Bump the production-dependencies group with 4 updates

[dependabot]

Bumps the production-dependencies group with 4 updates: @dagrejs/dagre, @xyflow/react, nanostores and query-string.

Updates @dagrejs/dagre from 3.0.0 to 3.1.1

Changelog

Sourced from @​dagrejs/dagre's changelog.

Changelog: dagre

All notable changes to this project will be documented in this file. This project adheres to Semantic Versioning.

[3.1.0] - 2026

New Features

• Per-Cluster Direction Support (PR #511): Each cluster/subgraph can now specify its own rankdir, ranksep, nodesep, and align settings. The layout engine recursively applies these settings, enabling complex nested cluster hierarchies with independent flow directions. Fully backward compatible with global rankdir and legacy layouts.
• Dynamic Graph Layout Support (PR #512): Added support for dynamic graph layouts via useDynamic and corePath configuration options in LayoutConfig. Enables persistent node ordering and layout stability when modifying graph structures.

Refactoring & Fixes

• TypeScript & Type Safety Improvements: Added ClusterNodeLabel and NodeCollection types, updated NodeLabel interfaces, and eliminated any type assertions across the codebase.
• Nested Cluster Fixes: Resolved edge cases in nested cluster isolation and improved edge routing for cross-cluster edges.

---

Commits

• c3ed080 Bumping the version and building for release
• dd45fd4 Merge pull request #516 from dagrejs/modules
• fc85d69 Fixing github tests
• a32accc Fixing github tests
• a35171b Setting the type module in package.json
• 63b699c Using the latest graphlib
• 2609a9e Merge pull request #515 from hmcelik/fix/layout-state-leak
• f8dddcd test: cover isolated dynamic layout state
• 62809ca fix: scope remembered layout to input graph
• a471bce Fixing the scripts and bumping the version to the next pre
• Additional commits viewable in compare view

Updates @xyflow/react from 12.11.2 to 12.11.4

Release notes

Sourced from @​xyflow/react's releases.

@​xyflow/react@​12.11.4

Patch Changes

• #5974 8c42922 - Minimap still works after ReactFlow remounts

• #5962 cbf40b9 - Show log if user hides attribution in development

• #5976 3319ef4 - Fix the MiniMap zooming out to include the origin when every node is hidden.

• #5955 965ca70 - Fix MiniMap calling useCallback conditionally for onNodeClick.

@​xyflow/react@​12.11.3

Patch Changes

• #5902 393d951 - Allow middle-mouse viewport panning to start from a selection rectangle.

• #5889 ff126a0 - Fix extent: 'parent' not immediately resolving when parent has width or initialWidth.

• #5943 d1def59 - Invoke an error if handle can not be found

• #5947 2ba040f - Use correct nodeExtent for internal setNodes.

• #5918 c5d7442 - Fix selection box appearing when dragging the pane via touch. Prefer touch panning over drag selection when selectionOnDrag is combined with mouse-button-specific panOnDrag settings.

• #5922 392da00 - Allow Control to activate pane panning with a primary-button drag.

• #5929 4c5d7d2 - Allow key combinations of three or more keys (e.g. 'Meta+Shift+s') for useKeyPress.

• #5938 91a052f - Fix <Background /> pattern offset miscalculation.

• Updated dependencies [393d951, ff126a0, e5d86bd, 392da00]:

  • @​xyflow/system@​0.0.80

Changelog

Sourced from @​xyflow/react's changelog.

12.11.4

Patch Changes

• #5974 8c42922 - Minimap still works after ReactFlow remounts

• #5962 cbf40b9 - Show log if user hides attribution in development

• #5976 3319ef4 - Fix the MiniMap zooming out to include the origin when every node is hidden.

• #5955 965ca70 - Fix MiniMap calling useCallback conditionally for onNodeClick.

12.11.3

Patch Changes

• #5902 393d951 - Allow middle-mouse viewport panning to start from a selection rectangle.

• #5889 ff126a0 - Fix extent: 'parent' not immediately resolving when parent has width or initialWidth.

• #5943 d1def59 - Invoke an error if handle can not be found

• #5947 2ba040f - Use correct nodeExtent for internal setNodes.

• #5918 c5d7442 - Fix selection box appearing when dragging the pane via touch. Prefer touch panning over drag selection when selectionOnDrag is combined with mouse-button-specific panOnDrag settings.

• #5922 392da00 - Allow Control to activate pane panning with a primary-button drag.

• #5929 4c5d7d2 - Allow key combinations of three or more keys (e.g. 'Meta+Shift+s') for useKeyPress.

