From be2ba7e88dbe6eb79260ddfb210a0c7a17d69c9a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 1 Sep 2026 18:37:38 +0000 Subject: [PATCH 1/2] Bump the production-dependencies group with 4 updates Bumps the production-dependencies group with 4 updates: [@dagrejs/dagre](https://github.com/dagrejs/dagre), [@xyflow/react](https://github.com/xyflow/xyflow/tree/HEAD/packages/react), [nanostores](https://github.com/nanostores/nanostores) and [query-string](https://github.com/sindresorhus/query-string). Updates `@dagrejs/dagre` from 3.0.0 to 3.1.1 - [Release notes](https://github.com/dagrejs/dagre/releases) - [Changelog](https://github.com/dagrejs/dagre/blob/master/changelog.md) - [Commits](https://github.com/dagrejs/dagre/compare/v3.0.0...v3.1.1) Updates `@xyflow/react` from 12.11.2 to 12.11.4 - [Release notes](https://github.com/xyflow/xyflow/releases) - [Changelog](https://github.com/xyflow/xyflow/blob/main/packages/react/CHANGELOG.md) - [Commits](https://github.com/xyflow/xyflow/commits/@xyflow/react@12.11.4/packages/react) Updates `nanostores` from 1.4.1 to 1.5.2 - [Release notes](https://github.com/nanostores/nanostores/releases) - [Changelog](https://github.com/nanostores/nanostores/blob/main/CHANGELOG.md) - [Commits](https://github.com/nanostores/nanostores/compare/1.4.1...1.5.2) Updates `query-string` from 9.4.1 to 9.5.0 - [Release notes](https://github.com/sindresorhus/query-string/releases) - [Commits](https://github.com/sindresorhus/query-string/compare/v9.4.1...v9.5.0) --- updated-dependencies: - dependency-name: "@dagrejs/dagre" dependency-version: 3.1.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@xyflow/react" dependency-version: 12.11.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: nanostores dependency-version: 1.5.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: query-string dependency-version: 9.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] --- package-lock.json | 56 +++++++++++++++++++++++------------------------ package.json | 8 +++---- 2 files changed, 32 insertions(+), 32 deletions(-) diff --git a/package-lock.json b/package-lock.json index bfba1f27..2ca5238b 100644 --- a/package-lock.json +++ b/package-lock.json @@ -8,7 +8,7 @@ "name": "river-ui-vite", "version": "0.0.0", "dependencies": { - "@dagrejs/dagre": "^3.0.0", + "@dagrejs/dagre": "^3.1.1", "@headlessui/react": "^2.2.10", "@heroicons/react": "^2.2.0", "@nanostores/persistent": "^1.3.5", @@ -16,12 +16,12 @@ "@tailwindcss/typography": "^0.5.20", "@tanstack/react-query": "^5.101.4", "@tanstack/react-router": "^1.170.18", - "@xyflow/react": "^12.11.2", + "@xyflow/react": "^12.11.4", "clsx": "^2.1.1", "date-fns": "^4.4.0", - "nanostores": "^1.4.1", + "nanostores": "^1.5.2", "next-themes": "^0.4.6", - "query-string": "^9.4.1", + "query-string": "^9.5.0", "react": "^19.2.8", "react-dom": "^19.2.8", "react-hot-toast": "^2.6.0", @@ -601,18 +601,18 @@ } }, "node_modules/@dagrejs/dagre": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/@dagrejs/dagre/-/dagre-3.0.0.tgz", - "integrity": "sha512-ZzhnTy1rfuoew9Ez3EIw4L2znPGnYYhfn8vc9c4oB8iw6QAsszbiU0vRhlxWPFnmmNSFAkrYeF1PhM5m4lAN0Q==", + "version": "3.1.1", + "resolved": "https://registry.npmjs.org/@dagrejs/dagre/-/dagre-3.1.1.tgz", + "integrity": "sha512-zroZB1dFOFiGgv4Xcrn1DckB1o4aOikPqD2NDQPV0WM//CXGcS6xiD0rNkqHmw6FEg4tabt4nxPLwgCWT+Vb2A==", "license": "MIT", "dependencies": { - "@dagrejs/graphlib": "4.0.1" + "@dagrejs/graphlib": "4.0.5" } }, "node_modules/@dagrejs/graphlib": { - "version": "4.0.1", - "resolved": "https://registry.npmjs.org/@dagrejs/graphlib/-/graphlib-4.0.1.tgz", - "integrity": "sha512-IvcV6FduIIAmLwnH+yun+QtV36SC7mERqa86aClNqmMN09WhmPPYU8ckHrZBozErf+UvHPWOTJYaGYiIcs0DgA==", + "version": "4.0.5", + "resolved": "https://registry.npmjs.org/@dagrejs/graphlib/-/graphlib-4.0.5.tgz", + "integrity": "sha512-7xrBTqIts3o+PMUZX97wSc+7TUbW+/rULzGNCTP6yooNVDXbzw4Wutg/H/xOutTB/c/k0YqOAavgPh4/Zk9PFA==", "license": "MIT" }, "node_modules/@emnapi/core": { @@ -4826,12 +4826,12 @@ "license": "MIT" }, "node_modules/@xyflow/react": { - "version": "12.11.2", - "resolved": "https://registry.npmjs.org/@xyflow/react/-/react-12.11.2.tgz", - "integrity": "sha512-eLAlDWJfWnQEhJwGMjlWdAXO9eYllKpliUmPQlAmOLxz6mExXuzMVDUKLMquixgkrtmMFFtug3jGKmYYld12cA==", + "version": "12.11.4", + "resolved": "https://registry.npmjs.org/@xyflow/react/-/react-12.11.4.tgz", + "integrity": "sha512-C5K1mQWH0zC5CldfXXLFRK2nkzcK550mtVf+0LSz4K7nuTBIq4VPNnCaVVUbyxi8ufDhcGzQBl6ELcbEFhMsaw==", "license": "MIT", "dependencies": { - "@xyflow/system": "0.0.79", + "@xyflow/system": "0.0.80", "classcat": "^5.0.3", "zustand": "^4.4.0" }, @@ -4851,9 +4851,9 @@ } }, "node_modules/@xyflow/system": { - "version": "0.0.79", - "resolved": "https://registry.npmjs.org/@xyflow/system/-/system-0.0.79.tgz", - "integrity": "sha512-czLyOh91NF0hIzbNzwi8I6GlqG23BHh2435OddfI6uiaLH3xdrdygO93gqgH1Bv9mhy8XPFQJOBn1FTq4LvEWA==", + "version": "0.0.80", + "resolved": "https://registry.npmjs.org/@xyflow/system/-/system-0.0.80.tgz", + "integrity": "sha512-ywc3ZqG91brzWrH1WlwMdIX4goOfrpBy6AbLdVSaof/Xx9l138ijIKRExM6EkMro2F+OImGmSiA/WKcXvKVcfA==", "license": "MIT", "dependencies": { "@types/d3-drag": "^3.0.7", @@ -5491,9 +5491,9 @@ "license": "MIT" }, "node_modules/decode-uri-component": { - "version": "0.4.1", - "resolved": "https://registry.npmjs.org/decode-uri-component/-/decode-uri-component-0.4.1.tgz", - "integrity": "sha512-+8VxcR21HhTy8nOt6jf20w0c9CADrw1O8d+VZ/YzzCt4bJ3uBjw+D1q2osAB8RnpwwaeYBxy0HyKQxD5JBMuuQ==", + "version": "0.5.0", + "resolved": "https://registry.npmjs.org/decode-uri-component/-/decode-uri-component-0.5.0.tgz", + "integrity": "sha512-1BiQVoK8C9gUbQU6NzAtO/tkz2qOFpEObMWpcFvhx4fYnj4Oc5yzaJN/LD36ihkVUdXyh5ZekzX+yM+ty/SrPg==", "license": "MIT", "engines": { "node": ">=14.16" @@ -7186,9 +7186,9 @@ } }, "node_modules/nanostores": { - "version": "1.4.1", - "resolved": "https://registry.npmjs.org/nanostores/-/nanostores-1.4.1.tgz", - "integrity": "sha512-PGd3uPojJB9Z07d5NX3Db/SOSBbyy3wLMUGq0GpnEEJfVzY9mq7daPMAZ3jObV5D3Jn+YKND636eI5ULg7F80Q==", + "version": "1.5.2", + "resolved": "https://registry.npmjs.org/nanostores/-/nanostores-1.5.2.tgz", + "integrity": "sha512-B0UbxzK1s0CN8Xht6r+7iT5+xV8PTaRERR1nATeplRv1Rw5YLWfVAid0hkqY3EceqpG4RjTk8GAwIxQY39Rnwg==", "funding": [ { "type": "github", @@ -7696,12 +7696,12 @@ } }, "node_modules/query-string": { - "version": "9.4.1", - "resolved": "https://registry.npmjs.org/query-string/-/query-string-9.4.1.tgz", - "integrity": "sha512-lSyJeN3RuaG7DZGWThtYRhk96+kEyZ/+doZpERuWbjeFL+Ok3vEat/swU498rAI0NcVt5/RJp8UDuLz7FckxrA==", + "version": "9.5.0", + "resolved": "https://registry.npmjs.org/query-string/-/query-string-9.5.0.tgz", + "integrity": "sha512-YlJmwNyi0RGYjlxYcuDncMsxFU7YyutbuI7gTm8ySxIGBlwx5yiBCOD5ig9ZNoHkawk/1Dey0N5mEfcUybMVAA==", "license": "MIT", "dependencies": { - "decode-uri-component": "^0.4.1", + "decode-uri-component": "^0.5.0", "filter-obj": "^5.1.0", "split-on-first": "^3.0.0" }, diff --git a/package.json b/package.json index 65ef02f2..ec0b6a6f 100644 --- a/package.json +++ b/package.json @@ -8,7 +8,7 @@ "npm": ">=11.10.0" }, "dependencies": { - "@dagrejs/dagre": "^3.0.0", + "@dagrejs/dagre": "^3.1.1", "@headlessui/react": "^2.2.10", "@heroicons/react": "^2.2.0", "@nanostores/persistent": "^1.3.5", @@ -16,12 +16,12 @@ "@tailwindcss/typography": "^0.5.20", "@tanstack/react-query": "^5.101.4", "@tanstack/react-router": "^1.170.18", - "@xyflow/react": "^12.11.2", + "@xyflow/react": "^12.11.4", "clsx": "^2.1.1", "date-fns": "^4.4.0", - "nanostores": "^1.4.1", + "nanostores": "^1.5.2", "next-themes": "^0.4.6", - "query-string": "^9.4.1", + "query-string": "^9.5.0", "react": "^19.2.8", "react-dom": "^19.2.8", "react-hot-toast": "^2.6.0", From 66310efa936c3c42c76008a5d2664c7d09b5242e Mon Sep 17 00:00:00 2001 From: Blake Gentry Date: Tue, 1 Sep 2026 16:56:22 -0500 Subject: [PATCH 2/2] keep production upgrades compatible Keep Dagre at 3.0.0 because 3.1.1 renames the bundle that River UI's Vite alias expects. Move XYFlow to 12.11.5 so it pairs with System 0.0.81, which supplies the export missing from the 12.11.4 pairing. Regenerate the lockfile so the Nanostores and Query-string updates, including the decoder security fix, can proceed safely. --- package-lock.json | 32 ++++++++++++++++---------------- package.json | 4 ++-- 2 files changed, 18 insertions(+), 18 deletions(-) diff --git a/package-lock.json b/package-lock.json index 2ca5238b..bbe27afb 100644 --- a/package-lock.json +++ b/package-lock.json @@ -8,7 +8,7 @@ "name": "river-ui-vite", "version": "0.0.0", "dependencies": { - "@dagrejs/dagre": "^3.1.1", + "@dagrejs/dagre": "^3.0.0", "@headlessui/react": "^2.2.10", "@heroicons/react": "^2.2.0", "@nanostores/persistent": "^1.3.5", @@ -16,7 +16,7 @@ "@tailwindcss/typography": "^0.5.20", "@tanstack/react-query": "^5.101.4", "@tanstack/react-router": "^1.170.18", - "@xyflow/react": "^12.11.4", + "@xyflow/react": "^12.11.5", "clsx": "^2.1.1", "date-fns": "^4.4.0", "nanostores": "^1.5.2", @@ -601,18 +601,18 @@ } }, "node_modules/@dagrejs/dagre": { - "version": "3.1.1", - "resolved": "https://registry.npmjs.org/@dagrejs/dagre/-/dagre-3.1.1.tgz", - "integrity": "sha512-zroZB1dFOFiGgv4Xcrn1DckB1o4aOikPqD2NDQPV0WM//CXGcS6xiD0rNkqHmw6FEg4tabt4nxPLwgCWT+Vb2A==", + "version": "3.0.0", + "resolved": "https://registry.npmjs.org/@dagrejs/dagre/-/dagre-3.0.0.tgz", + "integrity": "sha512-ZzhnTy1rfuoew9Ez3EIw4L2znPGnYYhfn8vc9c4oB8iw6QAsszbiU0vRhlxWPFnmmNSFAkrYeF1PhM5m4lAN0Q==", "license": "MIT", "dependencies": { - "@dagrejs/graphlib": "4.0.5" + "@dagrejs/graphlib": "4.0.1" } }, "node_modules/@dagrejs/graphlib": { - "version": "4.0.5", - "resolved": "https://registry.npmjs.org/@dagrejs/graphlib/-/graphlib-4.0.5.tgz", - "integrity": "sha512-7xrBTqIts3o+PMUZX97wSc+7TUbW+/rULzGNCTP6yooNVDXbzw4Wutg/H/xOutTB/c/k0YqOAavgPh4/Zk9PFA==", + "version": "4.0.1", + "resolved": "https://registry.npmjs.org/@dagrejs/graphlib/-/graphlib-4.0.1.tgz", + "integrity": "sha512-IvcV6FduIIAmLwnH+yun+QtV36SC7mERqa86aClNqmMN09WhmPPYU8ckHrZBozErf+UvHPWOTJYaGYiIcs0DgA==", "license": "MIT" }, "node_modules/@emnapi/core": { @@ -4826,12 +4826,12 @@ "license": "MIT" }, "node_modules/@xyflow/react": { - "version": "12.11.4", - "resolved": "https://registry.npmjs.org/@xyflow/react/-/react-12.11.4.tgz", - "integrity": "sha512-C5K1mQWH0zC5CldfXXLFRK2nkzcK550mtVf+0LSz4K7nuTBIq4VPNnCaVVUbyxi8ufDhcGzQBl6ELcbEFhMsaw==", + "version": "12.11.5", + "resolved": "https://registry.npmjs.org/@xyflow/react/-/react-12.11.5.tgz", + "integrity": "sha512-QqoryGkqEhWBuQN9bZWRKhwr3Uoj9lCGj/tg0NnIWHHEOXV+5c8cYsc7Q9TST63V92lHqcNV9P5cjvJ9ZAmblQ==", "license": "MIT", "dependencies": { - "@xyflow/system": "0.0.80", + "@xyflow/system": "0.0.81", "classcat": "^5.0.3", "zustand": "^4.4.0" }, @@ -4851,9 +4851,9 @@ } }, "node_modules/@xyflow/system": { - "version": "0.0.80", - "resolved": "https://registry.npmjs.org/@xyflow/system/-/system-0.0.80.tgz", - "integrity": "sha512-ywc3ZqG91brzWrH1WlwMdIX4goOfrpBy6AbLdVSaof/Xx9l138ijIKRExM6EkMro2F+OImGmSiA/WKcXvKVcfA==", + "version": "0.0.81", + "resolved": "https://registry.npmjs.org/@xyflow/system/-/system-0.0.81.tgz", + "integrity": "sha512-hfbafW4i7uLq7ILok8QWFFm4KMFw22lbZNJHKfHOMSOOoCk5e5m8yfr84UV9NaJajmogWaLVnp2XFU9JQejlqg==", "license": "MIT", "dependencies": { "@types/d3-drag": "^3.0.7", diff --git a/package.json b/package.json index ec0b6a6f..5d18a38b 100644 --- a/package.json +++ b/package.json @@ -8,7 +8,7 @@ "npm": ">=11.10.0" }, "dependencies": { - "@dagrejs/dagre": "^3.1.1", + "@dagrejs/dagre": "^3.0.0", "@headlessui/react": "^2.2.10", "@heroicons/react": "^2.2.0", "@nanostores/persistent": "^1.3.5", @@ -16,7 +16,7 @@ "@tailwindcss/typography": "^0.5.20", "@tanstack/react-query": "^5.101.4", "@tanstack/react-router": "^1.170.18", - "@xyflow/react": "^12.11.4", + "@xyflow/react": "^12.11.5", "clsx": "^2.1.1", "date-fns": "^4.4.0", "nanostores": "^1.5.2",