Skip to content

Update ui deps sync#694

Open
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/ui-deps-sync
Open

Update ui deps sync#694
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/ui-deps-sync

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate bot commented Oct 17, 2025 •
edited
Loading

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
@openzeppelin/confidential-contracts (source) ^0.3.1 → ^0.4.0 age adoption passing confidence
@rollup/plugin-commonjs (source) ^28.0.8 → ^28.0.9 age adoption passing confidence
@rollup/plugin-replace (source) ^6.0.2 → ^6.0.3 age adoption passing confidence
@rollup/plugin-typescript (source) ^12.1.4 → ^12.3.0 age adoption passing confidence
@types/node (source) ^20.19.21 → ^20.19.39 age adoption passing confidence
@upstash/redis (source) 1.35.6 → 1.37.0 age adoption passing confidence
@upstash/redis (source) 1.35.6 → 1.37.0 age adoption passing confidence
autoprefixer ^10.4.21 → ^10.5.0 age adoption passing confidence
jszip 3.6.0 → 3.10.1 age adoption passing confidence
postcss (source) ^8.5.6 → ^8.5.10 age adoption passing confidence
semver ^7.7.3 → ^7.7.4 age adoption passing confidence
tailwindcss (source) ^3.4.18 → ^3.4.19 age adoption passing confidence

Release Notes

OpenZeppelin/openzeppelin-confidential-contracts (@​openzeppelin/confidential-contracts)

v0.4.0

Compare Source

  • Migrate @fhevm/solidity dependency to 0.11.1 (#​311)
  • Upgrade openzeppelin/contracts and openzeppelin/contracts-upgradeable to v5.6.1 (#​314)
Token
  • ERC7984ERC20Wrapper: use a bytes32 unwrap request identifier instead of identifying batches by the euint64 unwrap amount. (#​326)
  • ERC7984ERC20Wrapper: Support ERC-165 interface detection on ERC7984ERC20Wrapper. (#​267)
  • ERC7984ERC20Wrapper: return the amount of wrapped token sent on wrap calls. (#​307)
  • ERC7984ERC20Wrapper: return unwrapped amount on unwrap calls (#​288)
  • ERC7984ERC20Wrapper: revert on wrap if there is a chance of total supply overflow. (#​268)
  • ERC7984Restricted, ERC7984Rwa: Rename isUserAllowed to canTransact (#​291)
Finance
  • BatcherConfidential: A batching primitive that enables routing between two ERC7984ERC20Wrapper contracts via a non-confidential route. (#​293)
Utils
  • HandleAccessManager: change _validateHandleAllowance to return a boolean and validate it. (#​303)
rollup/plugins (@​rollup/plugin-commonjs)

v28.0.9

2025-10-24

Bugfixes
  • fix: handle node: builtins with strictRequires: auto (#​1930)
rollup/plugins (@​rollup/plugin-replace)

v6.0.3

2025-10-29

Bugfixes
  • fix: update delimiters to respect valid js identifier chars (#​1938)
rollup/plugins (@​rollup/plugin-typescript)

v12.3.0

2025-10-23

Features
  • feat: expose latest Program to transformers in watch mode (#​1923)

v12.2.0

2025-10-22

Features
  • feat: process .js when allowJs is enabled (#​1920)
upstash/redis-js (@​upstash/redis)

v1.37.0

Compare Source

Minor Changes
Patch Changes

v1.36.4

Compare Source

What's Changed

New Contributors

Full Changelog: upstash/redis-js@v1.36.3...v1.36.4

v1.36.3

Compare Source

What's Changed

Full Changelog: upstash/redis-js@v1.36.2...v1.36.3

v1.36.2

Compare Source

What's Changed

Full Changelog: upstash/redis-js@v1.36.1...v1.36.2

v1.36.1

Compare Source

What's Changed

Full Changelog: upstash/redis-js@v1.36.0...v1.36.1

v1.36.0

Compare Source

What's Changed

Full Changelog: upstash/redis-js@v1.35.8...v1.36.0

v1.35.8

Compare Source

What's Changed

Full Changelog: upstash/redis-js@v1.35.7...v1.35.8

v1.35.7

Compare Source

What's Changed

New Contributors

Full Changelog: upstash/redis-js@v1.35.6...v1.35.7

postcss/autoprefixer (autoprefixer)

v10.5.0

Compare Source

  • Added mask-position-x and mask-position-y support (by @​toporek).

v10.4.27

Compare Source

  • Removed development key from package.json.

v10.4.26

Compare Source

  • Reduced package size.

v10.4.25

Compare Source

  • Fixed broken gradients on CSS Custom Properties (by @​serger777).

v10.4.24

Compare Source

  • Made Autoprefixer a little faster (by @​Cherry).

v10.4.23

Compare Source

v10.4.22

Compare Source

  • Fixed stretch prefixes on new Can I Use database.
  • Updated fraction.js.
Stuk/jszip (jszip)

v3.10.1

Compare Source

  • Add sponsorship files.
    • If you appreciate the time spent maintaining JSZip then I would really appreciate your sponsorship.
  • Consolidate metadata types and expose OnUpdateCallback #​851 and #​852
  • use const instead var in example from README.markdown #​828
  • Switch manual download link to HTTPS #​839

Internals:

v3.10.0

Compare Source

  • Change setimmediate dependency to more efficient one. Fixes #​617 (see #​829)
  • Update types of currentFile metadata to include null (see #​826)

v3.9.1

Compare Source

  • Fix recursive definition of InputFileFormat introduced in 3.9.0.

v3.9.0

Compare Source

  • Update types JSZip#loadAsync to accept a promise for data, and remove arguments from new JSZip() (see #​752)
  • Update types for compressionOptions to JSZipFileOptions and JSZipGeneratorOptions (see #​722)
  • Add types for generateInternalStream (see #​774)

v3.8.0

Compare Source

  • Santize filenames when files are loaded with loadAsync, to avoid "zip slip" attacks. The original filename is available on each zip entry as unsafeOriginalName. See the documentation. Many thanks to McCaulay Hudson for reporting.

v3.7.1

Compare Source

  • Fix build of dist files.
    • Note: this version ensures the changes from 3.7.0 are actually included in the dist files. Thanks to Evan W for reporting.

v3.7.0

Compare Source

  • Fix: Use a null prototype object for this.files (see #​766)
    • This change might break existing code if it uses prototype methods on the .files property of a zip object, for example zip.files.toString(). This approach is taken to prevent files in the zip overriding object methods that would exist on a normal object.
postcss/postcss (postcss)

v8.5.10

Compare Source

  • Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

v8.5.9

Compare Source

  • Speed up source map encoding paring in case of the error.

v8.5.8

Compare Source

  • Fixed Processor#version.

v8.5.7

Compare Source

  • Improved source map annotation cleaning performance (by CodeAnt AI).
npm/node-semver (semver)

v7.7.4

Compare Source

Bug Fixes
Documentation
Dependencies
Chores
tailwindlabs/tailwindcss (tailwindcss)

v3.4.19

Compare Source

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested a review from a team as a code owner October 17, 2025 02:41
@socket-security
Copy link
Copy Markdown

socket-security bot commented Oct 17, 2025 •
edited
Loading

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Block Low
Potential code anomaly (AI signal): npm ajv is 100.0% likely to have a medium risk anomaly

Notes: The code implements a standard AJV-like dynamic parser generator for JTD schemas. There are no explicit malware indicators in this fragment. The primary security concern is the dynamic code generation and execution from external schemas, which introduces a medium risk if schemas are untrusted. With trusted schemas and proper schema management, the risk is typically acceptable within this pattern.

Confidence: 1.00

Severity: 0.60

From: ? → npm/ajv@8.18.0

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ajv@8.18.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm ajv is 100.0% likely to have a medium risk anomaly

Notes: This module generates JavaScript code at runtime via standaloneCode(...) and then immediately executes it with require-from-string. Because the generated code can incorporate user-supplied schemas or custom keywords without sanitization or sandboxing, an attacker who controls those inputs could inject arbitrary code and achieve remote code execution in the Node process. Users should audit and lock down the standaloneCode output or replace dynamic evaluation with a safer, static bundling approach.

Confidence: 1.00

Severity: 0.60

From: ? → npm/ajv@8.18.0

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ajv@8.18.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm ajv is 100.0% likely to have a medium risk anomaly

Notes: The code implements standard timestamp validation with clear logic for normal and leap years and leap seconds. There is no network, file, or execution of external code within this isolated fragment. The only anomalous aspect is assigning a string to validTimestamp.code, which could enable external tooling to inject behavior in certain environments, but this does not constitute active malicious behavior in this isolated snippet. Overall, low to moderate security risk in typical usage; no malware detected within the shown code.

Confidence: 1.00

Severity: 0.60

From: ? → npm/ajv@8.18.0

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ajv@8.18.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm ignore is 100.0% likely to have a medium risk anomaly

Notes: The code fragment represents a conventional, well-structured path-ignore utility with caching and recursive parent-directory evaluation. Windows path normalization is present for compatibility but does not indicate malicious intent. No indicators of data leakage, external communication, or covert backdoors were found. Security impact primarily revolves around correct ignore semantics rather than intrinsic vulnerabilities. The component remains appropriate for use in a broader security-conscious pipeline if used with careful awareness of what is being ignored.

Confidence: 1.00

Severity: 0.60

From: ? → npm/ignore@7.0.5

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ignore@7.0.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm prettier is 100.0% likely to have a medium risk anomaly

Notes: No definitive malware detected in this fragment. The main security concern is supply-chain risk from dynamically loading plugins from potentially untrusted sources. To mitigate, enforce strict plugin provenance, disable remote plugin loading, verify plugin integrity, and apply least-privilege execution for plugins.

Confidence: 1.00

Severity: 0.60

From: package.json → npm/prettier@3.6.2

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/prettier@3.6.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai bot commented Oct 17, 2025 •
edited
Loading

Walkthrough

Package.json devDependencies updated: @types/node from ^20.19.21 to ^20.19.22 and rollup from ^4.52.4 to ^4.52.5. These are patch version updates with no runtime behavior changes.

Changes

Cohort / File(s) Summary
DevDependency version updates
packages/ui/package.json		 @types/node: ^20.19.21 → ^20.19.22; rollup: ^4.52.4 → ^4.52.5

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

Suggested reviewers

  • ericglau
  • collins-w
🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check name Status Explanation
Title Check ✅ Passed The title "Update ui deps sync" is directly related to the changeset, which updates dependencies in the packages/ui/package.json file (@types/node and rollup versions). The title accurately indicates the primary change involves updating UI package dependencies, and a teammate scanning the commit history would understand this is about dependency updates for the UI package. While the term "sync" is somewhat informal and could be more explicit about which dependencies are affected, the title is sufficiently clear and specific to describe the main change.
Docstring Coverage ✅ Passed No functions found in the changes. Docstring coverage check skipped.
Description check ✅ Passed The PR description provides a detailed table of dependency updates with version changes and release notes for each package, which directly relates to the changeset of updating dependencies in package.json.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch renovate/ui-deps-sync

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@renovate renovate bot changed the title Update dependency @types/node to ^20.19.22 Update ui deps sync Oct 18, 2025
@renovate renovate bot force-pushed the renovate/ui-deps-sync branch 6 times, most recently from 48f60b5 to 3a00523 Compare October 24, 2025 14:45
@renovate renovate bot force-pushed the renovate/ui-deps-sync branch 8 times, most recently from 8c719e6 to e42c08d Compare November 3, 2025 20:14
@renovate renovate bot force-pushed the renovate/ui-deps-sync branch 12 times, most recently from c81f512 to 2acb5f1 Compare November 12, 2025 04:13
@renovate renovate bot force-pushed the renovate/ui-deps-sync branch 11 times, most recently from fe2dd45 to 0fd8ede Compare December 15, 2025 13:19
@renovate renovate bot force-pushed the renovate/ui-deps-sync branch 2 times, most recently from 684b39e to 04ee6c9 Compare December 20, 2025 13:58
@renovate renovate bot force-pushed the renovate/ui-deps-sync branch 2 times, most recently from 2992cb2 to 83401de Compare December 31, 2025 14:05
@renovate renovate bot force-pushed the renovate/ui-deps-sync branch 6 times, most recently from c61a046 to 482fee9 Compare January 10, 2026 11:30
@renovate renovate bot force-pushed the renovate/ui-deps-sync branch 7 times, most recently from c613545 to f5e265c Compare January 19, 2026 11:00
@socket-security
Copy link
Copy Markdown

socket-security bot commented Apr 16, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Added@​changesets/​changelog-github@​0.5.11001006792100
Addedtypescript-eslint@​8.39.11001007498100
Added@​types/​semver@​7.7.11001007581100
Added@​openzeppelin/​confidential-contracts@​0.3.1801008094100
Added@​types/​node@​20.19.391001008196100
Addedpostcss@​8.5.10991008292100
Addedconcurrently@​9.2.09910010083100
Addedsemver@​7.7.410010010086100
Addedeslint-config-prettier@​10.1.810010010088100
Addedprettier-plugin-svelte@​3.4.09810010089100
Addedeslint@​9.33.08910010095100
Addedeslint-plugin-unicorn@​61.0.29710010090100
Addedtypescript@​5.9.3100100909990
Addedprettier@​3.6.2901009797100
Addedeslint-plugin-prettier@​5.5.49910010090100
Added@​eslint/​js@​9.33.01001009191100
Added@​openzeppelin/​contracts@​5.4.010010010092100
Added@​changesets/​cli@​2.29.59610010096100
Added@​openzeppelin/​community-contracts@​0.0.1100100100100100

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants