Skip to content

chore(deps): bump the production group across 1 directory with 21 updates#468

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-ecf70a1604
Open

chore(deps): bump the production group across 1 directory with 21 updates#468
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-ecf70a1604

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 2, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the production group with 21 updates in the / directory:

Package From To
@iconify-json/lucide 1.2.102 1.2.111
@iconify-json/simple-icons 1.2.77 1.2.84
@takumi-rs/image-response 0.62.8 1.6.0
@takumi-rs/wasm 0.62.8 1.6.0
@tanstack/react-query 5.99.0 5.100.14
@vercel/analytics 1.6.1 2.0.1
@vercel/speed-insights 1.3.1 2.0.0
@wagmi/core 3.4.11 3.5.0
abitype 1.2.3 1.2.4
accounts 0.10.7 0.14.6
ox 0.14.20 0.14.27
posthog-js 1.367.0 1.376.6
posthog-node 5.29.2 5.35.8
sql-formatter 15.7.3 15.8.0
tailwind-merge 3.5.0 3.6.0
tailwindcss 4.2.2 4.3.0
viem 2.48.8 2.52.0
wagmi 3.6.14 3.6.16
waku 1.0.0-beta.0 1.0.0-beta.1
webauthx 0.1.1 0.1.2
zod 4.3.6 4.4.3

Updates @iconify-json/lucide from 1.2.102 to 1.2.111

Commits

Updates @iconify-json/simple-icons from 1.2.77 to 1.2.84

Commits

Updates @takumi-rs/image-response from 0.62.8 to 1.6.0

Release notes

Sourced from @​takumi-rs/image-response's releases.

@​takumi-rs/image-response@​1.6.0

Patch Changes

  • takumi-js@1.6.0

@​takumi-rs/image-response@​1.5.1

Patch Changes

  • takumi-js@1.5.1

@​takumi-rs/image-response@​1.5.0

Patch Changes

  • takumi-js@1.5.0

@​takumi-rs/image-response@​1.4.1

Patch Changes

  • Updated dependencies [d6936e5]
    • takumi-js@1.4.1

@​takumi-rs/image-response@​1.4.0

Patch Changes

  • takumi-js@1.4.0

@​takumi-rs/image-response@​1.3.0

Patch Changes

  • takumi-js@1.3.0

@​takumi-rs/image-response@​1.2.1

Patch Changes

  • takumi-js@1.2.1

@​takumi-rs/image-response@​1.1.2

Patch Changes

  • takumi-js@1.1.2

@​takumi-rs/image-response@​1.1.1

Patch Changes

  • takumi-js@1.1.1

@​takumi-rs/image-response@​1.1.0

Patch Changes

  • takumi-js@1.1.0

... (truncated)

Commits

Updates @takumi-rs/wasm from 0.62.8 to 1.6.0

Release notes

Sourced from @​takumi-rs/wasm's releases.

@​takumi-rs/wasm@​1.6.0

Patch Changes

  • @​takumi-rs/helpers@​1.6.0

@​takumi-rs/wasm@​1.5.1

Patch Changes

  • @​takumi-rs/helpers@​1.5.1

@​takumi-rs/wasm@​1.5.0

Patch Changes

  • @​takumi-rs/helpers@​1.5.0

@​takumi-rs/wasm@​1.4.1

Patch Changes

  • @​takumi-rs/helpers@​1.4.1

@​takumi-rs/wasm@​1.4.0

Patch Changes

  • Updated dependencies [e83ab19]
    • @​takumi-rs/helpers@​1.4.0

@​takumi-rs/wasm@​1.3.0

Patch Changes

  • @​takumi-rs/helpers@​1.3.0

@​takumi-rs/wasm@​1.2.1

Patch Changes

  • @​takumi-rs/helpers@​1.2.1

@​takumi-rs/wasm@​1.1.2

Patch Changes

  • @​takumi-rs/helpers@​1.1.2

@​takumi-rs/wasm@​1.1.1

Patch Changes

  • @​takumi-rs/helpers@​1.1.1

@​takumi-rs/wasm@​1.1.0

Patch Changes

  • @​takumi-rs/helpers@​1.1.0

... (truncated)

Commits

Updates @tanstack/react-query from 5.99.0 to 5.100.14

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.100.14

Patch Changes

  • Updated dependencies [ed20b6d]:
    • @​tanstack/react-query@​5.100.14
    • @​tanstack/query-devtools@​5.100.14

@​tanstack/react-query-next-experimental@​5.100.14

Patch Changes

  • Updated dependencies [ed20b6d]:
    • @​tanstack/react-query@​5.100.14

@​tanstack/react-query-persist-client@​5.100.14

Patch Changes

  • Updated dependencies [ed20b6d]:
    • @​tanstack/react-query@​5.100.14
    • @​tanstack/query-persist-client-core@​5.100.14

@​tanstack/react-query@​5.100.14

Patch Changes

  • fix(react-query): do not go into optimistic fetching state when not subscribed (#10759)

  • Updated dependencies []:

    • @​tanstack/query-core@​5.100.14

@​tanstack/react-query-devtools@​5.100.13

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.100.13
    • @​tanstack/react-query@​5.100.13

@​tanstack/react-query-next-experimental@​5.100.13

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.100.13

@​tanstack/react-query-persist-client@​5.100.13

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-persist-client-core@​5.100.13
    • @​tanstack/react-query@​5.100.13

@​tanstack/react-query@​5.100.13

Patch Changes

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.100.14

Patch Changes

  • fix(react-query): do not go into optimistic fetching state when not subscribed (#10759)

  • Updated dependencies []:

    • @​tanstack/query-core@​5.100.14

5.100.13

Patch Changes

  • Updated dependencies [d423168]:
    • @​tanstack/query-core@​5.100.13

5.100.12

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.100.12

5.100.11

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.100.11

5.100.10

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.100.10

5.100.9

Patch Changes

  • Updated dependencies [fcee7bd]:
    • @​tanstack/query-core@​5.100.9

5.100.8

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.100.8

... (truncated)

Commits

Updates @vercel/analytics from 1.6.1 to 2.0.1

Release notes

Sourced from @​vercel/analytics's releases.

v2.0.1

What's Changed

New Contributors

Full Changelog: vercel/analytics@v2.0.0...v2.0.1

v2.0.0

What's Changed

Breaking Changes

  • License changed from MPL-2.0 to MIT (#170)
  • Nuxt: introduce module support. If you need to configure it, load injectAnalytics() from @vercel/analytics/nuxt/runtime (#183)

Features

  • feat: load dynamic configuration (#184) — analytics config can now be loaded dynamically

Bug Fixes

  • fix: src and endpoint paths do not work when relative (#186)

Full Changelog: vercel/speed-insights@1.6.1...2.0.0

v2.0.0-canary.1

Canary release for testing 2.0.0 changes

Commits

Updates @vercel/speed-insights from 1.3.1 to 2.0.0

Release notes

Sourced from @​vercel/speed-insights's releases.

v2.0.0

What's Changed

Breaking Changes

  • License changed from Apache-2.0 to MIT (#111)
  • Nuxt: introduce module support (#110). In case you need to configure it, load injectSpeedInsights() from @vercel/speed-insights/nuxt/runtime

Features

  • feat: load dynamic configuration (#112) — speed insights config can now be loaded dynamically

Full Changelog: vercel/speed-insights@1.3.1...2.0.0

v2.0.0-canary.1

Canary release for testing 2.0.0 changes

1.5.0-canary.4

What's Changed

Full Changelog: vercel/speed-insights@1.2.0-canary.3...1.5.0-canary.4

Commits
  • 828d10c chore: bump version to v2.0.0
  • 15cb241 chore: bump version to v2.0.0-canary.1
  • b10a09c feat: load dynamic configuration (#112)
  • c6f4e37 feat(nuxt)!: Add support for injectSpeedInsights() and Nuxt module (#110)
  • See full diff in compare view

Updates @wagmi/core from 3.4.11 to 3.5.0

Release notes

Sourced from @​wagmi/core's releases.

@​wagmi/core@​3.5.0

Minor Changes

  • Added discovered EIP-6963 providers to the connector setup config. (#5128)

@​wagmi/core@​3.4.12

Patch Changes

  • Handled malformed cookie state in cookieToInitialState. (#5116)

  • wagmi/tempo: Renamed Actions.wallet.send to Actions.wallet.transfer and Hooks.wallet.useSend to Hooks.wallet.useTransfer. (#5121)

    Also bumps the accounts peer dependency to ~0.12.

    - await Actions.wallet.send(config, {
-   to: '0x...',
-   token: '0x...',
-   value: '1.5',
- })
+ await Actions.wallet.transfer(config, {
+   amount: '1.5',
+   to: '0x...',
+   token: '0x...',
+ })
    - const send = Hooks.wallet.useSend()
+ const transfer = Hooks.wallet.useTransfer()
Changelog

Sourced from @​wagmi/core's changelog.

3.5.0

Minor Changes

  • Added discovered EIP-6963 providers to the connector setup config. (#5128)

3.4.12

Patch Changes

  • Handled malformed cookie state in cookieToInitialState. (#5116)

  • wagmi/tempo: Renamed Actions.wallet.send to Actions.wallet.transfer and Hooks.wallet.useSend to Hooks.wallet.useTransfer. (#5121)

    Also bumps the accounts peer dependency to ~0.12.

    - await Actions.wallet.send(config, {
-   to: '0x...',
-   token: '0x...',
-   value: '1.5',
- })
+ await Actions.wallet.transfer(config, {
+   amount: '1.5',
+   to: '0x...',
+   token: '0x...',
+ })
    - const send = Hooks.wallet.useSend()
+ const transfer = Hooks.wallet.useTransfer()
Commits

Updates abitype from 1.2.3 to 1.2.4

Release notes

Sourced from abitype's releases.

abitype@1.2.4

Patch Changes

  • Fixed Zod identifier regex to anchor start and end, rejecting invalid identifiers like café, 2g, and hello👋. (#296)
Commits

Updates accounts from 0.10.7 to 0.14.6

Release notes

Sourced from accounts's releases.

accounts@0.14.6

Patch Changes

  • 89a107f: Fixed getAccounts to respect signable.

accounts@0.14.5

Patch Changes

  • a33ed22: Added a strict option to Remote.validateSearch to let trusted wallet routes defer access-key policy validation.
  • b6fb206: Added showDeposit support to wallet_authorizeAccessKey requests.

accounts@0.14.4

Patch Changes

  • 8afc239: Fix React Native auth token handling and mobile auth URL encoding.

accounts@0.14.3

Patch Changes

  • 801e18a: Simplified Privy account loading and fixed stale wallet cache handling after failed account selection.
  • f176676: Point React Native mobile authentication at the remote manager route.

accounts@0.14.2

Patch Changes

  • 022d947: Simplified Privy account loading and fixed stale wallet cache handling after failed account selection.

accounts@0.14.1

Patch Changes

  • 62705cb: Added an on filter to the wallet_connect showDeposit capability to direct if the deposit screen should be shown on login or register.

accounts@0.14.0

Minor Changes

  • feb1ab6: Breaking: Updated Tempo chain imports to use scoped chain entrypoints. Bump your Viem version to >=2.50.4.

Patch Changes

  • 7aeec48: Fixed access key authorization to reject requests that require external key material when none is provided.
  • 78778cb: Added a Privy adapter for connecting and signing with app-provided Privy embedded wallet accounts.
  • e15757f: Added a showDeposit capability to wallet_connect.

accounts@0.13.0

Minor Changes

  • 0666744: Breaking: Changed Handler.auth() to require callers to provide origin or domain, so SIWE challenge and verify flows pinned domain binding instead of deriving it from request Host headers.

  • f652ff2: Breaking: Updated wallet_deposit params to use amount and token and removed value.

    

    • 






... (truncated)





Changelog

Sourced from accounts's changelog.




0.14.6


Patch Changes


    

  • 89a107f: Fixed getAccounts to respect signable.
    • 



0.14.5


Patch Changes


    

  • a33ed22: Added a strict option to Remote.validateSearch to let trusted wallet routes defer access-key policy validation.
    • 

  • b6fb206: Added showDeposit support to wallet_authorizeAccessKey requests.
    • 



0.14.4


Patch Changes


    

  • 8afc239: Fix React Native auth token handling and mobile auth URL encoding.
    • 



0.14.3


Patch Changes


    

  • 801e18a: Simplified Privy account loading and fixed stale wallet cache handling after failed account selection.
    • 

  • f176676: Point React Native mobile authentication at the remote manager route.
    • 



0.14.2


Patch Changes


    

  • 022d947: Simplified Privy account loading and fixed stale wallet cache handling after failed account selection.
    • 



0.14.1


Patch Changes


    

  • 62705cb: Added an on filter to the wallet_connect showDeposit capability to direct if the deposit screen should be shown on login or register.
    • 



0.14.0


Minor Changes


    

  • feb1ab6: Breaking: Updated Tempo chain imports to use scoped chain entrypoints. Bump your Viem version to >=2.50.4.
    • 



Patch Changes


    

  • 7aeec48: Fixed access key authorization to reject requests that require external key material when none is provided.
    • 

  • 78778cb: Added a Privy adapter for connecting and signing with app-provided Privy embedded wallet accounts.
    • 

  • e15757f: Added a showDeposit capability to wallet_connect.
    • 






... (truncated)





Commits

    

  • 4644fb9 chore: version packages (#592)
    • 

  • 42ef977 fix: validate persisted adapter accounts (#591)
    • 

  • 89a107f fix(provider): honor signable getAccount option (#590)
    • 

  • 3ff18b6 refactor(site): landing type scale + icon componentization (#587)
    • 

  • f76bfba fix(site): design tweaks for landing hero (#583)
    • 

  • b12b960 refactor: use viem managed access key authorization (#575)
    • 

  • 5b7083c feat: add wallet_authorizeAccessKey deposit toggle to playground (#581)
    • 

  • 9219d05 chore: version packages (#563)
    • 

  • b6fb206 feat: support showDeposit on wallet_authorizeAccessKey (#580)
    • 

  • 7d1a114 docs(site): remove adapter demo todos (#579)
    • 

  • Additional commits viewable in compare view
    • 







Updates ox from 0.14.20 to 0.14.27



Release notes

Sourced from ox's releases.




ox@0.14.27


Patch Changes


    

  • #263 451a442 Thanks @​jxom! - ox/tempo: Added the ReceivePolicyReceipt module for encoding/decoding TIP-1028 receive-policy claim receipts (ClaimReceiptV1 witnesses) with decode, encode, from, fromLog, and fromTransactionReceipt (returns one receipt per TransferBlocked log).
    • 



ox@0.14.26


Patch Changes


    

  • 

    #262 b1ac8c8 Thanks @​jxom! - ox/tempo: Added support for TIP-1049 (admin access keys) via optional isAdmin and account fields on KeyAuthorization that bind into the signing hash.
    

    • 

  • 

    #260 581ccee Thanks @​jxom! - ox/tempo: Added support for TIP-1053 (witnesses in key authorizations) via an optional 32-byte witness field on KeyAuthorization that is included in the signing hash.
    

    • 



ox@0.14.25


Patch Changes


    

  • #256 ad7610b Thanks @​jxom! - Renamed ChannelDescriptor.from to Channel.from, made Channel.Channel the descriptor type, and changed Channel.computeId to receive channel and options separately.
    • 



ox@0.14.24


Patch Changes


    

  • #254 d837628 Thanks @​jxom! - Added ChannelDescriptor.from for normalizing TIP-20 channel reserve descriptors.
    • 



ox@0.14.23


Patch Changes


    

  • #252 19cd833 Thanks @​jxom! - Added TIP-20 channel reserve constants, channel id computation, and voucher signing helpers.
    • 



ox@0.14.22


Patch Changes


    

  • #227 ffa64c0 Thanks @​Genmin! - Fixed Secp256k1.verify narrowing signature branches before address recovery.
    • 



ox@0.14.21


Patch Changes


    

  • 

    #246 32cf459 Thanks @​0xrusowsky! - Added TxEnvelopeTempo.encodeForSigning to expose the raw Tempo sender-signing preimage bytes.
    

    • 

  • 

    #248 e0474e9 Thanks @​jxom! - Added blockTimestamp support to transaction RPC conversions.
    

    • 








Commits






Updates posthog-js from 1.367.0 to 1.376.6



Commits

    

  • 88bd500 chore: update versions and lockfile [version bump]
    • 

  • 663e250 fix(persistence): skip save() when serialized props are unchanged (#3687)
    • 

  • af69e9c chore: update versions and lockfile [version bump]
    • 

  • 66cbc59 fix(persistence): only persist session activity timestamp every 5s (#3686)
    • 

  • a29b85b chore(release): temporarily disable @​posthog/mcp publish (#3707)
    • 

  • 6f0caf4 perf(react-native): coalesce storage writes with a debounce window (#3701)
    • 

  • 72050bc Bump flags-project-board workflow pin to latest (#3700)
    • 

  • d9ad199 fix(react-native): preserve property types for flag evaluation (#3694)
    • 

  • 501ade6 fix(react-native): fix posthog-xcode.sh receiving /bin/sh as $1 in Expo bundl...
    • 

  • e74382b ci: run generate-references on PRs (#3697)
    • 

  • Additional commits viewable in compare view
    • 







Updates posthog-node from 5.29.2 to 5.35.8



Changelog

Sourced from posthog-node's changelog.




5.35.8


Patch Changes


    

  • Updated dependencies []:

      

    • @​posthog/core@​1.29.15
      • 

    

    • 



5.35.7


Patch Changes


    

  • Updated dependencies [d9ad199]:

      

    • @​posthog/core@​1.29.14
      • 

    

    • 



5.35.6


Patch Changes



5.35.5


Patch Changes


    

  • Updated dependencies []:

      

    • @​posthog/core@​1.29.12
      • 

    

    • 



5.35.4


Patch Changes


    

  • Updated dependencies []:

      

    • @​posthog/core@​1.29.11
      • 

    

    • 



5.35.3


Patch Changes


    

  • Updated dependencies [5568f12]:

      

    • @​posthog/core@​1.29.10
      • 

    

    • 



5.35.2


Patch Changes


    

  • #3658 5d7a2d3 Thanks @​gustavohstrassburger! - Include group context in the $feature_flag_called deduplication key in _captureFlagCalledEventIfNeeded, so events fire independently per group combination.
(2026-05-25)
    • 






... (truncated)





Commits

    

  • 88bd500 chore: update versions and lockfile [version bump]
    • 

  • af69e9c chore: update versions and lockfile [version bump]
    • 

  • 4eb5416 test(node): drain promise queue in captureException context tests (#3696)
    • 

  • a122070 chore: update versions and lockfile [version bump]
    • 

  • 7b84b75 fix: unify capture exception (#3681)
    • 

  • 727ddcf chore: update versions and lockfile [version bump]
    • 

  • e5a89ac chore: update versions and lockfile [version bump]
    • 

  • 55b3c42 chore: update versions and lockfile [version bump]
    • 

  • 1d0daf0 chore: update versions and lockfile [version bump]
    • 

  • 5d7a2d3 fix(node): fire separate $feature_flag_called events per group context (#3658)
    • 

  • Additional commits viewable in compare view
    • 







Updates sql-formatter from 15.7.3 to 15.8.0



Release notes

Sourced from sql-formatter's releases.




15.8.0


PostgreSQL formatting


    

  • Add support for PostgreSQL keywords in CREATE CONSTRAINT TRIGGER (#948) (thanks to @​karlhorky)
    • 



Internal changes


    

  • Switch from yarn to pnpm (#949)
    • 



    View changes on GitHub


15.7.4


Bugfix








Commits

    

  • a3bfeeb Release v15.8.0
    • 

  • a7f50d8 Add tagName config to release-it
    • 

  • dab8693 Add release-it-pnpm as plugin to release-it
    • 

  • 5ab2c80 Add release-it-pnpm
    • 

  • 1a000ca Configure release-it to use pnpm
    • 

  • 34fe5b0 Fix scripts using -- (pnpm interprets this as file name)
    • 

  • 6610b6a Add pnpm to lockfile
    • 

  • af633e8 Switch from yarn@1.22.22 to pnpm@11.0.8 (#949)
    • 

  • ba7437e Ignore pnpm-lock.yaml from Prettier
    • 

  • dcee63f Work around pnpm bug with pmOnFail + devEngines.packageManager
    • 

  • Additional commits viewable in compare view
    • 







Updates tailwind-merge from 3.5.0 to 3.6.0



Release notes

Sourced from tailwind-merge's releases.




v3.6.0


New Features



Documentation



Other



Full Changelog: dcastil/tailwind-merge@v3.5.0...v3.6.0


Thanks to @​brandonmcconnell, @​manavm1990, @​langy, @​roboflow, @​syntaxfm, @​getsentry, @​codecov, a private sponsor, @​block, @​openclaw, @​sourcegraph, @​mike-healy and more via @​thnxdev for sponsoring tailwind-merge! ❤️







Commits

    

  • d54f7e5 v3.6.0
    • 

  • 638871a Update README to add info about Tailwind CSS v4.3 support
    • 

  • 39fc7b5 Revert "v3.6.0"
    • 

  • bd8390f v3.6.0
    • 

  • 802877c add v3.6.0 changelog
    • 

  • a35feda Merge pull request #665 from dcastil/renovate/rollup-plugin-babel-7.x
    • 

  • 940389c Merge pull request #667 from dcastil/renovate/release-drafter-release-drafter...
    • 

  • 005af6d pin to specific version
    • 

  • 5816ced implement breaking changes
    • 

  • 17041e1 Merge pull request #676 from dcastil/dependabot/npm_and_yarn/babel/plugin-tra...
    • 

  • Additional commits viewable in compare view
    • 







Updates tailwindcss from 4.2.2 to 4.3.0



Release notes

Sourced from tailwindcss's releases.




v4.3.0


Added


    

  • Add @container-size utility (#18901)
    • 

  • Add scrollbar-{auto,thin,none} utilities for scrollbar-width, and scrollbar-thumb-* / scrollbar-track-* color utilities for scrollbar-color (#19981, #20019)
    • 

  • Add scrollbar-gutter-* utilities (#20018)
    • 

  • Add zoom-* utilities (

    

  
  



      


          

          
  
  

    
  
    
    

  

  

  



                    

          
        





  





    



      

  
            

    

      
    

    


      


          @dependabot
dependabot
Bot



            added
      

  dependencies

  Pull requests that update a dependency file

      

  javascript

  Pull requests that update javascript code

  labels


      Jun 2, 2026

    

  








      

  
      



  

  @vercel






  



    

      

  

    

      
          
      

      
            vercel
  Bot

      

      

      commented


        Jun 2, 2026



      
  •

  

    
      

        
          edited
          
        
        
      

    
    
      
  
        
      Loading


  
    
  



    


  


  

    

      

          
    
    

  


        
            
  
      
              Copy link

  

              
  
      
                Copy Markdown

  

        
      

    


    

        



        

    

  





      


        



  
    

      
          
The latest updates on your projects. Learn more about Vercel for GitHub.






Project
Deployment
Actions
Updated (UTC)






tempo-docs
Ready Ready
Preview, Comment
Jun 8, 2026 11:52am






Request Review


      		
    

  





        


            

            
            

              
            

        

      


      

            
  
  

    
  
    
    

  

  

  


    












      

  
      



  

  @socket-security






  



    

      

  

    

      
          
      

      
            socket-security
  Bot

      

      

      commented


        Jun 2, 2026



      
  •

  

    
      

        
          edited
          
        
        
      

    
    
      
  
        
      Loading


  
    
  



    


  


  

    

      

          
    
    

  


        
            
  
      
              Copy link

  

              
  
      
                Copy Markdown

  

        
      

    


    

        



        

    

  





      


        



  
    

      
          
Review the following changes in direct dependencies. Learn more about Socket for GitHub.






Diff
Package
Supply Chain
Security		
Vulnerability
Quality
Maintenance
License





Added@​takumi-rs/​wasm@​1.6.0891007396100


Added@​iconify-json/​simple-icons@​1.2.841001007796100


Addedwebauthx@​0.1.27710010090100


Updatedaccounts@​0.10.7 ⏵ 0.14.677 -210099 +199100


Addedposthog-node@​5.35.89110078100100


Addedwagmi@​3.6.16801007996100


Added@​iconify-json/​lucide@​1.2.1111001007996100


Addedposthog-js@​1.376.68110082100100


Added@​vercel/​analytics@​2.0.1991008387100


Added@​takumi-rs/​image-response@​1.6.0851009996100


Addedwaku@​1.0.0-beta.18510010096100


Addedtailwind-merge@​3.6.01001008695100


Added@​vercel/​speed-insights@​2.0.0991008786100


Added@​tanstack/​react-query@​5.100.14991008899100


Addedabitype@​1.2.410010010088100


Addedsql-formatter@​15.8.010010010093100


Addedviem@​2.52.09710010098100


Addedox@​0.14.27991009997100





View full report



      		
    

  





        


            

            
            

              
            

        

      


      

            
  
  

    
  
    
    

  

  

  


    












      

  
      



  

  @socket-security






  



    

      

  

    

      
          
      

      
            socket-security
  Bot

      

      

      commented


        Jun 2, 2026



      
  •

  

    
      

        
          edited
          
        
        
      

    
    
      
  
        
      Loading


  
    
  



    


  


  

    

      

          
    
    

  


        
            
  
      
              Copy link

  

              
  
      
                Copy Markdown

  

        
      

    


    

        



        

    

  





      


        



  
    

      
          
Warning
Review the following alerts detected in dependencies.


According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.








Action
Severity
Alert  (click "▶" to expand/collapse)






Warn
High

Obfuscated code:  npm posthog-js is 90.0% likely obfuscated



Confidence: 0.90
 

Location: Package overview
 

From: package.json → npm/posthog-js@1.376.6


ℹ Read more on: This package | This alert | What is obfuscated code?





  Next steps: Take a moment to review the security alert above. Review
  the linked package source code to understand the potential risk. Ensure the
  package is not malicious before proceeding. If you're unsure how to proceed,
  reach out to your security team or ask the Socket team for help at
  support@socket.dev.



Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.



    Mark the package as acceptable risk. To ignore this alert only
    in this pull request, reply with the comment
    @SocketSecurity ignore npm/posthog-js@1.376.6. You can
    also ignore all packages with @SocketSecurity ignore-all.
    To ignore an alert for all future pull requests, use Socket's Dashboard to
    change the triage state of this alert.
  









Warn
High

Obfuscated code:  npm posthog-js is 90.0% likely obfuscated



Confidence: 0.90
 

Location: Package overview
 

From: package.json → npm/posthog-js@1.376.6


ℹ Read more on: This package | This alert | What is obfuscated code?





  Next steps: Take a moment to review the security alert above. Review
  the linked package source code to understand the potential risk. Ensure the
  package is not malicious before proceeding. If you're unsure how to proceed,
  reach out to your security team or ask the Socket team for help at
  support@socket.dev.



Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.



    Mark the package as acceptable risk. To ignore this alert only
    in this pull request, reply with the comment
    @SocketSecurity ignore npm/posthog-js@1.376.6. You can
    also ignore all packages with @SocketSecurity ignore-all.
    To ignore an alert for all future pull requests, use Socket's Dashboard to
    change the triage state of this alert.
  









Warn
High

Obfuscated code:  npm preact is 90.0% likely obfuscated



Confidence: 0.90
 

Location: Package overview
 

From: pnpm-lock.yaml → npm/posthog-js@1.376.6 → npm/preact@10.29.2


ℹ Read more on: This package | This alert | What is obfuscated code?





  Next steps: Take a moment to review the security alert above. Review
  the linked package source code to understand the potential risk. Ensure the
  package is not malicious before proceeding. If you're unsure how to proceed,
  reach out to your security team or ask the Socket team for help at
  support@socket.dev.



Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.



    Mark the package as acceptable risk. To ignore this alert only
    in this pull request, reply with the comment
    @SocketSecurity ignore npm/preact@10.29.2. You can
    also ignore all packages with @SocketSecurity ignore-all.
    To ignore an alert for all future pull requests, use Socket's Dashboard to
    change the triage state of this alert.
  











View full report


      		
    

  





        


            

            
            

              
            

        

      


      

            
  
  

    
  
    
    

  

  

  


    












      

  
          

  







      

  
        

  

      

  
  

  
          

  

    

      


  

      
        @dependabot
  




      

        
          chore(deps): bump the production group across 1 directory with 21 upd…
        

          
                        
      


      

        

    
    
    

  

    


      


      

        

          

    
    
    

  

  

    
  



        

      


      

        
          e65319c
        
      

    

  

    

      
…ates

Bumps the production group with 21 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@iconify-json/lucide](https://github.com/iconify/icon-sets) | `1.2.102` | `1.2.111` |
| [@iconify-json/simple-icons](https://github.com/iconify/icon-sets) | `1.2.77` | `1.2.84` |
| [@takumi-rs/image-response](https://github.com/kane50613/takumi) | `0.62.8` | `1.6.0` |
| [@takumi-rs/wasm](https://github.com/kane50613/takumi) | `0.62.8` | `1.6.0` |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.99.0` | `5.100.14` |
| [@vercel/analytics](https://github.com/vercel/analytics/tree/HEAD/packages/web) | `1.6.1` | `2.0.1` |
| [@vercel/speed-insights](https://github.com/vercel/speed-insights/tree/HEAD/packages/web) | `1.3.1` | `2.0.0` |
| [@wagmi/core](https://github.com/wevm/wagmi/tree/HEAD/packages/core) | `3.4.11` | `3.5.0` |
| [abitype](https://github.com/wevm/abitype) | `1.2.3` | `1.2.4` |
| [accounts](https://github.com/tempoxyz/accounts) | `0.10.7` | `0.14.6` |
| [ox](https://github.com/wevm/ox) | `0.14.20` | `0.14.27` |
| [posthog-js](https://github.com/PostHog/posthog-js) | `1.367.0` | `1.376.6` |
| [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.29.2` | `5.35.8` |
| [sql-formatter](https://github.com/sql-formatter-org/sql-formatter) | `15.7.3` | `15.8.0` |
| [tailwind-merge](https://github.com/dcastil/tailwind-merge) | `3.5.0` | `3.6.0` |
| [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.2.2` | `4.3.0` |
| [viem](https://github.com/wevm/viem) | `2.48.8` | `2.52.0` |
| [wagmi](https://github.com/wevm/wagmi/tree/HEAD/packages/react) | `3.6.14` | `3.6.16` |
| [waku](https://github.com/wakujs/waku/tree/HEAD/packages/waku) | `1.0.0-beta.0` | `1.0.0-beta.1` |
| [webauthx](https://github.com/wevm/webauthx) | `0.1.1` | `0.1.2` |
| [zod](https://github.com/colinhacks/zod) | `4.3.6` | `4.4.3` |



Updates `@iconify-json/lucide` from 1.2.102 to 1.2.111
- [Commits](https://github.com/iconify/icon-sets/commits)

Updates `@iconify-json/simple-icons` from 1.2.77 to 1.2.84
- [Commits](https://github.com/iconify/icon-sets/commits)

Updates `@takumi-rs/image-response` from 0.62.8 to 1.6.0
- [Release notes](https://github.com/kane50613/takumi/releases)
- [Commits](https://github.com/kane50613/takumi/compare/@takumi-rs/image-response@0.62.8...@takumi-rs/image-response@1.6.0)

Updates `@takumi-rs/wasm` from 0.62.8 to 1.6.0
- [Release notes](https://github.com/kane50613/takumi/releases)
- [Commits](https://github.com/kane50613/takumi/compare/@takumi-rs/wasm@0.62.8...@takumi-rs/wasm@1.6.0)

Updates `@tanstack/react-query` from 5.99.0 to 5.100.14
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.100.14/packages/react-query)

Updates `@vercel/analytics` from 1.6.1 to 2.0.1
- [Release notes](https://github.com/vercel/analytics/releases)
- [Commits](https://github.com/vercel/analytics/commits/v2.0.1/packages/web)

Updates `@vercel/speed-insights` from 1.3.1 to 2.0.0
- [Release notes](https://github.com/vercel/speed-insights/releases)
- [Commits](https://github.com/vercel/speed-insights/commits/v2.0.0/packages/web)

Updates `@wagmi/core` from 3.4.11 to 3.5.0
- [Release notes](https://github.com/wevm/wagmi/releases)
- [Changelog](https://github.com/wevm/wagmi/blob/main/packages/core/CHANGELOG.md)
- [Commits](https://github.com/wevm/wagmi/commits/@wagmi/core@3.5.0/packages/core)

Updates `abitype` from 1.2.3 to 1.2.4
- [Release notes](https://github.com/wevm/abitype/releases)
- [Commits](https://github.com/wevm/abitype/compare/abitype@1.2.3...abitype@1.2.4)

Updates `accounts` from 0.10.7 to 0.14.6
- [Release notes](https://github.com/tempoxyz/accounts/releases)
- [Changelog](https://github.com/tempoxyz/accounts/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tempoxyz/accounts/compare/accounts@0.10.7...accounts@0.14.6)

Updates `ox` from 0.14.20 to 0.14.27
- [Release notes](https://github.com/wevm/ox/releases)
- [Commits](https://github.com/wevm/ox/compare/ox@0.14.20...ox@0.14.27)

Updates `posthog-js` from 1.367.0 to 1.376.6
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.367.0...posthog-js@1.376.6)

Updates `posthog-node` from 5.29.2 to 5.35.8
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.35.8/packages/node)

Updates `sql-formatter` from 15.7.3 to 15.8.0
- [Release notes](https://github.com/sql-formatter-org/sql-formatter/releases)
- [Commits](sql-formatter-org/sql-formatter@v15.7.3...v15.8.0)

Updates `tailwind-merge` from 3.5.0 to 3.6.0
- [Release notes](https://github.com/dcastil/tailwind-merge/releases)
- [Commits](dcastil/tailwind-merge@v3.5.0...v3.6.0)

Updates `tailwindcss` from 4.2.2 to 4.3.0
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.0/packages/tailwindcss)

Updates `viem` from 2.48.8 to 2.52.0
- [Release notes](https://github.com/wevm/viem/releases)
- [Commits](https://github.com/wevm/viem/compare/viem@2.48.8...viem@2.52.0)

Updates `wagmi` from 3.6.14 to 3.6.16
- [Release notes](https://github.com/wevm/wagmi/releases)
- [Changelog](https://github.com/wevm/wagmi/blob/main/packages/react/CHANGELOG.md)
- [Commits](https://github.com/wevm/wagmi/commits/wagmi@3.6.16/packages/react)

Updates `waku` from 1.0.0-beta.0 to 1.0.0-beta.1
- [Release notes](https://github.com/wakujs/waku/releases)
- [Changelog](https://github.com/wakujs/waku/blob/main/CHANGELOG.md)
- [Commits](https://github.com/wakujs/waku/commits/v1.0.0-beta.1/packages/waku)

Updates `webauthx` from 0.1.1 to 0.1.2
- [Release notes](https://github.com/wevm/webauthx/releases)
- [Changelog](https://github.com/wevm/webauthx/blob/main/CHANGELOG.md)
- [Commits](https://github.com/wevm/webauthx/compare/webauthx@0.1.1...webauthx@0.1.2)

Updates `zod` from 4.3.6 to 4.4.3
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.3.6...v4.4.3)

---
updated-dependencies:
- dependency-name: "@iconify-json/lucide"
  dependency-version: 1.2.109
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: "@iconify-json/simple-icons"
  dependency-version: 1.2.84
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: "@takumi-rs/image-response"
  dependency-version: 1.5.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production
- dependency-name: "@takumi-rs/wasm"
  dependency-version: 1.5.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.100.14
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: "@vercel/analytics"
  dependency-version: 2.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production
- dependency-name: "@vercel/speed-insights"
  dependency-version: 2.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production
- dependency-name: "@wagmi/core"
  dependency-version: 3.4.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: abitype
  dependency-version: 1.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: accounts
  dependency-version: 0.14.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: ox
  dependency-version: 0.14.24
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: posthog-js
  dependency-version: 1.376.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: posthog-node
  dependency-version: 5.35.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: sql-formatter
  dependency-version: 15.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: tailwind-merge
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: tailwindcss
  dependency-version: 4.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: viem
  dependency-version: 2.51.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: wagmi
  dependency-version: 3.6.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: waku
  dependency-version: 1.0.0-beta.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: webauthx
  dependency-version: 0.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: zod
  dependency-version: 4.4.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
...

Signed-off-by: dependabot[bot] <support@github.com>

    







  








      

  
          

  
  

  
      @dependabot
  dependabot
Bot

        force-pushed
    the
        
      
  dependabot/npm_and_yarn/production-ecf70a1604


    
 branch
    from
    7db496d    to
    e65319c      
    Compare
  



    June 8, 2026 11:50    
    




  

  











  
  

    

      

  










  








  
      

  
    Sign up for free
    to join this conversation on GitHub.
    Already have an account?
    Sign in to comment


  










      

  

    
    

    

  

    Reviewers
  


    

    No reviews






    

  


      
  

    Assignees
  



        


    No one assigned







      


  


  

    Labels
  



    

      

    dependencies

  Pull requests that update a dependency file
  

    javascript

  Pull requests that update javascript code








      

  

    

        

    Projects
  


        




    None yet




  



      


  

    
  

    Milestone
  


      No milestone





    
      
          


  

    

      
        

          
  

    Development
  



            


Successfully merging this pull request may close these issues.





  
  



      
    

  




      

    

  
        

  

    

      0 participants