fix(deps): update prod minor+patch by renovate[bot] · Pull Request #102 · h8d13/caesar

renovate · 2026-08-03T02:47:56Z

This PR contains the following updates:

Package	Change	Age	Confidence
@noble/curves (source)	`^2.2.0` → `^2.3.0`
@noble/hashes (source)	`^2.2.0` → `^2.3.0`
@radix-ui/react-alert-dialog (source)	`^1.1.21` → `^1.1.23`
@radix-ui/react-avatar (source)	`^1.2.4` → `^1.2.6`
@radix-ui/react-context-menu (source)	`^2.3.5` → `^2.3.7`
@radix-ui/react-dialog (source)	`^1.1.21` → `^1.1.23`
@radix-ui/react-dropdown-menu (source)	`^2.1.22` → `^2.1.24`
@radix-ui/react-label (source)	`^2.1.13` → `^2.1.15`
@radix-ui/react-popover (source)	`^1.1.21` → `^1.1.23`
@radix-ui/react-select (source)	`^2.3.5` → `^2.3.7`
@radix-ui/react-separator (source)	`^1.1.13` → `^1.1.15`
@radix-ui/react-slider (source)	`^1.4.5` → `^1.4.7`
@radix-ui/react-slot (source)	`^1.3.1` → `^1.3.3`
@radix-ui/react-switch (source)	`^1.3.5` → `^1.3.7`
@radix-ui/react-tabs (source)	`^1.1.19` → `^1.1.21`
@radix-ui/react-tooltip (source)	`^1.2.14` → `^1.2.16`
@tiptap/core (source)	`^3.28.0` → `^3.29.2`
@tiptap/extension-emoji (source)	`^3.28.0` → `^3.29.2`
@tiptap/pm (source)	`^3.28.0` → `^3.29.2`
@tiptap/react (source)	`^3.28.0` → `^3.29.2`
@tiptap/starter-kit (source)	`^3.28.0` → `^3.29.2`
@tiptap/suggestion (source)	`^3.28.0` → `^3.29.2`
ipaddr.js	`^2.4.0` → `^2.5.0`
lucide-react (source)	`^1.26.0` → `^1.30.0`
marked (source)	`^18.0.7` → `^18.0.9`
mediasoup (source)	`3.22.0` → `3.24.1`
prosemirror-view	`^1.42.1` → `^1.42.2`
re-reselect	`^5.1.0` → `^5.1.1`
ws	`^8.21.1` → `^8.21.3`

Release Notes

paulmillr/noble-curves (@noble/curves)

`v2.3.0`

Compare Source

Security & constant-timeness

Hardened constant-time execution from best-effort to actual guarantees: no measurable timing behavior on 200K samples. Scalar multiplication now uses secret-scalar blinding via CSPRNG, un-precomputed points now use a constant-time fixed-window multiply instead of variable-time fallbacks, and modular arithmetic helpers were hardened. New CT benchmarks track timing behavior.
General hardening across all modules
Fixes from the Trail of Bits review: recovered ECDSA signatures are now bound to their recovery id, non-canonical BLS signature encodings are rejected, Edwards <-> Montgomery conversion helpers were corrected, and FROST DKG round-2 retry handling was hardened.

X25519 hardening

It was possible to execute a remote timing attack on X25519, across many samples, and learn up to 4.036 bits of long-term private key. Other 247 bits were NOT affected.

The impact: mainly fingerprinting (recognition of key across deployments), NOT key recovery, NOT X25519 breakage. Maintainer was also not able to escalate to co-residency (SMT).

Reported and found by:

George Stergiopoulos, Department of Informatics, Athens University of Economics and Business, Greece ([email protected])
Constantinos Patsakis, Department of Informatics, University of Piraeus, 80 Karaoli & Dimitriou str., 18534 Piraeus, Greece ([email protected])

Performance

ECDSA/EdDSA verification up to +32%, Weierstrass ECDH up to +19%, x25519 getPublicKey 2.7×
BLS signatures 2x
Init time (first getPublicKey or sign) reduced ~2x for ed25519, p256, p384, p521
Also faster verification of recovered signatures, pairing tower / FFT / Pippenger optimizations, and joint-MSM paths in FROST and OPRF
getPublicKey / sign got slower because we've decreased window size (W=8 => W=6) and hardened CT execution (see above). Long-running apps that prefer 2.2.0-level speed can restore it with one line: secp256k1.Point.BASE.precompute(8) (likewise for other curves).

Misc

Smaller bundles: improved tree-shaking across modules
Better error messages and type checks
Upgrade noble-hashes to 2.3.0, with performance boost
Reduce on-disk size 1831kb → 1548kb (-282kb) by disabling source maps (they became less relevant).

Full Changelog: paulmillr/noble-curves@2.2.0...2.3.0

paulmillr/noble-hashes (@noble/hashes)

`v2.3.0`

Compare Source

Improve speed:

+10-45% 32b inputs across all hashes
+40% SHA-3 / SHAKE, +50% 1mb KT128 / KT256 / TurboSHAKE, +20% kmac
2.2x argon
+20% pbkdf2 and hkdf

Other changes:

Better error messages and stricter type checks everywhere
Bugfix: HMAC _cloneInto now preserves canXOF (#134, ChALkeR); Argon2d typo rename (#135).
blake2.compress renamed to _compress (marked internal).
Reduce on-disk unpacked size 869kb → 665kb (-204kb) by disabling source maps (they became less relevant).

Full Changelog: paulmillr/noble-hashes@2.2.0...2.3.0

ueberdosis/tiptap (@tiptap/core)

ueberdosis/tiptap (@tiptap/extension-emoji)

`v3.29.2`

Compare Source

Patch Changes

`v3.29.1`

Compare Source

Patch Changes

ueberdosis/tiptap (@tiptap/pm)

`v3.29.2`

Compare Source

`v3.29.1`

Compare Source

ueberdosis/tiptap (@tiptap/react)

`v3.29.2`

Compare Source

Patch Changes

e914605: Fixed the caret jumping back to the previous block when pressing Enter inside a React node view.
- @tiptap/core@3.29.2
- @tiptap/pm@3.29.2

`v3.29.1`

Compare Source

Patch Changes

6d901e7: Fix caret placement after splitting a block rendered with a React NodeView.
- @tiptap/core@3.29.1
- @tiptap/pm@3.29.1

ueberdosis/tiptap (@tiptap/starter-kit)

`v3.29.2`

Compare Source

Patch Changes

@tiptap/extension-dropcursor@3.29.2
@tiptap/extension-gapcursor@3.29.2
@tiptap/extension-list-item@3.29.2
@tiptap/extension-list-keymap@3.29.2
@tiptap/core@3.29.2
@tiptap/extension-blockquote@3.29.2
@tiptap/extension-bold@3.29.2
@tiptap/extension-bullet-list@3.29.2
@tiptap/extension-code@3.29.2
@tiptap/extension-code-block@3.29.2
@tiptap/extension-document@3.29.2
@tiptap/extension-hard-break@3.29.2
@tiptap/extension-heading@3.29.2
@tiptap/extension-horizontal-rule@3.29.2
@tiptap/extension-italic@3.29.2
@tiptap/extension-link@3.29.2
@tiptap/extension-list@3.29.2
@tiptap/extension-ordered-list@3.29.2
@tiptap/extension-paragraph@3.29.2
@tiptap/extension-strike@3.29.2
@tiptap/extension-text@3.29.2
@tiptap/extension-underline@3.29.2
@tiptap/extensions@3.29.2
@tiptap/pm@3.29.2

`v3.29.1`

Compare Source

Patch Changes

@tiptap/extension-dropcursor@3.29.1
@tiptap/extension-gapcursor@3.29.1
@tiptap/extension-list-item@3.29.1
@tiptap/extension-list-keymap@3.29.1
@tiptap/core@3.29.1
@tiptap/extension-blockquote@3.29.1
@tiptap/extension-bold@3.29.1
@tiptap/extension-bullet-list@3.29.1
@tiptap/extension-code@3.29.1
@tiptap/extension-code-block@3.29.1
@tiptap/extension-document@3.29.1
@tiptap/extension-hard-break@3.29.1
@tiptap/extension-heading@3.29.1
@tiptap/extension-horizontal-rule@3.29.1
@tiptap/extension-italic@3.29.1
@tiptap/extension-link@3.29.1
@tiptap/extension-list@3.29.1
@tiptap/extension-ordered-list@3.29.1
@tiptap/extension-paragraph@3.29.1
@tiptap/extension-strike@3.29.1
@tiptap/extension-text@3.29.1
@tiptap/extension-underline@3.29.1
@tiptap/extensions@3.29.1
@tiptap/pm@3.29.1

ueberdosis/tiptap (@tiptap/suggestion)

`v3.29.2`

Compare Source

Patch Changes

@tiptap/core@3.29.2
@tiptap/pm@3.29.2

`v3.29.1`

Compare Source

Patch Changes

@tiptap/core@3.29.1
@tiptap/pm@3.29.1

whitequark/ipaddr.js (ipaddr.js)

`v2.5.0`

Compare Source

remove ipaddr.min.js, end users must provide own minification/bundling
fix: compress the leftmost zero run in toString (RFC 5952, 4.2.3)
fix: strict IPv6 validation — reject :: with zero compression and hextets >4 hex digits
fix: reject non-numeric prefix length in subnetMaskFromPrefixLength
fix: compress trailing zero run in toString when a zoneIndex is present
fix: throw a descriptive error for malformed input in IPv6.parse

lucide-icons/lucide (lucide-react)

`v1.30.0`

Compare Source

`v1.29.0`: Version 1.29.0

Compare Source

What's Changed

fix(@lucide/lab): Fix lab build by @ericfennis in #4618
feat(copilot): remove incorrect spaces clause from copilot instructions by @karsa-mistmere in #4623
feat(docs): remove Super and Noodle from showcase by @karsa-mistmere in #4626
chore(deps-dev): bump @angular/platform-server from 21.2.18 to 21.2.19 by @dependabot[bot] in #4629
ci(security): improve security with adding permissions by @ericfennis in #4619
feat(dependabot): added dependabot config, grouping PRs for each package by @karsa-mistmere in #4633
fix(ci): limit certain github workflows to main repository by @karsa-mistmere in #4628
fix(dependabot): Revert dependabot groups by @ericfennis in #4665
chore(dependabot): Group by dependency group by @ericfennis in #4666
chore(deps-dev): bump the svelte-deps group with 3 updates by @dependabot[bot] in #4671
chore(deps): bump the vue-deps group with 3 updates by @dependabot[bot] in #4670
chore(deps): bump the github-actions group with 13 updates by @dependabot[bot] in #4668
feat(icons): added layer reordering icons by @karsa-mistmere in #4617

Full Changelog: lucide-icons/lucide@1.28.0...1.29.0

`v1.28.0`

Compare Source

`v1.27.0`: Version 1.27.0

Compare Source

What's Changed

feat(icons): removed brand names from tags & revised brand stopwords by @karsa-mistmere in #4575
fix(docs): Fix site build by @ericfennis in #4582
fix(icons): optimised square-scissors icons by @karsa-mistmere in #4581
fix(packages/angular): add more supported attributes for SVG nodes by @karsa-mistmere in #4570
feat(icons): added pending-cw icon by @NielsLazaroms in #4439
fix(icons): changed zap and zap-off icons by @kapowaz in #4536
feat(icons): add square-off icon by @october-learns in #4496
chore(deps-dev): bump astro from 6.4.8 to 7.1.0 by @dependabot[bot] in #4572
fix(icons): changed toolbox icon by @karsa-mistmere in #4571
feat(icons): add scan-square by @samuelalake in #4550
feat(icons): added user-shield icon by @MArtytraM99 in #3099
feat(icons): added mosque icon by @iskepr in #4494
fix(request-review): Remove pull_request_target by @ericfennis in #4593
fix(icons): changed feather icon by @karsa-mistmere in #4584
feat(ci): added custom prettier plugin for icon SVG files by @karsa-mistmere in #4576
ci(ci.yml): Remove concurrency in ci.yml by @ericfennis in #4595
fix(icons): changed barrel icon by @karsa-mistmere in #4592
feat(lab): Migrate lab to main repo. by @ericfennis in #4521
feat(icons): added police-cap icon to lab by @uibalint in #3019
fix(icons): changed trophy icon by @karsa-mistmere in #4591
feat(analytics): add utm source and medium by @jguddas in #4596
feat(docs): Add lab requirement in pull_request_template.md by @danielbayley in #3651
feat(icons): added pilot icon by @jguddas in #2409
feat(icons): replaces podcast icon with new mic-* icons by @karsa-mistmere in #4583
feat(icons): add layout-freeform by @samuelalake in #4543

New Contributors

@NielsLazaroms made their first contribution in #4439
@kapowaz made their first contribution in #4536
@october-learns made their first contribution in #4496
@samuelalake made their first contribution in #4550
@iskepr made their first contribution in #4494

Full Changelog: lucide-icons/lucide@1.26.0...1.27.0

markedjs/marked (marked)

`v18.0.9`

Compare Source

`v18.0.8`

Compare Source

Bug Fixes

fall back to default checkbox renderer when extension returns false (#4023) (e1b6139)

versatica/mediasoup (mediasoup)

`v3.24.1`

Compare Source

Worker: Don't check ignoredSubchannel in piped DataConsumers (PR #1879).

`v3.24.0`

Compare Source

DataProducer.send(): Add ignoredSubchannel optional argument (PR #1877).

`v3.23.2`

Compare Source

Handle subchannels in pipe DataConsumers (PR #1875).

`v3.23.1`

Compare Source

Worker: Fix, use thread_local buffer on MS_ABORT() (PR#1873).

`v3.23.0`

Compare Source

Bump up Meson from 1.9.1 to 1.11.2 (PR #1861).
Worker: Update libsrtp to 3.0.0-beta-2fc078db (PR #1860).
Worker: Use constant-time memory comparison in MAC/credential verification (SCTP State Cookie MAC and STUN "MESSAGE-INTEGRITY") (PR #1867, credits to @alanturing881).
Worker: Fix OOB write in RTP::Packet::UpdateDependencyDescriptor() (PR #1868, credits to @alanturing881).
Worker: Fix integer overflow in SCTP MissingMandatoryParameterErrorCause (PR #1869, credits to @alanturing881).
SCTP: Add default per stream buffered amount low threshold option (PR #1871).

toomuchdesign/re-reselect (re-reselect)

`v5.1.1`

Compare Source

Patch Changes

#477 8a98e4d Thanks @veksa! - Fix createStructuredCachedSelector type error when a selector has a second optional argument

websockets/ws (ws)

`v8.21.3`

Compare Source

Bug fixes

The server now correctly rejects permessage-deflate offers if the incoming
client_max_window_bits parameter value is smaller than its configured
clientMaxWindowBits (e97a20e).

`v8.21.2`

Compare Source

Bug fixes

Fixed a test for CITGM (2eb3be0).

Configuration

📅 Schedule: (in timezone Europe/Lisbon)

Branch creation
- "before 5am on monday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot force-pushed the renovate/prod-minor+patch branch 7 times, most recently from bd98e92 to 1c42acc Compare August 10, 2026 14:16

fix(deps): update prod minor+patch

9a0050c

renovate Bot force-pushed the renovate/prod-minor+patch branch from 1c42acc to 9a0050c Compare August 11, 2026 21:46

Navigation Menu

fix(deps): update prod minor+patch - #102

fix(deps): update prod minor+patch#102
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/prod-minor+patch

renovate Bot commented Aug 3, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Security & constant-timeness

X25519 hardening

Performance

Misc

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

v1.29.0: Version 1.29.0

What's Changed

v1.27.0: Version 1.27.0

What's Changed

New Contributors

Bug Fixes

Patch Changes

Bug fixes

Bug fixes

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Aug 3, 2026 •

edited

Loading

`v1.29.0`: Version 1.29.0

`v1.27.0`: Version 1.27.0