... (truncated)

Commits

• 286816c chore(packages): bump
• 3319ef4 fix(react): keep minimap bounds at the viewport when all nodes are hidden
• b7186f3 fix(react): minimap still works after reactflow remounts #5971
• d8edc77 Merge pull request #5955 from Jian-Zhang08/fix/minimap-onnodeclick-conditiona...
• 59b1a60 Simplify node click handling in MiniMap component
• 25869f2 chore(system): add attr warning handler
• b04e9d1 chore(system): rename utils isDomNodeVisible
• 31535ef chore(system): add isDomNodeVisible
• bce7475 chore(proOptions): add comments
• 435123f Update index.tsx
• Additional commits viewable in compare view

Updates nanostores from 1.4.1 to 1.5.2

Release notes

Sourced from nanostores's releases.

1.5.2

• Fixed types (by @​edloidas).

1.5.1

• Fixed types (by @​edloidas).
• Fixed listenKeys when old value is not available (by @​edloidas).

1.5.0

• Added eq and eqKey for custom value comparison (by @​psd-coder).
• Fixed calling other listeners if one of them throws (by @​psd-coder).
• Fixed listenKeys deep paths on whole store set (by @​ankit1324).

1.4.2

• Fixed batch() conflict with builder (by @​psd-coder).
• Added new tools to docs (by @​firatciftci & @​alexcarpenter).

Changelog

Sourced from nanostores's changelog.

1.5.2

• Fixed types (by @​edloidas).

1.5.1

• Fixed types (by @​edloidas).
• Fixed listenKeys when old value is not available (by @​edloidas).

1.5.0

• Added eq and eqKey for custom value comparison (by @​psd-coder).
• Fixed calling other listeners if one of them throws (by @​psd-coder).
• Fixed listenKeys deep paths on whole store set (by @​ankit1324).

1.4.2

• Fixed batch() conflict with builder (by @​psd-coder).
• Added new tools to docs (by @​firatciftci & @​alexcarpenter).

Commits

• 400cbb3 Release 1.5.2 version
• 37c5e9e Update dependencies
• 9e781da Fix map key value types collapsing to never (#421)
• 77ab191 Release 1.5.1 version
• 51cdaae Reduce dependencies
• 7db5c5d Align TypeScript declarations with runtime behavior (#420)
• afce852 Release 1.5.0 version
• 0856df7 Simplify docs
• 579eae9 fix(listen-keys): compare deep paths on whole-store set (#419)
• fd78b3d Update size limit
• Additional commits viewable in compare view

Updates query-string from 9.4.1 to 9.5.0

Release notes

Sourced from query-string's releases.

v9.5.0

• Update dependencies 55e453d

---

sindresorhus/query-string@v9.4.1...v9.5.0

Commits

• aae373a 9.5.0
• 55e453d Update dependencies
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[bgentry]

Codex dependency security review — approve

Reviewed base b39808b61984c7ad5b81a8a714ac21195dec269d through exact head 66310efa936c3c42c76008a5d2664c7d09b5242e.

The final PR updates @xyflow/react 12.11.2 → 12.11.5 (with @xyflow/system 0.0.79 → 0.0.81), Nanostores 1.4.1 → 1.5.2, and Query-string 9.4.1 → 9.5.0. It deliberately keeps Dagre 3.0.0/Graphlib 4.0.1: Dagre 3.1.1 renames the CommonJS bundle that River UI's explicit Vite alias targets, and no newer Dagre release exists.

The original XYFlow 12.11.4/System 0.0.80 pair was also defective: React imports handleAttributionWarning, but System 0.0.80 does not export it. The release-age-compliant 12.11.5/System 0.0.81 pair explicitly repairs that contract. React's runtime bundles are otherwise byte-identical across 12.11.4→12.11.5, and System adds the expected development-only attribution warning with no network or telemetry behavior.

All changed artifacts use canonical npm registry tarballs with matching SHA-512 integrity. Tarball digests, publisher/repository continuity, registry signatures, and available provenance were checked. XYFlow and Nanostores retain GitHub trusted publishing/SLSA provenance. The final lockfile adds no lifecycle hooks, bins, native/WASM payloads, non-registry sources, weak integrity, or same-version identity rewrites.

This PR contains a confirmed security remediation: Query-string now resolves decode-uri-component 0.5.0, fixing GHSA-vcc3-ghjq-m6fr / CVE-2026-45822, an excessive-CPU denial of service on malformed percent-encoded input. River UI parses attacker-controlled URL search strings through Query-string, so the availability fix is relevant.

The exact final lockfile installs successfully. Local validation passes lint, all 34 test files / 233 tests, the production build, and the Storybook build. GitHub checks for the new head are still running at review time.

Residual risk is limited to normal generated-bundle review constraints, lack of SLSA attestations for the established Query-string/decoder publishers, and possible parsing differences for malformed percent-encoded input caused by the security fix. I found no blocking security or compatibility issue in the final dependency set.