Skip to content

chore(deps): bump the production group across 1 directory with 15 updates#733

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-037c581649
Closed

chore(deps): bump the production group across 1 directory with 15 updates#733
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-037c581649

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production group with 15 updates in the / directory:

Package From To
@iconify-json/lucide 1.2.115 1.2.117
@iconify-json/simple-icons 1.2.88 1.2.90
@shikijs/rehype 4.3.0 4.3.1
@wagmi/core 3.5.4 3.6.1
accounts 0.14.11 0.15.2
cva 1.0.0-beta.4 1.0.0-beta.7
hono 4.12.27 4.12.30
ox 0.14.30 1.0.0
posthog-js 1.396.4 1.400.0
posthog-node 5.39.2 5.42.0
prool 0.2.4 0.2.8
shiki 4.3.0 4.3.1
tapimo 0.4.0 0.4.1
viem 2.54.6 2.55.2
wagmi 3.6.20 3.7.1

Updates @iconify-json/lucide from 1.2.115 to 1.2.117

Commits

Updates @iconify-json/simple-icons from 1.2.88 to 1.2.90

Commits

Updates @shikijs/rehype from 4.3.0 to 4.3.1

Release notes

Sourced from @​shikijs/rehype's releases.

v4.3.1

   🚀 Features

    View changes on GitHub
Commits

Updates @wagmi/core from 3.5.4 to 3.6.1

Release notes

Sourced from @​wagmi/core's releases.

@​wagmi/core@​3.6.1

Patch Changes

  • Fixed waitForTransactionReceipt staying pending for reverted transactions when revert-reason lookup hangs behind a fallback transport. (#5190)

@​wagmi/core@​3.6.0

Minor Changes

  • Breaking (@​wagmi/core/tempo): Updated Tempo APIs for viem 2.54.0: token balance and allowance reads now return Amount objects. (#5188)

@​wagmi/core@​3.5.5

Patch Changes

  • Fixed Tempo types so transaction override parameters are optional. (#5171)
Changelog

Sourced from @​wagmi/core's changelog.

3.6.1

Patch Changes

  • Fixed waitForTransactionReceipt staying pending for reverted transactions when revert-reason lookup hangs behind a fallback transport. (#5190)

3.6.0

Minor Changes

  • Breaking (@​wagmi/core/tempo): Updated Tempo APIs for viem 2.54.0: token balance and allowance reads now return Amount objects. (#5188)

3.5.5

Patch Changes

  • Fixed Tempo types so transaction override parameters are optional. (#5171)
Commits

Updates accounts from 0.14.11 to 0.15.2

Release notes

Sourced from accounts's releases.

[email protected]

Patch Changes

  • 9d2bdc8: Skipped EIP-6963 provider announcement when crypto.randomUUID is unavailable (e.g. insecure contexts).
  • 29776b4: Added { domains } form to the wallet_connect identity.email capability for restricting email entry to allowed domains.
  • 5351e1c: Added paradigm.xyz to the list of trusted hosts.

[email protected]

Patch Changes

  • 03c1161: Added string and { address } forms to the wallet_connect identity.email capability for requiring a specific email.

[email protected]

Minor Changes

  • 2cfca91: Updated viem (>=2.54.0) and ox (~0.14.30) for the config-id-free TIP-1061 multisig format, removing genesisConfigId from the multisig relay ResolveConfig, Operation, and Status shapes.

[email protected]

Patch Changes

  • 186b1f7: Added provider MPP account resolution parameters for locally managed access keys.
  • 2e092e9: Added exact access-key selection for provider-backed mppx parameters.
  • d5c0d66: Changed Mount.auto to allow trusted hosts to use iframe mounts without IntersectionObserver v2 support.
  • 98a8138: Added identity to Provider.create, minting verified-email id tokens from a configured OIDC issuer when local adapters fulfill wallet_connect.
  • 4aa479d: Add SIWE resources to wallet_connect auth challenges, support server-provided SIWE statements in Handler.auth, and preserve extra auth verify JSON fields.
Changelog

Sourced from accounts's changelog.

0.15.2

Patch Changes

  • 9d2bdc8: Skipped EIP-6963 provider announcement when crypto.randomUUID is unavailable (e.g. insecure contexts).
  • 29776b4: Added { domains } form to the wallet_connect identity.email capability for restricting email entry to allowed domains.
  • 5351e1c: Added paradigm.xyz to the list of trusted hosts.

0.15.1

Patch Changes

  • 03c1161: Added string and { address } forms to the wallet_connect identity.email capability for requiring a specific email.

0.15.0

Minor Changes

  • 2cfca91: Updated viem (>=2.54.0) and ox (~0.14.30) for the config-id-free TIP-1061 multisig format, removing genesisConfigId from the multisig relay ResolveConfig, Operation, and Status shapes.

0.14.12

Patch Changes

  • 186b1f7: Added provider MPP account resolution parameters for locally managed access keys.
  • 2e092e9: Added exact access-key selection for provider-backed mppx parameters.
  • d5c0d66: Changed Mount.auto to allow trusted hosts to use iframe mounts without IntersectionObserver v2 support.
  • 98a8138: Added identity to Provider.create, minting verified-email id tokens from a configured OIDC issuer when local adapters fulfill wallet_connect.
  • 4aa479d: Add SIWE resources to wallet_connect auth challenges, support server-provided SIWE statements in Handler.auth, and preserve extra auth verify JSON fields.
Commits

Updates cva from 1.0.0-beta.4 to 1.0.0-beta.7

Release notes

Sourced from cva's releases.

v1.0.0-beta.7

What's Changed

Full Changelog: joe-bell/cva@v1.0.0-beta.6...v1.0.0-beta.7

v1.0.0-beta.6

What's Changed

Full Changelog: joe-bell/cva@v1.0.0-beta.5...v1.0.0-beta.6

v1.0.0-beta.5

What's Changed

Features

Clean-up

New Contributors

... (truncated)

Commits

Updates hono from 4.12.27 to 4.12.30

Release notes

Sourced from hono's releases.

v4.12.30

What's Changed

Full Changelog: honojs/hono@v4.12.29...v4.12.30

v4.12.29

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.28...v4.12.29

v4.12.28

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.27...v4.12.28

Commits
  • b2ae3a2 4.12.30
  • e0cdeb0 fix(method-override): set duplex when forwarding a stream body in query mode ...
  • 653025e fix(client): replaceUrlParam should not match a param that prefixes another (...
  • 67efb27 fix(compress): do not compress 206 Partial Content responses (#5020)
  • a48c8bf fix(cache): deduplicate Cache-Control directives case-insensitively (#5025)
  • 3bb9a0e chore: update to ts6 in prep for ts7 (#5104)
  • d3f97ca chore(benchmark): remove not used benchmarks (#5108)
  • 29a3f73 chore(benchmark/routers): bump deps (#5107)
  • cda1af2 4.12.29
  • 2126289 fix(etag): treat If-None-Match: * as a match (#5084)
  • Additional commits viewable in compare view

Updates ox from 0.14.30 to 1.0.0

Release notes

Sourced from ox's releases.

[email protected]

Major Changes

  • #231 40d9408 Thanks @​jxom! - Breaking: Changed ABI decode helpers to checksum decoded addresses by default.

    - AbiParameters.decode(parameters, data)
+ AbiParameters.decode(parameters, data, { checksumAddress: false })

  • #231 40d9408 Thanks @​jxom! - Removed the Tempo TokenId module and narrowed Tempo token inputs (feeToken, Channel.token, PoolId.from tokens) to Address.Address; also removed the now-redundant Channel.Resolved type.

      TxEnvelopeTempo.from({
    // ...
-   feeToken: 1n,
+   feeToken: '0x20c0000000000000000000000000000000000001',
  })

  • #231 40d9408 Thanks @​jxom! - Upgraded @noble/ciphers, @noble/curves, @noble/hashes, @scure/bip32, and @scure/bip39 to v2.

    Notable behavioral changes inherited from noble v2:

    • ECDSA signatures now default to lowS: true for both Secp256k1 and P256. Previously P256 signatures could have high-S values.
    • The noble re-exports on Secp256k1, P256, Ed25519, X25519, and Bls now reference the v2 APIs (e.g. randomSecretKey() instead of randomPrivateKey(), Point instead of ProjectivePoint/ExtendedPoint, bls.longSignatures.* instead of top-level bls.sign/verify). If you depended on the v1 shape via Module.noble, refer to the noble v2 changelog.

  • #231 40d9408 Thanks @​jxom! - Breaking: Removed the 4844-only blob-sidecar surface in favor of PeerDAS (EIP-7594).

    • Kzg.Kzg no longer includes computeBlobKzgProof. Bring a PeerDAS-capable backend (e.g. c-kzg ≥ v1.5, micro-eth-signer/advanced/kzg.js ≥ v0.18, or equivalent). The backend must implement computeCells, computeCellsAndKzgProofs, recoverCellsAndKzgProofs, and verifyCellKzgProofBatch in addition to blobToKzgCommitment.
    • Removed Blobs.toSidecars, Blobs.toProofs, Blobs.sidecarsToVersionedHashes, Blobs.BlobSidecar, and Blobs.BlobSidecars. Use the upcoming BlobCells module (next phase) for PeerDAS data-column construction. Kzg.Kzg.blobToKzgCommitment and Blobs.toVersionedHashes remain for transaction versioned-hash derivation.
    • Removed TxEnvelopeEip4844.sidecars (the legacy "network wrapper" RLP form for eth_sendRawTransaction). PeerDAS replaces the network wrapper with cell/column propagation; the on-chain envelope is unchanged.

  • #231 40d9408 Thanks @​jxom! - Migrated ECDSA and BLS coordinate fields (r, s, x, y, BLS Fp/Fp2) from bigint to padded Hex.Hex strings (32-byte for secp256k1/P256/WebAuthnP256, 48-byte for BLS12-381) on Signature, PublicKey, BlsPoint, Transaction, Authorization, TxEnvelope, and related Tempo and ERC envelopes, dropping the bigintType generic.

    - Signature.from({ r: 0x6e10...n, s: 0x4a90...n, yParity: 1 })
+ Signature.from({
+   r: '0x6e100a352ec6ad1b70802290e18aeed190704973570f3b8ed42cb9808e2ea6bf',

... (truncated)

Changelog

Sourced from ox's changelog.

1.0.0

Major Changes

  • #231 40d9408 Thanks @​jxom! - Breaking: Changed ABI decode helpers to checksum decoded addresses by default.

    - AbiParameters.decode(parameters, data)
+ AbiParameters.decode(parameters, data, { checksumAddress: false })

  • #231 40d9408 Thanks @​jxom! - Removed the Tempo TokenId module and narrowed Tempo token inputs (feeToken, Channel.token, PoolId.from tokens) to Address.Address; also removed the now-redundant Channel.Resolved type.

      TxEnvelopeTempo.from({
    // ...
-   feeToken: 1n,
+   feeToken: '0x20c0000000000000000000000000000000000001',
  })

  • #231 40d9408 Thanks @​jxom! - Upgraded @noble/ciphers, @noble/curves, @noble/hashes, @scure/bip32, and @scure/bip39 to v2.

    Notable behavioral changes inherited from noble v2:

    • ECDSA signatures now default to lowS: true for both Secp256k1 and P256. Previously P256 signatures could have high-S values.
    • The noble re-exports on Secp256k1, P256, Ed25519, X25519, and Bls now reference the v2 APIs (e.g. randomSecretKey() instead of randomPrivateKey(), Point instead of ProjectivePoint/ExtendedPoint, bls.longSignatures.* instead of top-level bls.sign/verify). If you depended on the v1 shape via Module.noble, refer to the noble v2 changelog.

  • #231 40d9408 Thanks @​jxom! - Breaking: Removed the 4844-only blob-sidecar surface in favor of PeerDAS (EIP-7594).

    • Kzg.Kzg no longer includes computeBlobKzgProof. Bring a PeerDAS-capable backend (e.g. c-kzg ≥ v1.5, micro-eth-signer/advanced/kzg.js ≥ v0.18, or equivalent). The backend must implement computeCells, computeCellsAndKzgProofs, recoverCellsAndKzgProofs, and verifyCellKzgProofBatch in addition to blobToKzgCommitment.
    • Removed Blobs.toSidecars, Blobs.toProofs, Blobs.sidecarsToVersionedHashes, Blobs.BlobSidecar, and Blobs.BlobSidecars. Use the upcoming BlobCells module (next phase) for PeerDAS data-column construction. Kzg.Kzg.blobToKzgCommitment and Blobs.toVersionedHashes remain for transaction versioned-hash derivation.
    • Removed TxEnvelopeEip4844.sidecars (the legacy "network wrapper" RLP form for eth_sendRawTransaction). PeerDAS replaces the network wrapper with cell/column propagation; the on-chain envelope is unchanged.

  • #231 40d9408 Thanks @​jxom! - Migrated ECDSA and BLS coordinate fields (r, s, x, y, BLS Fp/Fp2) from bigint to padded Hex.Hex strings (32-byte for secp256k1/P256/WebAuthnP256, 48-byte for BLS12-381) on Signature, PublicKey, BlsPoint, Transaction, Authorization, TxEnvelope, and related Tempo and ERC envelopes, dropping the bigintType generic.

    - Signature.from({ r: 0x6e10...n, s: 0x4a90...n, yParity: 1 })
+ Signature.from({

... (truncated)

Commits
Attestation changes

This version has no provenance attestation, while the previous version (0.14.30) was attested. Review the package versions before updating.


Updates posthog-js from 1.396.4 to 1.400.0

Release notes

Sourced from posthog-js's releases.

[email protected]

1.400.0

Minor Changes

  • #4101 dc2aa5b Thanks @​posthog! - Normalize the error tracking rate-limiter config to first-class options. The browser SDK now reads exceptionRateLimiterRefillRate / exceptionRateLimiterBucketSize on error_tracking, with the previous double-underscore __exceptionRateLimiterRefillRate / __exceptionRateLimiterBucketSize options deprecated but still honoured as a fallback. The option shape (ExceptionRateLimiterConfig) and default-resolution logic (resolveExceptionRateLimiterConfig) now live in @posthog/core and are shared between the browser and Node SDKs. (2026-07-14)

Patch Changes

  • #4140 1eabd30 Thanks @​turnipdabeets! - Handle sendBeacon quota rejections instead of silently dropping events. A beacon rejected by the browser (over the page's shared ~64KiB in-flight keepalive quota) is now split in half and re-sent recursively so the batch delivers as far as the quota allows; a rejected payload that cannot be split falls back to a non-keepalive fetch and logs a warning. Previously the boolean return of sendBeacon was ignored and an over-quota unload batch was lost with no signal. (2026-07-14)
  • Updated dependencies [dc2aa5b]:
    • @​posthog/core@​1.41.0
    • @​posthog/types@​1.394.0

[email protected]

1.399.5

Patch Changes

  • #4134 ab10064 Thanks @​posthog! - Bound autocapture's DOM ancestor walks against abnormal host-page DOM trees. autocapturePropertiesForElement and shouldCaptureElement now stop climbing the parentNode chain after 1000 ancestors or if they revisit a node (only possible when a page patches parentNode, since native DOMs cannot contain cycles), instead of walking indefinitely. When shouldCaptureElement cannot finish checking ancestors for ph-no-capture/ph-sensitive, it fails closed and reports the element as not capturable. Behavior on normal DOM trees is unchanged. (2026-07-14)

  • #4141 17d956c Thanks @​posthog! - Log network-level fetch failures from posthog-js's own request layer (ad blocker, dropped connection, CORS, page teardown) at warn instead of error. The browser rejects these with a generic TypeError (Failed to fetch, Firefox's NetworkError..., or Safari's Load failed); they are already caught and retried by the request queue, so they are expected noise rather than SDK errors — _fetch now gives them the same warn treatment as our own timeout aborts. Genuine, unexpected errors still log at error. (2026-07-14)

[email protected]

1.399.4

Patch Changes

  • #4139 7c339be Thanks @​turnipdabeets! - Encode uncompressed sendBeacon bodies as base64 form data so the beacon keeps a CORS-simple content type. Previously an uncompressed unload beacon was sent as application/json, which forces a CORS preflight — a preflight cannot complete while the page unloads, so on cross-origin hosts the browser silently dropped the POST and the final batch of events was lost. Compression is inactive whenever the remote config request fails (flaky network, blocked endpoint), when the config response omits supportedCompression, or with disable_compression: true. (2026-07-13)

[email protected]

1.399.3

Patch Changes

  • #4133 4ebb618 Thanks @​mikenicholls88! - Make jsonStringify circular-safe so event serialization never throws. Previously a captured property holding a circular value — most commonly a DOM node that retains a React fiber pointing back at the element — made JSON.stringify throw Converting circular structure to JSON; with capture_exceptions enabled that throw was recaptured as a new $exception, at times in a loop. On a throw we now fall back to safeJsonStringify from @posthog/core. The fast (non-circular) path is unchanged, and only true cycles become "[Circular]", so shared-but-acyclic references keep their real values. (2026-07-13)

[email protected]

1.399.2

Patch Changes

  • #4118 f630394 Thanks @​posthog! - Fix a RangeError: Maximum call stack size exceeded originating from the shared rrweb patch() helper. It patches shared globals such as Element.prototype.attachShadow (shadow-dom-manager) and the DOM/canvas observers, so multiple recorder instances or repeated start/stop cycles wrap the same global more than once. Previously an out-of-order restore silently no-op'd, leaving the wrapper in the call path; repeated cycles grew the wrapper chain without bound until a real call walked a chain deep enough to overflow the stack. Wrappers now delegate through a mutable per-layer link so any layer can be torn down even when newer wrappers sit on top of it, keeping the chain bounded. Recording behavior is unchanged. This applies the same fix as #4063 (fetch/XHR) to the shared helper so every rrweb-record caller inherits the bounded-chain behavior. (2026-07-10)

... (truncated)

Commits
  • d35f5f1 chore: update versions and lockfile [version bump]
  • dc2aa5b feat(error-tracking): first-class exception rate-limiter config shared across...
  • 629e6c4 chore: delete eslint-disable comments that suppress nothing (#4146)
  • 1eabd30 fix(browser): split over-quota beacons and fall back to fetch instead of drop...
  • e1ed828 chore: add SessionStart hook to point SSH_AUTH_SOCK at Secretive for commit s...
  • b5db955 fix(react-native): reword nativeCrashes macOS floor so public API references ...
  • 8cec061 chore: update versions and lockfile [version bump]
  • 17d956c fix(browser): log benign network-level fetch failures at warn, not error (#4141)
  • ab10064 fix(autocapture): bound DOM ancestor walks and fail closed on abnormal trees ...
  • bc0e563 chore: update versions and lockfile [version bump]
  • Additional commits viewable in compare view

Updates posthog-node from 5.39.2 to 5.42.0

Release notes

Sourced from posthog-node's releases.

[email protected]

5.42.0

Minor Changes

  • #4101 dc2aa5b Thanks @​posthog! - Expose the error tracking rate-limiter config via the new exceptionRateLimiterRefillRate and exceptionRateLimiterBucketSize options. Burst protection is scoped per exception type (each distinct $exception type gets its own token bucket, with no aggregate cap across types), so these let customers with high-cardinality exception types tune the per-type allowance. (2026-07-14)

Patch Changes

  • Updated dependencies [dc2aa5b]:
    • @​posthog/core@​1.41.0

[email protected]

5.41.0

Minor Changes

  • #4105 203284a Thanks @​eli-r-ph! - Add opt-in Capture V1 support. Set the POSTHOG_CAPTURE_MODE=v1 environment variable to submit analytics events to the Capture V1 endpoint (/i/v1/analytics/events) instead of the legacy /batch/ endpoint, on both the batched and immediate send paths. The default remains v0, so existing behavior is unchanged unless you opt in. Opt-in is env-var-only during the transition (no public option), so nothing on the API surface has to be removed when v1 later becomes the default.

    Capture V1 uses Bearer auth, lifts legacy $-sentinel properties into a typed options object, and does per-event partial retry with exponential backoff clamped against Retry-After. Dropped and undelivered events are surfaced on the client error channel as a CaptureV1Error. $ai_* events continue to use the legacy submitter for now, regardless of the capture mode.

    In v1 mode, $ai_* events are routed to an isolated in-memory queue and flushed independently of the Capture V1 queue, so the two transports never share a batch and a failure on one cannot re-send events already accepted on the other. Each queue keeps its own retry/durability semantics: the legacy queue re-queues on network failure (retrying on later flushes), while the V1 queue exhausts the sender's own attempt budget per cycle and then surfaces the failure rather than re-queuing. (2026-07-11)

Patch Changes

  • Updated dependencies [203284a]:
    • @​posthog/core@​1.40.2

[email protected]

5.40.0

Minor Changes

  • #4060 0b49a4c Thanks @​turnipdabeets! - Add secretKey config as the canonical alias for the deprecated personalApiKey (accepts a Personal API Key or Project Secret API Key). (2026-07-07)

[email protected]

5.39.4

Patch Changes

[email protected]

5.39.3

... (truncated)

Changelog

Sourced from posthog-node's changelog.

5.42.0

Minor Changes

  • #4101 dc2aa5b Thanks @​posthog! - Expose the error tracking rate-limiter config via the new exceptionRateLimiterRefillRate and exceptionRateLimiterBucketSize options. Burst protection is scoped per exception type (each distinct $exception type gets its own token bucket, with no aggregate cap across types), so these let customers with high-cardinality exception types tune the per-type allowance. (2026-07-14)

Patch Changes

  • Updated dependencies [dc2aa5b]:
    • @​posthog/core@​1.41.0

5.41.0

Minor Changes

  • #4105 203284a Thanks @​eli-r-ph! - Add opt-in Capture V1 support. Set the POSTHOG_CAPTURE_MODE=v1 environment variable to submit analytics events to the Capture V1 endpoint (/i/v1/analytics/events) instead of the legacy /batch/ endpoint, on both the batched and immediate send paths. The default remains v0, so existing behavior is unchanged unless you opt in. Opt-in is env-var-only during the transition (no public option), so nothing on the API surface has to be removed when v1 later becomes the default.

    Capture V1 uses Bearer auth, lifts legacy $-sentinel properties into a typed options object, and does per-event partial retry with exponential backoff clamped against Retry-After. Dropped and undelivered events are surfaced on the client error channel as a CaptureV1Error. $ai_* events continue to use the legacy submitter for now, regardless of the capture mode.

    In v1 mode, $ai_* events are routed to an isolated in-memory queue and flushed independently of the Capture V1 queue, so the two transports never share a batch and a failure on one cannot re-send events already accepted on the other. Each queue keeps its own retry/durability semantics: the legacy queue re-queues on network failure (retrying on later flushes), while the V1 queue exhausts the sender's own attempt budget per cycle and then surfaces the failure rather than re-queuing. (2026-07-11)

Patch Changes

  • Updated dependencies [203284a]:
    • @​posthog/core@​1.40.2

5.40.0

Minor Changes

  • #4060 0b49a4c Thanks @​turnipdabeets! - Add secretKey config as the canonical alias for the deprecated personalApiKey (accepts a Personal API Key or Project Secret API Key). (2026-07-07)

5.39.4

Patch Changes

5.39.3

Patch Changes

  • #4055 64e04ba Thanks @​marandaneto! - Retry /flags requests that receive HTTP 502 or 504 responses across SDKs that use the shared core flags client. (2026-07-02)
  • Updated dependencies [64e04ba]:

... (truncated)

Commits
  • d35f5f1 chore: update versions and lockfile [version bump]
  • dc2aa5b feat(err...

    Description has been truncated

@dependabot
chore(deps): bump the production group across 1 directory with 15 upd…
e61fe22 
…ates

Bumps the production group with 15 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@iconify-json/lucide](https://github.com/iconify/icon-sets) | `1.2.115` | `1.2.117` |
| [@iconify-json/simple-icons](https://github.com/iconify/icon-sets) | `1.2.88` | `1.2.90` |
| [@shikijs/rehype](https://github.com/shikijs/shiki/tree/HEAD/packages/rehype) | `4.3.0` | `4.3.1` |
| [@wagmi/core](https://github.com/wevm/wagmi/tree/HEAD/packages/core) | `3.5.4` | `3.6.1` |
| [accounts](https://github.com/tempoxyz/accounts) | `0.14.11` | `0.15.2` |
| [cva](https://github.com/joe-bell/cva) | `1.0.0-beta.4` | `1.0.0-beta.7` |
| [hono](https://github.com/honojs/hono) | `4.12.27` | `4.12.30` |
| [ox](https://github.com/wevm/ox) | `0.14.30` | `1.0.0` |
| [posthog-js](https://github.com/PostHog/posthog-js) | `1.396.4` | `1.400.0` |
| [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.39.2` | `5.42.0` |
| [prool](https://github.com/wevm/prool) | `0.2.4` | `0.2.8` |
| [shiki](https://github.com/shikijs/shiki/tree/HEAD/packages/shiki) | `4.3.0` | `4.3.1` |
| tapimo | `0.4.0` | `0.4.1` |
| [viem](https://github.com/wevm/viem) | `2.54.6` | `2.55.2` |
| [wagmi](https://github.com/wevm/wagmi/tree/HEAD/packages/react) | `3.6.20` | `3.7.1` |



Updates `@iconify-json/lucide` from 1.2.115 to 1.2.117
- [Commits](https://github.com/iconify/icon-sets/commits)

Updates `@iconify-json/simple-icons` from 1.2.88 to 1.2.90
- [Commits](https://github.com/iconify/icon-sets/commits)

Updates `@shikijs/rehype` from 4.3.0 to 4.3.1
- [Release notes](https://github.com/shikijs/shiki/releases)
- [Commits](https://github.com/shikijs/shiki/commits/v4.3.1/packages/rehype)

Updates `@wagmi/core` from 3.5.4 to 3.6.1
- [Release notes](https://github.com/wevm/wagmi/releases)
- [Changelog](https://github.com/wevm/wagmi/blob/main/packages/core/CHANGELOG.md)
- [Commits](https://github.com/wevm/wagmi/commits/@wagmi/[email protected]/packages/core)

Updates `accounts` from 0.14.11 to 0.15.2
- [Release notes](https://github.com/tempoxyz/accounts/releases)
- [Changelog](https://github.com/tempoxyz/accounts/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tempoxyz/accounts/compare/[email protected]@0.15.2)

Updates `cva` from 1.0.0-beta.4 to 1.0.0-beta.7
- [Release notes](https://github.com/joe-bell/cva/releases)
- [Commits](joe-bell/cva@v1.0.0-beta.4...v1.0.0-beta.7)

Updates `hono` from 4.12.27 to 4.12.30
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.27...v4.12.30)

Updates `ox` from 0.14.30 to 1.0.0
- [Release notes](https://github.com/wevm/ox/releases)
- [Changelog](https://github.com/wevm/ox/blob/main/CHANGELOG.md)
- [Commits](https://github.com/wevm/ox/compare/[email protected]@1.0.0)

Updates `posthog-js` from 1.396.4 to 1.400.0
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/compare/[email protected]@1.400.0)

Updates `posthog-node` from 5.39.2 to 5.42.0
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/commits/[email protected]/packages/node)

Updates `prool` from 0.2.4 to 0.2.8
- [Release notes](https://github.com/wevm/prool/releases)
- [Changelog](https://github.com/wevm/prool/blob/main/CHANGELOG.md)
- [Commits](wevm/prool@v0.2.4...v0.2.8)

Updates `shiki` from 4.3.0 to 4.3.1
- [Release notes](https://github.com/shikijs/shiki/releases)
- [Commits](https://github.com/shikijs/shiki/commits/v4.3.1/packages/shiki)

Updates `tapimo` from 0.4.0 to 0.4.1

Updates `viem` from 2.54.6 to 2.55.2
- [Release notes](https://github.com/wevm/viem/releases)
- [Commits](https://github.com/wevm/viem/compare/[email protected]@2.55.2)

Updates `wagmi` from 3.6.20 to 3.7.1
- [Release notes](https://github.com/wevm/wagmi/releases)
- [Changelog](https://github.com/wevm/wagmi/blob/main/packages/react/CHANGELOG.md)
- [Commits](https://github.com/wevm/wagmi/commits/[email protected]/packages/react)

---
updated-dependencies:
- dependency-name: "@iconify-json/lucide"
  dependency-version: 1.2.117
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: "@iconify-json/simple-icons"
  dependency-version: 1.2.90
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: "@shikijs/rehype"
  dependency-version: 4.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: "@wagmi/core"
  dependency-version: 3.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: accounts
  dependency-version: 0.15.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: cva
  dependency-version: 1.0.0-beta.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: hono
  dependency-version: 4.12.30
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: ox
  dependency-version: 1.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production
- dependency-name: posthog-js
  dependency-version: 1.400.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: posthog-node
  dependency-version: 5.42.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: prool
  dependency-version: 0.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: shiki
  dependency-version: 4.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: tapimo
  dependency-version: 0.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: viem
  dependency-version: 2.55.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: wagmi
  dependency-version: 3.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 21, 2026
@vercel

vercel Bot commented Jul 21, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
tempo-docs Error Error Jul 21, 2026 5:03pm

Request Review

@dependabot @github

dependabot Bot commented on behalf of github Jul 24, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Jul 24, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/production-037c581649 branch July 24, 2026 03:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants