Skip to content

chore(deps): Bump the npm_and_yarn group across 3 directories with 3 updates#3

Open
dependabot[bot] wants to merge 1 commit into
2026from
dependabot/npm_and_yarn/plp-platform/npm_and_yarn-45f7f37193
Open

chore(deps): Bump the npm_and_yarn group across 3 directories with 3 updates#3
dependabot[bot] wants to merge 1 commit into
2026from
dependabot/npm_and_yarn/plp-platform/npm_and_yarn-45f7f37193

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot Bot commented on behalf of github Feb 20, 2026

Bumps the npm_and_yarn group with 1 update in the /plp-platform directory: next.
Bumps the npm_and_yarn group with 2 updates in the /plp-platform/plp_program directory: diff and js-yaml.
Bumps the npm_and_yarn group with 1 update in the /plp-platform/plp_program/tests/integration directory: diff.

Updates next from 14.2.18 to 15.5.10

Release notes

Sourced from next's releases.

v15.5.10

Please refer the following changelogs for more information about this security release:

v15.4.11

Please see this changelog for more information about this security patch.

v15.3.9

Please see this changelog for more information about this security patch.

v15.2.9

Please see this changelog for more information about this security patch.

v15.1.12

Please see this changelog for more information about this security patch.

v15.0.8

Please see this changelog for more information about this security patch.

Commits

Updates js-yaml from 4.1.0 to 3.14.2

Changelog

Sourced from js-yaml's changelog.

[4.1.1] - 2025-11-12

Security

  • Fix prototype pollution issue in yaml merge (<<) operator.
Commits

Updates diff from 5.2.0 to 5.2.2

Changelog

Sourced from diff's changelog.

v5.2.2 - January 2026

Only change from 5.2.0 is a backport of the fix to GHSA-73rr-hh4g-fpgx.

v5.2.1 (deprecated)

Accidental release - do not use.

Commits

Updates diff from 3.5.0 to 3.5.1

Changelog

Sourced from diff's changelog.

v5.2.2 - January 2026

Only change from 5.2.0 is a backport of the fix to GHSA-73rr-hh4g-fpgx.

v5.2.1 (deprecated)

Accidental release - do not use.

Commits

Updates js-yaml from 4.1.0 to 4.1.1

Changelog

Sourced from js-yaml's changelog.

[4.1.1] - 2025-11-12

Security

  • Fix prototype pollution issue in yaml merge (<<) operator.
Commits

Updates diff from 4.0.2 to 4.0.4

Changelog

Sourced from diff's changelog.

v5.2.2 - January 2026

Only change from 5.2.0 is a backport of the fix to GHSA-73rr-hh4g-fpgx.

v5.2.1 (deprecated)

Accidental release - do not use.

Commits

You can trigger a rebase of this PR by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

…updates

Bumps the npm_and_yarn group with 1 update in the /plp-platform directory: [next](https://github.com/vercel/next.js).
Bumps the npm_and_yarn group with 2 updates in the /plp-platform/plp_program directory: [diff](https://github.com/kpdecker/jsdiff) and [js-yaml](https://github.com/nodeca/js-yaml).
Bumps the npm_and_yarn group with 1 update in the /plp-platform/plp_program/tests/integration directory: [diff](https://github.com/kpdecker/jsdiff).


Updates `next` from 14.2.18 to 15.5.10
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v14.2.18...v15.5.10)

Updates `js-yaml` from 4.1.0 to 3.14.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)

Updates `diff` from 5.2.0 to 5.2.2
- [Changelog](https://github.com/kpdecker/jsdiff/blob/master/release-notes.md)
- [Commits](kpdecker/jsdiff@v5.2.0...v5.2.2)

Updates `diff` from 3.5.0 to 3.5.1
- [Changelog](https://github.com/kpdecker/jsdiff/blob/master/release-notes.md)
- [Commits](kpdecker/jsdiff@v5.2.0...v5.2.2)

Updates `js-yaml` from 4.1.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)

Updates `diff` from 4.0.2 to 4.0.4
- [Changelog](https://github.com/kpdecker/jsdiff/blob/master/release-notes.md)
- [Commits](kpdecker/jsdiff@v5.2.0...v5.2.2)

---
updated-dependencies:
- dependency-name: next
  dependency-version: 15.5.10
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 3.14.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: diff
  dependency-version: 5.2.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: diff
  dependency-version: 3.5.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.1.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: diff
  dependency-version: 4.0.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Feb 20, 2026
@netlify
Copy link
Copy Markdown

netlify Bot commented Feb 20, 2026

Deploy Preview for superb-dango-3ac646 ready!

Name Link
🔨 Latest commit 626b970
🔍 Latest deploy log https://app.netlify.com/projects/superb-dango-3ac646/deploys/6997eda1fb4cae000833d74e
😎 Deploy Preview https://deploy-preview-3--superb-dango-3ac646.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@dependabot dependabot Bot changed the base branch from main to 2026 April 22, 2026 23:53
aitankfish added a commit that referenced this pull request May 23, 2026
…ders

User reported that the bet-amount slider on the browse page felt
janky during drag. Tracing the symptom led to two related issues
and one bonus polish.

#1 — MarketCard not memoized → cascading re-renders
=====================================================
BrowsePage re-renders on every socket event (every YES/NO vote
anywhere on the platform). Each parent re-render cascades to every
MarketCard. During a slider drag, those interrupt re-renders hit
the input mid-flight and the controlled-value handoff jitters.

Fix:
- Wrap MarketCard in React.memo so a card only re-renders when one
  of its own props changes ref.
- useCallback the handleQuickVote handler in BrowsePage so the
  prop reference stays stable across BrowsePage renders. Without
  this, every parent render passes a new function ref and the memo
  bails immediately.

Default shallow-equal works because:
- `market` ref is preserved across useMemo runs when the underlying
  market data hasn't changed (useMemo returns the same object).
- `position` comes from a useMemo Map, recreated only when
  positionsData refetches.
- Boolean props (isHot, isNew, isPulsing, voting) and primitives
  are trivially comparable.

#2 — Socket bursts → N parent re-renders per tick
=====================================================
useAllMarketsSocket fired setMarketUpdates() on every market:update
event. A burst of trades — common during hot-market moments — meant
N consecutive React renders on every consumer of the hook.

Fix: batch incoming events with requestAnimationFrame. Pending
updates accumulate in a ref; the first event in a frame schedules
one flush. Re-entrant events within the same ~16ms tick coalesce
into the same flush. Cleanup cancels any pending rAF on unmount so
we don't setState on a dead component.

Max added latency: 16ms. Effective throughput cap: 60 parent
re-renders/sec (versus potentially hundreds/sec under busy market
load).

#3 — Skip-recently-synced gate on performInitialSync (bonus)
=====================================================
On every server restart, sync-manager fetched every market's
on-chain state via getAccountInfo (1 Helius credit each). On a
rolling deploy where the previous instance kept the on-chain state
fresh, that's wasted RPC.

Fix: in performInitialSync, skip markets whose lastSyncedAt is
within the last 60s. The WS event processor (now coming back
online) will continue keeping them fresh. Project the lastSyncedAt
field in the Mongo find() so we can decide cheaply.

For a deploy where every market was just synced, this reduces
initial-sync RPC calls to ~zero. For a cold deploy after a
long outage, behaves identically to before.

──────────────────────────────────────────────────────────────────
Files
──────────────────────────────────────────────────────────────────
  apps/web/src/app/browse/page.tsx
    - import useCallback
    - wrap handleQuickVote in useCallback
    - wrap MarketCard in React.memo

  packages/shared/src/hooks/useSocket.ts
    - rAF batching of pendingMarketUpdatesRef in useAllMarketsSocket
    - cleanup cancels pending rAF

  apps/web/src/services/blockchain-sync/sync-manager.ts
    - project lastSyncedAt in performInitialSync
    - skip markets with lastSyncedAt within 60s
    - log skip count alongside the fetch-count message

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants