Skip to content

chore(deps): bump the npm-production group across 1 directory with 7 updates - #31

Open
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/npm-production-173cbb3630
Open

chore(deps): bump the npm-production group across 1 directory with 7 updates#31
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/npm-production-173cbb3630

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 16, 2026

Copy link
Copy Markdown

Bumps the npm-production group with 7 updates in the / directory:

Package From To
next 16.2.6 16.3.0
next-mdx-remote-client 2.1.11 2.1.12
posthog-js 1.376.4 1.417.0
react 19.2.4 19.2.8
react-dom 19.2.4 19.2.8
rehype-pretty-code 0.14.3 0.14.5
shiki 4.1.0 4.4.3

Updates next from 16.2.6 to 16.3.0

Release notes

Sourced from next's releases.

v16.3.0

Core Changes

  • Update vendored lodash to 4.17.23 to fix CVE-2025-13465: #91558
  • Fix invalid HTML response for route-level RSC requests in deployment adapter: #91541
  • Normalize encoded dynamic placeholders in app routes: #91603
  • Fix(pages-router): restore Content-Length and ETag for /_next/data/ JSON responses: #90304
  • Update tokio from 1.43.0 to 1.47.3: #90945
  • [turbopack] Simplify snapshotting logic: #91178
  • Turbopack: enable server HMR for app route handlers: #91466
  • turbo-tasks-backend: batch find_and_schedule_dirty using for_each_task_meta: #91497
  • [turbopack] Use bail! instead of panic! for duplicate module ident error: #91636
  • Skip loadBindings() Lightning CSS check during next start: #91538
  • turbo-tasks-backend: batch schedule dirty tasks in aggregation_update: #91461
  • Turbopack: Add importModule() support to webpack loaders: #89630
  • turbo-persistence: fix mmap page alignment and improve error context in MetaFile::open_internal: #91640
  • turbopack-css: demote recoverable CSS parse warnings to Warning severity: #91524
  • feat(node-streams): add config flag, define-env, and env precedence test: #90427
  • Rename /_next/webpack-hmr to /_next/hmr: #91415
  • Add per-slot error attribution for instant validation using slot markers and config depth preference: #91610
  • Handle encoded params further: #91627
  • [turbopack] Respect {eval:true} in worker_threads constructors: #91666
  • Fix missing route in otel spans without base-server: #91665
  • [turbopack] Optimize compaction cpu usage: #91468
  • Fix layout segment optimization: move app-page imports to server-utility transition: #91701
  • Fix server actions in standalone mode with cacheComponents: #91711
  • turbo-persistence: remove Unmergeable mmap advice: #91713
  • turbopack: move "compact database" tracing span to backend layer: #91693
  • Turbopack: lazy require metadata and handle TLA: #91705
  • Fix adapter outputs for dynamic metadata routes: #91680
  • Turbopack: fix webpack loader runner layer: #91727
  • [turbopack] Remove incorrect debug_assert in try_read_task_cell: #91699
  • Add module count field to module graph tracing spans: #91697
  • turbopack-cli: add --persistent-caching flag for filesystem-backed cache: #91657
  • Turbopack: pull in updated vercel/nft tests: #91651
  • [turbopack] Improve regressed build speed on cross-compiled MUSL: #91477
  • [Segment Bundling] [Scaffolding] Ensure inlining hint correctness: #91320
  • [Segment Bundling] [Scaffolding] Track which segments can be omitted from prefetch: #91438
  • Avoid deprecated TS node10 moduleResolution defaults: #91847
  • [turbopack] Rebuild the docker build scripts: #91799
  • Fix TS6 baseUrl deprecation for extended tsconfig: #91855
  • Add next internal post-build CLI command for Turbopack database compaction: #91336
  • Turbopack: Define Effect as a trait instead of a closure: #89080
  • Turbopack: Implement TraceRawVcs and NonLocalValue correctly for Effects: #89133
  • turbo-tasks-backend: improve print_cache_item_size instrumentation: #91742
  • Turbopack: switch from base40 to base38 hash encoding (remove ~ and . from charset): #91832
  • Use charCodeAt for normalizePathTrailingSlash: #91380
  • Turbopack: Only patch lockfile when bindings fails to load: #91379
  • [create-next-app] Skip interactive prompts when CLI flags are provided: #91840
  • [devtools] Make instant navs panel draggable: #91914
  • [Segment Bundling] Bundle static prefetches based on size: #91439

... (truncated)

Commits

Updates next-mdx-remote-client from 2.1.11 to 2.1.12

Release notes

Sourced from next-mdx-remote-client's releases.

v2.1.12

Consider this version is for react19 users

The changes made by @​talatkuyuk:

  • Update dependencies
  • Update github action main.yml for fix about installing npm@latest in node 20
  • Add a new sponsorship into README
  • Remove unnecessary esModuleInterop from tsconfig
  • Update @types/mdx
  • Add a comment for skipLibCheck in tsconfig
  • Add @types/jest to fix a type error related with @testing-library/jest-dom/vitest
  • Fix a type error about augmentations for the global scope can only be directly nested in external modules in requestIdleCallback.d.ts
  • Change moduleResolution to bundler from node in tsconfig to fix some library type errors
Commits
  • b26d913 v2.1.12
  • 984a8b1 Update dependencies
  • 36a3563 Update github action main.yml for fix about installing npm@latest in node 20
  • b6b668b Add a new sponsorship into README
  • 7a77d57 Remove unncessary esModuleInterop from tsconfig
  • ef066ab Update @​types/mdx
  • a0411a0 Add a comment for skipLibCheck in tsconfig
  • 88945ad Add @​types/jest to fix a type error related with @​testing-library/jest-dom/vi...
  • 368bce9 Fix a type error about augmentations for the global scope can only be directl...
  • ffcd516 Change moduleResolution to bundler from node in tsconfig to fix some library ...
  • See full diff in compare view

Updates posthog-js from 1.376.4 to 1.417.0

Release notes

Sourced from posthog-js's releases.

posthog-js@1.417.0

1.417.0

Minor Changes

  • #4485 8bc63c3 Thanks @​dustinbyrne! - Default external dependency loading to versioned asset paths with automatic fallback to legacy paths, and add a strict_script_versioning: 'fallback' mode. (2026-08-13)

Patch Changes

  • Updated dependencies [8bc63c3]:
    • @​posthog/types@​1.404.0

posthog-js@1.416.1

1.416.1

Patch Changes

  • #4443 b2c6830 Thanks @​arnohillen! - Harden the session replay stylesheet inlining budget (inlineStylesheetBudgetRules):

    • The default budget (10,000 rules) moves from the recorder chunk into posthog-js session recording options, so npm-pinned or cached bundles keep their configured override (including 0 to disable) and direct rrweb.record() consumers keep unbounded inlining unless they opt in.
    • Deferred inlining is bounded inside a sheet: a resumable cursor stringifies 200 rules per idle slice and emits a sheet's _cssText atomically, so monolithic sheets no longer produce one long task and partial CSS never reaches the wire.
    • Deferred sheets are flushed synchronously when recording stops and on pagehide; residual failure modes are counted via $sdk_debug_replay_deferred_stylesheets_failed / _abandoned.
    • CSSOM-only styles (insertRule output, adoptedStyleSheets) no longer charge the budget, since deferring <link> sheets buys those pages nothing.
    • Telemetry fixes: full-snapshot duration wraps the whole synchronous task, deferred counts are cumulative per session, new gauges cover non-deferrable rules and idle stringification cost, and duration samples straddling tab suspension are discarded ($sdk_debug_replay_discarded_duration_samples). (2026-08-13)

  • Updated dependencies [c9086de, b2c6830]:

    • @​posthog/core@​1.48.0
    • @​posthog/types@​1.403.1

posthog-js@1.416.0

1.416.0

Minor Changes

  • #4495 e4b9947 Thanks @​marandaneto! - feat(browser): add rewriteRequestPath to customize API, feature flag, and asset paths for reverse proxies (2026-08-12)

  • #4493 e34ebf9 Thanks @​marandaneto! - Add reset options for applying bootstrapped identity, feature flag, and session values after posthog.reset() while preserving the legacy boolean argument. (2026-08-12)

Patch Changes

posthog-js@1.415.7

1.415.7

Patch Changes

... (truncated)

Commits
  • 9b41d8a chore: update versions and lockfile [version bump]
  • 8bc63c3 feat(browser): default script versioning to fallback (#4485)
  • c708fbd ci: upgrade PostHog monorepo dependencies after releases (#4517)
  • f6d5ef8 chore: update versions and lockfile [version bump]
  • 5698fd5 fix(mcp): attribute tool calls and handshakes to their own client (#4515)
  • 5c5d26c chore: update versions and lockfile [version bump]
  • 1c5bf6f chore: bump PostHog CLI to 0.11.1 (#4516)
  • 48b1a0c fix(mcp): resolve identify on tools/list (#4504)
  • c9086de feat(aio): public beta captureAi with dedicated AI capture lane (#4289)
  • b2c6830 fix(replay): close the stylesheet budget review findings shipped in #4320 (#4...
  • Additional commits viewable in compare view

Updates react from 19.2.4 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

19.2.7 (June 1st, 2026)

React Server Components

19.2.6 (May 6th, 2026)

React Server Components

19.2.5 (April 8th, 2026)

React Server Components

Changelog

Sourced from react's changelog.

19.2.7 (June 1, 2026)

React Server Components

19.2.6 (May 6, 2026)

React Server Components

19.2.5 (March 18, 2026)

React Server Components

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react since your current version.


Updates react-dom from 19.2.4 to 19.2.8

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

19.2.7 (June 1st, 2026)

React Server Components

19.2.6 (May 6th, 2026)

React Server Components

19.2.5 (April 8th, 2026)

React Server Components

Changelog

Sourced from react-dom's changelog.

19.2.7 (June 1, 2026)

React Server Components

19.2.6 (May 6, 2026)

React Server Components

19.2.5 (March 18, 2026)

React Server Components

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react-dom since your current version.


Updates rehype-pretty-code from 0.14.3 to 0.14.5

Release notes

Sourced from rehype-pretty-code's releases.

rehype-pretty-code@0.14.5

Patch Changes

  • fix: detect showLineNumbers wherever it appears in the meta string, not only before the highlight annotations, while ignoring the word when it is part of a character highlight such as /foo showLineNumbers bar/ (#204)
  • fix: stop character-highlight ranges leaking across patterns, so an id-only annotation like /foo/#a no longer makes a later pattern inherit the previous pattern's range, and a range-ignored occurrence no longer consumes the whole token it lives in (#169)

Range-excluded occurrences are counted without changing the token tree, so unhighlighted markup remains intact.

Partial highlights contained within a transformer-generated element preserve that surrounding semantic element instead of cloning it.

rehype-pretty-code@0.14.4

Patch Changes

  • fix: prevent an infinite loop in inline character highlighting when a pattern matches text that spans multiple syntax tokens and occurs more than once on the same line (#185)
Changelog

Sourced from rehype-pretty-code's changelog.

0.14.5

Patch Changes

  • fix: detect showLineNumbers wherever it appears in the meta string, not only before the highlight annotations, while ignoring the word when it is part of a character highlight such as /foo showLineNumbers bar/ (#204)
  • fix: stop character-highlight ranges leaking across patterns, so an id-only annotation like /foo/#a no longer makes a later pattern inherit the previous pattern's range, and a range-ignored occurrence no longer consumes the whole token it lives in (#169)

Range-excluded occurrences are counted without changing the token tree, so unhighlighted markup remains intact.

Partial highlights contained within a transformer-generated element preserve that surrounding semantic element instead of cloning it.

0.14.4

Patch Changes

  • fix: prevent an infinite loop in inline character highlighting when a pattern matches text that spans multiple syntax tokens and occurs more than once on the same line (#185)
Commits
  • b878d09 [ci] release (#277)
  • 7a0d191 fix(core): stop chars ranges leaking across patterns and shared tokens (#276)
  • 012acb6 fix(core): detect showLineNumbers anywhere in the meta string (#275)
  • ad648c5 [ci] release (#273)
  • a68bb0a fix(core): prevent infinite loop in charsHighlighter for repeated multi-token...
  • See full diff in compare view

Updates shiki from 4.1.0 to 4.4.3

Release notes

Sourced from shiki's releases.

v4.4.3

   🚀 Features

   🐞 Bug Fixes

    View changes on GitHub

v4.4.2

   🐞 Bug Fixes

   🏎 Performance

    View changes on GitHub

v4.4.1

   🚀 Features

    View changes on GitHub

v4.4.0

   🚀 Features

   🐞 Bug Fixes

    View changes on GitHub

v4.3.1

   🚀 Features

    View changes on GitHub

v4.3.0

   🚀 Features

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the npm-production group across 1 directory with 7 …
40f0ca1 
…updates

Bumps the npm-production group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [next](https://github.com/vercel/next.js) | `16.2.6` | `16.3.0` |
| [next-mdx-remote-client](https://github.com/ipikuka/next-mdx-remote-client) | `2.1.11` | `2.1.12` |
| [posthog-js](https://github.com/PostHog/posthog-js) | `1.376.4` | `1.417.0` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.4` | `19.2.8` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.4` | `19.2.8` |
| [rehype-pretty-code](https://github.com/rehype-pretty/rehype-pretty-code/tree/HEAD/packages/core) | `0.14.3` | `0.14.5` |
| [shiki](https://github.com/shikijs/shiki/tree/HEAD/packages/shiki) | `4.1.0` | `4.4.3` |



Updates `next` from 16.2.6 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.2.6...v16.3.0)

Updates `next-mdx-remote-client` from 2.1.11 to 2.1.12
- [Release notes](https://github.com/ipikuka/next-mdx-remote-client/releases)
- [Commits](ipikuka/next-mdx-remote-client@v2.1.11...v2.1.12)

Updates `posthog-js` from 1.376.4 to 1.417.0
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.376.4...posthog-js@1.417.0)

Updates `react` from 19.2.4 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react)

Updates `react-dom` from 19.2.4 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom)

Updates `rehype-pretty-code` from 0.14.3 to 0.14.5
- [Release notes](https://github.com/rehype-pretty/rehype-pretty-code/releases)
- [Changelog](https://github.com/rehype-pretty/rehype-pretty-code/blob/master/packages/core/CHANGELOG.md)
- [Commits](https://github.com/rehype-pretty/rehype-pretty-code/commits/rehype-pretty-code@0.14.5/packages/core)

Updates `shiki` from 4.1.0 to 4.4.3
- [Release notes](https://github.com/shikijs/shiki/releases)
- [Commits](https://github.com/shikijs/shiki/commits/v4.4.3/packages/shiki)

---
updated-dependencies:
- dependency-name: next
  dependency-version: 16.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-production
- dependency-name: next-mdx-remote-client
  dependency-version: 2.1.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-production
- dependency-name: posthog-js
  dependency-version: 1.417.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-production
- dependency-name: react
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-production
- dependency-name: react-dom
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-production
- dependency-name: rehype-pretty-code
  dependency-version: 0.14.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-production
- dependency-name: shiki
  dependency-version: 4.4.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants