Skip to content

build(deps): bump the bun-minor-patch group with 6 updates - #78

Closed
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/bun/bun-minor-patch-60342327ec
Closed

build(deps): bump the bun-minor-patch group with 6 updates#78
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/bun/bun-minor-patch-60342327ec

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the bun-minor-patch group with 6 updates:

Package From To
@sentry/bun 11.4.0 11.6.0
lucide-react 1.52.0 1.53.0
posthog-js 1.438.2 1.438.3
@graphql-codegen/cli 7.4.4 7.4.5
playwright 1.63.0 1.64.0
vite 8.3.3 8.3.4

Updates @sentry/bun from 11.4.0 to 11.6.0

Release notes

Sourced from @​sentry/bun's releases.

11.6.0

Important Changes

  • feat(nextjs): Add @sentry/nextjs/cloudflare (#24998)

    The new @sentry/nextjs/cloudflare entry point exports withSentry for the Worker entry of a Next.js app on Cloudflare Workers, for example .open-next/worker.js of OpenNext. It is withSentry of @sentry/cloudflare with the Next.js server handling added, so a Next.js app on Workers gets the same spans as on Node.js.

    import * as Sentry from '@sentry/nextjs/cloudflare';
import handler from './.open-next/worker.js';
export default Sentry.withSentry(
env => ({
dsn: env.SENTRY_DSN,
tracesSampleRate: 1.0,
}),
handler,
);

  • feat(server-utils): Add instrumentation for pi-durable (#24993)

    The new piDurableIntegration traces agents built with pi-durable: each run, with its model requests and tool calls.

  • fix(core): Correct sleep clock drift on telemetry timestamps (#23054)

    When a device sleeps, the performance.now() clock of the browser stops. Before this change, timestamps of spans and other telemetry recorded after the sleep could be too early. The SDK now detects this drift and corrects its time origin, also for spans created from performance entries. Span end times are now computed from the performance.now() duration since the span start, like in OpenTelemetry (#24903).

Other Changes

  • feat(cloudflare): Skip spans for the pi_ tables of PiHarness (#25028)
  • feat(remix): Propagate the server trace to Remix 3 page loads (#25145)
  • feat(server-utils): Map Mastra classifier evaluations to gen_ai.evaluate spans (#25044)
  • feat(server-utils): Record LangChain TypeSafeClassifier runs as gen_ai.evaluate spans (#25120)
  • fix(browser): Check for clock drift on page lifecycle events (#25091)
  • fix(core): Exclude attachments from internal exception events (#25160)
  • fix(effect): Convert Effect span times to the Sentry clock (#24972)
  • fix(effect): Detect HTTP spans named after the request method (#25159)
  • fix(node): Register Vercel keep-alive listeners once (#25146)
  • fix(replay): Place CLS and INP web vitals at the right time (#24990)
  • fix(server-utils): Record LangGraph span I/O for non-MessagesAnnotation state (#23315)
  • fix(sveltekit): Upload source maps with SvelteKit 3 (#25139)
  • chore: Add external contributor to CHANGELOG.md (#25136)
  • chore(deps-dev): Bump next from 15.5.24 to 15.5.27 (#25171)
  • chore(nitro): Remove stale bundler-plugin-core rollup external (#25149)
  • feat(cloudflare): Wrap vinext Worker entries with @sentry/nextjs/cloudflare (#25000)

... (truncated)

Changelog

Sourced from @​sentry/bun's changelog.

11.6.0

Important Changes

  • feat(nextjs): Add @sentry/nextjs/cloudflare (#24998)

    The new @sentry/nextjs/cloudflare entry point exports withSentry for the Worker entry of a Next.js app on Cloudflare Workers, for example .open-next/worker.js of OpenNext. It is withSentry of @sentry/cloudflare with the Next.js server handling added, so a Next.js app on Workers gets the same spans as on Node.js.

    import * as Sentry from '@sentry/nextjs/cloudflare';
import handler from './.open-next/worker.js';
export default Sentry.withSentry(
env => ({
dsn: env.SENTRY_DSN,
tracesSampleRate: 1.0,
}),
handler,
);

  • feat(server-utils): Add instrumentation for pi-durable (#24993)

    The new piDurableIntegration traces agents built with pi-durable: each run, with its model requests and tool calls.

  • fix(core): Correct sleep clock drift on telemetry timestamps (#23054)

    When a device sleeps, the performance.now() clock of the browser stops. Before this change, timestamps of spans and other telemetry recorded after the sleep could be too early. The SDK now detects this drift and corrects its time origin, also for spans created from performance entries. Span end times are now computed from the performance.now() duration since the span start, like in OpenTelemetry (#24903).

Other Changes

  • feat(cloudflare): Skip spans for the pi_ tables of PiHarness (#25028)
  • feat(remix): Propagate the server trace to Remix 3 page loads (#25145)
  • feat(server-utils): Map Mastra classifier evaluations to gen_ai.evaluate spans (#25044)
  • feat(server-utils): Record LangChain TypeSafeClassifier runs as gen_ai.evaluate spans (#25120)
  • fix(browser): Check for clock drift on page lifecycle events (#25091)
  • fix(core): Exclude attachments from internal exception events (#25160)
  • fix(effect): Convert Effect span times to the Sentry clock (#24972)
  • fix(effect): Detect HTTP spans named after the request method (#25159)
  • fix(node): Register Vercel keep-alive listeners once (#25146)
  • fix(replay): Place CLS and INP web vitals at the right time (#24990)
  • fix(server-utils): Record LangGraph span I/O for non-MessagesAnnotation state (#23315)
  • fix(sveltekit): Upload source maps with SvelteKit 3 (#25139)
  • chore: Add external contributor to CHANGELOG.md (#25136)
  • chore(deps-dev): Bump next from 15.5.24 to 15.5.27 (#25171)
  • chore(nitro): Remove stale bundler-plugin-core rollup external (#25149)

... (truncated)

Commits
  • 3c0c830 release: 11.6.0
  • 13743e9 Merge pull request #25184 from getsentry/prepare-release/11.6.0
  • 3605c50 chore(size-limit): Bump @​sentry/node size limits
  • 53ae996 meta(changelog): Update changelog for 11.6.0
  • e99e6e1 feat(remix): Propagate the server trace to Remix 3 page loads (#25145)
  • 2fdcb23 test(e2e): Add Mastra Jev classifier test to node-mastra (#25115)
  • 5bb9a68 feat(server-utils): Map Mastra classifier evaluations to gen_ai.evaluate span...
  • 221dd86 test(e2e): Add a cloudflare-pi-durable end-to-end application (#25022)
  • 966e1ff feat(cloudflare): Skip spans for the pi_ tables of PiHarness (#25028)
  • b70f6bb test(e2e): Add a node-pi-durable end-to-end application (#24994)
  • Additional commits viewable in compare view

Updates lucide-react from 1.52.0 to 1.53.0

Release notes

Sourced from lucide-react's releases.

Version 1.53.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.52.0...1.53.0

Commits

Updates posthog-js from 1.438.2 to 1.438.3

Release notes

Sourced from posthog-js's releases.

posthog-js@1.438.3

1.438.3

Patch Changes

  • #5200 34cdfa6 Thanks @​hpouillot! - fix(replay): add a private opt-in to preserve application stacks for failed fetch requests (2026-10-08)
  • Updated dependencies [34cdfa6]:
    • @​posthog/types@​1.415.2
Commits
  • 92eae41 chore: update versions and lockfile [version bump]
  • 34cdfa6 fix(replay): preserve application stacks for rejected fetches (#5200)
  • c95ce40 chore: update versions and lockfile [version bump]
  • 3132998 perf(mcp): sanitize each tool response once (#5162)
  • 339540f chore: update versions and lockfile [version bump]
  • a52361c docs(react-native): describe apiKey as the project token (#5221)
  • See full diff in compare view

Updates @graphql-codegen/cli from 7.4.4 to 7.4.5

Changelog

Sourced from @​graphql-codegen/cli's changelog.

7.4.5

Patch Changes

... (truncated)

Commits

Updates playwright from 1.63.0 to 1.64.0

Release notes

Sourced from playwright's releases.

v1.64.0

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');
for (const tool of await page.webmcp.tools())
console.log(tool.name, tool.description);
const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
use: {
video: {
mode: 'on',
size: { width: 1920, height: 1080 },
fps: 60,
show: {
actions: {
style: {
point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
highlight: 'outline: 2px solid #333; background: rgba(0, 128, 255, .15)',
title: 'font-size: 16px',
},
},
},
},
</tr></table>

... (truncated)

Commits
  • 606ecd8 cherry-pick(#43192): fix(locators): parse locators the way the client API bui...
  • e4f872c cherry-pick(#43188): feat(api): expose asLocatorDescription via LocalUtils fo...
  • f6a439e cherry-pick(#43189): docs(webmcp): expose WebMCP to all languages
  • e2335c3 cherry-pick(#43174): fix(mcp): do not close the browser twice when the client...
  • d2a436e cherry-pick(#43163): Revert "fix(blob): do not remove existing reports from o...
  • a0c4b5e cherry-pick(#43175): feat(api): return language-specific locator code from re...
  • 3f7d535 cherry-pick(#43131): docs: fix broken C# samples in API docs and handles guide
  • 1cde64f cherry-pick(#43170): fix(locators): parse mixed role options
  • 8851e72 cherry-pick(#43171): fix(locators): parse JavaScript escapes and regex classes
  • dcc5065 cherry-pick(#43172): fix(locator): parse within and getByRef locators
  • Additional commits viewable in compare view

Updates vite from 8.3.3 to 8.3.4

Release notes

Sourced from vite's releases.

v8.3.4

Features

  • bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

  • avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)
  • build: correct preloads when chunkImportMap is enabled with non-root base (#23698) (2a8c0f0)
  • build: wait for in-flight stylesheets in preload helper (fix #23652) (#23662) (036b745)
  • bundled-dev: serve /@vite/client and stub @vite/env (#23664) (5afc5a8)
  • client: skip rewriting unchanged adopted styles (#23697) (fa71469)
  • css: resolve imported preprocessors from their file path with lightningcss (#23688) (cf52011)
  • deps: update all non-major dependencies (#23648) (8a4c19c)
  • deps: update rolldown-related dependencies (#23649) (794516d)
  • dev: a restart requested during a restart used to be dropped (fix #23392) (#23484) (70d56ea)
  • don't treat modules ending with js-like query as js (#23687) (fcb6f12)
  • html: avoid adding filesystem root to watcher (#23689) (3a7f2ae)
  • html: skip caching CSS of chunks in a cycle (fix #23628) (#23636) (15d82f7)
  • optimizer: scan deep imports with custom extensions (#23678) (8579189)
  • remove input option unescaping for now (#23694) (facc2fb)
  • server: match static aliases on path boundaries (#23643) (b28db28)
  • watcher: normalize file before root check in ensureWatchedFile (#23673) (12bb28c)

Performance Improvements

  • module-runner: skip cloning call sites that have no source map (#23646) (3d67486)

Code Refactoring

  • bundled-dev: import CSS HMR helpers from /@vite/client (#23674) (182f5b2)
Changelog

Sourced from vite's changelog.

8.3.4 (2026-10-08)

Features

  • bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

  • avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)
  • build: correct preloads when chunkImportMap is enabled with non-root base (#23698) (2a8c0f0)
  • build: wait for in-flight stylesheets in preload helper (fix #23652) (#23662) (036b745)
  • bundled-dev: serve /@vite/client and stub @vite/env (#23664) (5afc5a8)
  • client: skip rewriting unchanged adopted styles (#23697) (fa71469)
  • css: resolve imported preprocessors from their file path with lightningcss (#23688) (cf52011)
  • deps: update all non-major dependencies (#23648) (8a4c19c)
  • deps: update rolldown-related dependencies (#23649) (794516d)
  • dev: a restart requested during a restart used to be dropped (fix #23392) (#23484) (70d56ea)
  • don't treat modules ending with js-like query as js (#23687) (fcb6f12)
  • html: avoid adding filesystem root to watcher (#23689) (3a7f2ae)
  • html: skip caching CSS of chunks in a cycle (fix #23628) (#23636) (15d82f7)
  • optimizer: scan deep imports with custom extensions (#23678) (8579189)
  • remove input option unescaping for now (#23694) (facc2fb)
  • server: match static aliases on path boundaries (#23643) (b28db28)
  • watcher: normalize file before root check in ensureWatchedFile (#23673) (12bb28c)

Performance Improvements

  • module-runner: skip cloning call sites that have no source map (#23646) (3d67486)

Code Refactoring

  • bundled-dev: import CSS HMR helpers from /@vite/client (#23674) (182f5b2)
Commits
  • b6c20f6 release: v8.3.4 (#23702)
  • b28db28 fix(server): match static aliases on path boundaries (#23643)
  • bc0f21c feat(bundled-dev): support import.meta.hot.acceptExports (#23463)
  • fa71469 fix(client): skip rewriting unchanged adopted styles (#23697)
  • 2a8c0f0 fix(build): correct preloads when chunkImportMap is enabled with non-root bas...
  • 3a7f2ae fix(html): avoid adding filesystem root to watcher (#23689)
  • facc2fb fix: remove input option unescaping for now (#23694)
  • 70d56ea fix(dev): a restart requested during a restart used to be dropped (fix #23392...
  • cf52011 fix(css): resolve imported preprocessors from their file path with lightningc...
  • fcb6f12 fix: don't treat modules ending with js-like query as js (#23687)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the bun-minor-patch group with 6 updates
934f8c2 
Bumps the bun-minor-patch group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [@sentry/bun](https://github.com/getsentry/sentry-javascript) | `11.4.0` | `11.6.0` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.52.0` | `1.53.0` |
| [posthog-js](https://github.com/PostHog/posthog-js) | `1.438.2` | `1.438.3` |
| [@graphql-codegen/cli](https://github.com/dotansimha/graphql-code-generator/tree/HEAD/packages/graphql-codegen-cli) | `7.4.4` | `7.4.5` |
| [playwright](https://github.com/microsoft/playwright) | `1.63.0` | `1.64.0` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.3.3` | `8.3.4` |


Updates `@sentry/bun` from 11.4.0 to 11.6.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@11.4.0...11.6.0)

Updates `lucide-react` from 1.52.0 to 1.53.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.53.0/packages/lucide-react)

Updates `posthog-js` from 1.438.2 to 1.438.3
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.438.2...posthog-js@1.438.3)

Updates `@graphql-codegen/cli` from 7.4.4 to 7.4.5
- [Release notes](https://github.com/dotansimha/graphql-code-generator/releases)
- [Changelog](https://github.com/dotansimha/graphql-code-generator/blob/master/packages/graphql-codegen-cli/CHANGELOG.md)
- [Commits](https://github.com/dotansimha/graphql-code-generator/commits/@graphql-codegen/cli@7.4.5/packages/graphql-codegen-cli)

Updates `playwright` from 1.63.0 to 1.64.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.63.0...v1.64.0)

Updates `vite` from 8.3.3 to 8.3.4
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.4/packages/vite)

---
updated-dependencies:
- dependency-name: "@sentry/bun"
  dependency-version: 11.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bun-minor-patch
- dependency-name: lucide-react
  dependency-version: 1.53.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bun-minor-patch
- dependency-name: posthog-js
  dependency-version: 1.438.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bun-minor-patch
- dependency-name: "@graphql-codegen/cli"
  dependency-version: 7.4.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: bun-minor-patch
- dependency-name: playwright
  dependency-version: 1.64.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bun-minor-patch
- dependency-name: vite
  dependency-version: 8.3.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: bun-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 15, 2026
@patchwave

patchwave Bot commented Oct 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Review PatchWave’s changes

✅ Safe to merge (6)
Dependency Update
@sentry/bun 11.4.0 → 11.6.0
lucide-react 1.52.0 → 1.53.0
posthog-js 1.438.2 → 1.438.3
@graphql-codegen/cli 7.4.4 → 7.4.5
playwright 1.63.0 → 1.64.0
vite 8.3.3 → 8.3.4

View the full report · Analyzed by PatchWave

@patchwave
fix: resolve patched GraphQL tools dependencies
51d1ab0 
The Codegen 7.4.5 update moves its supported dependency tree to @graphql-tools/utils 12, but the lockfile retained vulnerable 11.x copies affected by GHSA-7mx3-vvmw-hjmv. Refresh compatible Codegen and GraphQL Tools transitive releases so all locked utils versions are patched without forcing an incompatible override or changing Dependabot's direct package versions.

[dependabot skip]

Generated-by: PatchWave (https://patchwave.ai)
PatchWave-Operation: fix
@dependabot @github

dependabot Bot commented on behalf of github Oct 15, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 15, 2026
@dependabot
dependabot Bot deleted the dependabot/bun/bun-minor-patch-60342327ec branch October 15, 2026 17:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jcarver989 jcarver989 Awaiting requested review from jcarver989 jcarver989 is a code owner
@blimmer blimmer Awaiting requested review from blimmer blimmer is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants