Bump the production-dependencies group across 1 directory with 6 updates

[dependabot]

Bumps the production-dependencies group with 6 updates in the / directory:

Package	From	To
@nanostores/persistent	1.3.4	1.3.5
@xyflow/react	12.11.1	12.11.2
nanostores	1.3.0	1.4.1
query-string	9.4.0	9.4.1
react	19.2.7	19.2.8
react-dom	19.2.7	19.2.8

Updates @nanostores/persistent from 1.3.4 to 1.3.5

Release notes

Sourced from @​nanostores/persistent's releases.

1.3.5

• Fix removed keys in persistent map restoration (by @​rajanpanth).

Changelog

Sourced from @​nanostores/persistent's changelog.

1.3.5

• Fix removed keys in persistent map restoration (by @​rajanpanth).

Commits

• 5a3f307 Release 1.3.5 version
• d575fd4 Update dependencies
• 50b8de2 Move to pnpm 11 and new publish system
• 0945f7f Add public Dev Container
• ae10cec Merge pull request #73 from rajanpanth/fix/restore-removed-map-keys
• 34c02f7 Fix removed keys in persistent map restoration
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​nanostores/persistent since your current version.

Updates @xyflow/react from 12.11.1 to 12.11.2

Release notes

Sourced from @​xyflow/react's releases.

@​xyflow/react@​12.11.2

Patch Changes

• #5825 5072914 - Only create an XYDrag instance for draggable nodes.

• #5847 742860c - Stop the MiniMap from re-rendering on every store update.

• #5846 17c64a1 - Apply the viewport pan/zoom transform imperatively so the Viewport component only renders once.

• Updated dependencies [c707267, 0c0cebc, 56cf3b0, a01bb6b, 9b3f390, cdfcbeb]:

  • @​xyflow/system@​0.0.79

Changelog

Sourced from @​xyflow/react's changelog.

12.11.2

Patch Changes

• #5825 5072914 - Only create an XYDrag instance for draggable nodes.

• #5847 742860c - Stop the MiniMap from re-rendering on every store update.

• #5846 17c64a1 - Apply the viewport pan/zoom transform imperatively so the Viewport component only renders once.

• Updated dependencies [c707267, 0c0cebc, 56cf3b0, a01bb6b, 9b3f390, cdfcbeb]:

  • @​xyflow/system@​0.0.79

Commits

• 3ab66ef chore(packages): bump
• 01d58b6 Merge pull request #5846 from AlaricBaraou/perf/viewport-imperative-transform
• 742860c perf(react): skip minimap re-renders when its geometry is unchanged
• 17c64a1 perf(react): apply the viewport transform imperatively instead of re-renderin...
• 775bdd6 Merge pull request #5825 from AlaricBaraou/perf/xydrag-draggable-only
• 576a43d refactor(react): pass nodesDraggable to prevent wrong initial state
• 5072914 perf(react): only create an XYDrag instance for draggable nodes
• See full diff in compare view

Updates nanostores from 1.3.0 to 1.4.1

Release notes

Sourced from nanostores's releases.

1.4.1

• Fixed task() for synchronous callbacks (by @​rajanpanth).
• Fixed docs (by @​maxtaran2010 & @​VdustR).

1.4.0

• Added batch to run one re-render on many stores changes (by @​psd-coder).
• Added listening base key for nested mutation to listenKeys (by @​ifo123).
• Fixed getPath throwing on null intermediate values (by @​chatman-media).
• Fixed listenKeys on the whole set changes (by @​LeSingh1).
• Fixed resetting computed cache on cleanStores (by @​ATOM00blue).

Changelog

Sourced from nanostores's changelog.

1.4.1

• Fixed task() for synchronous callbacks (by @​rajanpanth).
• Fixed docs (by @​maxtaran2010 & @​VdustR).

1.4.0

• Added batch to run one re-render on many stores changes (by @​psd-coder).
• Added listening base key for nested mutation to listenKeys (by @​ifo123).
• Fixed getPath throwing on null intermediate values (by @​chatman-media).
• Fixed listenKeys on the whole set changes (by @​LeSingh1).
• Fixed resetting computed cache on cleanStores (by @​ATOM00blue).

Commits

• 241cb14 Release 1.4.1 version
• 99cc97f Update dependencies
• 82592e1 Fix synchronous task callbacks (#411)
• 7d2b6e0 Remove now unnecessary notice
• 5138d72 fix: correct JSDoc typos in path.d.ts (#410)
• 75be13f Update dependencies
• 9e7571f Clean up
• e0bb5c5 docs: add storage and dataLayer integrations (#409)
• b84e734 Fix Node.js 20 on CI
• 25d59ac Typo
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nanostores since your current version.

Updates query-string from 9.4.0 to 9.4.1

Release notes

Sourced from query-string's releases.

v9.4.1

• Fix relative URLs with fragments 872fb6f

---

sindresorhus/query-string@v9.4.0...v9.4.1

Commits

• c69443c 9.4.1
• 872fb6f Fix relative URLs with fragments
• f5daa07 Create security.md
• See full diff in compare view

Updates react from 19.2.7 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• See full diff in compare view

Updates react-dom from 19.2.7 to 19.2.8

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• See full diff in compare view

[bgentry]

Security gate: clear. Compatibility gate: clear.

Reviewed head 8126c159e5d4fdd36c3e79907340c6bc07c7e665.

The lockfile changes only the intended six direct production packages and
one Xyflow transitive package. All old and new tarballs match their lockfile
SHA-512 values and registry metadata. The package graph adds or removes
nothing and introduces no lifecycle hooks, bins, native/platform payloads,
non-registry sources, weak integrity, or same-version integrity churn.
Artifact/source diffs contain no unexpected network, credential, filesystem,
process, dynamic-evaluation, or install-time behavior. Publishers, licenses,
and source repositories remain consistent; trusted-publishing provenance
improves for Nano Stores.

The production audit is clean. React 19.2.8 shares a release with a Server
Functions security fix, but the affected react-server-dom-* packages are
absent from this lockfile, so this group is not itself a confirmed security
remediation.

On the exact head, npm ci, registry signature/provenance audit, lint, all
229 tests, the application build, and the Storybook build pass. CI's JS,
Go, release, and public-image paths also pass. The Pro image failure is the
repository-wide Dependabot AWS OIDC authorization failure, not behavior
introduced by these package updates.

Residual risk is limited to generated/minified Xyflow and React artifacts,
Query String's unchanged lack of provenance attestation, and the usual gap
from not independently reproducing generated upstream builds.