Skip to content

fix(deps): bump the prod-minor-patch group across 1 directory with 12 updates - #449

Open
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/npm_and_yarn/prod-minor-patch-8dbfaa23a6
Open

fix(deps): bump the prod-minor-patch group across 1 directory with 12 updates#449
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/npm_and_yarn/prod-minor-patch-8dbfaa23a6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 9, 2026

Copy link
Copy Markdown
Contributor

Bumps the prod-minor-patch group with 12 updates in the / directory:

Package From To
@ably/chat 1.3.1 1.4.0
@inquirer/prompts 8.4.2 8.7.1
ably 2.21.0 2.28.0
open 11.0.0 11.0.2
ora 9.4.0 9.4.1
react 19.2.6 19.2.8
react-dom 19.2.6 19.2.8
smol-toml 1.6.1 1.8.0
tar 7.5.21 7.5.22
ws 8.20.0 8.21.3
lucide-react 1.14.0 1.41.0
tailwind-merge 3.5.0 3.6.0

Updates @ably/chat from 1.3.1 to 1.4.0

Release notes

Sourced from @​ably/chat's releases.

V1.4.0

What's Changed

New Contributors

Full Changelog: ably/ably-chat-js@1.3.1...1.4.0

Changelog

Sourced from @​ably/chat's changelog.

1.4.0 (2026-05-28)

New Features

  • Message Version History: Added room.messages.getVersions(serial) to retrieve the full version history of a message — the original create followed by any updates and deletes — in oldest-first order. #730
  • Idempotent REST Publishing: Added an opt-in idempotentRestPublishing flag on ChatClientOptions (default false). When enabled, the SDK attaches an idempotencyKey to send, update, and delete message requests so the server can deduplicate retried publish attempts. #726

Bug Fixes

  • Package Exports: Reordered the "types" condition to appear first in package.json exports so type resolution works correctly across bundlers. #725
  • Security: Bumped ws to 8.20.1 to resolve GHSA-58qx-3vcg-4xpx. #727
Commits
  • 1c9b068 Merge pull request #729 from ably/release/1.4.0
  • 89e560c chore: release 1.4.0
  • 47e4211 chore: release 1.4.0
  • 85b0e35 Merge pull request #730 from ably/feat/message-versions
  • 7770e52 docs: fix getVersions JSDoc and restore eslint ignores for local files
  • 3234f73 test: replace fixed sleep with vi.waitFor in versions integration test
  • b94dfd9 feat: add getVersions() to retrieve full message version history
  • b740b63 Merge pull request #726 from ably/feat/add-idempotent-rest-publish-support
  • f999a29 review: make idempotentRestPublishing required on ChatApi
  • 6592172 review: address PR #726 feedback
  • Additional commits viewable in compare view

Updates @inquirer/prompts from 8.4.2 to 8.7.1

Release notes

Sourced from @​inquirer/prompts's releases.

@​inquirer/prompts@​8.7.1

What's new

  • All bundled prompts now pin @inquirer/type to an exact version in their published manifests. Since these type definitions leak into consumers' tsc runs, a semver range on the types-only dependency could break downstream TypeScript builds without any change to Inquirer.js itself (#2247, fixes #2244).

Included

  • @inquirer/checkbox@^5.2.4
  • @inquirer/confirm@^6.3.1
  • @inquirer/editor@^5.3.2
  • @inquirer/expand@^5.1.4
  • @inquirer/input@^5.1.5
  • @inquirer/number@^4.2.2
  • @inquirer/password@^5.2.1
  • @inquirer/rawlist@^5.3.4
  • @inquirer/search@^4.3.2
  • @inquirer/select@^5.2.4

@​inquirer/prompts@​8.7.0

What's new

  • password gains the toggleMask option (ctrl+t to reveal the typed value).
  • confirm now matches localized yes/no answers per-locale.
  • Prettified prompt and theme types for better IDE display.
  • Added inquirer-grouped-checkbox to the community prompts list (#2236).

Included

  • @inquirer/checkbox@^5.2.3
  • @inquirer/confirm@^6.3.0
  • @inquirer/editor@^5.3.1
  • @inquirer/expand@^5.1.3
  • @inquirer/input@^5.1.4
  • @inquirer/number@^4.2.1
  • @inquirer/password@^5.2.0
  • @inquirer/rawlist@^5.3.3
  • @inquirer/search@^4.3.1
  • @inquirer/select@^5.2.3

@​inquirer/prompts@​8.6.0

The all-in-one prompts package, re-exporting every individual prompt at its latest version.

Highlights

This release rides on @inquirer/core@12.0.0, which makes the useState setter accept a reducer/updater function. It also brings a new initialValue option to search, plus fixes for number, confirm, and editor.

What's new

... (truncated)

Commits
  • 5748bd9 chore: Publish new release
  • 269ae73 fix: pin @​inquirer/type exactly in published manifests
  • 927d6dd fix(@​inquirer/testing): keep keypress simulation working under TERM=dumb
  • 2d813b1 chore(deps): Bump @​humanfs/node from 0.16.6 to 0.16.8 (#2245)
  • 7affbc9 chore(deps-dev): Bump turbo from 2.10.9 to 2.10.11 in the build group (#2243)
  • 56db989 chore(deps-dev): Bump oxfmt in the formatting group (#2242)
  • 8e6bc3c chore(deps-dev): Bump the linting group with 2 updates (#2241)
  • 427b7a1 chore(deps-dev): Bump the testing group with 3 updates (#2240)
  • 51ac389 chore: Publish new release
  • 0f1718e feat(@​inquirer/password): add ctrl+t toggle to reveal password
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​inquirer/prompts since your current version.


Updates ably from 2.21.0 to 2.28.0

Release notes

Sourced from ably's releases.

2.28.0

2.28.0 (2026-08-21)

Full Changelog

  • Roll out e2e encryption of data payloads on annotations. They were previously a message type whose publish path deliberately did not apply the channel's encryption (and were documented accordingly), but the reasons for this no longer apply, so there is no reason now not to enable e2e encryption on annotation payloads. #2277

v2.27.0

Full Changelog: ably/ably-pubsub-js@2.26.0...2.27.0

What's Changed

  • Fall back to the base transport when a proxy rejects the WebSocket handshake outright, rather than reporting disconnected after exhausting every host #2285
  • Move connection resumability decisions from the client to the server: Connection#id, Connection#key and a channel's channelSerial are retained through SUSPENDED, and reconnection always attempts a resume. Connection#createRecoveryKey() consequently returns a recovery key in SUSPENDED, where it previously returned null #2273
  • Fix a resumed attach advancing the channel's attach serial, which broke the contiguity of untilAttach history with the realtime message stream #2276
  • Fix stale presence members surviving when a new presence sync replaces one still in progress #2261
  • Expand the docstrings on Auth, RealtimeChannel, RealtimePresence, RealtimeAnnotations and RestAnnotations to cover prerequisites, side effects and failure modes, and link the REST Channel and Presence members to their reference pages #2242 #2243 #2244 #2245 #2282

v2.26.0

Full Changelog

What's Changed

  • Add push.updateToken() to update the device's push token on React Native after the underlying push platform rotates it, keeping the device registration in sync with Ably #2267
  • Add a useObject React hook for subscribing to LiveObjects state #2259
  • PathObject.instance() method now returns undefined only if nothing exists at that path. It wraps whatever value resolves there: a LiveMap, a LiveCounter, or a primitive value. A primitive-backed Instance is read-only: it has no id and exposes the primitive via value().

v2.25.0

Full Changelog

What's Changed

  • Add push notification support for React Native via the new ably/react-native-push plugin. Adds an asynchronous client.getDevice() and deprecates the synchronous client.device() #2262
  • Surface previously silent failures when channel modes are missing: presence.get() without the presence_subscribe mode and channel.subscribe() without the subscribe mode now log an error, or throw when the new strictMode client option is enabled #2236

v2.24.0

What's Changed

  • Add iOS Live Activity support via APNs broadcast channels: push.admin.createApnsBroadcast and push.admin.liveActivity (start/update/end) #2253
  • Fix: use error code 40106 for missing credentials #2254

v2.23.0

Full Changelog: ably/ably-pubsub-js@2.22.1...2.23.0

What's Changed

  • Allow omitting channelName in the React channel hooks to use the nearest ChannelProvider #2248
  • Fix presence auto-reenter causing "Unable to perform operation on channel" NACKs after reconnecting from a transient disconnect; presence operations are now queued at the channel level until the channel next re-attaches #2241

v2.22.1

... (truncated)

Changelog

Sourced from ably's changelog.

2.28.0 (2026-08-21)

Full Changelog

What's Changed

  • Roll out e2e encryption of data payloads on annotations. They were previously a message type whose publish path deliberately did not apply the channel's encryption (and were documented accordingly), but the reasons for this no longer apply, so there is no reason now not to enable e2e encryption on annotation payloads. #2277

2.27.0 (2026-08-10)

Full Changelog

What's Changed

  • Fall back to the base transport when a proxy rejects the WebSocket handshake outright, rather than reporting disconnected after exhausting every host #2285
  • Move connection resumability decisions from the client to the server: Connection#id, Connection#key and a channel's channelSerial are retained through SUSPENDED, and reconnection always attempts a resume. Connection#createRecoveryKey() consequently returns a recovery key in SUSPENDED, where it previously returned null #2273
  • Fix a resumed attach advancing the channel's attach serial, which broke the contiguity of untilAttach history with the realtime message stream #2276
  • Fix stale presence members surviving when a new presence sync replaces one still in progress #2261
  • Expand the docstrings on Auth, RealtimeChannel, RealtimePresence, RealtimeAnnotations and RestAnnotations to cover prerequisites, side effects and failure modes, and link the REST Channel and Presence members to their reference pages #2242 #2243 #2244 #2245 #2282

2.26.0 (2026-07-22)

Full Changelog

What's Changed

  • Add push.updateToken() to update the device's push token on React Native after the underlying push platform rotates it, keeping the device registration in sync with Ably #2267
  • Add a useObject React hook for subscribing to LiveObjects state #2259
  • PathObject.instance() method now returns undefined only if nothing exists at that path. It wraps whatever value resolves there: a LiveMap, a LiveCounter, or a primitive value. A primitive-backed Instance is read-only: it has no id and exposes the primitive via value().

2.25.0 (2026-07-17)

Full Changelog

What's Changed

  • Add push notification support for React Native via the new ably/react-native-push plugin. Adds an asynchronous client.getDevice() and deprecates the synchronous client.device() #2262
  • Surface previously silent failures when channel modes are missing: presence.get() without the presence_subscribe mode and channel.subscribe() without the subscribe mode now log an error, or throw when the new strictMode client option is enabled #2236

2.24.0 (2026-07-08)

Full Changelog

What's Changed

  • Add iOS Live Activity support via APNs broadcast channels: push.admin.createApnsBroadcast and push.admin.liveActivity (start/update/end) #2253
  • Fix: use error code 40106 for missing credentials #2254

2.23.0 (2026-06-19)

... (truncated)

Commits
  • 25058b0 Merge pull request #2292 from ably/release/2.28.0f
  • debdc51 chore: release/2.28.0
  • 6d6abed Correct the annotation encryption docstrings
  • 151e8f1 Merge pull request #2281 from ably/error-codes
  • 6578249 Check error codes against the ably-common registry at compile time
  • 4a59fe7 Merge pull request #2277 from ably/encrypted-annotation-bodies
  • d5742b5 Require channelCipher, not just cipher, before encrypting
  • 486ad68 Replace CipherOptions with a narrowed ChannelOptions type
  • 0e2b656 Remove annotation test anti-flake sleeps
  • c62db4f Encrypt annotation data payloads on encrypted channels
  • Additional commits viewable in compare view

Updates open from 11.0.0 to 11.0.2

Release notes

Sourced from open's releases.

v11.0.2

  • Update dependencies 6f006ad

sindresorhus/open@v11.0.1...v11.0.2

v11.0.1

  • Fix WSL failure when the working directory is unreachable from Windows 6ac3fe4

sindresorhus/open@v11.0.0...v11.0.1

Commits

Updates ora from 9.4.0 to 9.4.1

Release notes

Sourced from ora's releases.

v9.4.1

  • Fix type definitions (#257) 431ebc4
  • Fix failText type to accept unknown instead of Error, matching the actual promise rejection value bc3a283

sindresorhus/ora@v9.4.0...v9.4.1

Commits

Updates react from 19.2.6 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

19.2.7 (June 1st, 2026)

React Server Components

Changelog

Sourced from react's changelog.

19.2.7 (June 1, 2026)

React Server Components

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react since your current version.


Updates react-dom from 19.2.6 to 19.2.8

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

19.2.7 (June 1st, 2026)

React Server Components

Changelog

Sourced from react-dom's changelog.

19.2.7 (June 1, 2026)

React Server Components

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react-dom since your current version.


Updates smol-toml from 1.6.1 to 1.8.0

Release notes

Sourced from smol-toml's releases.

v1.8.0

What's Changed

Full Changelog: squirrelchat/smol-toml@v1.7.2...v1.8.0

v1.7.2

What's Changed

Full Changelog: squirrelchat/smol-toml@v1.7.1...v1.7.2

v1.7.1

This release includes flagging internal functions as @internal to strip them from the emitted type declarations.

⚠️ Includes a fix for GHSA-7w5x-hrqm-74c2

Full Changelog: squirrelchat/smol-toml@v1.7.0...v1.7.1

v1.7.0

This version slightly changes the behaviour of stringify: integers beyond the safe range are always emitted as float numbers.

String decode logic has been rewritten, it is a bit faster now and uses a single-pass approach instead of a dual-pass approach as it did previously. The code should be a bit smaller too, though I didn't actually measure that.

The package is now published with source-maps, declaration-maps, and a copy of the original TypeScript source files. This will improve your DX if you're like me and like Ctrl+Click'ing things a lot. ;)

What's Changed

New Contributors

Full Changelog: squirrelchat/smol-toml@v1.6.1...v1.7.0

Commits
  • 6d0f477 chore: bump version
  • 97e9713 docs: mention temporal api
  • 7a3068d perf: ubench opt for instanceof Date
  • 7e8c09a feat: stringify temporal
  • 19239d0 chore: bump version
  • 5f55c3a chore: revert sourcemap publishing
  • 5c26f1b chore: update benchmarks
  • 92832d2 refactor: better logic orchestration in structs
  • 2fb9ab8 refactor: ctx object instead of pointer arg + tuple returns
  • e6017c4 ci: use staged publish
  • Additional commits viewable in compare view

Updates tar from 7.5.21 to 7.5.22

Commits

Updates ws from 8.20.0 to 8.21.3

Release notes

Sourced from ws's releases.

8.21.3

Bug fixes

  • The server now correctly rejects permessage-deflate offers if the incoming client_max_window_bits parameter value is smaller than its configured clientMaxWindowBits (e97a20ea).

8.21.2

Bug fixes

  • Fixed a test for CITGM (2eb3be0b).

8.21.1

Bug fixes

  • Empty fragments are now counted toward the limit (a2f4e7c0).
  • The default values of the maxBufferedChunks and maxFragments options have been reduced (f197ac65).

8.21.0

Features

  • Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

  • Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
</tr></table>

... (truncated)

Commits
  • c791e70 [dist] 8.21.3
  • e97a20e [fix] Reject offers with client_max_window_bits below config
  • 787ebf2 [dist] 8.21.2
  • b4d62eb Revert "[ci] Trust Coveralls Homebrew tap"
  • e4bb883 [security] Use GitHub PVR as main reporting channel
  • 2eb3be0 [test] Skip test on Node.js versions where it does not apply
  • ae1de54 [dist] 8.21.1
  • 8e9511b [ci] Trust Coveralls Homebrew tap
  • f197ac6 [fix] Lower default values of maxBufferedChunks and maxFragments
  • 8df8265 [ci] Update actions/checkout action to v7
  • Additional commits viewable in compare view

Updates lucide-react from 1.14.0 to 1.41.0

Release notes

Sourced from lucide-react's releases.

Version 1.41.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.40.0...1.41.0

Version 1.40.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.39.0...1.40.0

Version 1.39.0

What's Changed

Full Changelog: lucide-icons/lucide@1.38.0...1.39.0

... (truncated)

Commits
  • 75b5516 chore(dev): upgrade ESLint to latest compatible stack (v10) (#4378)
  • 0f8d48b test(packages): updates unit test snapshots with face-slightly-smiling (#4676)
  • f229f83 chore(depedencies): Update dependencies (#4553)
  • 5ff536e ci(release.yml): Fix workflow and remove version scripts in package scripts...
  • 07c885e fix(docs): fix zephyr-cloud URL in readmes
  • See full diff in compare view

Updates tailwind-merge from 3.5.0 to 3.6.0

Release notes

Sourced from tailwind-merge's releases.

v3.6.0

New Features

Documentation

Other

Full Changelog: dcastil/tailwind-merge@v3.5.0...v3.6.0

Thanks to @​brandonmcconnell, @​manavm1990, @​langy, @​roboflow, @​syntaxfm, @​getsentry, @​codecov, a private sponsor, @​block, @​openclaw, @​sourcegraph, @​mike-healy and more via @​thnxdev for sponsoring tailwind-merge! ❤️

Commits
  • d54f7e5 v3.6.0
  • 638871a Update README to add info about Tailwind CSS v4.3 support
  • 39fc7b5 Revert "v3.6.0"
  • bd8390f v3.6.0
  • 802877c add v3.6.0 changelog
  • a35feda Merge pull request #665 from dcastil/renovate/rollup-plugin-babel-7.x
  • 940389c Merge pull request #667 from dcastil/renovate/release-drafter-release-drafter...
  • 005af6d pin to specific version
  • 5816ced implement breaking changes
  • 17041e1 Merge pull request #676 from dcastil/dependabot/npm_and_yarn/babel/plugin-tra...
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
fix(deps): bump the prod-minor-patch group across 1 directory with 12…
03463c4 
… updates

Bumps the prod-minor-patch group with 12 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@ably/chat](https://github.com/ably/ably-chat-js) | `1.3.1` | `1.4.0` |
| [@inquirer/prompts](https://github.com/SBoudrias/Inquirer.js) | `8.4.2` | `8.7.1` |
| [ably](https://github.com/ably/ably-js) | `2.21.0` | `2.28.0` |
| [open](https://github.com/sindresorhus/open) | `11.0.0` | `11.0.2` |
| [ora](https://github.com/sindresorhus/ora) | `9.4.0` | `9.4.1` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.6` | `19.2.8` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.6` | `19.2.8` |
| [smol-toml](https://github.com/squirrelchat/smol-toml) | `1.6.1` | `1.8.0` |
| [tar](https://github.com/isaacs/node-tar) | `7.5.21` | `7.5.22` |
| [ws](https://github.com/websockets/ws) | `8.20.0` | `8.21.3` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.14.0` | `1.41.0` |
| [tailwind-merge](https://github.com/dcastil/tailwind-merge) | `3.5.0` | `3.6.0` |



Updates `@ably/chat` from 1.3.1 to 1.4.0
- [Release notes](https://github.com/ably/ably-chat-js/releases)
- [Changelog](https://github.com/ably/ably-chat-js/blob/main/CHANGELOG.md)
- [Commits](ably/ably-chat-js@1.3.1...1.4.0)

Updates `@inquirer/prompts` from 8.4.2 to 8.7.1
- [Release notes](https://github.com/SBoudrias/Inquirer.js/releases)
- [Commits](https://github.com/SBoudrias/Inquirer.js/compare/@inquirer/prompts@8.4.2...@inquirer/prompts@8.7.1)

Updates `ably` from 2.21.0 to 2.28.0
- [Release notes](https://github.com/ably/ably-js/releases)
- [Changelog](https://github.com/ably/ably-js/blob/main/CHANGELOG.md)
- [Commits](ably/ably-pubsub-js@2.21.0...2.28.0)

Updates `open` from 11.0.0 to 11.0.2
- [Release notes](https://github.com/sindresorhus/open/releases)
- [Commits](sindresorhus/open@v11.0.0...v11.0.2)

Updates `ora` from 9.4.0 to 9.4.1
- [Release notes](https://github.com/sindresorhus/ora/releases)
- [Commits](sindresorhus/ora@v9.4.0...v9.4.1)

Updates `react` from 19.2.6 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react)

Updates `react-dom` from 19.2.6 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom)

Updates `smol-toml` from 1.6.1 to 1.8.0
- [Release notes](https://github.com/squirrelchat/smol-toml/releases)
- [Commits](squirrelchat/smol-toml@v1.6.1...v1.8.0)

Updates `tar` from 7.5.21 to 7.5.22
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-tar@v7.5.21...v7.5.22)

Updates `ws` from 8.20.0 to 8.21.3
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.20.0...8.21.3)

Updates `lucide-react` from 1.14.0 to 1.41.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.41.0/packages/lucide-react)

Updates `tailwind-merge` from 3.5.0 to 3.6.0
- [Release notes](https://github.com/dcastil/tailwind-merge/releases)
- [Commits](dcastil/tailwind-merge@v3.5.0...v3.6.0)

---
updated-dependencies:
- dependency-name: "@ably/chat"
  dependency-version: 1.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-patch
- dependency-name: "@inquirer/prompts"
  dependency-version: 8.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-patch
- dependency-name: ably
  dependency-version: 2.28.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-patch
- dependency-name: open
  dependency-version: 11.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-minor-patch
- dependency-name: ora
  dependency-version: 9.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-minor-patch
- dependency-name: react
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-minor-patch
- dependency-name: react-dom
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-minor-patch
- dependency-name: smol-toml
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-patch
- dependency-name: tar
  dependency-version: 7.5.22
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-minor-patch
- dependency-name: ws
  dependency-version: 8.21.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-patch
- dependency-name: lucide-react
  dependency-version: 1.41.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-patch
- dependency-name: tailwind-merge
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 9, 2026
@vercel

vercel Bot commented Sep 9, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
cli-web-cli Ready Ready Preview Sep 9, 2026 9:55am UTC

Request Review

@ci-lockfile-regen

ci-lockfile-regen Bot commented Sep 9, 2026

Copy link
Copy Markdown

Dependabot Fix Assessment

Packages: Group bump of 12 packages (prod-minor-patch group)
Scope: runtime dependencies (all in dependencies)
Workspace: root (affects all 3 workspace projects)

Package From To Type
@ably/chat 1.3.1 1.4.0 minor
@inquirer/prompts 8.4.2 8.7.1 minor
ably 2.21.0 2.28.0 minor
open 11.0.0 11.0.2 patch
ora 9.4.0 9.4.1 patch
react 19.2.6 19.2.8 patch
react-dom 19.2.6 19.2.8 patch
smol-toml 1.6.1 1.8.0 minor
tar 7.5.21 7.5.22 patch
ws 8.20.0 8.21.3 minor
lucide-react 1.14.0 1.41.0 minor
tailwind-merge 3.5.0 3.6.0 minor

What changed upstream

  • @ably/chat 1.4.0: Added getVersions() for message version history, idempotentRestPublishing option. Fixed package exports ordering for TypeScript. No removed APIs.
  • ably 2.28.0: e2e encryption for annotation data payloads, connection resumability improvements, bug fixes. No removed APIs.
  • @inquirer/prompts 8.7.1: @inquirer/core@12.0.0 — useState setter now accepts reducer/updater function. Pinned @inquirer/type exactly in published manifests.
  • lucide-react 1.41.0: 27 minor releases, added many icons. Notable: trash icon removed in favour of trash-2 in one intermediate release. We only use SplitSquareHorizontal, X, Key, Settings, Shield, Lock, Terminal, AlertCircle, ArrowRight, Save, RefreshCw, SquareTerminal, CheckCircle — none affected.
  • ora 9.4.1: failText type widened from Error to unknown (non-breaking).
  • ws 8.21.3: Fixed DoS vulnerability (OOM via high-volume tiny fragments), new maxBufferedChunks/maxFragments options.

Root cause of CI failures

All three failing checks (Run Tests, E2E Tests, Web CLI E2E Tests) failed at the same step:

ERR_PNPM_LOCKFILE_CONFIG_MISMATCH  Cannot proceed with the frozen installation.
The current "overrides" configuration doesn't match the value found in the lockfile

The initial Dependabot commit updated package.json (version ranges + pnpm.overrides) but the pnpm-lock.yaml was generated with the old overrides. The subsequent fix(deps): regenerate pnpm-lock.yaml commit corrected this — the lockfile now matches package.json exactly.

Migration concerns checked

  • Peer dependencies: OK — no peer dep version conflicts
  • Type changes: OK — ora widened failText (non-breaking), @ably/chat currentlyTyping is now deprecated (pre-existing warning, not an error)
  • Config files: OK — pnpm.overrides are correct and match the lockfile
  • Module format: OK — all packages continue to support ESM
  • React compatibility: OK — pnpm why react shows single version 19.2.8
  • Monorepo impact: OK — react-web-cli package builds and all tests pass

What broke

  • All CI checks: pnpm install --frozen-lockfile failed because the lockfile's overrides section didn't match package.json — fixed by the fix(deps): regenerate pnpm-lock.yaml commit.

What was fixed

  • No code changes required. The lockfile regeneration commit resolves all CI failures.

Verification

  • pnpm install --frozen-lockfile: ✅
  • Build (pnpm run build): ✅
  • Lint (pnpm exec eslint .): ✅ (0 errors, 10 pre-existing warnings)
  • Unit tests (pnpm test:unit): ✅ 188 test files, 2644 tests passed
  • Web CLI tests (pnpm --filter @ably/react-web-cli test): ✅ 4 test files, 57 tests passed

Notes for reviewer

  • There is a pre-existing (or newly surfaced) deprecation warning: currentlyTyping in src/commands/rooms/typing/subscribe.ts:87 is deprecated in favour of currentTypers. This is a warning, not an error, and does not block CI — but could be cleaned up in a follow-up PR.
  • The pnpm.overrides entry smol-toml@<1.6.1: 1.6.1 remains valid even though the direct dep was bumped to ^1.8.0 — the override only applies to transitive dependencies that resolve to versions older than 1.6.1.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants