deps(deps): bump the minor-and-patch group with 36 updates

[dependabot]

Bumps the minor-and-patch group with 36 updates:

Package	From	To
@noriginmedia/norigin-spatial-navigation	3.1.0	3.2.0
@radix-ui/react-dialog	1.1.15	1.1.17
@radix-ui/react-dropdown-menu	2.1.16	2.1.18
@radix-ui/react-progress	1.1.8	1.1.10
@radix-ui/react-scroll-area	1.2.10	1.2.12
@radix-ui/react-separator	1.1.8	1.1.10
@radix-ui/react-slider	1.3.6	1.4.1
@radix-ui/react-slot	1.2.4	1.3.0
@radix-ui/react-tabs	1.1.13	1.1.15
@radix-ui/react-toast	1.2.15	1.2.17
@radix-ui/react-tooltip	1.2.8	1.2.10
@supabase/supabase-js	2.99.3	2.108.2
framer-motion	12.38.0	12.40.0
imapflow	1.3.6	1.4.2
ioredis	5.10.1	5.11.1
isomorphic-dompurify	3.12.0	3.18.0
lucide-react	1.14.0	1.21.0
mailparser	3.9.9	3.9.11
next	16.2.4	16.2.9
openai	6.36.0	6.44.0
posthog-js	1.381.0	1.392.0
react	19.2.5	19.2.7
@types/react	19.2.14	19.2.17
react-dom	19.2.5	19.2.7
resend	6.12.2	6.14.0
tailwind-merge	3.5.0	3.6.0
video.js	8.23.7	8.23.8
@playwright/test	1.60.0	1.61.0
@tailwindcss/postcss	4.2.4	4.3.1
@types/jsdom	28.0.0	28.0.3
@vitest/coverage-v8	4.1.8	4.1.9
eslint-config-next	16.2.4	16.2.9
postcss	8.5.14	8.5.15
tailwindcss	4.2.4	4.3.1
tsx	4.21.0	4.22.4
vitest	4.1.8	4.1.9

Updates @noriginmedia/norigin-spatial-navigation from 3.1.0 to 3.2.0

Release notes

Sourced from @​noriginmedia/norigin-spatial-navigation's releases.

@​noriginmedia/norigin-spatial-navigation-core@​3.2.0

Minor Changes

• a18ed66: Add focusOnPresetKey init option (default true) to control whether a component is automatically focused when it is added and its focus key was already set as the current focus key (e.g. setFocus was called before the component mounted). Set it to false to disable this implicit refocus on add.

@​noriginmedia/norigin-spatial-navigation-react@​3.2.0

Minor Changes

• a18ed66: Add focusOnPresetKey init option (default true) to control whether a component is automatically focused when it is added and its focus key was already set as the current focus key (e.g. setFocus was called before the component mounted). Set it to false to disable this implicit refocus on add.

Patch Changes

• Updated dependencies [a18ed66]
  • @​noriginmedia/norigin-spatial-navigation-core@​3.2.0

@​noriginmedia/norigin-spatial-navigation@​3.2.0

Minor Changes

• a18ed66: Add focusOnPresetKey init option (default true) to control whether a component is automatically focused when it is added and its focus key was already set as the current focus key (e.g. setFocus was called before the component mounted). Set it to false to disable this implicit refocus on add.

Patch Changes

• Updated dependencies [a18ed66]
  • @​noriginmedia/norigin-spatial-navigation-core@​3.2.0
  • @​noriginmedia/norigin-spatial-navigation-react@​3.2.0

Commits

• 2a0924b ci: Release Packages (#237)
• a18ed66 feat: configurable focus-on-preset-key behavior + CLAUDE.md (#236)
• 02f652b Update README.md to use latest logos (#232)
• dd47d22 Added SKILL.md for agents to use this library (#229)
• See full diff in compare view

Updates @radix-ui/react-dialog from 1.1.15 to 1.1.17

Changelog

Sourced from @​radix-ui/react-dialog's changelog.

1.1.17

• Removed dev-only warnings for dialogs when title and/or description is not rendered.
• Fixed Dismissable Layer so outside interactions stopped by extension UI overlays do not dismiss dialogs or popovers.
• Updated dependencies: @radix-ui/react-slot@1.3.0, @radix-ui/react-dismissable-layer@1.1.13, @radix-ui/react-primitive@2.1.6, @radix-ui/react-focus-scope@1.1.10, @radix-ui/react-portal@1.1.12

1.1.16

• Fixed disabled pointer events in closed dialogs
• Fixed a bug where iOS text selection and editing on HTML inputs within react-dialog were broken
• Fixed triggers referencing a non-existent element via aria-controls when their content is removed from the DOM (credit to @​dodomorandi for the original PR)
• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/react-presence@1.1.6, @radix-ui/react-slot@1.2.5, @radix-ui/react-focus-guards@1.1.4, @radix-ui/react-dismissable-layer@1.1.12, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-focus-scope@1.1.9, @radix-ui/react-id@1.1.2, @radix-ui/react-portal@1.1.11, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-controllable-state@1.2.3

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-dialog since your current version.

Updates @radix-ui/react-dropdown-menu from 2.1.16 to 2.1.18

Changelog

Sourced from @​radix-ui/react-dropdown-menu's changelog.

2.1.18

• Fixed a bug where menus and submenus remained open after a window loses focus.
• Updated dependencies: @radix-ui/react-menu@2.1.18, @radix-ui/react-primitive@2.1.6

2.1.17

• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/react-menu@2.1.17, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-id@1.1.2, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-controllable-state@1.2.3

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-dropdown-menu since your current version.

Updates @radix-ui/react-progress from 1.1.8 to 1.1.10

Changelog

Sourced from @​radix-ui/react-progress's changelog.

1.1.10

• Updated dependencies: @radix-ui/react-primitive@2.1.6

1.1.9

• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/react-context@1.1.4, @radix-ui/react-primitive@2.1.5

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-progress since your current version.

Updates @radix-ui/react-scroll-area from 1.2.10 to 1.2.12

Changelog

Sourced from @​radix-ui/react-scroll-area's changelog.

1.2.12

• Stabilized the viewport style tag unless the nonce changes.
• Fixed Duplicate index signature errors that surfaced when consuming multiple packages together.
• Updated dependencies: @radix-ui/react-primitive@2.1.6

1.2.11

• Fixed missing data-state attribute for Scroll Area scrollbars
• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/react-presence@1.1.6, @radix-ui/react-direction@1.1.2, @radix-ui/number@1.1.2, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-callback-ref@1.1.2, @radix-ui/react-use-layout-effect@1.1.2

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-scroll-area since your current version.

Updates @radix-ui/react-separator from 1.1.8 to 1.1.10

Changelog

Sourced from @​radix-ui/react-separator's changelog.

1.1.10

• Updated dependencies: @radix-ui/react-primitive@2.1.6

1.1.9

• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/react-primitive@2.1.5

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-separator since your current version.

Updates @radix-ui/react-slider from 1.3.6 to 1.4.1

Changelog

Sourced from @​radix-ui/react-slider's changelog.

1.4.1

• Fixed Duplicate index signature errors that surfaced when consuming multiple packages together.
• Updated dependencies: @radix-ui/react-primitive@2.1.6, @radix-ui/react-collection@1.1.10

1.4.0

• Added unstable ThumbProvider, ThumbTrigger, and BubbleInput parts to Slider. SliderThumb was previously a single component that implicitly rendered a hidden native input for form submission. It is now composed from these new parts, which are exposed so consumers can decouple the bubble input from the thumb (for example, to render or customize it independently) instead of relying on SliderThumb to render it implicitly. SliderThumb continues to render all three by default, so existing usage is unaffected.
• Added focusVisible for non-keyboard interactions with slider thumbs for progressively enabling styles using :focus-visible alongside programmatic focus management
• Fixed Slider focus bugs in scrollable context
• Fixed a Slider bug where very small step values made the thumbs unresponsive
• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/react-collection@1.1.9, @radix-ui/react-direction@1.1.2, @radix-ui/number@1.1.2, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-controllable-state@1.2.3, @radix-ui/react-use-layout-effect@1.1.2, @radix-ui/react-use-previous@1.1.2, @radix-ui/react-use-size@1.1.2

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-slider since your current version.

Updates @radix-ui/react-slot from 1.2.4 to 1.3.0

Changelog

Sourced from @​radix-ui/react-slot's changelog.

1.3.0

Added generic type arguments for SlotProps and createSlot

SlotProps and createSlot now accept generic type arguments to specify the type of element a slot should render, as well as its props.

const Slot = createSlot<HTMLButtonElement, MyCustomButtonProps>("Slot");

1.2.5

• Fixed infinite re-render loop in React 19 caused by Slot creating a new ref callback on every render
• Added support for nested Slottable via a render prop, so a slotted element can be wrapped while still merging Slot props and refs onto it
• Added repository.directory to all package.json files
• Improved error messages for invalid slot children
• Updated dependencies: @radix-ui/react-compose-refs@1.1.3

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-slot since your current version.

Updates @radix-ui/react-tabs from 1.1.13 to 1.1.15

Changelog

Sourced from @​radix-ui/react-tabs's changelog.

1.1.15

• Updated dependencies: @radix-ui/react-primitive@2.1.6, @radix-ui/react-roving-focus@1.1.13

1.1.14

• Fixed triggers referencing a non-existent element via aria-controls when their content is removed from the DOM (credit to @​dodomorandi for the original PR)
• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/react-presence@1.1.6, @radix-ui/react-direction@1.1.2, @radix-ui/primitive@1.1.4, @radix-ui/react-context@1.1.4, @radix-ui/react-id@1.1.2, @radix-ui/react-primitive@2.1.5, @radix-ui/react-roving-focus@1.1.12, @radix-ui/react-use-controllable-state@1.2.3

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-tabs since your current version.

Updates @radix-ui/react-toast from 1.2.15 to 1.2.17

Changelog

Sourced from @​radix-ui/react-toast's changelog.

1.2.17

• Updated dependencies: @radix-ui/react-dismissable-layer@1.1.13, @radix-ui/react-primitive@2.1.6, @radix-ui/react-collection@1.1.10, @radix-ui/react-portal@1.1.12, @radix-ui/react-visually-hidden@1.2.6

1.2.16

• Allow to specify container for ToastAnnounce
• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/react-presence@1.1.6, @radix-ui/react-dismissable-layer@1.1.12, @radix-ui/react-collection@1.1.9, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-portal@1.1.11, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-callback-ref@1.1.2, @radix-ui/react-use-controllable-state@1.2.3, @radix-ui/react-use-layout-effect@1.1.2, @radix-ui/react-visually-hidden@1.2.5

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-toast since your current version.

Updates @radix-ui/react-tooltip from 1.2.8 to 1.2.10

Changelog

Sourced from @​radix-ui/react-tooltip's changelog.

1.2.10

• Updated dependencies: @radix-ui/react-slot@1.3.0, @radix-ui/react-popper@1.3.1, @radix-ui/react-dismissable-layer@1.1.13, @radix-ui/react-primitive@2.1.6, @radix-ui/react-portal@1.1.12, @radix-ui/react-visually-hidden@1.2.6

1.2.9

• Fixed runtime error when event target is non-Node
• Fixed a Tooltip bug so that skipDelayDuration={0} works as expected. Previously, the open delay could still be skipped when moving between triggers.
• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/react-presence@1.1.6, @radix-ui/react-popper@1.3.0, @radix-ui/react-slot@1.2.5, @radix-ui/react-dismissable-layer@1.1.12, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-id@1.1.2, @radix-ui/react-portal@1.1.11, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-controllable-state@1.2.3, @radix-ui/react-visually-hidden@1.2.5

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-tooltip since your current version.

Updates @supabase/supabase-js from 2.99.3 to 2.108.2

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.108.2

2.108.2 (2026-06-15)

🩹 Fixes

• auth: preserve valid session on refresh failure and cooldown repeat failures (#2436)
• realtime: clarify httpSend() 404 error and server migration note (#2444)
• release: pin Deno and bound JSR publish to survive stranded-task hangs (#2439)
• release: restore JSR publish flags and enable for beta (#2440)

❤️ Thank You

• Katerina Skroumpelou @​mandarini

v2.108.2-canary.5

2.108.2-canary.5 (2026-06-15)

This was a version bump only, there were no code changes.

v2.108.2-canary.4

2.108.2-canary.4 (2026-06-12)

🩹 Fixes

• realtime: clarify httpSend() 404 error and server migration note (#2444)

❤️ Thank You

• Katerina Skroumpelou @​mandarini

v2.108.2-canary.3

2.108.2-canary.3 (2026-06-11)

This was a version bump only, there were no code changes.

v2.108.2-canary.2

2.108.2-canary.2 (2026-06-11)

🩹 Fixes

• release: restore JSR publish flags and enable for beta (#2440)

❤️ Thank You

• Katerina Skroumpelou @​mandarini

v2.108.2-canary.1

2.108.2-canary.1 (2026-06-11)

🩹 Fixes

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.108.2 (2026-06-15)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.108.0 (2026-06-08)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.107.0 (2026-06-02)

🚀 Features

• auth: remove navigator.locks-based mutex; introduce commit guard + dispose() (#2392)
• supabase: update X-Client-Info to structured metadata format (#2359)
• realtime: allow httpSend to send binary payload (#2400)

❤️ Thank You

• Claude Sonnet 4.6
• Eduardo Gurgel
• Guilherme Souza
• Katerina Skroumpelou @​mandarini
• Omar Al Matar @​Bewinxed

2.106.2 (2026-05-25)

🩹 Fixes

• misc: add react-native export condition for Hermes-safe resolution (#2393)

❤️ Thank You

• Myroslav Hryhschenko @​BLOCKMATERIAL

2.106.1 (2026-05-20)

🩹 Fixes

• misc: hide dynamic import from hermesc (#2381)

❤️ Thank You

• Katerina Skroumpelou @​mandarini

2.106.0 (2026-05-18)

🚀 Features

• supabase: W3C/OpenTelemetry trace context propagation (#2163)

... (truncated)

Commits

• 76f3f02 test(auth): add passkey unit and e2e coverage (#2442)
• 65fafe5 chore(release): version 2.108.0 changelogs (#2433)
• 57014e1 chore(release): version 2.107.0 changelogs (#2421)
• 54ec2b6 feat(auth): remove navigator.locks-based mutex; introduce commit guard + disp...
• 3397c92 feat(supabase): update X-Client-Info to structured metadata format (#2359)
• 335207f feat(realtime): allow httpSend to send binary payload (#2400)
• 42f12dd docs(repo): ship per-package AGENTS.md and migrations via npm (#2397)
• b200b74 chore(release): version 2.106.2 changelogs (#2396)
• a5f09cf chore(repo): adopt pnpm catalog and clean up devDeps (#2389)
• c72cc56 fix(misc): add react-native export condition for Hermes-safe resolution (#2393)
• Additional commits viewable in compare view

Updates framer-motion from 12.38.0 to 12.40.0

Changelog

Sourced from framer-motion's changelog.

[12.40.0] 2026-05-21

Added

• path option to transition.
• arc() for motion along an arc.

[12.39.0] 2026-05-18

Added

• Support for repeatType and repeatDelay in animation sequences.

Fixed

• Variants: Re-run keyframe animations when switching between variant labels even when they share identical keyframe arrays.
• Drag: Preserve in-flight motion value animations across React 19 reorder unmount/remount so dragSnapToOrigin no longer leaves the drag transform stranded after a layout swap.
• LazyMotion: Share React contexts between the framer-motion and framer-motion/m (and therefore motion/react and motion/react-m) CJS bundles so that <m.div> from the /m subpath picks up features loaded by <LazyMotion> from the main entry point.
• useScroll: Support hydrating target and container refs from anywhere in the tree.
• Drag: Gesture no longer starts from incorrect start point when rendered inside <AnimatePresence initial={false} />.
• Drag: dragConstraints, when set as viewport-relative ref, no longer break on scroll.§
• Updated visualElement hydration order.
• useAnimate: Now respects skipAnimations.
• AnimatePresence: Fix object-form initial values not applied on re-entry after exit completes.
• scroll: Fixed callback progress when tracking an element.
• useScroll: Fix hardware acceleration when tracking an element.

Commits

• 38ebb94 v12.40.0
• b1f766c Latest
• bca5544 Merge pull request #3699 from motiondivision/lochie/arcs-injectable
• f1a96cf arc(): rename amp/rotate, expose MotionPath, fix explicit cw/ccw
• b4aaba0 pathRotation: non-destructive orientToPath rotation channel
• 8604ef3 Make arcs injectable via transition.path = arc()
• f90fe29 add orientToPath
• 9ebe999 fix: test
• bc2107e Revert "no should"
• 6eeb92d no should
• Additional commits viewable in compare view

Updates imapflow from 1.3.6 to 1.4.2

Changelog

Sourced from imapflow's changelog.

1.4.2 (2026-06-19)

Bug Fixes

• bump nodemailer to 9.0.1 (9c46aa9)

1.4.1 (2026-06-15)

Bug Fixes

• ship refreshed dependencies (nodemailer 9, updated toolchain) (e1d36e6)

1.4.0 (2026-06-09)

Features

• add Gmail label search term to the search compiler (4b2d173)

1.3.7 (2026-06-08)

Bug Fixes

• harden FLAGS guard and bring lib to full test coverage (6666bec)

Commits

• 03f6831 chore(master): release 1.4.2 [skip-ci] (#361)
• 9c46aa9 fix: bump nodemailer to 9.0.1
• 2a02044 chore(master): release 1.4.1 [skip-ci] (#359)
• e1d36e6 fix: ship refreshed dependencies (nodemailer 9, updated toolchain)
• cb2503a chore: refresh dependencies and align project tooling with EmailEngine
• 5b13151 chore(master): release 1.4.0 [skip-ci] (#358)
• 4b2d173 feat: add Gmail label search term to the search compiler
• c0969c6 chore(master): release 1.3.7 [skip-ci] (#357)
• 6666bec fix: harden FLAGS guard and bring lib to full test coverage
• See full diff in compare view

Updates ioredis from 5.10.1 to 5.11.1

Release notes

Sourced from ioredis's releases.

v5.11.1

5.11.1 (2026-06-04)

Bug Fixes

• cluster: reconnect to nodes that restart without slot changes (#2096) (c84b2ee)
• parse protocol-relative Redis URLs as TCP connections (#2125) (131ee24)

v5.11.0

5.11.0 (2026-05-26)

Bug Fixes

• prevent RangeError from string accumulation in pipeline (#2088) (defc077)
• replace deprecated url.parse() with WHATWG URL API (#2081) (0021a45), closes redis/ioredis#1747

Features

• add array commands, typings and tests (#2114) (baf68d6)
• add increx command (#2115) (37d0695)
• add Redis MSETEX support (#2111) (04a4615)
• add typed GCRA command support and functional tests (#2094) (468a802)
• add vector set command support (#2116) (b7b3def)
• Add xnack command (#2103) (187d29b)
• Add zinter zunion count (#2104) (0d510bb)
• Implement TracingChannel support (#2089) (4760e0a)

Changelog

Sourced from ioredis's changelog.

5.11.1 (2026-06-04)

Bug Fixes

• cluster: reconnect to nodes that restart without slot changes (#2096) (c84b2ee)
• parse protocol-relative Redis URLs as TCP connections (#2125) (131ee24)

5.11.0 (2026-05-26)

Bug Fixes

• prevent RangeError from string accumulation in pipeline (#2088) (defc077)
• replace deprecated url.parse() with WHATWG URL API (#2081) (0021a45), closes redis/ioredis#1747

Features

• add array commands, typings and tests (#2114) (baf68d6)
• add increx command (#2115) (37d0695)
• add Redis MSETEX support (#2111) (04a4615)
• add typed GCRA command support and functional tests (#2094) (468a802)
• add vector set command support (#2116) (b7b3def)
• Add xnack command (#2103) (187d29b)
• Add zinter zunion count (#2104) (0d510bb)
• Implement TracingChannel support (#2089) (4760e0a)

Commits

• fb224a7 chore(release): 5.11.1 [skip ci]
• 131ee24 fix: parse protocol-relative Redis URLs as TCP connections (#2125)
• c84b2ee fix(cluster): reconnect to nodes that restart without slot changes (#2096)
• 1490432 chore(release): 5.11.0 [skip ci]
• 5359d4d refactor(utils): inline defaults and isArguments helpers (#2107)
• b7b3def feat: add vector set command support (#2116)
• faa53fd ci: update Node.js and Redis test matrix (#2119)
• 37d0695 feat: add increx command (#2115)
• 612ee9d chore: update Redis 8.8 test image to custom (#2118)
• baf68d6 feat: add array commands, typings and tests (#2114)
• Additional commits viewable in compare view

Updates isomorphic-dompurify from 3.12.0 to 3.18.0

Release notes

Sourced from isomorphic-dompurify's releases.

3.18.0: Updated dependencies

• dompurify 3.4.10 -> 3.4.11
• vitest 4.1.8 -> 4.1.9
• pnpm/action-setup 6 -> 6.0.8

3.17.0: Updated dependencies

• dompurify 3.4.8 -> 3.4.10
• @​biomejs/biome 2.4.16 -> 2.5.0
• pnpm 11.4.0 -> 11.6.0

3.16.0: Updated dependencies

• dompurify 3.4.7 -> 3.4.8
• vitest 4.1.7 -> 4.1.8
• lefthook 2.1.8 -> 2.1.9

3.15.0: Updated dependencies

• dompurify 3.4.5 -> 3.4.7
• @​biomejs/biome 2.4.15 -> 2.4.16
• vitest 4.1.6 -> 4.1.7
• packageManager pnpm 11.1.3 -> 11.4.0

3.14.0: Updated dependencies

What's Changed

• chore(deps): bump dompurify from 3.4.3 to 3.4.5 by @​dependabot[bot]
• chore: Allowed esbuild and disallowed lefthook for ci.
• chore: Added homepage URL to package.json.

Full Changelog: kkomelin/isomorphic-dompurify@3.13.0...3.14.0

3.13.0: Updated dependencies

What's Changed

• chore(deps-dev): bump vitest from 4.1.5 to 4.1.6 by @​dependabot[bot] in kkomelin/isomorphic-dompurify#435
• chore(deps-dev): bump @​types/jsdom from 28.0.1 to 28.0.3 by @​dependabot[bot] in kkomelin/isomorphic-dompurify#436
• chore(deps-dev): bump @​biomejs/biome from 2.4.14 to 2.4.15 by @​dependabot[bot] in kkomelin/isomorphic-dompurify#434
• chore(deps): bump dompurify from 3.4.2 to 3.4.3 by @​dependabot[bot] in kkomelin/isomorphic-dompurify#437

Full Changelog: kkomelin/isomorphic-dompurify@3.12.0...3.13.0

Commits

• 1d5745c chore: release v3.18.0
• e1202c5 chore(deps): bump dompurify from 3.4.10 to 3.4.11
• ab9cc6b chore(deps-dev): bump vitest from 4.1.8 to 4.1.9
• 60491d6 chore(deps): bump pnpm/action-setup from 6 to 6.0.8
• 4b0f0db chore: Updated dependencies.
• 1e537bd chore(deps): bump dompurify from 3.4.8 to 3.4.9
• bee551b chore: Bump version to 3.16.0 and update dependencies.
• e03b0c0 chore(deps): bump dompurify from 3.4.7 to 3.4.8
• 86abe8b chore(deps-dev): bump lefthook from 2.1.8 to 2.1.9
• 284831c chore(deps-dev): bump vitest from 4.1.7 to 4.1.8
• Additional commits viewable in compare view

Updates lucide-react from 1.14.0 to 1.21.0

Release notes

Sourced from lucide-react's releases.

Version 1.21.0

What's Changed

• ci(release.yml): Remove new-version in release flow by @​ericfennis in lucide-icons/lucide#4478
• ci(release.yml): Fix workflow and remove version scripts in package scripts by @​ericfennis in lucide-icons/lucide#4479
• fix(docs): rename navigation category label by @​Hsiii in lucide-icons/lucide#4483
• feat(icons): added broken-bone icon by @​Patolord in lucide-icons/lucide#4131

New Contributors

• @​Hsiii made their first contribution in lucide-icons/lucide#4483
• @​Patolord made their first contribution in lucide-icons/lucide#4131

Full Changelog: lucide-icons/lucide@1.20.0...1.21.0

Version 1.20.0

What's Changed

• fix(icons): decreased size of arrows inside square-arrow-* icons by @​jguddas in lucide-icons/lucide#3926
• chore(tags): Add tags to search- icons by @​jamiemlaw in lucide-icons/lucide#4099
• feat(icons): added save-check icon by @​Konixy in lucide-icons/lucide#3120
• feat(icons): added tag-plus and tag-x icons by @​adam-kov in lucide-icons/lucide#3980
• feat(icons): added banknote-check icon by @​mfjramirezf in lucide-icons/lucide#3956
• feat(icons): added clock-arrow-in icon by @​jguddas in lucide-icons/lucide#2403
• feat(icons): added summary icon by @​jpjacobpadilla in lucide-icons/lucide#3114
• feat(icons): added user-round-arrow-in icon by @​jguddas in lucide-icons/lucide#2283
• feat(icons): added clock-arrow-out icon by @​jguddas in lucide-icons/lucide#2404
• docs(docs): fix broken Svelte package source link in README by @​SRKrukowski in lucide-icons/lucide#4468
• chore(deps-dev): bump @​angular/compiler from 21.2.5 to 21.2.17 by @​dependabot[bot] in lucide-icons/lucide#4474
• chore(deps-dev): bump @​angular/core from 21.2.5 to 21.2.17 by @​dependabot[bot] in lucide-icons/lucide#4470
• chore(deps-dev): bump vitest from 4.0.12 to 4.1.0 by @​dependabot[bot] in lucide-icons/lucide#4429
• chore(deps-dev): bump markdown-it from 14.1.1 to 14.2.0 by @​dependabot[bot] in lucide-icons/lucide#4475
• chore(deps-dev): bump @​angular/common from 21.2.5 to 21.2.17 by @​dependabot[bot] in lucide-icons/lucide#4471
• feat(icons): added pencil-sparkles icon by @​jennieboops in lucide-icons/lucide#4445

New Contributors

• @​Konixy made their first contribution in lucide-icons/lucide#3120
• @​adam-kov made their first contribution in lucide-icons/lucide#3980
• @​mfjramirezf made their first contribution in lucide-icons/lucide#3956
• @​SRKrukowski made their first contribution in lucide-icons/lucide#4468
• @​jennieboops made their first contribution in lucide-icons/lucide#4445

Full Changelog: lucide-icons/lucide@1.19.0...1.20.0

Version 1.19.0

What's Changed

• chore(deps): upgrade pnpm to version 11.6.0 by @​ericfennis in lucide-icons/lucide#4458
• feat(icons): added star-* icons by @​RajnishKMehta in lucide-icons/lucide#3918
• chore(suggest-tags): Update metadata suggestion script by @​ericfennis in lucide-icons/lucide#4462
• feat(icons): added save-pen icon by @​vaporvee in lucide-icons/lucide#4179
• feat(icons): added wrench-off icon by @​nilsjonsson in lucide-icons/lucide#4434
• feat(icons): added ad icon by @​jamiemlaw in lucide-icons/lucide#4323
• feat(icons): added eye-dashed icon by @​karsa-mistmere in lucide-icons/lucide#4415

... (truncated)

Commits

• 5ff536e ci(release.yml): Fix workflow and remove version scripts in package scripts...
• 07c885e fix(docs): fix zephyr-cloud URL in readmes
• See full diff in compare view

Updates mailparser from 3.9.9 to 3.9.11

Changelog

Sourced from mailparser's changelog.

3.9.11 (2026-06-19)

Bug Fixes

• bump nodemailer to 9.0.1 (020f140)

3.9.10 (2026-06-15)

Bug Fixes

• bump dependencies (nodemailer 9, eslint 10.5, prettier 3.8.4) (262ecff)

Commits

• 04116f0 chore(master): release 3.9.11 [skip-ci] (#425)
• 020f140 fix: bump nodemailer to 9.0.1
• b890336 docs: add PGP-signed SECURITY.txt (RFC ...

  Description has been truncated

[dependabot]

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

vu1nz Security Review

0 finding(s) in PR #?

No security issues found.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	next@​16.2.9
	@​radix-ui/​react-separator@​1.1.10
	eslint-config-next@​16.2.9
	@​radix-ui/​react-progress@​1.1.10
	@​radix-ui/​react-slot@​1.2.3 ⏵ 1.3.0	+1		+1
	@​radix-ui/​react-tabs@​1.1.15
	@​radix-ui/​react-dialog@​1.1.17
	@​radix-ui/​react-dropdown-menu@​2.1.18
	posthog-js@​1.392.0
	@​radix-ui/​react-tooltip@​1.2.10
	@​radix-ui/​react-slider@​1.4.1
	@​radix-ui/​react-toast@​1.2.17
	@​radix-ui/​react-scroll-area@​1.2.12
	@​noriginmedia/​norigin-spatial-navigation@​3.2.0
	@​types/​jsdom@​28.0.3
	openai@​6.44.0
	@​types/​react@​19.2.17
	vitest@​4.1.9
	@​vitest/​coverage-v8@​4.1.9
	mailparser@​3.9.11
	lucide-react@​1.21.0
	postcss@​8.5.15
	tailwindcss@​4.3.1
	react@​19.2.7
	tailwind-merge@​3.6.0
	video.js@​8.23.8
	framer-motion@​12.40.0
	react-dom@​19.2.7
	isomorphic-dompurify@​3.18.0
	imapflow@​1.4.2
	resend@​6.14.0
	@​tailwindcss/​postcss@​4.3.1
See 1 more rows in the dashboard

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @emnapi/runtime is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/next@16.2.9 → npm/@emnapi/runtime@1.11.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/runtime@1.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm @typescript-eslint/eslint-plugin is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/eslint-config-next@16.2.9 → npm/@typescript-eslint/eslint-plugin@8.61.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript-eslint/eslint-plugin@8.61.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm @videojs/vhs-utils is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/video.js@8.23.8 → npm/@videojs/vhs-utils@4.1.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@videojs/vhs-utils@4.1.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Publisher changed: npm @videojs/vhs-utils is now published by essk Author: essk From: pnpm-lock.yaml → npm/video.js@8.23.8 → npm/@videojs/vhs-utils@4.1.2 ℹ Read more on: This package | This alert | What is unstable ownership? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@videojs/vhs-utils@4.1.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Publisher changed: npm mpd-parser is now published by essk Author: essk From: pnpm-lock.yaml → npm/video.js@8.23.8 → npm/mpd-parser@1.4.0 ℹ Read more on: This package | This alert | What is unstable ownership? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/mpd-parser@1.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm playwright-core under ms-azure-data-studio License: ms-azure-data-studio - The applicable license policy does not permit this license (5) (package/ThirdPartyNotices.txt) From: pnpm-lock.yaml → npm/@playwright/test@1.61.0 → npm/playwright-core@1.61.0 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/playwright-core@1.61.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm playwright under ms-azure-data-studio License: ms-azure-data-studio - The applicable license policy does not permit this license (5) (package/ThirdPartyNotices.txt) From: pnpm-lock.yaml → npm/@playwright/test@1.61.0 → npm/playwright@1.61.0 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/playwright@1.61.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm posthog-js is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package.json → npm/posthog-js@1.392.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/posthog-js@1.392.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm rollup under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/LICENSE.md) From: pnpm-lock.yaml → npm/@vitejs/plugin-react@5.1.4 → npm/vitest@4.1.9 → npm/rollup@4.62.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rollup@4.62.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report