or array value
  • useWatch returning a stale value on name change when the new value is null
  • unregister inverting keepDirty when broadcasting isDirty

[7.85.0] - 2026-08-08

Added

  • Support <Activity />

Fixed

  • getFieldState error resolution from a field path
  • useWatch discarding useForm({ defaultValues }) in favor of its own defaultValue before the form mounts
  • setValue emitting a duplicate values state notification for fields without a native input ref
  • Stale render re-creating a field array path vacated by an array action
  • useFieldArray root-level error (errors.name.root) being lost on append/prepend/insert/remove
  • min/max validation being skipped for valueAsDate fields
Commits
  • 33860b4 7.86.0
  • e5b117b 🐞 fix(unregister): keepDirty inverted when broadcasting isDirty (#13669)
  • 64ec9bc 🐞 fix: useWatch returns stale value on name change when new value is null (#1...
  • dead471 🦌 fix(setValues): update fields registered under an object or array value (#1...
  • 1ca83d2 🪖 close #13664 notify a Controller registered on a field array item root when...
  • 06e4efd 🚚 perf: avoid cloning values in unregister without subscribers (#13662)
  • 9b7af71 🐞 fix has validation check issue (#13661)
  • 51e3309 🗜️ chore: remove any (#13660)
  • 1c5ff08 🤖 fix ts error ignore on getCheckboxValues (#13659)
  • 7223514 🧛 improve uuid function (#13658)
  • Additional commits viewable in compare view

Updates tsx from 4.23.9 to 4.23.12

Release notes

Sourced from tsx's releases.

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

  • shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

This release is also available on:

v4.23.11

4.23.11 (2026-08-07)

Bug Fixes

  • preserve async ESM require fallback (55cbece)

This release is also available on:

v4.23.10

4.23.10 (2026-08-07)

Bug Fixes

This release is also available on:

Commits
  • ed9d330 fix: shim import.meta when tokens are split by comments or newlines (#829)
  • 651f5be test: cover CommonJS TypeScript import.meta paths
  • bd3bc64 test: cover CommonJS loader source fallback
  • 55cbece fix: preserve async ESM require fallback
  • 6c5ba85 docs: document CommonJS default interop
  • ec1bcd5 fix: support nyc coverage discovery (#710)
  • b6e5b48 docs: clarify CommonJS default imports
  • See full diff in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 24, 2026
@dependabot
build(deps): bump the production-dependencies group across 1 director…
60a280a 
…y with 6 updates

Bumps the production-dependencies group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@azure/identity](https://github.com/Azure/azure-sdk-for-js/tree/HEAD/sdk/identity/identity) | `4.13.1` | `4.13.2` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `0.441.0` | `0.577.0` |
| [mammoth](https://github.com/mwilliamson/mammoth.js) | `1.12.0` | `1.12.1` |
| [openai](https://github.com/openai/openai-node) | `7.4.0` | `7.5.0` |
| [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.84.0` | `7.86.0` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.9` | `4.23.12` |



Updates `@azure/identity` from 4.13.1 to 4.13.2
- [Release notes](https://github.com/Azure/azure-sdk-for-js/releases)
- [Changelog](https://github.com/Azure/azure-sdk-for-js/blob/@azure/identity_4.13.2/sdk/identity/identity/CHANGELOG.md)
- [Commits](https://github.com/Azure/azure-sdk-for-js/commits/@azure/identity_4.13.2/sdk/identity/identity)

Updates `lucide-react` from 0.441.0 to 0.577.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/0.577.0/packages/lucide-react)

Updates `mammoth` from 1.12.0 to 1.12.1
- [Release notes](https://github.com/mwilliamson/mammoth.js/releases)
- [Changelog](https://github.com/mwilliamson/mammoth.js/blob/master/NEWS)
- [Commits](mwilliamson/mammoth.js@1.12.0...1.12.1)

Updates `openai` from 7.4.0 to 7.5.0
- [Release notes](https://github.com/openai/openai-node/releases)
- [Changelog](https://github.com/openai/openai-node/blob/main/CHANGELOG.md)
- [Commits](openai/openai-node@v7.4.0...v7.5.0)

Updates `react-hook-form` from 7.84.0 to 7.86.0
- [Release notes](https://github.com/react-hook-form/react-hook-form/releases)
- [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md)
- [Commits](react-hook-form/react-hook-form@v7.84.0...v7.86.0)

Updates `tsx` from 4.23.9 to 4.23.12
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.23.9...v4.23.12)

---
updated-dependencies:
- dependency-name: "@azure/identity"
  dependency-version: 4.13.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: lucide-react
  dependency-version: 0.577.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: mammoth
  dependency-version: 1.12.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: openai
  dependency-version: 7.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: react-hook-form
  dependency-version: 7.85.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: tsx
  dependency-version: 4.23.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/production-dependencies-fda869f580 branch from a400994 to 60a280a Compare August 28, 2026 08:51
@vladpm Vlad G (vladpm) self-assigned this Aug 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@vladpm Vlad G (vladpm)

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@vladpm