build(deps): bump the production-dependencies group across 1 directory with 11 updates by dependabot[bot] · Pull Request #45 · gleaned-app/gleaned

dependabot · 2026-07-27T03:13:26Z

Bumps the production-dependencies group with 11 updates in the / directory:

Package	From	To
@fontsource-variable/caveat	`5.2.8`	`5.3.0`
@fontsource-variable/dm-sans	`5.2.8`	`5.3.0`
@fontsource-variable/lora	`5.2.8`	`5.3.0`
@fontsource-variable/playfair-display	`5.2.8`	`5.3.0`
argon2	`0.44.0`	`0.45.1`
better-sqlite3	`12.11.1`	`13.0.1`
dompurify	`3.4.11`	`3.4.12`
marked	`18.0.5`	`18.0.7`
next	`16.2.10`	`16.2.12`
react	`19.2.7`	`19.2.8`
react-dom	`19.2.7`	`19.2.8`

Updates @fontsource-variable/caveat from 5.2.8 to 5.3.0

Commits

See full diff in compare view

Updates @fontsource-variable/dm-sans from 5.2.8 to 5.3.0

Commits

See full diff in compare view

Updates @fontsource-variable/lora from 5.2.8 to 5.3.0

Commits

See full diff in compare view

Updates @fontsource-variable/playfair-display from 5.2.8 to 5.3.0

Commits

See full diff in compare view

Updates argon2 from 0.44.0 to 0.45.1

Release notes

Sourced from argon2's releases.

v0.45.1

Fixes an issue with v0.45.0 where TypeScript generated types for the hash function as returning Promise<any>

Full Changelog: ranisalt/node-argon2@v0.45.0...v0.45.1

v0.45.0

What's Changed

Drops support for Node 18 and 20 (probably still works, but isn't tested)

Add comparison with node:crypto and clarify parameter usage in README.md by @cbodin in ranisalt/node-argon2#491

Fix compilation on solaris by @matt-fidd in ranisalt/node-argon2#538

New Contributors

@cbodin made their first contribution in ranisalt/node-argon2#491

@matt-fidd made their first contribution in ranisalt/node-argon2#538

Full Changelog: ranisalt/node-argon2@v0.44.0...v0.45.0

Commits

786de71 fix: hash function generated types
e2fe33f fix: update Node.js version to latest in publish job
e27980f fix: revert sync to default in freebsd test
3d0a0b4 fix: change npm publish to npm stage publish in release workflow
c61513f chore: update actions versions
2bc0733 fix: revert sync to default in freebsd build
b012379 chore: update dependencies and devDependencies
d2edf4e fix(tests): add unicode flag to regex assertions in option tests
0eb1db1 Apply npm fixes to package.json
a09b94e Fix compilation on solaris (#538)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for argon2 since your current version.

Updates better-sqlite3 from 12.11.1 to 13.0.1

Release notes

Sourced from better-sqlite3's releases.

v13.0.1

Full Changelog: WiseLibs/better-sqlite3@v13.0.0...v13.0.1

Fixed a regression in parameter binding where it would be overly strict and reject plain objects from other realms (e.g., in jest tests).

v13.0.0

Version 13.0.0 marks a major milestone, as it's the first version of better-sqlite3 to run on the N-API. This means prebuilt binaries should theoretically work across different versions of Node.js and Electron, and perhaps even other runtimes like Bun. As a result, we've removed the deprecated prebuild-install dependency, and now prebuilt binaries are published directly with the better-sqlite3 code itself. If your platform/architecture doesn't have a prebuilt binary, it should compile during install as before.

What's Changed

Refactored codebase to use node-addon-api by @JoshuaWise in WiseLibs/better-sqlite3#1498

Added a new db.explain() method, for running EXPLAIN queries without needing to supply bound parameters.

Added a new preparedStatement.toString() method, for getting the expanded SQL of a prepared statement.

Fix SqliteError cross-realm and Error.isError compatibility by @dennismutuku2005 in WiseLibs/better-sqlite3#1473

New Contributors

@dennismutuku2005 made their first contribution in WiseLibs/better-sqlite3#1473

Full Changelog: WiseLibs/better-sqlite3@v12.12.0...v13.0.0

v12.12.0

What's Changed

[!WARNING]

BREAKING: Starting with Electron v43, binary assets will require glibc 2.41 or higher on Linux hosts.

Update SQLite to version 3.53.3 by @JoshuaWise in WiseLibs/better-sqlite3#1492

Utilize node:20-trixie for Electron v43 and onwards by @neoxpert in WiseLibs/better-sqlite3#1495

Full Changelog: WiseLibs/better-sqlite3@v12.11.2...v12.12.0

v12.11.2

What's Changed

Add support for electron v43 prebuilds by @m4heshd in WiseLibs/better-sqlite3#1490

Full Changelog: WiseLibs/better-sqlite3@v12.11.1...v12.11.2

Commits

6efdbc5 13.0.1
32ee0ab Merge remote-tracking branch 'origin/master'
bce8300 fixed overly strict regression in parameter binding
ecfe2f7 13.0.0
ae19080 fixed typos
57d4bbb implemented Database#explain()
49fd7e6 added docs for Statement#toString()
1cb18ec implemented Statement#toString()
af60f6b updated github workflow dep versions
6ffd750 fixed tests for SqliteError
Additional commits viewable in compare view

Install script changes

This version modifies install script that runs during installation. Review the package contents before updating.

Updates dompurify from 3.4.11 to 3.4.12

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.12

Fixed an issue where a hook would not get called for custom elements, thanks @Rikuxx0

Hardened the handling of hooks removing elements, @mkrause-bee360

Added support for a few new SVG attributes, thanks @cbn-falias & @Develop-KIM

Hardened the handling of declarative partial updates

Updated the documentation is several spots, README, wiki, etc.

Bumped several dependencies where possible

Commits

a9ca1e5 release: 3.4.12 (#1537)
See full diff in compare view

Updates marked from 18.0.5 to 18.0.7

Release notes

Sourced from marked's releases.

v18.0.7

18.0.7 (2026-07-21)

Bug Fixes

Avoid O(n^2) backtracking in HTML block close and tilde interrupt regexes (#4014) (f945fc5), closes #3991

Avoid O(n^2) masked source rebuild in inline tokenizer (#4017) (9154f8f)

keep empty list after blockquote as a sibling block (#4004) (3f144a0)

preserve code spans adjacent to tildes (#4012) (0de7188)

Recognize setext headings whose first line starts with # (#4015) (f056437), closes #1

treat a line of only tabs as a blank line between paragraphs (#4007) (bc2f121)

v18.0.6

18.0.6 (2026-07-09)

Bug Fixes

Avoid O(n^2) backtracking in inline link href regex (#4013) (a009808)

Fix ordered lists after blockquotes (#4003) (33928d0)

keep trailing text on HTML block close line for PI, declarations, and CDATA (#3991) (bbb84c8)

Commits

a8971a1 chore(release): 18.0.7 [skip ci]
d899c2e chore(deps): bump actions/setup-node from 6 to 7 (#4025)
7fbf82e chore(deps-dev): bump semantic-release from 25.0.7 to 25.0.8 (#4026)
738edf2 chore(deps-dev): bump brace-expansion from 5.0.2 to 5.0.6 (#4027)
9154f8f fix: Avoid O(n^2) masked source rebuild in inline tokenizer (#4017)
f945fc5 fix: Avoid O(n^2) backtracking in HTML block close and tilde interrupt regexe...
3f144a0 fix: keep empty list after blockquote as a sibling block (#4004)
0de7188 fix: preserve code spans adjacent to tildes (#4012)
f056437 fix: Recognize setext headings whose first line starts with # (#4015)
12bfa94 chore(deps-dev): bump semantic-release from 25.0.5 to 25.0.7 (#4020)
Additional commits viewable in compare view

Updates next from 16.2.10 to 16.2.12

Release notes

Sourced from next's releases.

v16.2.12

What's Changed

Backport/docs fixes 16.2 - July round by @icyJoseph in vercel/next.js#96031

[Backport] Fixes to support TypeScript 7 by @lukesandberg in vercel/next.js#95831

Full Changelog: vercel/next.js@v16.2.11...v16.2.12

v16.2.11

This release contains security fixes for the following advisories:

High:

Denial of Service in App Router using Server Actions

Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Server-Side Request Forgery in Server Actions on custom servers

Moderate:

Cache confusion of response bodies for requests with bodies

Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Denial of Service in the Image Optimization API using SVGs

Unauthenticated disclosure of internal Server Function endpoints

Unbounded Server Action payload in Edge runtime

Commits

2234717 v16.2.12
957f5ed [Backport] Fixes to support TypeScript 7 (#95831)
b56eb16 Backport/docs fixes 16.2 - July round (#96031)
9beca08 v16.2.11
3c48c7a [16.x] Fix Turbopack middleware matcher with i18n single locale
ac1eff3 [16.x] Improve performance of checking valid MPA form submissions
9a4651e [16.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
b512063 [16.x] Set correct origin for internal redirects in custom server
d303326 [16.x] Ensure exotic rewrite param values are properly encoded
73b9487 [16.x] fix(fetch-cache): key fetch(Request, init) by the effective request
Additional commits viewable in compare view

Updates react from 19.2.7 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

Performance improvements when decoding (#37087 by @eps1lon)

Commits

1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
See full diff in compare view

Updates react-dom from 19.2.7 to 19.2.8

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

Performance improvements when decoding (#37087 by @eps1lon)

Commits

1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…y with 11 updates Bumps the production-dependencies group with 11 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@fontsource-variable/caveat](https://github.com/fontsource/font-files/tree/HEAD/fonts/variable/caveat) | `5.2.8` | `5.3.0` | | [@fontsource-variable/dm-sans](https://github.com/fontsource/font-files/tree/HEAD/fonts/variable/dm-sans) | `5.2.8` | `5.3.0` | | [@fontsource-variable/lora](https://github.com/fontsource/font-files/tree/HEAD/fonts/variable/lora) | `5.2.8` | `5.3.0` | | [@fontsource-variable/playfair-display](https://github.com/fontsource/font-files/tree/HEAD/fonts/variable/playfair-display) | `5.2.8` | `5.3.0` | | [argon2](https://github.com/ranisalt/node-argon2) | `0.44.0` | `0.45.1` | | [better-sqlite3](https://github.com/WiseLibs/better-sqlite3) | `12.11.1` | `13.0.1` | | [dompurify](https://github.com/cure53/DOMPurify) | `3.4.11` | `3.4.12` | | [marked](https://github.com/markedjs/marked) | `18.0.5` | `18.0.7` | | [next](https://github.com/vercel/next.js) | `16.2.10` | `16.2.12` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.7` | `19.2.8` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.7` | `19.2.8` | Updates `@fontsource-variable/caveat` from 5.2.8 to 5.3.0 - [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md) - [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/variable/caveat) Updates `@fontsource-variable/dm-sans` from 5.2.8 to 5.3.0 - [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md) - [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/variable/dm-sans) Updates `@fontsource-variable/lora` from 5.2.8 to 5.3.0 - [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md) - [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/variable/lora) Updates `@fontsource-variable/playfair-display` from 5.2.8 to 5.3.0 - [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md) - [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/variable/playfair-display) Updates `argon2` from 0.44.0 to 0.45.1 - [Release notes](https://github.com/ranisalt/node-argon2/releases) - [Commits](ranisalt/node-argon2@v0.44.0...v0.45.1) Updates `better-sqlite3` from 12.11.1 to 13.0.1 - [Release notes](https://github.com/WiseLibs/better-sqlite3/releases) - [Commits](WiseLibs/better-sqlite3@v12.11.1...v13.0.1) Updates `dompurify` from 3.4.11 to 3.4.12 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.4.11...3.4.12) Updates `marked` from 18.0.5 to 18.0.7 - [Release notes](https://github.com/markedjs/marked/releases) - [Commits](markedjs/marked@v18.0.5...v18.0.7) Updates `next` from 16.2.10 to 16.2.12 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.2.10...v16.2.12) Updates `react` from 19.2.7 to 19.2.8 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react) Updates `react-dom` from 19.2.7 to 19.2.8 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom) --- updated-dependencies: - dependency-name: "@fontsource-variable/caveat" dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@fontsource-variable/dm-sans" dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@fontsource-variable/lora" dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@fontsource-variable/playfair-display" dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: argon2 dependency-version: 0.45.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: better-sqlite3 dependency-version: 13.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: dompurify dependency-version: 3.4.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: marked dependency-version: 18.0.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: next dependency-version: 16.2.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: react dependency-version: 19.2.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: react-dom dependency-version: 19.2.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 27, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): bump the production-dependencies group across 1 directory with 11 updates - #45

build(deps): bump the production-dependencies group across 1 directory with 11 updates#45
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-f4c2dcfea3

dependabot Bot commented on behalf of github Jul 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 27, 2026

v0.45.1

v0.45.0

What's Changed

New Contributors

v13.0.1

v13.0.0

What's Changed

New Contributors

v12.12.0

What's Changed

BREAKING: Starting with Electron v43, binary assets will require glibc 2.41 or higher on Linux hosts.

v12.11.2

What's Changed

DOMPurify 3.4.12

v18.0.7

18.0.7 (2026-07-21)

Bug Fixes

v18.0.6

18.0.6 (2026-07-09)

Bug Fixes

v16.2.12

What's Changed

v16.2.11

19.2.8 (July 21st, 2026)

React Server Components

19.2.8 (July 21st, 2026)

React Server Components

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants