Skip to content

Javascript dependency: Bump the web-javascript-minor-and-patch group across 1 directory with 9 updates - #10711

Closed
dependabot[bot] wants to merge 3 commits into
masterfrom
dependabot/npm_and_yarn/web/web-javascript-minor-and-patch-cd61f3ac81
Closed

Javascript dependency: Bump the web-javascript-minor-and-patch group across 1 directory with 9 updates#10711
dependabot[bot] wants to merge 3 commits into
masterfrom
dependabot/npm_and_yarn/web/web-javascript-minor-and-patch-cd61f3ac81

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 30, 2026

Copy link
Copy Markdown
Contributor

Bumps the web-javascript-minor-and-patch group with 9 updates in the /web directory:

Package From To
@tanstack/react-query 5.104.5 5.105.0
@tanstack/react-virtual 3.14.13 3.14.23
axios 1.20.0 1.21.0
chart.js 4.5.1 4.6.1
marked 18.0.14 18.1.2
autoprefixer 10.6.1 10.6.2
postcss 8.5.31 8.5.32
typescript-eslint 8.72.0 8.72.1
webpack 5.112.0 5.112.2

Updates @tanstack/react-query from 5.104.5 to 5.105.0

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.105.0

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.105.0
    • @​tanstack/react-query@​5.105.0

@​tanstack/react-query-next-experimental@​5.105.0

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.105.0

@​tanstack/react-query-persist-client@​5.105.0

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-persist-client-core@​5.105.0
    • @​tanstack/react-query@​5.105.0

@​tanstack/react-query@​5.105.0

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.105.0
Changelog

Sourced from @​tanstack/react-query's changelog.

5.105.0

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.105.0
Commits
  • 5cc606e ci: Version Packages (#12301)
  • 14cc330 style(packages): write durations in 'count * unit * 1000' order (#12382)
  • d7c0418 chore(react-query/{useQuery,useInfiniteQuery}): remove the unused '@​eslint-re...
  • aa3e26b chore(react-query/{HydrationBoundary,utils}): explain why 'react-hooks-js/ref...
  • b2801aa test(react-query/useMutation): assert that the mutation settles in the cache ...
  • 43636c4 test(react-query/useMutation): wait for the mutation to settle after unmount ...
  • 1eed9d9 chore(*): explain why 'vitest-js/valid-expect' is disabled for the 'expectTyp...
  • 6bdeb13 test(*/useQuery): rename the 'throwOnError' callback parameter to 'err' to av...
  • 86b9f20 test(*/useMutationState): rename the built 'mutation' to 'existingMutation' t...
  • d09972b test(*): rename the 'queryKey' test helper to 'createKey' since it creates ke...
  • Additional commits viewable in compare view

Updates @tanstack/react-virtual from 3.14.13 to 3.14.23

Release notes

Sourced from @​tanstack/react-virtual's releases.

@​tanstack/react-virtual@​3.14.23

Patch Changes

  • Updated dependencies [2343004]:
    • @​tanstack/virtual-core@​3.19.8

@​tanstack/react-virtual@​3.14.22

Patch Changes

@​tanstack/react-virtual@​3.14.21

Patch Changes

  • Updated dependencies [05bb4d3]:
    • @​tanstack/virtual-core@​3.19.6

@​tanstack/react-virtual@​3.14.20

Patch Changes

@​tanstack/react-virtual@​3.14.19

Patch Changes

  • Updated dependencies [269e8ed]:
    • @​tanstack/virtual-core@​3.19.4

@​tanstack/react-virtual@​3.14.18

Patch Changes

  • Updated dependencies [f211d3a]:
    • @​tanstack/virtual-core@​3.19.3

@​tanstack/react-virtual@​3.14.17

Patch Changes

@​tanstack/react-virtual@​3.14.16

Patch Changes

@​tanstack/react-virtual@​3.14.15

Patch Changes

... (truncated)

Changelog

Sourced from @​tanstack/react-virtual's changelog.

3.14.23

Patch Changes

  • Updated dependencies [2343004]:
    • @​tanstack/virtual-core@​3.19.8

3.14.22

Patch Changes

3.14.21

Patch Changes

  • Updated dependencies [05bb4d3]:
    • @​tanstack/virtual-core@​3.19.6

3.14.20

Patch Changes

3.14.19

Patch Changes

  • Updated dependencies [269e8ed]:
    • @​tanstack/virtual-core@​3.19.4

3.14.18

Patch Changes

  • Updated dependencies [f211d3a]:
    • @​tanstack/virtual-core@​3.19.3

3.14.17

Patch Changes

3.14.16

... (truncated)

Commits

Updates axios from 1.20.0 to 1.21.0

Release notes

Sourced from axios's releases.

v1.21.0 — October 21, 2026

This release adds response timing and opt-in UTF-8 Basic authentication, improves request handling across runtimes, and changes how header defaults are recognized.

⚠️ Breaking Changes & Deprecations

  • Header Defaults: Only plain objects, null-prototype maps, and compatible AxiosHeaders instances are treated as common or method-specific defaults; literal headers such as Link are now preserved. Applications using custom class instances as defaults must convert them to plain maps, for example { post: { ...customDefaults } }, or compatible AxiosHeaders. Otherwise, those instances become literal header values, including on requests using other methods. (#11156)

🚀 New Features

  • Response Timing: Added response.duration, in milliseconds, including on error.response when present. Timing measures adapter execution and excludes interceptors and transforms; streamed responses stop timing when the stream becomes available. Axios replaces any existing duration value supplied by a custom adapter. (#11214)
  • UTF-8 Basic Authentication: Added transitional.encodeBasicAuthUsername: true to support Unicode usernames in XHR and Fetch requests. The option defaults to false, preserving existing authentication behavior; applications opting in should supply the original Unicode username and remove manual pre-encoding workarounds. (#11159)

🐛 Bug Fixes

  • Fetch Compatibility: Restored requests in runtimes such as Cloudflare Workers that reject the implicit cache: 'default', while preserving explicit caller settings. Response-size failures now retain their original ERR_BAD_RESPONSE and request context when runtime wrappers replace the underlying stream error. (#11194, #11179)
  • Runtime Consistency: Aligned encoded-byte size accounting, multipart uploads, proxy routing, same-origin resolution, parameter merging, and form serialization across adapters. Circular parameters now reject with ERR_BAD_OPTION_VALUE, and sparse or non-index numeric form fields serialize as keyed objects. With proxy: false, native proxyEnv agents using unsupported pool-management or TLS-session lifecycle overrides now reject with ERR_BAD_OPTION_VALUE; construct those agents without proxyEnv. (#11242)
  • Header Handling: Preserved headers named __proto__ using safe casing without changing the AxiosHeaders instance prototype. Function matchers in has(), delete(), and clear() now receive the headers instance as this, matching their declared contract. (#11134, #11216)
  • URL and Data URL Parsing: Accepted case-insensitive supported URL schemes and Base64 markers, and corrected decoding of percent-encoded Base64 data URLs. Node data URL allocation estimates remain aligned with decoding so configured size limits apply before allocation. (#11138, #11163, #11294)
  • Error Diagnostics: Preserved short reconstructed request stacks and appended wrapped error stacks under Caused by: so tooling that reads only error.stack retains the original failure context. (#11132, #11142)
  • Interceptor Removal: Restored removal through canonical numeric-string interceptor IDs, including after registry compaction. (#11139)
  • Proxy TLS: HTTPS CONNECT tunnels now apply current origin TLS options from an explicit httpsAgent, or from https.globalAgent when no explicit agent is supplied. This preserves process-wide custom CA settings through proxy tunnels. (#11178)
  • XHR Lifecycle: Used asynchronous Cookie Store reads for XSRF tokens where supported, preserving cookie fallback, timeout accounting, and cancellation. Upload and download progress listeners are now removed on completion, failure, timeout, and cancellation. (#11166, #11225)
  • HTTP/2 Sessions: Stopped reusing sessions immediately after GOAWAY and prevented draining sessions from scheduling idle timers that could delay process exit. (#11210)
  • TypeScript Declarations: Exposed the response-default marker as a public type to resolve TS2527 when consumers emit declarations involving unresolved response generics, covering both ESM and CommonJS. (#11125)

🔧 Maintenance & Chores

  • Configuration Performance: Reduced request configuration merge overhead, particularly for requests with many headers, while preserving merge semantics and prototype-pollution guards. (#11208)
  • Same-Origin Checks: Removed obsolete Internet Explorer detection without changing origin decisions in supported environments. (#11174)
  • Dependencies: Updated follow-redirects to 1.16.1 and refreshed development, documentation, test, and GitHub Actions dependencies. Removed unused dayjs from the docs package, root chalk, and chai from CJS module tests. (#11169, #11188, #11189, #11195, #11212, #11213, #11218, #11220, #11221, #11230, #11234, #11244, #11245, #11266, #11267, #11268, #11269, #11270, #11271, #11272, #11298, #11302, #11303, #11304, #11305, #11306, #11313, #11321, #11322, #11323, #11342)
  • Documentation: Fixed interceptor test links, updated README CDN examples to the published 1.20.0 bundle, and corrected guidance on interceptor options and request lifecycle ordering. (#11228, #11149, #11335)
  • Contributor Workflow: Consolidated agent instructions in AGENTS.md, standardized PR labels, required prerelease notes and validation evidence, and clarified that npm test requires installed Playwright browsers. (#11238, #11273, #11223, #11284)
  • Sponsors and Support: Added HeroDevs, Code for Japan, and Sweepico sponsor listings, refreshed sponsor data, and documented extended security support for Axios v0. (#11222, #11249, #11252, #11341)
  • Proxy Regression Coverage: Added a long dotted request-hostname test for NO_PROXY handling, extending coverage of an existing denial-of-service fix. (#11235)
  • Release Preparation: Updated package version metadata for 1.21.0. (#11346)

🌟 New Contributors

Welcome to our 24 new contributors. Thank you for helping improve Axios:

... (truncated)

Changelog

Sourced from axios's changelog.

v1.21.0 — October 21, 2026

This release adds response timing and opt-in UTF-8 Basic authentication, improves request handling across runtimes, and changes how header defaults are recognized.

⚠️ Breaking Changes & Deprecations

  • Header Defaults: Only plain objects, null-prototype maps, and compatible AxiosHeaders instances are treated as common or method-specific defaults; literal headers such as Link are now preserved. Applications using custom class instances as defaults must convert them to plain maps, for example { post: { ...customDefaults } }, or compatible AxiosHeaders. Otherwise, those instances become literal header values, including on requests using other methods. (#11156)

🚀 New Features

  • Response Timing: Added response.duration, in milliseconds, including on error.response when present. Timing measures adapter execution and excludes interceptors and transforms; streamed responses stop timing when the stream becomes available. Axios replaces any existing duration value supplied by a custom adapter. (#11214)
  • UTF-8 Basic Authentication: Added transitional.encodeBasicAuthUsername: true to support Unicode usernames in XHR and Fetch requests. The option defaults to false, preserving existing authentication behavior; applications opting in should supply the original Unicode username and remove manual pre-encoding workarounds. (#11159)

🐛 Bug Fixes

  • Fetch Compatibility: Restored requests in runtimes such as Cloudflare Workers that reject the implicit cache: 'default', while preserving explicit caller settings. Response-size failures now retain their original ERR_BAD_RESPONSE and request context when runtime wrappers replace the underlying stream error. (#11194, #11179)
  • Runtime Consistency: Aligned encoded-byte size accounting, multipart uploads, proxy routing, same-origin resolution, parameter merging, and form serialization across adapters. Circular parameters now reject with ERR_BAD_OPTION_VALUE, and sparse or non-index numeric form fields serialize as keyed objects. With proxy: false, native proxyEnv agents using unsupported pool-management or TLS-session lifecycle overrides now reject with ERR_BAD_OPTION_VALUE; construct those agents without proxyEnv. (#11242)
  • Header Handling: Preserved headers named __proto__ using safe casing without changing the AxiosHeaders instance prototype. Function matchers in has(), delete(), and clear() now receive the headers instance as this, matching their declared contract. (#11134, #11216)
  • URL and Data URL Parsing: Accepted case-insensitive supported URL schemes and Base64 markers, and corrected decoding of percent-encoded Base64 data URLs. Node data URL allocation estimates remain aligned with decoding so configured size limits apply before allocation. (#11138, #11163, #11294)
  • Error Diagnostics: Preserved short reconstructed request stacks and appended wrapped error stacks under Caused by: so tooling that reads only error.stack retains the original failure context. (#11132, #11142)
  • Interceptor Removal: Restored removal through canonical numeric-string interceptor IDs, including after registry compaction. (#11139)
  • Proxy TLS: HTTPS CONNECT tunnels now apply current origin TLS options from an explicit httpsAgent, or from https.globalAgent when no explicit agent is supplied. This preserves process-wide custom CA settings through proxy tunnels. (#11178)
  • XHR Lifecycle: Used asynchronous Cookie Store reads for XSRF tokens where supported, preserving cookie fallback, timeout accounting, and cancellation. Upload and download progress listeners are now removed on completion, failure, timeout, and cancellation. (#11166, #11225)
  • HTTP/2 Sessions: Stopped reusing sessions immediately after GOAWAY and prevented draining sessions from scheduling idle timers that could delay process exit. (#11210)
  • TypeScript Declarations: Exposed the response-default marker as a public type to resolve TS2527 when consumers emit declarations involving unresolved response generics, covering both ESM and CommonJS. (#11125)

🔧 Maintenance & Chores

  • Configuration Performance: Reduced request configuration merge overhead, particularly for requests with many headers, while preserving merge semantics and prototype-pollution guards. (#11208)
  • Same-Origin Checks: Removed obsolete Internet Explorer detection without changing origin decisions in supported environments. (#11174)
  • Dependencies: Updated follow-redirects to 1.16.1 and refreshed development, documentation, test, and GitHub Actions dependencies. Removed unused dayjs from the docs package, root chalk, and chai from CJS module tests. (#11169, #11188, #11189, #11195, #11212, #11213, #11218, #11220, #11221, #11230, #11234, #11244, #11245, #11266, #11267, #11268, #11269, #11270, #11271, #11272, #11298, #11302, #11303, #11304, #11305, #11306, #11313, #11321, #11322, #11323, #11342)
  • Documentation: Fixed interceptor test links, updated README CDN examples to the published 1.20.0 bundle, and corrected guidance on interceptor options and request lifecycle ordering. (#11228, #11149, #11335)
  • Contributor Workflow: Consolidated agent instructions in AGENTS.md, standardized PR labels, required prerelease notes and validation evidence, and clarified that npm test requires installed Playwright browsers. (#11238, #11273, #11223, #11284)
  • Sponsors and Support: Added HeroDevs, Code for Japan, and Sweepico sponsor listings, refreshed sponsor data, and documented extended security support for Axios v0. (#11222, #11249, #11252, #11341)
  • Proxy Regression Coverage: Added a long dotted request-hostname test for NO_PROXY handling, extending coverage of an existing denial-of-service fix. (#11235)
  • Release Preparation: Updated package version metadata for 1.21.0. (#11346)

🌟 New Contributors

Welcome to our 24 new contributors. Thank you for helping improve Axios:

... (truncated)

Commits
  • aa54a5e docs: remove cancelled sponsors from README (#11369)
  • e6b79d9 chore(release): prepare release 1.21.0 (#11346)
  • fceeb10 chore(deps-dev): bump the development_dependencies group with 4 updates (#11342)
  • 7d15df3 docs: refresh sponsor data (#11341)
  • 8d8e844 docs: correct interceptor options and request lifecycle guide (#11335)
  • 326843a test(no-proxy): cover the request-hostname path with a long dotted host (#11235)
  • e5195ec feat(core): expose request duration on the response (#11214)
  • 8d415e6 fix(headers): bind matcher callbacks to the headers instance (#11216)
  • b16dd77 fix(xhr): remove progress event listeners on request completion (#11225)
  • 790b2ca chore(deps): bump the github-actions group with 3 updates (#11323)
  • Additional commits viewable in compare view

Updates chart.js from 4.5.1 to 4.6.1

Release notes

Sourced from chart.js's releases.

v4.6.1

Essential Links

  • #12355 fix: trusted publishing fix + version 4.6.1 bump

Thanks to @​etimberg

v4.6.0

Essential Links

  • #12354 chore: version bump to 4.6.0 to prepare for release
  • #12328 test: stabilize overlapping polar-area label fixture

Enhancements

  • #12238 Corrected spacing in pie/doughnut/polarArea (Fixes #10059)
  • #12130 Enable scale title stroke (12092)

Bugs Fixed

  • #12283 filler plugin fill extends past line when offset: true + index scale min/max
  • #12155 Fix early exit from clearStacks
  • #12142 Use integer canvas dimensions

Types

  • #12321 fix(types): allow scriptable and indexed grid tick widths

Documentation

  • #12258 Add a note that axis labels can span lines
  • #12134 docs: Add note about flexbox/grid layout responsivity issue
  • #12139 Fix amount of category scales count in docs

Development

  • #12306 Bump actions/setup-node from 6 to 7
  • #12303 Bump actions/checkout from 6 to 7

... (truncated)

Commits
  • 76d8cf8 fix: trusted publishing fix + version 4.6.1 bump (#12355)
  • 4e5443d chore: version bump to 4.6.0 to prepare for release (#12354)
  • 7169e65 fix(types): allow scriptable and indexed grid tick widths (#12321)
  • 714b48c test: stabilize overlapping polar-area labels across browsers (#12328)
  • 6a86e23 Bump actions/setup-node from 6 to 7 (#12306)
  • afb3d64 Bump actions/checkout from 6 to 7 (#12303)
  • 0db976c Bump pnpm/action-setup from 4.2.0 to 6.1.0 (#12307)
  • d2ddcf9 Specify build script for compressed size (#12310)
  • b972574 filler plugin fill extends past line when offset: true + index scale min/max ...
  • 0ad783f Use node 24 for CI (#12309)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for chart.js since your current version.


Updates marked from 18.0.14 to 18.1.2

Release notes

Sourced from marked's releases.

v18.1.2

18.1.2 (2026-10-26)

Bug Fixes

  • allow a tab or end of input after a type 6 html block tag name (#4128) (e09c40d)
  • apply emphasis flanking and rules 9-10 to the whole delimiter run (#4145) (5d8e234)
  • cli: await config functions before parsing (#4138) (3a11ad1)
  • cli: create no-clobber output files atomically (#4135) (e7c4f64)
  • do not continue a block quote paragraph from a whitespace-only line (#4134) (42f34a8)
  • expand a tab after the block quote marker to the next tab stop (#4110) (2d3899b)
  • honor per-call async options when composing hooks (#4139) (379be9d)
  • keep a line starting with # but no space in the list item (#4127) (6b63189)
  • keep duplicate link definitions in the tokens (#4132) (2784acc)
  • keep lazy lines after a list in a nested blockquote (#4137) (38c7e55)
  • keep lazy setext underlines in list items as text (#4126) (398234c)
  • render nested image alt formatting as plain text (#4131) (15f59bb)
  • stop an unclosed inline raw tag from unescaping later blocks (#4130) (4562b6f)

Performance Improvements

  • ~16% faster parsing by skipping em/strong masking for runs without *, _ or ~ (#4142) (f0fd3e0)

v18.1.1

18.1.1 (2026-10-12)

Bug Fixes

  • cli: honor an explicitly empty string input (#4113) (ec3a4e5)
  • end blockquote before a lazy line after a heading, hr or html block (#4115) (9e64a6a)
  • keep a backslash in a code span from hiding emphasis (#4117) (6a57018)
  • keep a decoded character reference from forming a new one (#4111) (6bbac0c), closes #38 #112
  • let indented and type 3-5 html blocks interrupt a paragraph (#4124) (eaa1fff)
  • make walkTokens linear by appending values in place (#4121) (627d9ae), closes #4120
  • match pre, script, style and textarea as whole tag names (#4114) (0db74cb)
  • preserve enclosing link state after parsing images (#4123) (cc07bb9)
  • respect tab stops in list continuation indentation (#4119) (4bd2528)

Performance Improvements

  • avoid repeated raw string copies in nested lists (#4082) (7e8754d)

v18.1.0

18.1.0 (2026-10-05)

... (truncated)

Commits
  • 5beecae chore(release): 18.1.2 [skip ci]
  • c1e6ca1 chore(deps): update deps (#4168)
  • 3a01ac4 chore: test:redos -> test:recheck (#4167)
  • 15f59bb fix: render nested image alt formatting as plain text (#4131)
  • 2d3899b fix: expand a tab after the block quote marker to the next tab stop (#4110)
  • e09c40d fix: allow a tab or end of input after a type 6 html block tag name (#4128)
  • 398234c fix: keep lazy setext underlines in list items as text (#4126)
  • 6b63189 fix: keep a line starting with # but no space in the list item (#4127)
  • 5d8e234 fix: apply emphasis flanking and rules 9-10 to the whole delimiter run (#4145)
  • 3a11ad1 fix(cli): await config functions before parsing (#4138)
  • Additional commits viewable in compare view

Updates autoprefixer from 10.6.1 to 10.6.2

Release notes

Sourced from autoprefixer's releases.

10.6.2

  • Added /* autoprefixer: ignore next warning */ (by @​dualfroz).
  • Fixed losing unprefixed selectors in old browsers in grouping (by @​ybai08).
  • Fixed selector duplicates on multiple Autoprefixer runs.
  • Fixed case-insensitive pseudo-selector prefixing (by @​jakezwang).
  • Fixed -webkit-cross-fade() for images with numbers (by @​mkantautas).
  • Fixed source maps for Grid prefixes (by @​dualfroz).
Changelog

Sourced from autoprefixer's changelog.

10.6.2

  • Added /* autoprefixer: ignore next warning */ (by @​dualfroz).
  • Fixed losing unprefixed selectors in old browsers in grouping (by @​ybai08).
  • Fixed selector duplicates on multiple Autoprefixer runs.
  • Fixed case-insensitive pseudo-selector prefixing (by @​jakezwang).
  • Fixed -webkit-cross-fade()Description has been truncated

@dependabot dependabot Bot added the Dependencies Pull requests that update a dependency file label Oct 30, 2026
@coderabbitai

coderabbitai Bot commented Oct 30, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

dependabot Bot added 3 commits November 4, 2026 11:05
@dependabot @dpage
Javascript dependency: Bump serialize-javascript from 7.0.5 to 7.1.3 …
c2f1824 
…in /web (#10679)

Regenerates yarn.lock, which the Dependabot PR left stale; the resolution
now resolves to 7.1.4.
@dependabot @dpage
Javascript dependency: Bump eslint from 9.39.5 to 10.13.0 in /web (#1…
8e385f2 
…0671)

ESLint 10 no longer bundles @eslint/js, so it is now a direct
devDependency. @babel/eslint-parser 7 does not work with ESLint 10 and
version 8 needs Babel 8, so the lint config uses ESLint's own parser,
which handles everything the Babel parser was configured for (JSX and
class properties); @babel/eslint-parser and @babel/eslint-plugin are
removed. eslint-plugin-react has no ESLint 10 release yet, so it is
wrapped with @eslint/compat's fixupPluginRules. The two rules ESLint 10
added to eslint:recommended (no-useless-assignment, no-unassigned-vars)
are switched off for now; they flag 95 existing sites.
@dependabot @dpage
Javascript dependency: Bump the web-javascript-minor-and-patch group …
70a71ef 
…across 1 directory with 9 updates (#10711)

Bumps autoprefixer to 10.6.2, postcss to 8.5.32, typescript-eslint to
8.72.1, webpack to 5.112.2, @tanstack/react-query to 5.105.0,
@tanstack/react-virtual to 3.14.23, axios to 1.21.0, chart.js to 4.6.1
and marked to 18.1.2.

marked 18.1.2 ships class private methods, which the explicitly listed
class-properties Babel plugin trips over before preset-env runs, so add
@babel/plugin-transform-private-methods alongside it.

@tanstack/virtual-core 3.19 sizes the scroll element from clientHeight
and clientWidth rather than offsetHeight and offsetWidth, so mock those
in the Jest setup too.
@dpage
dpage force-pushed the dependabot/npm_and_yarn/web/web-javascript-minor-and-patch-cd61f3ac81 branch from b942b78 to 70a71ef Compare November 4, 2026 11:05
dpage pushed a commit that referenced this pull request Nov 4, 2026
@dependabot @dpage
Javascript dependency: Bump the web-javascript-minor-and-patch group …
dde24b4 
…across 1 directory with 9 updates (#10711)

Bumps autoprefixer to 10.6.2, postcss to 8.5.32, typescript-eslint to
8.72.1, webpack to 5.112.2, @tanstack/react-query to 5.105.0,
@tanstack/react-virtual to 3.14.23, axios to 1.21.0, chart.js to 4.6.1
and marked to 18.1.2.

marked 18.1.2 ships class private methods, which the explicitly listed
class-properties Babel plugin trips over before preset-env runs, so add
@babel/plugin-transform-private-methods alongside it.

@tanstack/virtual-core 3.19 sizes the scroll element from clientHeight
and clientWidth rather than offsetHeight and offsetWidth, so mock those
in the Jest setup too.
@dpage

dpage commented Nov 4, 2026

Copy link
Copy Markdown
Contributor

Landed as dde24b4.

@dpage dpage closed this Nov 4, 2026
@dependabot @github

dependabot Bot commented on behalf of github Nov 4, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/web/web-javascript-minor-and-patch-cd61f3ac81 branch November 4, 2026 13:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

Dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@dpage