chore(deps): bump the production-dependencies group across 1 directory with 7 updates by dependabot[bot] · Pull Request #388 · allxsmith/bestax

dependabot · 2026-07-24T22:50:26Z

Bumps the production-dependencies group with 7 updates in the / directory:

Package	From	To
react	`19.2.7`	`19.2.8`
react-dom	`19.2.7`	`19.2.8`
@fortawesome/fontawesome-free	`7.3.0`	`7.3.1`
@docusaurus/core	`3.10.1`	`3.10.2`
@docusaurus/preset-classic	`3.10.1`	`3.10.2`
@docusaurus/theme-common	`3.10.1`	`3.10.2`
@docusaurus/theme-live-codeblock	`3.10.1`	`3.10.2`

Updates react from 19.2.7 to 19.2.8

Release notes

Sourced from react's releases.

Commits

1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
See full diff in compare view

Updates react-dom from 19.2.7 to 19.2.8

Release notes

Sourced from react-dom's releases.

Commits

1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
See full diff in compare view

Updates @fortawesome/fontawesome-free from 7.3.0 to 7.3.1

Release notes

Sourced from @fortawesome/fontawesome-free's releases.

Commits

14c65a3 Release 7.3.1 (#21630)
See full diff in compare view

Maintainer changes

This version was pushed to npm by fortawesome-admin, a new releaser for @fortawesome/fontawesome-free since your current version.

Updates @docusaurus/core from 3.10.1 to 3.10.2

Release notes

Sourced from @docusaurus/core's releases.

Changelog

Sourced from @docusaurus/core's changelog.

Commits

f37f903 v3.10.2
2f5389d chore: cherry-pick commits for v3.10.2 patch release (#12265)
See full diff in compare view

Updates @docusaurus/preset-classic from 3.10.1 to 3.10.2

Release notes

Sourced from @docusaurus/preset-classic's releases.

Changelog

Sourced from @docusaurus/preset-classic's changelog.

Commits

f37f903 v3.10.2
See full diff in compare view

Updates @docusaurus/theme-common from 3.10.1 to 3.10.2

Release notes

Sourced from @docusaurus/theme-common's releases.

Changelog

Sourced from @docusaurus/theme-common's changelog.

Commits

f37f903 v3.10.2
2f5389d chore: cherry-pick commits for v3.10.2 patch release (#12265)
See full diff in compare view

Updates @docusaurus/theme-live-codeblock from 3.10.1 to 3.10.2

Release notes

Sourced from @docusaurus/theme-live-codeblock's releases.

Changelog

Sourced from @docusaurus/theme-live-codeblock's changelog.

Commits

f37f903 v3.10.2
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…y with 7 updates Bumps the production-dependencies group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.7` | `19.2.8` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.7` | `19.2.8` | | [@fortawesome/fontawesome-free](https://github.com/FortAwesome/Font-Awesome) | `7.3.0` | `7.3.1` | | [@docusaurus/core](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus) | `3.10.1` | `3.10.2` | | [@docusaurus/preset-classic](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic) | `3.10.1` | `3.10.2` | | [@docusaurus/theme-common](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-common) | `3.10.1` | `3.10.2` | | [@docusaurus/theme-live-codeblock](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-live-codeblock) | `3.10.1` | `3.10.2` | Updates `react` from 19.2.7 to 19.2.8 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react) Updates `react-dom` from 19.2.7 to 19.2.8 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom) Updates `@fortawesome/fontawesome-free` from 7.3.0 to 7.3.1 - [Release notes](https://github.com/FortAwesome/Font-Awesome/releases) - [Changelog](https://github.com/FortAwesome/Font-Awesome/blob/7.x/CHANGELOG.md) - [Commits](FortAwesome/Font-Awesome@7.3.0...7.3.1) Updates `@docusaurus/core` from 3.10.1 to 3.10.2 - [Release notes](https://github.com/facebook/docusaurus/releases) - [Changelog](https://github.com/facebook/docusaurus/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/docusaurus/commits/v3.10.2/packages/docusaurus) Updates `@docusaurus/preset-classic` from 3.10.1 to 3.10.2 - [Release notes](https://github.com/facebook/docusaurus/releases) - [Changelog](https://github.com/facebook/docusaurus/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/docusaurus/commits/v3.10.2/packages/docusaurus-preset-classic) Updates `@docusaurus/theme-common` from 3.10.1 to 3.10.2 - [Release notes](https://github.com/facebook/docusaurus/releases) - [Changelog](https://github.com/facebook/docusaurus/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/docusaurus/commits/v3.10.2/packages/docusaurus-theme-common) Updates `@docusaurus/theme-live-codeblock` from 3.10.1 to 3.10.2 - [Release notes](https://github.com/facebook/docusaurus/releases) - [Changelog](https://github.com/facebook/docusaurus/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/docusaurus/commits/v3.10.2/packages/docusaurus-theme-live-codeblock) --- updated-dependencies: - dependency-name: react dependency-version: 19.2.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: react-dom dependency-version: 19.2.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: "@fortawesome/fontawesome-free" dependency-version: 7.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: "@docusaurus/core" dependency-version: 3.10.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: "@docusaurus/preset-classic" dependency-version: 3.10.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: "@docusaurus/theme-common" dependency-version: 3.10.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: "@docusaurus/theme-live-codeblock" dependency-version: 3.10.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-07-24T22:51:11Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@docusaurus/preset-classic@3.10.2
	@docusaurus/theme-common@3.10.2
	@docusaurus/core@3.10.2
	@docusaurus/theme-live-codeblock@3.10.2
	@fortawesome/fontawesome-free@7.3.1

View full report

socket-security · 2026-07-24T22:51:13Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `webpack` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/@storybook/addon-docs@10.4.6` → `npm/@storybook/react-vite@10.4.6` → `npm/@docusaurus/core@3.10.2` → `npm/@docusaurus/theme-common@3.10.2` → `npm/@docusaurus/preset-classic@3.10.2` → `npm/@docusaurus/theme-live-codeblock@3.10.2` → `npm/raw-loader@4.0.2` → `npm/webpack@5.108.4` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/webpack@5.108.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Consolidates dependabot's production-dependencies (#388) and dev-dependencies (#390) grouped updates, bumps the prettier override to 3.9.6 in lockstep with the new manifest floors, and removes the expired brace-expansion cooldown-bypass entry (the >=5.0.8 security override stays).

allxsmith · 2026-07-27T23:12:54Z

Closing as superseded by #393 (merged as 2fb0a1a): all seven production bumps in this group — react/react-dom 19.2.8, @fortawesome/fontawesome-free 7.3.1, @docusaurus/* 3.10.2 — landed there with the lockfile re-resolved on top of current main.

For the record: this PR's Build and Test failure was stale, not real — the audit step failed on brace-expansion (GHSA-mh99-v99m-4gvg), which main fixed in 55d4850 about two hours after this branch was cut.

Generated by Claude Code

dependabot · 2026-07-27T23:13:11Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

…oth CLIs (#447) * chore(deps): consolidate dependabot updates, pin patched minimatch and yaml Consolidates #427, #428, #431, #432 and #440 into one PR so the shared pnpm-lock.yaml is regenerated once instead of forcing dependabot to rebase six branches serially. Same approach as #393 for #388/#390. docusaurus-plugin-llms 0.5.x pins its own dependencies exactly rather than by range, which dragged minimatch back to 9.0.3 (three high ReDoS advisories) and yaml to 2.8.1, failing both `pnpm audit --audit-level=high` and Dependency Review on #440. Two scoped overrides restore the patched versions; the rest of that group was already clean. @semantic-release/changelog 7 and @semantic-release/git 11 are the same CJS-to-ESM wave and are taken together. Every option the release configs actually pass (changelogFile, assets, message) is unchanged, and both declare a semantic-release peer of >=20.1.0, satisfied by ^25.0.8. @testing-library/jest-dom 7 removes no matchers; the new required peer @testing-library/dom is already resolved at 10.4.1 via @testing-library/react. Claude-Session: https://claude.ai/code/session_01TGA6sFTUGsJ6oXhfpjKEnh * feat(create-bestax): require Node 22 and take chalk 6 chalk 6 drops support for Node below 22. The API surface this package uses is unchanged — every call site is a default import using .red/.yellow/.green and friends — so no calling code changes. Raising engines.node to >=22 brings the manifest in line with what the docs have claimed all along: the installation guide already states "Node.js: 22.0.0 or higher (the current LTS baseline)". The version guard in src/index.ts moves ahead of every import and stops using chalk. Import declarations are hoisted and evaluated before any statement in the module, and chalk 6 itself requires Node >= 22 — so a static import would fail to load on exactly the runtimes the guard exists to catch, replacing a clear message with an opaque loader error. ./cli.js is now imported dynamically for the same reason. BREAKING CHANGE: create-bestax now requires Node.js 22 or newer. Node 18 and 20 are both past end-of-life. Running it on an older runtime prints an explicit upgrade message and exits 1. Claude-Session: https://claude.ai/code/session_01TGA6sFTUGsJ6oXhfpjKEnh * feat(bestax-migrate): require Node 22 and take chalk 6 chalk 6 drops support for Node below 22. The API surface this package uses is unchanged, so no calling code changes. The version guard in src/index.ts moves ahead of every import and no longer depends on anything: import declarations are hoisted and evaluated before any statement in the module, and chalk 6 itself requires Node >= 22, so a static import would fail to load on exactly the runtimes the guard exists to catch. ./cli.js is now imported dynamically for the same reason. @babel/parser deliberately stays on 7.x. Babel 8 removes the `deprecatedImportAssert` plugin with no replacement, and this package parses the legacy `import x from 'y' assert { type: 'json' }` form on purpose — a codemod that migrates older codebases must not crash on the syntax those codebases still contain. There is a regression test for it ("parses the legacy import-assert syntax"), which Babel 8 fails outright. jscodeshift 17 bundles its own Babel 7 regardless, so staying on 7 also keeps a single parser in the tree rather than two. BREAKING CHANGE: bestax-migrate now requires Node.js 22 or newer. Node 18 and 20 are both past end-of-life. Running it on an older runtime prints an explicit upgrade message and exits 1. Claude-Session: https://claude.ai/code/session_01TGA6sFTUGsJ6oXhfpjKEnh

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 24, 2026

allxsmith mentioned this pull request Jul 27, 2026

chore: apply grouped dependency updates from #388 and #390 #393

Merged

9 tasks done

allxsmith closed this Jul 27, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-4416e7e3b9 branch July 27, 2026 23:13

This was referenced Jul 28, 2026

CI: Test and Preview Deployment fails on every dependabot PR — guard the wrangler steps on secret presence #398

Closed

chore(deps): consolidate the dependabot backlog, require Node 22 in both CLIs #447

Merged

Navigation Menu

Repository navigation

chore(deps): bump the production-dependencies group across 1 directory with 7 updates - #388

chore(deps): bump the production-dependencies group across 1 directory with 7 updates#388
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-4416e7e3b9

dependabot Bot commented on behalf of github Jul 24, 2026

Uh oh!

socket-security Bot commented Jul 24, 2026

Uh oh!

socket-security Bot commented Jul 24, 2026

Uh oh!

allxsmith commented Jul 27, 2026

Uh oh!

dependabot Bot commented on behalf of github Jul 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Jul 24, 2026

19.2.8 (July 21st, 2026)

React Server Components

19.2.8 (July 21st, 2026)

React Server Components

Release 7.3.1

3.10.2 (2026-07-10)

3.10.2 (2026-07-10)

3.10.2 (2026-07-10)

3.10.2 (2026-07-10)

3.10.2 (2026-07-10)

3.10.2 (2026-07-10)

3.10.2 (2026-07-10)

3.10.2 (2026-07-10)

Uh oh!

socket-security Bot commented Jul 24, 2026

Uh oh!

socket-security Bot commented Jul 24, 2026

Uh oh!

allxsmith commented Jul 27, 2026

Uh oh!

dependabot Bot commented on behalf of github Jul 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant