Skip to content

chore(deps): bump the npm-deps group with 13 updates#610

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm-deps-a9cd319b81
Open

chore(deps): bump the npm-deps group with 13 updates#610
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm-deps-a9cd319b81

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 28, 2026

Bumps the npm-deps group with 13 updates:

Package From To
@base-ui/react 1.4.0 1.4.1
mppx 0.5.13 0.6.0
stripe 22.0.1 22.0.2
tailwindcss 4.2.2 4.2.4
viem 2.47.17 2.48.2
wagmi 3.6.1 3.6.3
waku 1.0.0-alpha.7 1.0.0-alpha.8
@biomejs/biome 2.4.11 2.4.12
@iconify/json 2.2.462 2.2.464
shiki 3.22.0 4.0.2
typescript 6.0.2 6.0.3
vite 8.0.8 8.0.9
vitest 4.1.4 4.1.5

Updates @base-ui/react from 1.4.0 to 1.4.1

Release notes

Sourced from @​base-ui/react's releases.

v1.4.1

General Changes

Navigation Menu

All contributors of this release in alphabetical order : @​atomiks, @​LukasTy

Changelog

Sourced from @​base-ui/react's changelog.

v1.4.1

Apr 20, 2026

General Changes

Navigation Menu

All contributors of this release in alphabetical order : @​atomiks, @​LukasTy

Commits
  • be88b61 [release] v1.4.1 (#4650)
  • fc7f4f9 [navigation menu] Fix stale popup size on rapid trigger hover (#4646)
  • 783e530 [mergeProps] Fix multi-argument event handler forwarding (#4598)
  • 2622ddf [all components] Fix display: contents tabbability (#4642)
  • c0b4937 [core] Mark date-fns peer dependencies as optional (#4639)
  • c8fd3a0 [dialog][popover][tooltip][menu][preview] Remove dead create*EventDetails w...
  • 099541a [select] Remove unused itemToStringLabel and itemToStringValue from context (...
  • 7158d7b [otp] Refactor OTPFieldRoot and OTPFieldHiddenInput (#4609)
  • af33404 [temporal adapter date-fns] Fix date-only string parsing and setTimezone duck...
  • 41da0c1 [docs] Fix Field validity API descriptions (#4592)
  • Additional commits viewable in compare view

Updates mppx from 0.5.13 to 0.6.0

Release notes

Sourced from mppx's releases.

mppx@0.6.0

Minor Changes

  • e606fa9: Breaking: Removed default Accept-Payment headers on every outgoing request for polyfilled fetch in browsers. Now defaults to same-origin requests in browser environments. Non-browser environments are unaffected. Use acceptPaymentPolicy to control supported payment origins.

Patch Changes

  • e606fa9: Added acceptPaymentPolicy option to control when the Accept-Payment header is injected on outgoing requests, mitigating CORS preflight failures on non-payment-aware servers.

    • In browsers, Fetch.polyfill and Mppx.create (with polyfill: true) default to 'same-origin', preventing cross-origin CORS issues.
    • Non-browser environments and Mppx.create with polyfill: false default to 'always'.
    • Supported values: 'always', 'same-origin', 'never', { origins: string[] } (with *. wildcard support).
    • Exported Fetch namespace from mppx/client.

  • 1a831eb: Fixed Tempo session content gating and SSE plain-response billing to share request-body detection so HTTP/2 POST requests without Content-Length were classified consistently.

mppx@0.5.17

Patch Changes

  • 3259157: Added mppx account export command for exporting the private key of local keychain-backed accounts.

mppx@0.5.16

Patch Changes

  • 5b6a938: Thread context through pinned requests so MCP tool calls and HEAD requests cannot bypass the shared management-vs-content gate.
  • 22be301: Preserve keyAuthorization in fee-sponsored Tempo charge transactions and reject unsupported transaction fields instead of silently dropping them.
  • 3e7320d: Charge tempo/session SSE streams with unitType: "request" once per streamed response instead of once per emitted SSE data event.

mppx@0.5.14

Patch Changes

  • 1ba7af2: Hardened sponsored Tempo session open and topUp flows by enforcing fee-payer policy limits, blocking call smuggling, and adding feePayerPolicy support.
  • 1ba7af2: Fixed fee-sponsored Tempo charge flows by simulating sponsored transactions before broadcast and binding swap approvals to the DEX input token.
  • 1ba7af2: Normalized Tempo session channel IDs across storage and verification paths, preventing case-variant aliases from creating duplicate channel state.
Changelog

Sourced from mppx's changelog.

0.6.0

Minor Changes

  • e606fa9: Breaking: Removed default Accept-Payment headers on every outgoing request for polyfilled fetch in browsers. Now defaults to same-origin requests in browser environments. Non-browser environments are unaffected. Use acceptPaymentPolicy to control supported payment origins.

Patch Changes

  • e606fa9: Added acceptPaymentPolicy option to control when the Accept-Payment header is injected on outgoing requests, mitigating CORS preflight failures on non-payment-aware servers.

    • In browsers, Fetch.polyfill and Mppx.create (with polyfill: true) default to 'same-origin', preventing cross-origin CORS issues.
    • Non-browser environments and Mppx.create with polyfill: false default to 'always'.
    • Supported values: 'always', 'same-origin', 'never', { origins: string[] } (with *. wildcard support).
    • Exported Fetch namespace from mppx/client.

  • 1a831eb: Fixed Tempo session content gating and SSE plain-response billing to share request-body detection so HTTP/2 POST requests without Content-Length were classified consistently.

0.5.17

Patch Changes

  • 3259157: Added mppx account export command for exporting the private key of local keychain-backed accounts.

0.5.16

Patch Changes

  • 5b6a938: Thread context through pinned requests so MCP tool calls and HEAD requests cannot bypass the shared management-vs-content gate.
  • 22be301: Preserve keyAuthorization in fee-sponsored Tempo charge transactions and reject unsupported transaction fields instead of silently dropping them.
  • 3e7320d: Charge tempo/session SSE streams with unitType: "request" once per streamed response instead of once per emitted SSE data event.

0.5.15

Patch Changes

  • 7aff8ab: Prevented default HTTP tempo.session() content requests from replaying the same accepted voucher without advancing request/response accounting.
  • 7aff8ab: Pinned credential verification and compose dispatch to challenge opaque metadata so same-economics sibling routes could not replay each other's credentials.

0.5.14

Patch Changes

  • 1ba7af2: Hardened sponsored Tempo session open and topUp flows by enforcing fee-payer policy limits, blocking call smuggling, and adding feePayerPolicy support.
  • 1ba7af2: Fixed fee-sponsored Tempo charge flows by simulating sponsored transactions before broadcast and binding swap approvals to the DEX input token.
  • 1ba7af2: Normalized Tempo session channel IDs across storage and verification paths, preventing case-variant aliases from creating duplicate channel state.
Commits
  • c8ea9c1 chore: version packages (#380)
  • e606fa9 feat: add acceptPaymentPolicy to control Accept-Payment header injection (#...
  • 1a831eb fix: share session request body detection (#378)
  • 743466d test(cli): isolate XDG data home in CLI tests (#379)
  • ea3081a proposal: mppx.challenge and mppx.verifyCredential interface refactor (#337)
  • 79420f7 fix: allow zero close for untouched channels (#343)
  • f35976c chore: version packages (#376)
  • d00c88a chore(deps-dev): bump @​hono/node-server (#375)
  • 3259157 feat(cli): add account private-key command (#370)
  • 28ab514 chore(deps): bump actions/cache in the github-actions group (#372)
  • Additional commits viewable in compare view

Updates stripe from 22.0.1 to 22.0.2

Release notes

Sourced from stripe's releases.

v22.0.2

  • #2685 Adds parseEventNotificationAsync to match existing sync function
  • #2681 Add emitEventBodies config to include bodies in request/response events
    • Added emitEventBodies config option to include request and response bodies in request/response events.
    • Changed httpClient config type from HttpClient class to HttpClientInterface interface.
  • #2670 tolerance, receivedAt, timestamp are now optional in Webhook.ts
  • #2677 Fixed named export for Bun 
    // ✅ Fixed
import { Stripe } from 'stripe';

See the changelog for more details.

Changelog

Sourced from stripe's changelog.

22.0.2 - 2026-04-16

  • #2685 Adds parseEventNotificationAsync to match existing sync function
  • #2681 Add emitEventBodies config to include bodies in request/response events
    • Added emitEventBodies config option to include request and response bodies in request/response events.
    • Changed httpClient config type from HttpClient class to HttpClientInterface interface.
  • #2670 tolerance, receivedAt, timestamp are now optional in Webhook.ts
  • #2677 Fixed named export for Bun 
    // ✅ Fixed
import { Stripe } from 'stripe';
Commits
  • bf563e1 Bump version to 22.0.2
  • e01b892 Add emitEventBodies config to include bodies in request/response events (#2681)
  • 7ae0d66 Adds parseEventNotificationAsync to match existing sync function (#2685)
  • 549d89f tolerance, receivedAt, timestamp are now optional in Webhook.ts (#2670)
  • f0cd24c Fixed named export for Bun (#2677)
  • See full diff in compare view

Updates tailwindcss from 4.2.2 to 4.2.4

Release notes

Sourced from tailwindcss's releases.

v4.2.4

Fixed

  • Ensure imports in @import and @plugin still resolve correctly when using Vite aliases in @tailwindcss/vite (#19947)

v4.2.3

Fixed

  • Canonicalization: improve canonicalizations for tracking-* utilities by preferring non-negative utilities (e.g. -tracking-tighter → tracking-wider) (#19827)
  • Fix crash due to invalid characters in candidate (exceeding valid unicode code point range) (#19829)
  • Ensure query params in imports are considered unique resources when using @tailwindcss/webpack (#19723)
  • Canonicalization: collapse arbitrary values into shorthand utilities (e.g. px-[1.2rem] py-[1.2rem] → p-[1.2rem]) (#19837)
  • Canonicalization: collapse border-{t,b}-* into border-y-*, border-{l,r}-* into border-x-*, and border-{t,r,b,l}-* into border-* (#19842)
  • Canonicalization: collapse scroll-m{t,b}-* into scroll-my-*, scroll-m{l,r}-* into scroll-mx-*, and scroll-m{t,r,b,l}-* into scroll-m-* (#19842)
  • Canonicalization: collapse scroll-p{t,b}-* into scroll-py-*, scroll-p{l,r}-* into scroll-px-*, and scroll-p{t,r,b,l}-* into scroll-p-* (#19842)
  • Canonicalization: collapse overflow-{x,y}-* into overflow-* (#19842)
  • Canonicalization: collapse overscroll-{x,y}-* into overscroll-* (#19842)
  • Read from --placeholder-color instead of --background-color for placeholder-* utilities (#19843)
  • Upgrade: ensure files are not emptied out when killing the upgrade process while it's running (#19846)
  • Upgrade: use config.content when migrating from Tailwind CSS v3 to Tailwind CSS v4 (#19846)
  • Upgrade: never migrate files that are ignored by git (#19846)
  • Add .env and .env.* to default ignored content files (#19846)
  • Canonicalization: migrate overflow-ellipsis into text-ellipsis (#19849)
  • Canonicalization: migrate start-full → inset-s-full, start-auto → inset-s-auto, start-px → inset-s-px, and start-<number> → inset-s-<number> as well as negative versions (#19849)
  • Canonicalization: migrate end-full → inset-e-full, end-auto → inset-e-auto, end-px → inset-e-px, and end-<number> → inset-e-<number> as well as negative versions (#19849)
  • Canonicalization: move the - sign inside the arbitrary value -left-[9rem] → left-[-9rem] (#19858)
  • Canonicalization: move the - sign outside the arbitrary value ml-[calc(-1*var(--width))] → -ml-(--width) (#19858)
  • Improve performance when scanning JSONL / NDJSON files (#19862)
  • Support NODE_PATH environment variable in standalone CLI (#19617)
Changelog

Sourced from tailwindcss's changelog.

[4.2.4] - 2026-04-21

Fixed

  • Ensure imports in @import and @plugin still resolve correctly when using Vite aliases in @tailwindcss/vite (#19947)

[4.2.3] - 2026-04-20

Fixed

  • Canonicalization: improve canonicalizations for tracking-* utilities by preferring non-negative utilities (e.g. -tracking-tighter → tracking-wider) (#19827)
  • Fix crash due to invalid characters in candidate (exceeding valid unicode code point range) (#19829)
  • Ensure query params in imports are considered unique resources when using @tailwindcss/webpack (#19723)
  • Canonicalization: collapse arbitrary values into shorthand utilities (e.g. px-[1.2rem] py-[1.2rem] → p-[1.2rem]) (#19837)
  • Canonicalization: collapse border-{t,b}-* into border-y-*, border-{l,r}-* into border-x-*, and border-{t,r,b,l}-* into border-* (#19842)
  • Canonicalization: collapse scroll-m{t,b}-* into scroll-my-*, scroll-m{l,r}-* into scroll-mx-*, and scroll-m{t,r,b,l}-* into scroll-m-* (#19842)
  • Canonicalization: collapse scroll-p{t,b}-* into scroll-py-*, scroll-p{l,r}-* into scroll-px-*, and scroll-p{t,r,b,l}-* into scroll-p-* (#19842)
  • Canonicalization: collapse overflow-{x,y}-* into overflow-* (#19842)
  • Canonicalization: collapse overscroll-{x,y}-* into overscroll-* (#19842)
  • Read from --placeholder-color instead of --background-color for placeholder-* utilities (#19843)
  • Upgrade: ensure files are not emptied out when killing the upgrade process while it's running (#19846)
  • Upgrade: use config.content when migrating from Tailwind CSS v3 to Tailwind CSS v4 (#19846)
  • Upgrade: never migrate files that are ignored by git (#19846)
  • Add .env and .env.* to default ignored content files (#19846)
  • Canonicalization: migrate overflow-ellipsis into text-ellipsis (#19849)
  • Canonicalization: migrate start-full → inset-s-full, start-auto → inset-s-auto, start-px → inset-s-px, and start-<number> → inset-s-<number> as well as negative versions (#19849)
  • Canonicalization: migrate end-full → inset-e-full, end-auto → inset-e-auto, end-px → inset-e-px, and end-<number> → inset-e-<number> as well as negative versions (#19849)
  • Canonicalization: move the - sign inside the arbitrary value -left-[9rem] → left-[-9rem] (#19858)
  • Canonicalization: move the - sign outside the arbitrary value ml-[calc(-1*var(--width))] → -ml-(--width) (#19858)
  • Improve performance when scanning JSONL / NDJSON files (#19862)
  • Support NODE_PATH environment variable in standalone CLI (#19617)
Commits

Updates viem from 2.47.17 to 2.48.2

Release notes

Sourced from viem's releases.

viem@2.48.2

Patch Changes

viem@2.48.1

Patch Changes

viem@2.48.0

Minor Changes

viem@2.47.19

Patch Changes

viem@2.47.18

Patch Changes

Commits
  • cc8e67b test: update getFeeHistory snapshot
  • 47f845d ci: temporarily disable wagmi type checks
  • ea09309 chore: version package (#4531)
  • 2d5380d chore: fix biome formatting in contract.test-d.ts
  • 30ac0cf fix: replace extraData decoding with l2SequenceNumber() call in getGames (#4428)
  • c0c09a6 fix: accept readonly arrays in LogTopic type (#4455)
  • 870f9ce chore: move hashString to bottom of file
  • c543ac9 perf: use hash to avoid arbitrary key length in buildRequest's dedupe (#4470)
  • 3e88a77 chore: Add Tron blockTime + multicall deployment (#4520)
  • 67d979c fix: preserve nonce 0 in prepareTransactionRequest
  • Additional commits viewable in compare view

Updates wagmi from 3.6.1 to 3.6.3

Release notes

Sourced from wagmi's releases.

wagmi@3.6.3

Patch Changes

wagmi@3.6.2

Patch Changes

Changelog

Sourced from wagmi's changelog.

3.6.3

Patch Changes

3.6.2

Patch Changes

Commits

Updates waku from 1.0.0-alpha.7 to 1.0.0-alpha.8

Release notes

Sourced from waku's releases.

v1.0.0-alpha.8

We are making progress on framework stability and getting close to beta. Stay tuned, and please report issues meanwhile!

What's Changed

New Contributors

Full Changelog: wakujs/waku@v1.0.0-alpha.7...v1.0.0-alpha.8

Commits

Updates @biomejs/biome from 2.4.11 to 2.4.12

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.4.12

2.4.12

Patch Changes

  • #9376 9701a33 Thanks @​dyc3! - Added the nursery/noIdenticalTestTitle lint rule. This rule disallows using the same title for two describe blocks or two test cases at the same nesting level.

    describe("foo", () => {});
describe("foo", () => {
  // invalid: same title as previous describe block
  test("baz", () => {});
  test("baz", () => {}); // invalid: same title as previous test case
});

  • #9889 7ae83f2 Thanks @​dyc3! - Improved the diagnostics for useForOf to better explain the problem, why it matters, and how to fix it.

  • #9916 27dd7b1 Thanks @​Jayllyz! - Added a new nursery rule noComponentHookFactories, that disallows defining React components or custom hooks inside other functions.

    For example, the following snippets trigger the rule:

    function createComponent(label) {
  function MyComponent() {
    return <div>{label}</div>;
  }
  return MyComponent;
}
    function Parent() {
  function Child() {
    return <div />;
  }
  return <Child />;
}

  • #9980 098f1ff Thanks @​ematipico! - Fixed #9941: Biome now emits a warning diagnostic when a file exceed the files.maxSize limit.

  • #9942 9956f1d Thanks @​dyc3! - Fixed #9918: useConsistentTestIt no longer panics when applying fixes to chained calls such as test.for([])("x", () => {});.

  • #9891 4d9ac51 Thanks @​dyc3! - Improved the noGlobalObjectCalls diagnostic to better explain why calling global objects like Math or JSON is invalid and how to fix it.

  • #9902 3f4d103 Thanks @​ematipico! - Fixed #9901: the command lint --write is now idempotent when it's run against HTML-ish files that contains scripts and styles.

  • #9891 4d9ac51 Thanks @​dyc3! - Improved the noMultiStr diagnostic to explain why escaped multiline strings are discouraged and what to use instead.

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.4.12

Patch Changes

  • #9376 9701a33 Thanks @​dyc3! - Added the nursery/noIdenticalTestTitle lint rule. This rule disallows using the same title for two describe blocks or two test cases at the same nesting level.

    describe("foo", () => {});
describe("foo", () => {
  // invalid: same title as previous describe block
  test("baz", () => {});
  test("baz", () => {}); // invalid: same title as previous test case
});

  • #9889 7ae83f2 Thanks @​dyc3! - Improved the diagnostics for useForOf to better explain the problem, why it matters, and how to fix it.

  • #9916 27dd7b1 Thanks @​Jayllyz! - Added a new nursery rule noComponentHookFactories, that disallows defining React components or custom hooks inside other functions.

    For example, the following snippets trigger the rule:

    function createComponent(label) {
  function MyComponent() {
    return <div>{label}</div>;
  }
  return MyComponent;
}
    function Parent() {
  function Child() {
    return <div />;
  }
  return <Child />;
}

  • #9980 098f1ff Thanks @​ematipico! - Fixed #9941: Biome now emits a warning diagnostic when a file exceed the files.maxSize limit.

  • #9942 9956f1d Thanks @​dyc3! - Fixed #9918: useConsistentTestIt no longer panics when applying fixes to chained calls such as test.for([])("x", () => {});.

  • #9891 4d9ac51 Thanks @​dyc3! - Improved the noGlobalObjectCalls diagnostic to better explain why calling global objects like Math or JSON is invalid and how to fix it.

  • #9902 3f4d103 Thanks @​ematipico! - Fixed #9901: the command lint --write is now idempotent when it's run against HTML-ish files that contains scripts and styles.

  • #9891 4d9ac51 Thanks @​dyc3! - Improved the noMultiStr diagnostic to explain why escaped multiline strings are discouraged and what to use instead.

  • #9966 322675e Thanks @​siketyan! - Fixed #9113: Biome now parses and formats @media and other conditional blocks correctly inside embedded CSS snippets.

... (truncated)

Commits Description has been truncated

@dependabot
chore(deps): bump the npm-deps group with 13 updates
6c97964 
Bumps the npm-deps group with 13 updates:

| Package | From | To |
| --- | --- | --- |
| [@base-ui/react](https://github.com/mui/base-ui/tree/HEAD/packages/react) | `1.4.0` | `1.4.1` |
| [mppx](https://github.com/wevm/mppx) | `0.5.13` | `0.6.0` |
| [stripe](https://github.com/stripe/stripe-node) | `22.0.1` | `22.0.2` |
| [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.2.2` | `4.2.4` |
| [viem](https://github.com/wevm/viem) | `2.47.17` | `2.48.2` |
| [wagmi](https://github.com/wevm/wagmi/tree/HEAD/packages/react) | `3.6.1` | `3.6.3` |
| [waku](https://github.com/wakujs/waku/tree/HEAD/packages/waku) | `1.0.0-alpha.7` | `1.0.0-alpha.8` |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.4.11` | `2.4.12` |
| [@iconify/json](https://github.com/iconify/icon-sets) | `2.2.462` | `2.2.464` |
| [shiki](https://github.com/shikijs/shiki/tree/HEAD/packages/shiki) | `3.22.0` | `4.0.2` |
| [typescript](https://github.com/microsoft/TypeScript) | `6.0.2` | `6.0.3` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.0.8` | `8.0.9` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.4` | `4.1.5` |


Updates `@base-ui/react` from 1.4.0 to 1.4.1
- [Release notes](https://github.com/mui/base-ui/releases)
- [Changelog](https://github.com/mui/base-ui/blob/master/CHANGELOG.md)
- [Commits](https://github.com/mui/base-ui/commits/v1.4.1/packages/react)

Updates `mppx` from 0.5.13 to 0.6.0
- [Release notes](https://github.com/wevm/mppx/releases)
- [Changelog](https://github.com/wevm/mppx/blob/main/CHANGELOG.md)
- [Commits](https://github.com/wevm/mppx/compare/mppx@0.5.13...mppx@0.6.0)

Updates `stripe` from 22.0.1 to 22.0.2
- [Release notes](https://github.com/stripe/stripe-node/releases)
- [Changelog](https://github.com/stripe/stripe-node/blob/master/CHANGELOG.md)
- [Commits](stripe/stripe-node@v22.0.1...v22.0.2)

Updates `tailwindcss` from 4.2.2 to 4.2.4
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.2.4/packages/tailwindcss)

Updates `viem` from 2.47.17 to 2.48.2
- [Release notes](https://github.com/wevm/viem/releases)
- [Commits](https://github.com/wevm/viem/compare/viem@2.47.17...viem@2.48.2)

Updates `wagmi` from 3.6.1 to 3.6.3
- [Release notes](https://github.com/wevm/wagmi/releases)
- [Changelog](https://github.com/wevm/wagmi/blob/main/packages/react/CHANGELOG.md)
- [Commits](https://github.com/wevm/wagmi/commits/wagmi@3.6.3/packages/react)

Updates `waku` from 1.0.0-alpha.7 to 1.0.0-alpha.8
- [Release notes](https://github.com/wakujs/waku/releases)
- [Changelog](https://github.com/wakujs/waku/blob/main/CHANGELOG.md)
- [Commits](https://github.com/wakujs/waku/commits/v1.0.0-alpha.8/packages/waku)

Updates `@biomejs/biome` from 2.4.11 to 2.4.12
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.4.12/packages/@biomejs/biome)

Updates `@iconify/json` from 2.2.462 to 2.2.464
- [Commits](iconify/icon-sets@2.2.462...2.2.464)

Updates `shiki` from 3.22.0 to 4.0.2
- [Release notes](https://github.com/shikijs/shiki/releases)
- [Commits](https://github.com/shikijs/shiki/commits/v4.0.2/packages/shiki)

Updates `typescript` from 6.0.2 to 6.0.3
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](microsoft/TypeScript@v6.0.2...v6.0.3)

Updates `vite` from 8.0.8 to 8.0.9
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.0.9/packages/vite)

Updates `vitest` from 4.1.4 to 4.1.5
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.5/packages/vitest)

---
updated-dependencies:
- dependency-name: "@base-ui/react"
  dependency-version: 1.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-deps
- dependency-name: mppx
  dependency-version: 0.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-deps
- dependency-name: stripe
  dependency-version: 22.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-deps
- dependency-name: tailwindcss
  dependency-version: 4.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-deps
- dependency-name: viem
  dependency-version: 2.48.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-deps
- dependency-name: wagmi
  dependency-version: 3.6.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-deps
- dependency-name: waku
  dependency-version: 1.0.0-alpha.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-deps
- dependency-name: "@biomejs/biome"
  dependency-version: 2.4.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-deps
- dependency-name: "@iconify/json"
  dependency-version: 2.2.464
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-deps
- dependency-name: shiki
  dependency-version: 4.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-deps
- dependency-name: typescript
  dependency-version: 6.0.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-deps
- dependency-name: vite
  dependency-version: 8.0.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-deps
- dependency-name: vitest
  dependency-version: 4.1.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 28, 2026
@vercel
Copy link
Copy Markdown

vercel Bot commented Apr 28, 2026 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
mpp Error Error Apr 28, 2026 4:19pm

Request Review

@socket-security
Copy link
Copy Markdown

socket-security Bot commented Apr 28, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addedshiki@​4.0.21001007794100
Updatedvitest@​4.1.4 ⏵ 4.1.596 +110079 +199100
Updatedwagmi@​3.6.1 ⏵ 3.6.380 +110079 +197100
Updatedstripe@​22.0.1 ⏵ 22.0.28010010096 +1100
Updatedmppx@​0.5.13 ⏵ 0.6.081 +1100100 +198 +1100
Updatedvite@​8.0.8 ⏵ 8.0.999 +110082 +199 +1100
Updatedtailwindcss@​4.2.2 ⏵ 4.2.4100 +110084 +198100
Updatedwaku@​1.0.0-alpha.7 ⏵ 1.0.0-alpha.885 +1100100 +195 +1100
Updated@​base-ui/​react@​1.4.0 ⏵ 1.4.1901008996 +2100
Updatedtypescript@​6.0.2 ⏵ 6.0.3100100909990
Updated@​iconify/​json@​2.2.462 ⏵ 2.2.46410010010096100
Updatedviem@​2.47.17 ⏵ 2.48.298 +1100100 +198 +1100
Updated@​biomejs/​biome@​2.4.11 ⏵ 2.4.12100 +110010098 -1100

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

config dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants