Skip to content

⬆️(deps): Bump the security-updates group across 1 directory with 7 updates#47

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/security-updates-c83c766fcf
Open

⬆️(deps): Bump the security-updates group across 1 directory with 7 updates#47
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/security-updates-c83c766fcf

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Mar 30, 2026

Bumps the security-updates group with 7 updates in the / directory:

Package From To
@sentry/nextjs 10.34.0 10.46.0
contentful 11.10.2 11.12.0
geist 1.5.1 1.7.0
lucide-react 0.562.0 1.7.0
shadcn 3.7.0 4.1.1
tailwind-merge 3.4.0 3.5.0
web-vitals 5.1.0 5.2.0

Updates @sentry/nextjs from 10.34.0 to 10.46.0

Release notes

Sourced from @​sentry/nextjs's releases.

10.46.0

Important Changes

  • feat(elysia): @sentry/elysia - Alpha Release (#19509)

    New Sentry SDK for the Elysia web framework, supporting both Bun and Node.js runtimes.

    Note: This is an alpha release. Please report any issues or feedback on GitHub.

    Features

    • Automatic error capturing — 5xx errors captured via global onError hook; 3xx/4xx ignored by default. Customizable with shouldHandleError.
    • Automatic tracing — Lifecycle spans for every Elysia phase (Request, Parse, Transform, BeforeHandle, Handle, AfterHandle, MapResponse, AfterResponse, Error) with parameterized route names (e.g. GET /users/:id).
    • Distributed tracingsentry-trace and baggage headers propagated automatically on incoming/outgoing requests.

    Usage

    import * as Sentry from '@sentry/elysia';
    import { Elysia } from 'elysia';
    Sentry.init({ dsn: 'DSN', tracesSampleRate: 1.0 });
    const app = Sentry.withElysia(new Elysia());
    app.get('/', () => 'Hello World');
    app.listen(3000);

Other Changes

  • feat(nuxt): Conditionally use plugins based on Nitro version (v2/v3) (#19955)
  • fix(cloudflare): Forward ctx argument to Workflow.do user callback (#19891)
  • fix(cloudflare): Send correct events in local development (#19900)
  • fix(core): Do not overwrite user provided conversation id in Vercel (#19903)
  • fix(core): Preserve .withResponse() on Anthropic instrumentation (#19935)
  • fix(core): Send internal_error as span status for Vercel error spans (#19921)
  • fix(core): Truncate content array format in Vercel (#19911)
  • fix(deps): bump fast-xml-parser to 5.5.8 in @​azure/core-xml chain (#19918)
  • fix(deps): bump socket.io-parser to 4.2.6 to fix CVE-2026-33151 (#19880)
  • fix(nestjs): Add node to nest metadata (#19875)
  • fix(serverless): Add node to metadata (#19878)
  • chore(ci): Fix "Gatbsy" typo in issue package label workflow (#19905)
  • chore(claude): Enable Claude Code Intelligence (LSP) (#19930)
  • chore(deps): bump mongodb-memory-server-global from 10.1.4 to 11.0.1 (#19888)
  • chore(deps-dev): bump @​react-router/node from 7.13.0 to 7.13.1 (#19544)
  • chore(deps-dev): bump effect from 3.19.19 to 3.20.0 (#19926)
  • chore(deps-dev): bump qunit-dom from 3.2.1 to 3.5.0 (#19546)

... (truncated)

Changelog

Sourced from @​sentry/nextjs's changelog.

10.46.0

Important Changes

  • feat(elysia): @sentry/elysia - Alpha Release (#19509)

    New Sentry SDK for the Elysia web framework, supporting both Bun and Node.js runtimes.

    Note: This is an alpha release. Please report any issues or feedback on GitHub.

    Features

    • Automatic error capturing — 5xx errors captured via global onError hook; 3xx/4xx ignored by default. Customizable with shouldHandleError.
    • Automatic tracing — Lifecycle spans for every Elysia phase (Request, Parse, Transform, BeforeHandle, Handle, AfterHandle, MapResponse, AfterResponse, Error) with parameterized route names (e.g. GET /users/:id).
    • Distributed tracingsentry-trace and baggage headers propagated automatically on incoming/outgoing requests.

    Usage

    import * as Sentry from '@sentry/elysia';
    import { Elysia } from 'elysia';
    Sentry.init({ dsn: 'DSN', tracesSampleRate: 1.0 });
    const app = Sentry.withElysia(new Elysia());
    app.get('/', () => 'Hello World');
    app.listen(3000);

Other Changes

  • feat(nuxt): Conditionally use plugins based on Nitro version (v2/v3) (#19955)
  • fix(cloudflare): Forward ctx argument to Workflow.do user callback (#19891)
  • fix(cloudflare): Send correct events in local development (#19900)
  • fix(core): Do not overwrite user provided conversation id in Vercel (#19903)
  • fix(core): Preserve .withResponse() on Anthropic instrumentation (#19935)
  • fix(core): Send internal_error as span status for Vercel error spans (#19921)
  • fix(core): Truncate content array format in Vercel (#19911)
  • fix(deps): bump fast-xml-parser to 5.5.8 in @​azure/core-xml chain (#19918)
  • fix(deps): bump socket.io-parser to 4.2.6 to fix CVE-2026-33151 (#19880)
  • fix(nestjs): Add node to nest metadata (#19875)
  • fix(serverless): Add node to metadata (#19878)
  • chore(ci): Fix "Gatbsy" typo in issue package label workflow (#19905)
  • chore(claude): Enable Claude Code Intelligence (LSP) (#19930)
  • chore(deps): bump mongodb-memory-server-global from 10.1.4 to 11.0.1 (#19888)
  • chore(deps-dev): bump @​react-router/node from 7.13.0 to 7.13.1 (#19544)
  • chore(deps-dev): bump effect from 3.19.19 to 3.20.0 (#19926)

... (truncated)

Commits
  • e5fdc9d release: 10.46.0
  • c01fe86 release: 10.46.0
  • 0f1171b Merge pull request #19973 from getsentry/prepare-release/10.46.0
  • 6f48cc4 meta(changelog): Update changelog for 10.46.0
  • 54abb35 refactor(elysia): drop @​elysiajs/opentelemetry dependency (#19947)
  • a54de04 ref(core): Remove duplicate buildMethodPath utility from openai (#19969)
  • 0156846 feat(nuxt): Conditionally use plugins based on Nitro version (v2/v3) (#19955)
  • 18a624e feat(elysia): Elysia SDK (#19509)
  • c9812ae test(cloudflare): Enable multi-worker tests for CF integration tests (#19938)
  • 83cabf3 fix(core): Preserve .withResponse() on Anthropic instrumentation (#19935)
  • Additional commits viewable in compare view

Updates contentful from 11.10.2 to 11.12.0

Release notes

Sourced from contentful's releases.

v11.12.0

11.12.0 (2026-03-23)

Features

  • add integration for locale based publishing in CDA [TOL-3653] (#2649) (1952af9)

v11.11.1

11.11.1 (2026-03-20)

v11.11.0

11.11.0 (2026-03-18)

Features

  • types: align CreateClientParams with contentful-sdk-core (#2635) (4c42bdc)

v11.10.7

11.10.7 (2026-03-17)

v11.10.6

11.10.6 (2026-03-11)

v11.10.5

11.10.5 (2026-02-24)

v11.10.4

11.10.4 (2026-02-17)

v11.10.3

11.10.3 (2026-01-27)

Bug Fixes

  • deps: bump contentful-sdk-core version [DX-704] (#2631) (258aebf)
Commits
  • 1952af9 feat: add integration for locale based publishing in CDA [TOL-3653] (#2649)
  • af346f2 build(deps): update @​semantic-release/npm, which updates @​actions/core, which...
  • 6fae9ed [DX-820] Fix security vulnerabilities (#2660)
  • 4c42bdc feat(types): align CreateClientParams with contentful-sdk-core (#2635)
  • 2ef4adb ci(github-actions): update main on triggers to include pull requests (#2658)
  • 2ff7175 build(deps): bump axios in the production-dependencies group (#2657)
  • 57e399b Fix/ts query contentype (#2655)
  • 6d85031 build(deps-dev): bump @​optimize-lodash/rollup-plugin from 4.0.4 to 6.0.0 (#2654)
  • 48081cb build(deps-dev): bump @​rollup/plugin-babel, prettier, semantic-release, types...
  • 338157b build(deps): bump contentful-resolve-response (#2652)
  • Additional commits viewable in compare view

Updates geist from 1.5.1 to 1.7.0

Release notes

Sourced from geist's releases.

geist@1.7.0

We're excited to announce a new member to our font family: Geist Pixel

It's a display typeface family featuring five unique pixel-based variants, each with a distinct visual style. It is designed for decorative use in headlines, logos, and other display contexts where a pixelated aesthetic is desired.

It includes five distinct variants, each exported separately:

Export CSS Variable Description
GeistPixelSquare --font-geist-pixel-square Square pixel shapes
GeistPixelGrid --font-geist-pixel-grid Grid-based pixel pattern
GeistPixelCircle --font-geist-pixel-circle Circular pixel shapes
GeistPixelTriangle --font-geist-pixel-triangle Triangular pixel shapes
GeistPixelLine --font-geist-pixel-line Line-based pixel pattern
import {
  GeistPixelSquare,
  GeistPixelGrid,
  GeistPixelCircle,
  GeistPixelTriangle,
  GeistPixelLine,
} from "geist/font/pixel";
Changelog

Sourced from geist's changelog.

1.7.0

Minor Changes

  • d7ef63c: We're excited to announce a new member to our font family: Geist Pixel

    It's a display typeface family featuring five unique pixel-based variants, each with a distinct visual style. It is designed for decorative use in headlines, logos, and other display contexts where a pixelated aesthetic is desired.

    It includes five distinct variants, each exported separately:

    Export CSS Variable Description
    GeistPixelSquare --font-geist-pixel-square Square pixel shapes
    GeistPixelGrid --font-geist-pixel-grid Grid-based pixel pattern
    GeistPixelCircle --font-geist-pixel-circle Circular pixel shapes
    GeistPixelTriangle --font-geist-pixel-triangle Triangular pixel shapes
    GeistPixelLine --font-geist-pixel-line Line-based pixel pattern
    import {
      GeistPixelSquare,
      GeistPixelGrid,
      GeistPixelCircle,
      GeistPixelTriangle,
      GeistPixelLine,
    } from "geist/font/pixel";
Commits
Maintainer changes

This version was pushed to npm by vercel-release-bot, a new releaser for geist since your current version.


Updates lucide-react from 0.562.0 to 1.7.0

Release notes

Sourced from lucide-react's releases.

Version 1.7.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.6.0...1.7.0

Version 1.6.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.5.0...1.6.0

Version 1.5.0

What's Changed

Full Changelog: lucide-icons/lucide@1.4.0...1.5.0

Version 1.4.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.3.0...1.4.0

Version 1.3.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.2.0...1.3.0

Version 1.2.0

What's Changed

New Contributors

... (truncated)

Commits

Updates shadcn from 3.7.0 to 4.1.1

Release notes

Sourced from shadcn's releases.

shadcn@4.1.1

Patch Changes

shadcn@4.1.0

Minor Changes

shadcn@4.0.8

Patch Changes

shadcn@4.0.7

Patch Changes

shadcn@4.0.6

Patch Changes

shadcn@4.0.5

Patch Changes

shadcn@4.0.4

Patch Changes

shadcn@4.0.3

Patch Changes

shadcn@4.0.2

Patch Changes

shadcn@4.0.1

Patch Changes

... (truncated)

Changelog

Sourced from shadcn's changelog.

4.1.1

Patch Changes

4.1.0

Minor Changes

4.0.8

Patch Changes

4.0.7

Patch Changes

4.0.6

Patch Changes

4.0.5

Patch Changes

4.0.4

Patch Changes

4.0.3

Patch Changes

... (truncated)

Commits

Updates tailwind-merge from 3.4.0 to 3.5.0

Release notes

Sourced from tailwind-merge's releases.

v3.5.0

New Features

Full Changelog: dcastil/tailwind-merge@v3.4.1...v3.5.0

Thanks to @​brandonmcconnell, @​manavm1990, @​langy, @​roboflow, @​syntaxfm, @​getsentry, @​codecov, a private sponsor, @​block, @​openclaw, @​sourcegraph and more via @​thnxdev for sponsoring tailwind-merge! ❤️

v3.4.1

Bug Fixes

Full Changelog: dcastil/tailwind-merge@v3.4.0...v3.4.1

Thanks to @​brandonmcconnell, @​manavm1990, @​langy, @​roboflow, @​syntaxfm, @​getsentry, @​codecov, a private sponsor, @​block, @​openclaw, @​sourcegraph and more via @​thnxdev for sponsoring tailwind-merge! ❤️

Commits
  • 270ac79 v3.5.0
  • 86f772e add changelog for 3.5.0
  • 6c1f77c Merge pull request #651 from dcastil/feature/add-support-for-tailwind-css-v4.2
  • 7a4cacf Add support for decimal fraction values
  • 9ef0f79 fix incorrectly escaped characters
  • f4938b0 update README with v4.2 support
  • b02a572 Add Tailwind v4.2 font-features utilities support
  • 5bd25ec Add Tailwind v4.2 logical sizing utilities
  • 697c920 Add Tailwind v4.2 logical border block utilities
  • 6656a47 Improve JSDoc comments for logical insets
  • Additional commits viewable in compare view

Updates web-vitals from 5.1.0 to 5.2.0

Changelog

Sourced from web-vitals's changelog.

v5.2.0 (2026-03-25)

  • Replace filter()[0] with find() for better performance (#658)
  • Use queueMicrotask for microtask scheduling (#660)
  • Simplify the event and LoAF entry clean up logic (#662)
  • Remove obsolete FID polyfill types (#675)
  • Use LargestContentfulPaint.id as fallback when element is removed from DOM (#676)
  • Fix bug for onLCP when attached late (#697)
  • FHandle initially hidden pages and onLCP registered on visibility change (#698)
  • Ensure we clear idle callbacks in whenIdleOrHidden (#707)
  • Limit pending events to conserve memory (#710)
  • Add includeProcessedEventEntries option (#714)
  • Reduce bundle size by refactoring (#713)
Commits
Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…pdates

Bumps the security-updates group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@sentry/nextjs](https://github.com/getsentry/sentry-javascript) | `10.34.0` | `10.46.0` |
| [contentful](https://github.com/contentful/contentful.js) | `11.10.2` | `11.12.0` |
| [geist](https://github.com/vercel/geist-font/tree/HEAD/packages/next) | `1.5.1` | `1.7.0` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `0.562.0` | `1.7.0` |
| [shadcn](https://github.com/shadcn-ui/ui/tree/HEAD/packages/shadcn) | `3.7.0` | `4.1.1` |
| [tailwind-merge](https://github.com/dcastil/tailwind-merge) | `3.4.0` | `3.5.0` |
| [web-vitals](https://github.com/GoogleChrome/web-vitals) | `5.1.0` | `5.2.0` |



Updates `@sentry/nextjs` from 10.34.0 to 10.46.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.34.0...10.46.0)

Updates `contentful` from 11.10.2 to 11.12.0
- [Release notes](https://github.com/contentful/contentful.js/releases)
- [Commits](contentful/contentful.js@v11.10.2...v11.12.0)

Updates `geist` from 1.5.1 to 1.7.0
- [Release notes](https://github.com/vercel/geist-font/releases)
- [Changelog](https://github.com/vercel/geist-font/blob/main/packages/next/CHANGELOG.md)
- [Commits](https://github.com/vercel/geist-font/commits/geist@1.7.0/packages/next)

Updates `lucide-react` from 0.562.0 to 1.7.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.7.0/packages/lucide-react)

Updates `shadcn` from 3.7.0 to 4.1.1
- [Release notes](https://github.com/shadcn-ui/ui/releases)
- [Changelog](https://github.com/shadcn-ui/ui/blob/main/packages/shadcn/CHANGELOG.md)
- [Commits](https://github.com/shadcn-ui/ui/commits/shadcn@4.1.1/packages/shadcn)

Updates `tailwind-merge` from 3.4.0 to 3.5.0
- [Release notes](https://github.com/dcastil/tailwind-merge/releases)
- [Commits](dcastil/tailwind-merge@v3.4.0...v3.5.0)

Updates `web-vitals` from 5.1.0 to 5.2.0
- [Changelog](https://github.com/GoogleChrome/web-vitals/blob/main/CHANGELOG.md)
- [Commits](GoogleChrome/web-vitals@v5.1.0...v5.2.0)

---
updated-dependencies:
- dependency-name: "@sentry/nextjs"
  dependency-version: 10.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: security-updates
- dependency-name: contentful
  dependency-version: 11.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: security-updates
- dependency-name: geist
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: security-updates
- dependency-name: lucide-react
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: security-updates
- dependency-name: shadcn
  dependency-version: 4.1.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: security-updates
- dependency-name: tailwind-merge
  dependency-version: 3.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: security-updates
- dependency-name: web-vitals
  dependency-version: 5.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: security-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant