Bump lucide-react from 1.14.0 to 1.40.0 - #345
Conversation
dependabot
Bot
added
the
dependencies
|
@dependabot merge |
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF Scorecard
Scanned Files
|
|
Dependabot can't parse your pnpm-lock.yaml. Because of this, Dependabot cannot update this pull request. |
9953370 to
7068d10
Compare
|
@dependabot merge |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 7068d10. Configure here.
|
|
||
| xlsx@https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz: | ||
| resolution: {integrity: sha512-oLDq3jw7AcLqKWH2AhCpVTZl8mf6X2YReP+Neh0SJUzV/BdZYjth94tG5toiMB1PPrYtxOCfaoUCkvtuH+3AJA==, tarball: https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz} | ||
| resolution: {tarball: https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz} |
There was a problem hiding this comment.
Lockfile drops xlsx integrity
High Severity
Updating lucide-react also stripped the integrity hash from the remote xlsx tarball resolution in pnpm-lock.yaml. With pnpm@10.33.2, a missing lockfile integrity field skips verification for that CDN package, so a tampered cdn.sheetjs.com artifact can install without an integrity failure.
Reviewed by Cursor Bugbot for commit 7068d10. Configure here.
|
Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting |
Bumps [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) from 1.14.0 to 1.40.0. - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.40.0/packages/lucide-react) --- updated-dependencies: - dependency-name: lucide-react dependency-version: 1.31.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
7068d10 to
c1a59da
Compare
|
@dependabot merge |
Bumps lucide-react from 1.14.0 to 1.40.0.
Release notes
Sourced from lucide-react's releases.
... (truncated)
Commits
75b5516chore(dev): upgrade ESLint to latest compatible stack (v10) (#4378)0f8d48btest(packages): updates unit test snapshots with face-slightly-smiling (#4676)f229f83chore(depedencies): Update dependencies (#4553)5ff536eci(release.yml): Fix workflow and removeversionscripts in package scripts...07c885efix(docs): fix zephyr-cloud URL in readmesNote
Low Risk
Dependency-only icon library upgrade with no logic or auth changes; possible minor visual diffs for icons already in use.
Overview
Bumps
lucide-reactinsites/mainwebfrom 1.14.0 to ^1.40.0 and refreshespnpm-lock.yamlso the workspace resolves 1.40.0 against the existing React 19 peer dependency.There are no application code changes—only the dependency declaration and lockfile. Incidental lockfile edits (e.g. deprecation text on transitive packages,
xlsxtarball metadata) are not part of the intentional upgrade.Between these versions, Lucide adds many new icons and adjusts some existing glyph designs; any icons already imported in the app may render slightly differently, but usage in mainweb is standard named imports with no API changes required.
Reviewed by Cursor Bugbot for commit c1a59da. Bugbot is set up for automated code reviews on this repo. Configure here.