chore(deps): bump the minor-and-patch group in /packages-explorer with 5 updates by dependabot[bot] · Pull Request #2192 · dotandev/hintents

dependabot · 2026-11-09T04:31:17Z

Bumps the minor-and-patch group in /packages-explorer with 5 updates:

Package	From	To
next	`16.4.3`	`16.4.5`
lucide-react	`1.63.0`	`1.69.0`
motion	`14.7.1`	`14.9.1`
postcss	`8.5.28`	`8.5.32`
autoprefixer	`10.6.1`	`10.6.2`

Updates next from 16.4.3 to 16.4.5

Release notes

Sourced from next's releases.

v16.4.5

This release contains security fixes for the following advisories:

Moderate

Cross-tenant sensitive information disclosure in Next.js 'use cache' when called through unstable_cache

Cache leak across root param values in nested 'use cache' functions (follow-up)

Cache poisoning of shared fallback shells in Cache Components via request-supplied placeholder route params

Cross-user cache disclosure and poisoning in Next.js use cache with binary arguments

Cross-client response injection and disclosure in self-hosted Next.js applications forwarding fetched responses

SVG rejection bypass in Next.js image optimization

HttpOnly cookie exposure through internal response header on Next.js Edge runtime routes

v16.4.4

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. The announced security released for November will be published tomorrow.

Core Changes

[lts-active] test: disable the reads fallback params after a client navigation deployment test (#100668)

[lts-active] Reload on missed Turbopack startup CSS updates (#100619)

[lts-active] Revert "Optimize strict module factory chunks (#98421)" (#100866)

[lts-active] Emit the Turbopack shared-runtime bootstrap in the PPR resume so it gets the CSP nonce (#100907)

[lts-active] [ci] Pin deploy test deployments to Node.js 22.x (#100886)

[lts-active] fix(analyze): use route summaries as the analyzer route index (#100974)

[lts-active] Use fast-jwt instead of jsonwebtoken (#100885)

Credits

Huge thanks to @icyJoseph, @mischnic, @wbinnssmith, @lukesandberg, and @eps1lon for helping!

Commits

4e5335a v16.4.5
809be72 [lts-active] Strip internal middleware cookie headers from edge responses (#282)
2842833 [lts-active] Fix stale compressed framing for forwarded fetch responses (#281)
6596840 [lts-active] [use cache] Fix cache key when binary args are used (#280)
18eeffb [lts-active] Fix shared shell poisoning from request-supplied placeholder par...
e66e656 [lts-active] [next/image] Fix false-positive AVIF/HEIC detection (#278)
d605874 [lts-active] Fix unstable_cache leaking cold 'use cache' fills across roo...
80c96ed [lts-active] Fix outer 'use cache' entries reused across root param values ...
b175f52 v16.4.4
ba4a4c1 [lts-active] Use fast-jwt instead of jsonwebtoken (#100885)
Additional commits viewable in compare view

Updates lucide-react from 1.63.0 to 1.69.0

Release notes

Sourced from lucide-react's releases.

Version 1.69.0

What's Changed

feat(icons): added package-pen icon by @ericfennis in lucide-icons/lucide#5154

feat(icons): added package-question-mark icon by @ericfennis in lucide-icons/lucide#5155

feat(icons): added opacity icon by @ilyavred in lucide-icons/lucide#4222

feat(icons): added circle-fading-check icon by @n2duc in lucide-icons/lucide#4089

New Contributors

@ilyavred made their first contribution in lucide-icons/lucide#4222

@n2duc made their first contribution in lucide-icons/lucide#4089

Full Changelog: lucide-icons/lucide@1.68.0...1.69.0

Version 1.68.0

What's Changed

fix(site): keep sponsor tiers within content width by @ffgenius in lucide-icons/lucide#5149

feat(icons): added mango icon by @Prsenapati09 in lucide-icons/lucide#4902

chore(icons): Renamed *-warning and *-alert to *-exclamation-point by @ericfennis in lucide-icons/lucide#5143

New Contributors

@ffgenius made their first contribution in lucide-icons/lucide#5149

@Prsenapati09 made their first contribution in lucide-icons/lucide#4902

Full Changelog: lucide-icons/lucide@1.67.0...1.68.0

Version 1.67.0

What's Changed

feat(site): Add sponsor page by @ericfennis in lucide-icons/lucide#5132

fix(icons): changed chef-hat icon by @karsa-mistmere in lucide-icons/lucide#4577

fix(icons): changed (circle|square)-letter-j by @karsa-mistmere in lucide-icons/lucide#5138

feat(icons): added globe-ban icon by @PrimeTestLab in lucide-icons/lucide#5020

chore(deps): bump playwright to 1.64.1 to support ubuntu 26.04 runners by @ericfennis in lucide-icons/lucide#5140

chore(deps): bump the svelte-deps group across 1 directory with 3 updates by @dependabot[bot] in lucide-icons/lucide#5139

feat(icons): added diagram-flow-horizontal, diagram-flow-vertical icons by @karsa-mistmere in lucide-icons/lucide#5125

chore(deps-dev): bump preact from 11.0.2 to 11.1.0 in the preact-deps group across 1 directory by @dependabot[bot] in lucide-icons/lucide#5135

feat(icons): added globe-plus icon by @Turboman3000 in lucide-icons/lucide#4938

feat(lab): added map-pin-laptop icon by @k8adev in lucide-icons/lucide#3699

feat(lab): added circuit-resistor icon by @synthetic-blood in lucide-icons/lucide#4698

feat(lab): added flask-conical-titration icon by @jwlinqx in lucide-icons/lucide#4428

feat(lab): added soldering-iron icon by @psjdev in lucide-icons/lucide#4850

feat(lab): added cup-bubble-tea icon by @DrashtiC07 in lucide-icons/lucide#5098

test(build-icons): cover Windows file URL imports by @vugarbbakhishov-hub in lucide-icons/lucide#4862

chore(deps-dev): bump the angular-deps group across 1 directory with 15 updates by @dependabot[bot] in lucide-icons/lucide#5114

chore(deps-dev): bump react-native from 0.88.0 to 0.88.1 in the react-native-deps group across 1 directory by @dependabot[bot] in lucide-icons/lucide#5134

chore(deps-dev): bump the solid-deps group across 1 directory with 6 updates by @dependabot[bot] in lucide-icons/lucide#5142

chore(deps): Update dependencies by @ericfennis in lucide-icons/lucide#5146

fix(dev): avoid polynomial regex backtracking in toCamelCase helper by @ericfennis in lucide-icons/lucide#5148

chore(deps): Fix security vulnerabilities alerts by @ericfennis in lucide-icons/lucide#5147

New Contributors

... (truncated)

Commits

b196797 Update deps (#5146)
588113e test(build-icons): cover Windows file URL imports (#4862)
14cab02 feat(site): Add sponsor page (#5132)
1668a0c chore(deps): bump rollup to 4.65.1 and keep typescript on v6 (#5110)
See full diff in compare view

Updates motion from 14.7.1 to 14.9.1

Changelog

Sourced from motion's changelog.

[14.9.1] 2026-11-04

Added

Ensure accelerated transform animations finish correctly.

AnimatePresence: Fix exit never starting when a child mounts already exiting.

AnimatePresence: Fix exit stuck after an open layoutId card switches to another item.

Ensure accelerated animations are cleaned up in WebKit.

[14.9.0] 2026-10-30

Added

PresenceContext: Added internal keepValuesOnRemount option for internal use.

dragConstraints: Accepts function for internal use.

Reorder: Keyboard accessibility now focuses just the first item, arrows move focus, arrow keys work in relation to how items are presented on-screen.

[14.8.0] 2026-10-29

Added

transition: Added mixer option for passing custom mixer functions.

Fixed

Only counts projection stats while recordStats() is running.

Fix accelerated animations stuck at initial after remount.

drag: 20% smaller.

m component: 6% smaller.

Keep timeline adjustments within timeline scope.

Reorder

Commits

6be4a29 v14.9.1
4216b2f Updating changelog
30b1051 Latest
a2c76b9 Raise the motion/remix size limit to 49.2 kB
e945386 Keep the timeline running on the drag-animate test page
625e6af Merge pull request #4035 from motiondivision/claude/project-thread-fx11r9
405ebe2 Merge pull request #4043 from motiondivision/claude/project-thread-8iynk0
e835b8f Merge pull request #4045 from motiondivision/claude/project-thread-cb06bn
cc43fef Merge pull request #4050 from motiondivision/claude/project-thread-5hniaw
0a0584b Keep values when an element is shown again only to exit
Additional commits viewable in compare view

Updates postcss from 8.5.28 to 8.5.32

Release notes

Sourced from postcss's releases.

8.5.32

Fixed Input#origin() without opts.from (by @wleeaf).

Fixed final-word lookup without source offsets (by @Don-Yin).

Fixed explicit start in Warning#toString() (by @Don-Yin).

Fixed Promise semantics in LazyResult#finally() (by @Don-Yin).

8.5.31

Fix better source map on </style> escaping (by @firefoxic).

8.5.30

Fix broken map on </style> escaping (by @Rufflet).

8.5.29

Improved </style> escaping (by @choudhryfrompak).

Fixed comments support in list.comma() and list.space() (by @00200200).

Fixed semicolon and custom property (by @wahidrizka).

Changelog

Sourced from postcss's changelog.

8.5.32

Fixed Input#origin() without opts.from (by @wleeaf).

Fixed final-word lookup without source offsets (by @Don-Yin).

Fixed explicit start in Warning#toString() (by @Don-Yin).

Fixed Promise semantics in LazyResult#finally() (by @Don-Yin).

8.5.31

Fix better source map on </style> escaping (by @firefoxic).

8.5.30

Fix broken map on </style> escaping (by @Rufflet).

8.5.29

Improved </style> escaping (by @choudhryfrompak).

Fixed comments support in list.comma() and list.space() (by @00200200).

Fixed semicolon and custom property (by @wahidrizka).

Commits

2455ac8 Release 8.5.32 version
e367106 Update dependencies
f70f586 Fix Input#origin() without from or with relative sourceRoot (#2179)
eb28619 Fix final-word lookup without source offsets (#2178)
095654b Preserve explicit start in Warning#toString() (#2177)
9b3d8b8 Preserve Promise semantics in result finally() (#2176)
d190857 Release 8.5.31 version
4ef6d8c Update dependencies
6abd674 Call the builder with every node when the output is escaped (#2175)
f1aca7e Release 8.5.30 version
Additional commits viewable in compare view

Updates autoprefixer from 10.6.1 to 10.6.2

Release notes

Sourced from autoprefixer's releases.

10.6.2

Added /* autoprefixer: ignore next warning */ (by @dualfroz).

Fixed losing unprefixed selectors in old browsers in grouping (by @ybai08).

Fixed selector duplicates on multiple Autoprefixer runs.

Fixed case-insensitive pseudo-selector prefixing (by @jakezwang).

Fixed -webkit-cross-fade() for images with numbers (by @mkantautas).

Fixed source maps for Grid prefixes (by @dualfroz).

Changelog

Sourced from autoprefixer's changelog.

10.6.2

Added /* autoprefixer: ignore next warning */ (by @dualfroz).

Fixed losing unprefixed selectors in old browsers in grouping (by @ybai08).

Fixed selector duplicates on multiple Autoprefixer runs.

Fixed case-insensitive pseudo-selector prefixing (by @jakezwang).

Fixed -webkit-cross-fade() for images with numbers (by @mkantautas).

Fixed source maps for Grid prefixes (by @dualfroz).

Commits

a7dbf4d Release 10.6.2 version
c3cd98d Fix selector duplicates on multiple Autoprefixer runs
5ae399e Keep unprefixed selectors in prefixed grouping rules (#1561)
50ca3e2 Fix -webkit-cross-fade() for images with numbers (#1562)
0efb61b Add /* autoprefixer: ignore next warning */ control comment (#1560)
7ca1fad Set source for Grid prefixes in source maps (#1559)
c6d89bc Fix case-insensitive pseudo-selector prefixing (#1558)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the minor-and-patch group in /packages-explorer with 5 updates: | Package | From | To | | --- | --- | --- | | [next](https://github.com/vercel/next.js) | `16.4.3` | `16.4.5` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.63.0` | `1.69.0` | | [motion](https://github.com/motiondivision/motion) | `14.7.1` | `14.9.1` | | [postcss](https://github.com/postcss/postcss) | `8.5.28` | `8.5.32` | | [autoprefixer](https://github.com/postcss/autoprefixer) | `10.6.1` | `10.6.2` | Updates `next` from 16.4.3 to 16.4.5 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.4.3...v16.4.5) Updates `lucide-react` from 1.63.0 to 1.69.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.69.0/packages/lucide-react) Updates `motion` from 14.7.1 to 14.9.1 - [Changelog](https://github.com/motiondivision/motion/blob/main/CHANGELOG.md) - [Commits](motiondivision/motion@v14.7.1...v14.9.1) Updates `postcss` from 8.5.28 to 8.5.32 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.28...8.5.32) Updates `autoprefixer` from 10.6.1 to 10.6.2 - [Release notes](https://github.com/postcss/autoprefixer/releases) - [Changelog](https://github.com/postcss/autoprefixer/blob/main/CHANGELOG.md) - [Commits](postcss/autoprefixer@10.6.1...10.6.2) --- updated-dependencies: - dependency-name: next dependency-version: 16.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: lucide-react dependency-version: 1.69.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: motion dependency-version: 14.9.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: postcss dependency-version: 8.5.32 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: autoprefixer dependency-version: 10.6.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-11-09T04:31:21Z

Labels

The following labels could not be found: npm. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

vercel · 2026-11-09T04:31:21Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
hintents-zmu7	Ready	Preview	Nov 9, 2026 4:31am UTC

3 Skipped Deployments

Project	Deployment	Actions	Updated
hintents	Ignored	Preview	Nov 9, 2026 4:31am UTC
packages	Ignored	Preview	Nov 9, 2026 4:31am UTC
playground	Ignored	Preview	Nov 9, 2026 4:31am UTC

dependabot · 2026-11-10T17:30:50Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

dependabot Bot added the dependencies label Nov 9, 2026

vercel Bot deployed to Preview – hintents-zmu7 November 9, 2026 04:31

View deployment

dotandev closed this Nov 10, 2026

Navigation Menu

Repository navigation

chore(deps): bump the minor-and-patch group in /packages-explorer with 5 updates - #2192

chore(deps): bump the minor-and-patch group in /packages-explorer with 5 updates#2192
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/packages-explorer/minor-and-patch-94f16934f6

dependabot Bot commented on behalf of github Nov 9, 2026

Uh oh!

dependabot Bot commented on behalf of github Nov 9, 2026

Uh oh!

vercel Bot commented Nov 9, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Nov 10, 2026

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Nov 9, 2026

v16.4.5

Moderate

v16.4.4

Core Changes

Credits

Version 1.69.0

What's Changed

New Contributors

Version 1.68.0

What's Changed

New Contributors

Version 1.67.0

What's Changed

New Contributors

[14.9.1] 2026-11-04

Added

[14.9.0] 2026-10-30

Added

[14.8.0] 2026-10-29

Added

Fixed

8.5.32

8.5.31

8.5.30

8.5.29

8.5.32

8.5.31

8.5.30

8.5.29

10.6.2

10.6.2

Uh oh!

dependabot Bot commented on behalf of github Nov 9, 2026

Labels

Uh oh!

vercel Bot commented Nov 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dependabot Bot commented on behalf of github Nov 10, 2026

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented Nov 9, 2026 •

edited

Loading