Skip to content

Update ui deps sync #684

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Update ui deps sync #684

wants to merge 1 commit into from
+241 −220

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Oct 6, 2025 •
edited
Loading

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
@rollup/plugin-alias (source) ^5.0.0 -> ^5.1.1 age adoption passing confidence
@rollup/plugin-commonjs (source) ^28.0.0 -> ^28.0.6 age adoption passing confidence
@rollup/plugin-json (source) ^6.0.0 -> ^6.1.0 age adoption passing confidence
@rollup/plugin-node-resolve (source) ^16.0.0 -> ^16.0.2 age adoption passing confidence
@rollup/plugin-replace (source) ^6.0.0 -> ^6.0.2 age adoption passing confidence
@rollup/plugin-typescript (source) ^12.0.0 -> ^12.1.4 age adoption passing confidence
@types/file-saver (source) ^2.0.1 -> ^2.0.7 age adoption passing confidence
@types/node (source) ^20.0.0 -> ^20.19.19 age adoption passing confidence
@types/resize-observer-browser (source) ^0.1.5 -> ^0.1.11 age adoption passing confidence
@types/semver (source) ^7.5.7 -> ^7.7.1 age adoption passing confidence
@upstash/redis 1.25.2 -> 1.35.5 age adoption passing confidence
@upstash/redis 1.25.2 -> 1.35.5 age adoption passing confidence
autoprefixer ^10.4.2 -> ^10.4.21 age adoption passing confidence
ava (source) ^6.1.2 -> ^6.4.1 age adoption passing confidence
highlight.js (source) ^11.0.0 -> ^11.11.1 age adoption passing confidence
highlightjs-solidity (source) ^2.0.0 -> ^2.0.6 age adoption passing confidence
openai 5.13.1 -> 5.23.2 age adoption passing confidence
openai 5.13.1 -> 5.23.2 age adoption passing confidence
postcss (source) ^8.2.8 -> ^8.5.6 age adoption passing confidence
postcss-load-config ^6.0.0 -> ^6.0.1 age adoption passing confidence
rollup (source) ^4.0.0 -> ^4.52.4 age adoption passing confidence
rollup-plugin-livereload ^2.0.0 -> ^2.0.5 age adoption passing confidence
rollup-plugin-svelte ^7.0.0 -> ^7.2.3 age adoption passing confidence
rollup-plugin-terser ^7.0.0 -> ^7.0.2 age adoption passing confidence
semver ^7.6.0 -> ^7.7.3 age adoption passing confidence
sirv-cli ^3.0.0 -> ^3.0.1 age adoption passing confidence
svelte-check ^3.0.1 -> ^3.8.6 age adoption passing confidence
svelte-preprocess ^5.0.0 -> ^5.1.4 age adoption passing confidence
tailwindcss (source) ^3.0.15 -> ^3.4.18 age adoption passing confidence
tippy.js (source) ^6.3.1 -> ^6.3.7 age adoption passing confidence
tslib (source) ^2.0.0 -> ^2.8.1 age adoption passing confidence
typescript (source) ^5.0.0 -> ^5.9.3 age adoption passing confidence
util ^0.12.4 -> ^0.12.5 age adoption passing confidence

Release Notes

rollup/plugins (@​rollup/plugin-node-resolve)

v16.0.2

2025-10-04

Bugfixes
  • fix: error thrown with empty entry (#​1893)
upstash/upstash-redis (@​upstash/redis)

v1.35.5

Compare Source

What's Changed

New Contributors

Full Changelog: upstash/redis-js@v1.35.4...v1.35.5

v1.35.4

Compare Source

What's Changed

New Contributors

Full Changelog: upstash/redis-js@v1.35.3...v1.35.4

v1.35.3

Compare Source

What's Changed

New Contributors

Full Changelog: upstash/redis-js@v1.35.2...v1.35.3

v1.35.2

Compare Source

What's Changed

New Contributors

Full Changelog: upstash/redis-js@v1.35.1...v1.35.2

v1.35.1

Compare Source

What's Changed

Full Changelog: upstash/redis-js@v1.35.0...v1.35.1

v1.35.0

Compare Source

What's Changed

Features:

Fixes:

Full Changelog: upstash/redis-js@v1.34.9...v1.35.0

v1.34.9

Compare Source

What's Changed

Fixes:

Full Changelog: upstash/redis-js@v1.34.8...v1.34.9

v1.34.8

Compare Source

What's Changed

Full Changelog: upstash/redis-js@v1.34.7...v1.34.8

v1.34.7

Compare Source

What's Changed

Features:

Fixes:

Full Changelog: upstash/redis-js@v1.34.6...v1.34.7

v1.34.6

Compare Source

What's Changed

New Contributors

Full Changelog: upstash/redis-js@v1.34.5...v1.34.6

v1.34.5

Compare Source

What's Changed

Full Changelog: upstash/redis-js@v1.34.4...v1.34.5

v1.34.4

Compare Source

What's Changed

Features:

Fixes:

New Contributors

Full Changelog: upstash/redis-js@v1.34.3...v1.34.4

v1.34.3

Compare Source

What's Changed
Changes
Vercel Env Variables

@​upstash/redis sdk now also works when the env variables of Vercel KV are set:

KV_REST_API_URL
KV_REST_API_TOKEN
Granular Auto Pipeline Errors

When the pipeline of the auto pipeline failed, it threw an error for all commands in the auto pipeline. This is not ideal for the use case of auto pipeline. Now, they are raised seperately.

This required changing the exec method of Pipeline. It's not possible to return the errors instead of raising them. See the docstring for more details.

Remove throw on missing URL/Token

We updated the SDK to throw error if the URL or the token is not set in v1.31.1, in PR #​1065. This causes the Vercel builds in Turbo repo to fail unless the turbo.json is updated.

Now, we only print warning logs if the credentials are missing, instead of throwing.

Full Changelog: upstash/redis-js@v1.34.2...v1.34.3

v1.34.2

Compare Source

What's Changed

Full Changelog: upstash/redis-js@v1.34.1...v1.34.2

v1.34.1

Compare Source

What's Changed
New Contributors

Full Changelog: upstash/redis-js@v1.34.0...v1.34.1

v1.34.0

Compare Source

What's Changed

Full Changelog: upstash/redis-js@v1.33.0...v1.34.0

v1.33.0

Compare Source

What's Changed

Full Changelog: upstash/redis-js@v1.32.0...v1.33.0

v1.32.0

Compare Source

What's Changed
New Contributors

Full Changelog: upstash/redis-js@v1.31.6...v1.32.0

v1.31.6

Compare Source

What's Changed

Full Changelog: upstash/redis-js@v1.31.5...v1.31.6

v1.31.5

Compare Source

What's Changed

Full Changelog: upstash/redis-js@v1.31.4...v1.31.5

v1.31.4

Compare Source

What's Changed

After this patch, cursor field in the SCAN, HSCAN, SSCAN and ZSCAN will always be string even if deserialization is enabled.

Full Changelog: upstash/redis-js@v1.31.3...v1.31.4

v1.31.3

Compare Source

What's Changed

Full Changelog: upstash/redis-js@v1.31.2...v1.31.3

v1.31.2

Compare Source

What's Changed

Full Changelog: upstash/redis-js@v1.31.1...v1.31.2

v1.31.1

Compare Source

What's Changed
New Contributors

Full Changelog: upstash/redis-js@v1.31.0...v1.31.1

v1.31.0

Compare Source

What's Changed

Full Changelog: upstash/redis-js@v1.30.1...v1.31.0

v1.30.1

Compare Source

What's Changed
New Contributors

Full Changelog: upstash/redis-js@v1.30.0...v1.30.1

v1.30.0

Compare Source

What's Changed

Full Changelog: upstash/redis-js@v1.29.0...v1.30.0

v1.29.0

Compare Source

What's Changed

New Contributors

Full Changelog: upstash/redis-js@v1.28.4...v1.29.0

v1.28.4

Compare Source

What's Changed

Full Changelog: upstash/redis-js@v1.28.3...v1.28.4

v1.28.3

Compare Source

What's Changed

Full Changelog: upstash/redis-js@v1.28.2...v1.28.3

  • Added generics for JSONMGet and JSONGet
  • Run formatter for the entire project
  • Add husky for hooks

v1.28.2

Compare Source

What's Changed

Full Changelog: upstash/redis-js@v1.28.1...v1.28.2

v1.28.1

Compare Source

What's Changed

Full Changelog: upstash/redis-js@v1.28.0...v1.28.1

v1.28.0

Compare Source

What's Changed

Full Changelog: upstash/redis-js@v1.27.1...v1.28.0

v1.27.1

Compare Source

What's Changed

Full Changelog: upstash/redis-js@v1.27.0...v1.27.1

v1.27.0

Compare Source

What's Changed

Full Changelog: upstash/redis-js@v1.26.0...v1.27.0

openai/openai-node (openai)

v5.23.2

Compare Source

Full Changelog: v5.23.2...v6.0.0

⚠ BREAKING CHANGES
  • api: ResponseFunctionToolCallOutputItem.output and ResponseCustomToolCallOutput.output now return string | Array<ResponseInputText | ResponseInputImage | ResponseInputFile> instead of string only. This may break existing callsites that assume output is always a string.
Features
  • api: Support images and files for function call outputs in responses, BatchUsage (abe56f8)
Chores

v5.23.1

Compare Source

Full Changelog: v5.23.1...v5.23.2

Chores
  • env-tests: upgrade jest-fixed-jsdom 0.0.9 -> 0.0.10 (6d6d0b0)
  • internal: codegen related update (1b684af)
  • internal: ignore .eslintcache (da9e146)

v5.23.0

Compare Source

Full Changelog: v5.23.0...v5.23.1

Bug Fixes
  • realtime: remove beta header from GA classes (a5e9e70)
Performance Improvements
Chores
  • internal: fix incremental formatting in some cases (166d28f)
  • internal: remove deprecated compilerOptions.baseUrl from tsconfig.json (dfab408)

v5.22.1

Compare Source

Full Changelog: v5.22.1...v5.23.0

Features

v5.22.0

Compare Source

Full Changelog:

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested a review from a team as a code owner October 6, 2025 07:39
@coderabbitai coderabbitai
Copy link
Contributor

coderabbitai bot commented Oct 6, 2025 •
edited
Loading

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Comment @coderabbitai help to get the list of available commands and usage tips.

@renovate renovate bot force-pushed the renovate/ui-deps-sync branch from 955b98a to 335f059 Compare October 6, 2025 17:47
@socket-security Socket Security
Copy link

socket-security bot commented Oct 6, 2025 •
edited
Loading

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Block High
[email protected] has a High CVE.

CVE: GHSA-4hjh-wcwx-xvwj Axios is vulnerable to DoS attack through lack of data size check (HIGH)

Affected versions: >= 1.0.0 < 1.12.0; < 0.30.2

Patched version: 1.12.0

From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/@nomicfoundation/[email protected] → npm/[email protected]

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
[email protected] is a AI-detected potential code anomaly.

Notes: The code implements a global module loader hook that prepends a require('amdefine')(module) shim to nearly all .js modules before they are compiled. This is not directly overtly malicious, but it is a high-impact supply-chain/style modification: it alters every module load, can obscure behavior from static analysis, and increases attack surface if an attacker can modify this package or the amdefine module. Use of this module should be considered a risk in environments that require strict control of execution semantics or provenance; review and pin amdefine and this loader carefully. No clear evidence of direct data exfiltration or backdoor in this fragment.

Confidence: 1.00

Severity: 0.60

From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/@nomicfoundation/[email protected] → npm/[email protected]

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
[email protected] is a AI-detected potential code anomaly.

Notes: No direct malicious actions (network exfiltration, reverse shells, or hard-coded credentials) are present in this fragment. However, the module intentionally monkeypatches Node's module loader and VM APIs to transform and execute code at load time. Those capabilities are high-risk: if a malicious transformer/matcher is supplied (or if the package itself is replaced with a malicious version), it can inject arbitrary code into any loaded module, enabling supply-chain attacks, data theft, or backdoors. Reviewers should treat usage of this module as a high-privilege operation, ensure transformers are trusted, and limit hook usage to controlled environments.

Confidence: 1.00

Severity: 0.60

From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/@nomicfoundation/[email protected] → npm/[email protected]

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
[email protected] is a AI-detected potential code anomaly.

Notes: The code implements a cross-chain deposit flow with proper validations, artifact reads, and on-chain interactions. There is no evidence of hidden backdoors, data exfiltration, or malware. The main security considerations relate to token approval logic and correct configuration of flags to avoid granting excessive allowances. Overall, the module appears legitimate for a bridge deposit flow, with moderate risk primarily around configuration of approvals and correct handling of gas/fees.

Confidence: 1.00

Severity: 0.60

From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/@nomicfoundation/[email protected] → npm/[email protected]

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
[email protected] is a AI-detected potential code anomaly.

Notes: The code implements a standard EventTarget-like mixin for wrapping event listeners and dispatching events to user callbacks. There are no suspicious patterns such as dynamic code execution, hardcoded secrets, or network activity. The risk is contingent on what the consumer does inside their handlers; the snippet itself does not introduce malware or data leakage mechanisms beyond normal event dispatch. Overall security risk is low in isolation.

Confidence: 1.00

Severity: 0.60

From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/@nomicfoundation/[email protected] → npm/[email protected]

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
[email protected] is a AI-detected potential code anomaly.

Notes: The code implements a standard EventTarget-like mixin for wrapping event listeners and dispatching events to user callbacks. There are no suspicious patterns such as dynamic code execution, hardcoded secrets, or network activity. The risk is contingent on what the consumer does inside their handlers; the snippet itself does not introduce malware or data leakage mechanisms beyond normal event dispatch. Overall security risk is low in isolation.

Confidence: 1.00

Severity: 0.60

From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/@nomicfoundation/[email protected] → npm/[email protected]

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@renovate renovate bot force-pushed the renovate/ui-deps-sync branch 4 times, most recently from 2e1185e to 72529cd Compare October 7, 2025 22:13
@socket-security Socket Security
Copy link

socket-security bot commented Oct 7, 2025 •
edited
Loading

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Added@​nomicfoundation/​hardhat-toolbox@​6.1.0981007679100

View full report

@renovate renovate bot force-pushed the renovate/ui-deps-sync branch from 72529cd to f8f61d0 Compare October 8, 2025 20:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants