Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 22 updates - #601

Closed
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/npm_and_yarn/dev/production-dependencies-963ffabc86
Closed

chore(deps): bump the production-dependencies group across 1 directory with 22 updates#601
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/npm_and_yarn/dev/production-dependencies-963ffabc86

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 22 updates in the / directory:

Package From To
@libp2p/circuit-relay-v2 4.2.13 4.2.14
@libp2p/identify 4.1.14 4.1.15
@libp2p/interface 3.3.0 3.3.1
@libp2p/webrtc 6.0.33 6.1.0
@libp2p/websockets 10.1.21 10.1.22
libp2p 3.3.11 3.3.12
lucide-react 1.52.0 1.57.0
next 16.3.8 16.4.0
@types/node 26.6.4 26.6.5
prettier 3.9.9 3.9.10
fumadocs-core 16.16.2 16.17.3
fumadocs-mdx 15.4.6 15.4.7
fumadocs-ui 16.16.2 16.17.3
mermaid 12.1.0 12.2.0
zod 4.6.5 4.6.7
@nestjs/common 12.1.2 12.1.3
@nestjs/core 12.1.2 12.1.3
@nestjs/platform-express 12.1.2 12.1.3
@libp2p/interface-internal 3.1.13 3.1.14
@libp2p/utils 7.4.1 7.4.2
@next/third-parties 16.3.8 16.4.0
bitcoinjs-lib 7.0.2 7.0.4

Updates @libp2p/circuit-relay-v2 from 4.2.13 to 4.2.14

Commits
  • d5f5f8d chore: release main (#3643)
  • e724dd1 chore: revert "abort connections only after pings stop succeeding" (#3655)
  • 9441e04 fix(metrics-simple): return histogram buckets from collect() (#3654)
  • fc90066 fix(metrics-simple): collect calculated histogram and summary groups (#3651)
  • 40480a0 feat(libp2p)!: abort connections only after pings stop succeeding (#3504)
  • 2357117 fix(utils): yield all buffered data before stream iterators end (#3648)
  • 16fba56 chore: bump codecov/codecov-action from 7.0.0 to 7.1.1 (#3634)
  • 183116b feat: webrtc-direct-v2 (#3480)
  • a9bae64 docs: regenerate READMEs for mdast-util-to-markdown 2.1.3 (#3647)
  • 776cded fix(utils): ignore byteStream messages after unwrap (#3642)
  • Additional commits viewable in compare view

Updates @libp2p/identify from 4.1.14 to 4.1.15

Release notes

Sourced from @​libp2p/identify's releases.

identify: v4.1.15

4.1.15 (2026-10-10)

Dependencies

  • require main-event ^1.0.5 (#3641) (e7359e5)
  • The following workspace dependencies were updated
    • dependencies
      • @​libp2p/crypto bumped from ^5.1.23 to ^5.1.24
      • @​libp2p/interface bumped from ^3.3.0 to ^3.3.1
      • @​libp2p/interface-internal bumped from ^3.1.13 to ^3.1.14
      • @​libp2p/peer-id bumped from ^6.0.15 to ^6.0.16
      • @​libp2p/peer-record bumped from ^9.0.16 to ^9.0.17
      • @​libp2p/utils bumped from ^7.4.1 to ^7.4.2
    • devDependencies
      • @​libp2p/logger bumped from ^6.2.13 to ^6.2.14
Commits

Updates @libp2p/interface from 3.3.0 to 3.3.1

Release notes

Sourced from @​libp2p/interface's releases.

interface: v3.3.1

3.3.1 (2026-10-10)

Dependencies

Commits

Updates @libp2p/webrtc from 6.0.33 to 6.1.0

Release notes

Sourced from @​libp2p/webrtc's releases.

webrtc: v6.1.0

6.1.0 (2026-10-10)

Features

Dependencies

  • require main-event ^1.0.5 (#3641) (e7359e5)
  • The following workspace dependencies were updated
    • dependencies
      • @​libp2p/crypto bumped from ^5.1.23 to ^5.1.24
      • @​libp2p/interface bumped from ^3.3.0 to ^3.3.1
      • @​libp2p/interface-internal bumped from ^3.1.13 to ^3.1.14
      • @​libp2p/keychain bumped from ^6.1.7 to ^6.1.8
      • @​libp2p/noise bumped from ^17.0.3 to ^17.0.4
      • @​libp2p/peer-id bumped from ^6.0.15 to ^6.0.16
      • @​libp2p/utils bumped from ^7.4.1 to ^7.4.2
    • devDependencies
      • @​libp2p/logger bumped from ^6.2.13 to ^6.2.14

daemon: v6.0.40

6.0.40 (2026-10-10)

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​libp2p/daemon-server bumped from ^9.0.39 to ^9.0.40

webtransport: v6.0.40

6.0.40 (2026-09-23)

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​libp2p/noise bumped from ^17.0.2 to ^17.0.3
    • devDependencies
      • @​libp2p/daemon-client bumped from ^10.0.38 to ^10.0.39
Commits

Updates @libp2p/websockets from 10.1.21 to 10.1.22

Release notes

Sourced from @​libp2p/websockets's releases.

websockets: v10.1.22

10.1.22 (2026-10-10)

Dependencies

  • require main-event ^1.0.5 (#3641) (e7359e5)
  • The following workspace dependencies were updated
    • dependencies
      • @​libp2p/interface bumped from ^3.3.0 to ^3.3.1
      • @​libp2p/utils bumped from ^7.4.1 to ^7.4.2
    • devDependencies
      • @​libp2p/logger bumped from ^6.2.13 to ^6.2.14
Commits
  • 2de9b12 chore: release main (#2965)
  • e7e2802 feat: expose maxDataLength for outgoing messages in PeerStreams (#2954)
  • 6d0f3ee fix(webrtc): remove vulnerable unmaintained stun package dependency (#2967)
  • 5a9bbf7 fix: override browser override for react-native (#2970)
  • 68ad366 chore: fix linting
  • d222968 docs: add TSDoc comments interface-internal module (#2949)
  • b818882 chore: specify dependabot dirs
  • 1fc0e26 deps: bump it-length-prefixed from 9.1.1 to 10.0.1 (#2962)
  • 23685db docs: update link to prometheus lib in metrics module (#2950)
  • See full diff in compare view

Updates libp2p from 3.3.11 to 3.3.12

Commits
  • d5f5f8d chore: release main (#3643)
  • e724dd1 chore: revert "abort connections only after pings stop succeeding" (#3655)
  • 9441e04 fix(metrics-simple): return histogram buckets from collect() (#3654)
  • fc90066 fix(metrics-simple): collect calculated histogram and summary groups (#3651)
  • 40480a0 feat(libp2p)!: abort connections only after pings stop succeeding (#3504)
  • 2357117 fix(utils): yield all buffered data before stream iterators end (#3648)
  • 16fba56 chore: bump codecov/codecov-action from 7.0.0 to 7.1.1 (#3634)
  • 183116b feat: webrtc-direct-v2 (#3480)
  • a9bae64 docs: regenerate READMEs for mdast-util-to-markdown 2.1.3 (#3647)
  • 776cded fix(utils): ignore byteStream messages after unwrap (#3642)
  • Additional commits viewable in compare view

Updates lucide-react from 1.52.0 to 1.57.0

Release notes

Sourced from lucide-react's releases.

Version 1.57.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.56.0...1.57.0

Version 1.56.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.55.0...1.56.0

Version 1.55.0

What's Changed

... (truncated)

Commits
  • 3f1255e chore(deps-dev): bump @​vitejs/plugin-react (#4995)
  • 949bc6d test(lucide-react): add tests for DynamicIcon fallback and ref forwarding (#4...
  • See full diff in compare view

Updates next from 16.3.8 to 16.4.0

Release notes

Sourced from next's releases.

v16.4.0

Check out the 16.4 announcement post to get an overview of the changes.

Core Changes

  • Show compiler plugin warning in more situations: #75682
  • fix(scripts): correct typo in rm.mjs error message: #87015
  • docs: improve clarity and punctuation in README: #86096
  • Fix debug build paths Pages Router support entries: #93529
  • bundle-analyzer: record historical snapshots on each analyze run: #93520
  • fix: detect proxy.ts correctly with compound pageExtensions: #93246
  • feat(turbopack): support false values for resolveAlias config: #93331

Misc Changes

  • docs: correction to dynamicParams migration: #96624
  • docs: proxy event argument: #96435
  • docs: remove experimental note from runtime prefetching: #96615
  • Preserve per-segment prefetching after dynamic navigation: #96583
  • Rename static generation stream option to waitForAllReady: #96564
  • Remove obsolete static generation plumbing: #96563
  • [turbopack] Drop dead writes to exports: #96381
  • [turbopack] Ignore writes to exports after a module.exports = {} writes: #96380
  • [turbopack] Add test for sideEffects with optimizePackageImports: #96549
  • [turbopack] Strip leading BOM before parsing CSS: #96678
  • Upgrade React from cbb046ab-20260731 to 7dfc7ccd-20260803: #96550
  • docs: use relative doc links in instant-navigation error pages: #96672
  • Turbopack: terminate failed plugin worker threads: #96592
  • Fix HTML-limited bot matching in prerender bypass rules: #96584
  • [ci] Fix create_release_branch for new repo permissions: #96641
  • test: skip action module instance deploy test: #96629
  • docs: quote the dynamicParams build error in a blockquote: #96633
  • [react-sync] Open pull requests as the bot that authors the commits: #96682
  • [Bench] Fixes for pure Fizz bench: #96771
  • Derive foreground cache revalidation from the consumer: #96731
  • Fix race when navigating Back before hydration: #96252
  • docs: present each Skill as steps in the AI agents guide: #96751
  • Reuse completed cache entries for the rest of a request: #96727
  • Upgrade React from 7dfc7ccd-20260803 to 11eddecd-20260805: #96735
  • Remove WorkStore execution mode: #96674
  • Remove cache revalidation execution mode reads: #96670
  • Separate App Route render and prerender pipelines: #96662
  • Remove App Page execution mode reads: #96660
  • test: fix missing await in css-chunking test: #96725
  • docs (Skills): stop assuming app/ at the root and port 3000: #96696
  • Implement next/font BeforeResolvePlugins as ImportMappingReplacement: #95808
  • Use Tailwind Turbopack loader in create-next-app: #96606
  • docs: instant navigation quick start with an adoption prompt: #96663
  • Separate App Page render and prerender pipelines: #96659
  • Move App Router execution intent to entrypoints: #96640

... (truncated)

Commits
  • e273d5b v16.4.0
  • fdf41d6 [ai-upgrade] discover upgrade models and reasoning efforts from agent CLIs (#...
  • c3e76ad v16.4.0-canary.63
  • 47c6cc8 Document next analyze export in the package bundling guide (#99735)
  • 5b10604 Revert stabilization of forbidden() and unauthorized() (#99734)
  • f3a6f97 Preserve configured output directories during static export (#99507)
  • b22e5a2 Rename skill to next-bundle-optimizer and document its usage (#99731)
  • 74dc549 [turbo-tasks-backend] Clean up task state before publishing execution complet...
  • ccf8c15 v16.4.0-canary.62
  • b8c7c7f Improve static route error guidance (#99724)
  • Additional commits viewable in compare view

Updates @types/node from 26.6.4 to 26.6.5

Commits

Updates prettier from 3.9.9 to 3.9.10

Release notes

Sourced from prettier's releases.

3.9.10

  • Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.10

diff

Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

See micromark/micromark-extension-gfm-table@4f43ead for details.

Commits
  • 1172b82 Release 3.9.10
  • d014227 Update micromark-extension-gfm-table to fix the table parse issue on perfor...
  • 953b908 Bump Prettier dependency to 3.9.9
  • ad8a6bf Clean changelog_unreleased
  • See full diff in compare view

Updates fumadocs-core from 16.16.2 to 16.17.3

Release notes

Sourced from fumadocs-core's releases.

fumadocs@16.17.3

  • @​fumadocs/base-ui@​16.17.3
  • fumadocs-core@16.17.3
  • fumadocs-ui@16.17.3

Lightbox for zoomable images

Zoomable images inside <Lightbox /> open in one viewer, browse them with arrow keys, swipes or the side buttons.

import { Lightbox } from 'fumadocs-ui/components/image-zoom';
<Lightbox>
<MDX components={getMDXComponents()} />
</Lightbox>;

  • The image title is shown as caption, pass caption to <ImageZoom /> for rich content.
  • rmiz props don't apply inside <Lightbox />.
  • Added translation keys of the image viewer to @fumadocs/language.

Show failed searches in the search dialog

  • <SearchDialog /> accepts the error of search hooks, <SearchDialogList /> shows it above the previous results.

Fix #3698

fumadocs@16.17.2

  • @​fumadocs/base-ui@​16.17.2
  • fumadocs-core@16.17.2
  • fumadocs-ui@16.17.2

Layout fixes

  • Docs Layout: layout tabs with tabMode: 'top' no longer cover the page.
  • Glass Layout: sidebar items are not all active with a page tree without $id.
  • Glass Layout: icons of layout tabs are sized correctly with the default tabs option.

Faster loader()

  • Page trees are built faster, especially with custom sort options.
  • Faster loader() setup and page lookups like getPage() and getPageByUrl().
  • Fallback page trees of i18n sources keep the locale in URLs and IDs.
  • A page listed in pages is no longer duplicated when another folder takes it with a higher priority, like pagesIndex.

fumadocs@16.17.1

  • @​fumadocs/base-ui@​16.17.1
  • fumadocs-core@16.17.1
  • fumadocs-ui@16.17.1

... (truncated)

Commits
  • f1f5b6f Version Packages (#3701)
  • 15a5857 fix(ui): show error
  • 7029b7d feat(ui): support light box component
  • 639cae4 Version Packages (#3695)
  • 17913ca perf(story): lazy load
  • 47417f9 docs: show layouts as stories
  • de1a2e8 fix(ui): improve details
  • 6d2484c feat(story): redesign & support iframe for story
  • d6ce97d perf(core): faster loader
  • 93ad7b0 fix(registry): pass the system prompt as instructions in ai/openrouter and ai...
  • Additional commits viewable in compare view

Updates fumadocs-mdx from 15.4.6 to 15.4.7

Release notes

Sourced from fumadocs-mdx's releases.

fumadocs-mdx@15.4.7

Markdown and search records from the authored source

remarkLLMs() and remarkStructure() of fumadocs-core slice their Markdown from the authored source like Sätteri, instead of stringifying the syntax tree. It is much faster, Markdown is no longer escaped or reformatted, and local images keep their addresses. Re-sync your search indexes to pick up the new records.

  • Plugins record the Markdown of content they replace with replaceSource() or embedSource() from fumadocs-core/mdx-plugins/stringifier, in place of data._stringify, and add search records with data.structuredData. Nodes they insert otherwise are left out. A namespace limits an edit to the stringifiers of that namespace, like search for search records.
  • Search records are always Markdown, also in Sätteri. filterElement replaces stringify.filterElement, it chooses the JSX elements kept as HTML tags (File, TypeTable, Callout and Card by default) that search dialogs render as components. Other elements and links are replaced by their content, images are removed, and an element on one line is recorded like a paragraph.
  • Removed defaultStringifier() (use createStringifier()), StringifyOptions, allowedMdxAttributes, filterMdxAttributes, placeholder() (use mdxAsPlaceholder), and the stringify and mdast-util-to-markdown options of both plugins.
  • Included content goes through the plugins like the document's own, Sätteri includes .md files as Markdown.
  • <auto-files> shows its files in a code block, auto-type-table its props in a Markdown table, created by typeTableToMarkdown() from fumadocs-typescript.
  • remarkShow() and fileGenerator() of fumadocs-docgen record their Markdown, generators receive the file to do the same.
  • Records of fumadocs-obsidian resolve wikilinks, and leave comments, block IDs, callout markers and embeds out. Comments are removed before parsing, so they no longer split a paragraph.
  • Pages of fumadocs-python compile from their MDX, so they have Markdown and search records.
  • fumadocs-mdx, fumadocs-docgen and fumadocs-obsidian require fumadocs-core 16.17.0.

Fix #3662

Commits
  • e380a0d Version Packages (#3659)
  • 5d9353b feat(core): better mixedbread search
  • 097a544 feat(openapi): auth provider API
  • 945b87a fix(core,satteri): optimize traverse & better search records
  • 3bf9928 fix(ui): display fallback tree slidings correctly
  • 433b586 fix(openapi): better code examples
  • b221e1d fix(twoslash): better truncate & performance
  • 48bf8c6 fix(openapi,typescript): render Markdown images, show the OAuth redirect URI
  • cb7d92c docs: introduce new APIs
  • 8f1ffb3 refactor(ui): use prose class for search result markdown
  • Additional commits viewable in compare view

Updates fumadocs-ui from 16.16.2 to 16.17.3

Release notes

Sourced from fumadocs-ui's releases.

fumadocs@16.17.3

  • @​fumadocs/base-ui@​16.17.3
  • fumadocs-core@16.17.3
  • fumadocs-ui@16.17.3

Lightbox for zoomable images

Zoomable images inside <Lightbox /> open in one viewer, browse them with arrow keys, swipes or the side buttons.

import { Lightbox } from 'fumadocs-ui/components/image-zoom';
<Lightbox>
<MDX components={getMDXComponents()} />
</Lightbox>;

  • The image title is shown as caption, pass caption to <ImageZoom /> for rich content.
  • rmiz props don't apply inside <Lightbox />.
  • Added translation keys of the image viewer to @fumadocs/language.

Show failed searches in the search dialog

  • <SearchDialog /> accepts the error of search hooks, <SearchDialogList /> shows it above the previous results.

Fix #3698

fumadocs@16.17.2

  • @​fumadocs/base-ui@​16.17.2
  • fumadocs-core@16.17.2
  • fumadocs-ui@16.17.2

Layout fixes

  • Docs Layout: layout tabs with tabMode: 'top' no longer cover the page.
  • Glass Layout: sidebar items are not all active with a page tree without $id.
  • Glass Layout: icons of layout tabs are sized correctly with the default tabs option.

Faster loader()

  • Page trees are built faster, especially with custom sort options.
  • Faster loader() setup and page lookups like getPage() and getPageByUrl().
  • Fallback page trees of i18n sources keep the locale in URLs and IDs.
  • A page listed in pages is no longer duplicated when another folder takes it with a higher priority, like pagesIndex.

fumadocs@16.17.1

  • @​fumadocs/base-ui@​16.17.1
  • fumadocs-core@16.17.1
  • fumadocs-ui@16.17.1

... (truncated)

Commits
  • f1f5b6f Version Packages (#3701)
  • 15a5857 fix(ui): show error
  • 7029b7d feat(ui): support light box component
  • 639cae4 Version Packages (#3695)
  • 17913ca perf(story): lazy load
  • 47417f9 docs: show layouts as stories
  • de1a2e8 fix(ui): improve details
  • 6d2484c feat(story): redesign & support iframe for story
  • d6ce97d perf(core): faster loader
  • 93ad7b0 fix(registry): pass the system prompt as instructions in ai/openrouter and ai...
  • Additional commits viewable in compare view

Updates mermaid from 12.1.0 to 12.2.0

Release notes

Sourced from mermaid's releases.

mermaid@12.2.0

Minor Changes

  • #8394 6ac38cb Thanks @​jackroberts236! - feat: Add opt-in mindmap coloring by hierarchy depth using mindmap.colorBy: depth and the existing theme palette.

Patch Changes

  • #8409 419ee68 Thanks @​ashishjain0512! - fix: size circle and double-circle nodes from their label instead of minNodeWidth, and trim neo circle padding

  • #8395 2fb3ff1 Thanks @​ashishjain0512! - fix: ELK no longer straightens an edge terminal when that would put a label over another edge, or an edge through a label

  • #8394 cbf89ab Thanks @​jackroberts236! - fix: Keep mindmap HTML labels readable in the neo look on themes that repaint node backgrounds

  • #8390 430ac9b Thanks @​ashishjain0512! - fix: Centre mindmap node labels when htmlLabels is false

  • #8161 d7532ed Thanks @​filipsajdak! - fix: scope a swimlane cluster's DOM id like every other cluster, so two diagrams on one page do not collide

  • #8270 ad8d61a Thanks @​filipsajdak! - fix(rendering): clip an edge for the layout engine that drew it, so a diagram pinning its own engine (bpmn, swimlanes) still renders when the configured default is another one

  • #8383 9d41c0f Thanks @​filipsajdak! - fix(swimlanes): split shared terminal lanes again after crossing cleanup, so an edge that detours around another lane no longer ends on the same attachment point as a neighbouring edge

  • #8384 6c67397 Thanks @​filipsajdak! - fix(swimlanes): move a lane's title band clear of an edge that crosses it, in LR diagrams whose lanes carry no direction of their own and when the edge runs along the band's border

  • #8366 40124c3 Thanks @​SwastikTripathi! - fix: swimlane nodes with no edges keep their source order inside a lane instead of being sorted by ID

Commits
  • 1fb7869 Merge pull request #8432 from mermaid-js/changeset-release/master
  • 34772ca Version Packages
  • 42292ea Merge pull request #8428 from mermaid-js/release/12.2.0
  • e6c8059 Wrong version set previously
  • 6c55f56 Set mermaid version when Coloring by depth supported in Mindmap
  • 5a0d8cf Fix missing parallel uploads
  • 788f396 Update according to discussion with core-team members
  • 33d0a49 Merge pull request #8411 from mermaid-js/renovate/npm-katex-vulnerability
  • 6538fde Update dependency katex to ^0.18.0 [SECURITY]
  • ba3022d Merge pull request #8398 from mermaid-js/pebr/12.1.0-tmp
  • Additional commits viewable in compare view

Updates zod from 4.6.5 to 4.6.7

Release notes

Sourced from zod's releases.

v4.6.7

Commits:

  • b500a2ee95134f81d74da7911d7378dd2853d042 4.6.7

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

  • 0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini
  • 9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales
  • 34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note
  • 74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)
  • b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors
  • 8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze
  • bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles
  • c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)
  • a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)
  • a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)
  • 529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6
  • 9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why
Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 14, 2026
@changeset-bot

changeset-bot Bot commented Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 7e1cec8

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@netlify

netlify Bot commented Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Deploy Preview for docsccc ready!

Name Link
🔨 Latest commit 7e1cec8
🔍 Latest deploy log https://app.netlify.com/projects/docsccc/deploys/6ad0bc8aaee7f25fad482ee2
😎 Deploy Preview https://deploy-preview-601--docsccc.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.
Lighthouse
Lighthouse		 1 paths audited
Performance: 78 (🔴 down 14 from production)
Accessibility: 95 (no change from production)
Best Practices: 92 (🔴 down 8 from production)
SEO: 75 (no change from production)
PWA: -
View the detailed breakdown and full score reports
🤖 Make changes Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

@netlify

netlify Bot commented Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Deploy Preview for appccc ready!

Name Link
🔨 Latest commit 7e1cec8
🔍 Latest deploy log https://app.netlify.com/projects/appccc/deploys/6ad0bc8a65c671cd5221c816
😎 Deploy Preview https://deploy-preview-601--appccc.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.
Lighthouse
Lighthouse		 1 paths audited
Performance: 38 (🔴 down 24 from production)
Accessibility: 98 (🟢 up 1 from production)
Best Practices: 92 (🔴 down 8 from production)
SEO: 99 (🟢 up 11 from production)
PWA: -
View the detailed breakdown and full score reports
🤖 Make changes Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

@netlify

netlify Bot commented Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Deploy Preview for apiccc ready!

Name Link
🔨 Latest commit 7e1cec8
🔍 Latest deploy log https://app.netlify.com/projects/apiccc/deploys/6ad0bc8ae0be10965752db52
😎 Deploy Preview https://deploy-preview-601--apiccc.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.
Lighthouse
Lighthouse		 1 paths audited
Performance: 83 (🔴 down 6 from production)
Accessibility: 100 (no change from production)
Best Practices: 100 (no change from production)
SEO: 95 (no change from production)
PWA: -
View the detailed breakdown and full score reports
🤖 Make changes Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

@coderabbitai

coderabbitai Bot commented Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: a9a552ea-afbc-4ba5-bea1-d01b6eaf2807

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@netlify

netlify Bot commented Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Deploy Preview for liveccc ready!

Name Link
🔨 Latest commit 7e1cec8
🔍 Latest deploy log https://app.netlify.com/projects/liveccc/deploys/6ad0bc8ada266f64316d4406
😎 Deploy Preview https://deploy-preview-601--liveccc.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.
Lighthouse
Lighthouse		 1 paths audited
Performance: 10 (🔴 down 2 from production)
Accessibility: 88 (no change from production)
Best Practices: 92 (🔴 down 8 from production)
SEO: 100 (no change from production)
PWA: -
View the detailed breakdown and full score reports
🤖 Make changes Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

@dependabot
chore(deps): bump the production-dependencies group across 1 director…
7e1cec8 
…y with 22 updates

Bumps the production-dependencies group with 22 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@libp2p/circuit-relay-v2](https://github.com/libp2p/js-libp2p) | `4.2.13` | `4.2.14` |
| [@libp2p/identify](https://github.com/libp2p/js-libp2p) | `4.1.14` | `4.1.15` |
| [@libp2p/interface](https://github.com/libp2p/js-libp2p) | `3.3.0` | `3.3.1` |
| [@libp2p/webrtc](https://github.com/libp2p/js-libp2p) | `6.0.33` | `6.1.0` |
| [@libp2p/websockets](https://github.com/libp2p/js-libp2p) | `10.1.21` | `10.1.22` |
| [libp2p](https://github.com/libp2p/js-libp2p) | `3.3.11` | `3.3.12` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.52.0` | `1.57.0` |
| [next](https://github.com/vercel/next.js) | `16.3.8` | `16.4.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.4` | `26.6.5` |
| [prettier](https://github.com/prettier/prettier) | `3.9.9` | `3.9.10` |
| [fumadocs-core](https://github.com/fuma-nama/fumadocs) | `16.16.2` | `16.17.3` |
| [fumadocs-mdx](https://github.com/fuma-nama/fumadocs) | `15.4.6` | `15.4.7` |
| [fumadocs-ui](https://github.com/fuma-nama/fumadocs) | `16.16.2` | `16.17.3` |
| [mermaid](https://github.com/mermaid-js/mermaid) | `12.1.0` | `12.2.0` |
| [zod](https://github.com/colinhacks/zod) | `4.6.5` | `4.6.7` |
| [@nestjs/common](https://github.com/nestjs/nest/tree/HEAD/packages/common) | `12.1.2` | `12.1.3` |
| [@nestjs/core](https://github.com/nestjs/nest/tree/HEAD/packages/core) | `12.1.2` | `12.1.3` |
| [@nestjs/platform-express](https://github.com/nestjs/nest/tree/HEAD/packages/platform-express) | `12.1.2` | `12.1.3` |
| [@libp2p/interface-internal](https://github.com/libp2p/js-libp2p) | `3.1.13` | `3.1.14` |
| [@libp2p/utils](https://github.com/libp2p/js-libp2p) | `7.4.1` | `7.4.2` |
| [@next/third-parties](https://github.com/vercel/next.js/tree/HEAD/packages/third-parties) | `16.3.8` | `16.4.0` |
| [bitcoinjs-lib](https://github.com/bitcoinjs/bitcoinjs-lib) | `7.0.2` | `7.0.4` |



Updates `@libp2p/circuit-relay-v2` from 4.2.13 to 4.2.14
- [Release notes](https://github.com/libp2p/js-libp2p/releases)
- [Commits](libp2p/js-libp2p@circuit-relay-v2-v4.2.13...circuit-relay-v2-v4.2.14)

Updates `@libp2p/identify` from 4.1.14 to 4.1.15
- [Release notes](https://github.com/libp2p/js-libp2p/releases)
- [Commits](libp2p/js-libp2p@fetch-v4.1.14...identify-v4.1.15)

Updates `@libp2p/interface` from 3.3.0 to 3.3.1
- [Release notes](https://github.com/libp2p/js-libp2p/releases)
- [Commits](libp2p/js-libp2p@libp2p-v3.3.0...libp2p-v3.3.1)

Updates `@libp2p/webrtc` from 6.0.33 to 6.1.0
- [Release notes](https://github.com/libp2p/js-libp2p/releases)
- [Commits](libp2p/js-libp2p@daemon-v6.0.33...utils-v6.1.0)

Updates `@libp2p/websockets` from 10.1.21 to 10.1.22
- [Release notes](https://github.com/libp2p/js-libp2p/releases)
- [Commits](libp2p/js-libp2p@floodsub-v10.1.21...floodsub-v10.1.22)

Updates `libp2p` from 3.3.11 to 3.3.12
- [Release notes](https://github.com/libp2p/js-libp2p/releases)
- [Commits](libp2p/js-libp2p@libp2p-v3.3.11...libp2p-v3.3.12)

Updates `lucide-react` from 1.52.0 to 1.57.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.57.0/packages/lucide-react)

Updates `next` from 16.3.8 to 16.4.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.3.8...v16.4.0)

Updates `@types/node` from 26.6.4 to 26.6.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `prettier` from 3.9.9 to 3.9.10
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.9.9...3.9.10)

Updates `fumadocs-core` from 16.16.2 to 16.17.3
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs@16.16.2...fumadocs@16.17.3)

Updates `fumadocs-mdx` from 15.4.6 to 15.4.7
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs-mdx@15.4.6...fumadocs-mdx@15.4.7)

Updates `fumadocs-ui` from 16.16.2 to 16.17.3
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs@16.16.2...fumadocs@16.17.3)

Updates `mermaid` from 12.1.0 to 12.2.0
- [Release notes](https://github.com/mermaid-js/mermaid/releases)
- [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@12.1.0...mermaid@12.2.0)

Updates `zod` from 4.6.5 to 4.6.7
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.6.5...v4.6.7)

Updates `@nestjs/common` from 12.1.2 to 12.1.3
- [Release notes](https://github.com/nestjs/nest/releases)
- [Commits](https://github.com/nestjs/nest/commits/v12.1.3/packages/common)

Updates `@nestjs/core` from 12.1.2 to 12.1.3
- [Release notes](https://github.com/nestjs/nest/releases)
- [Commits](https://github.com/nestjs/nest/commits/v12.1.3/packages/core)

Updates `@nestjs/platform-express` from 12.1.2 to 12.1.3
- [Release notes](https://github.com/nestjs/nest/releases)
- [Commits](https://github.com/nestjs/nest/commits/v12.1.3/packages/platform-express)

Updates `@libp2p/interface-internal` from 3.1.13 to 3.1.14
- [Release notes](https://github.com/libp2p/js-libp2p/releases)
- [Commits](libp2p/js-libp2p@echo-v3.1.13...echo-v3.1.14)

Updates `@libp2p/utils` from 7.4.1 to 7.4.2
- [Release notes](https://github.com/libp2p/js-libp2p/releases)
- [Commits](libp2p/js-libp2p@utils-v7.4.1...utils-v7.4.2)

Updates `@next/third-parties` from 16.3.8 to 16.4.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.4.0/packages/third-parties)

Updates `bitcoinjs-lib` from 7.0.2 to 7.0.4
- [Changelog](https://github.com/bitcoinjs/bitcoinjs-lib/blob/master/CHANGELOG.md)
- [Commits](https://github.com/bitcoinjs/bitcoinjs-lib/commits)

---
updated-dependencies:
- dependency-name: "@libp2p/circuit-relay-v2"
  dependency-version: 4.2.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@libp2p/identify"
  dependency-version: 4.1.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@libp2p/interface"
  dependency-version: 3.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@libp2p/interface-internal"
  dependency-version: 3.1.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@libp2p/utils"
  dependency-version: 7.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@libp2p/webrtc"
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@libp2p/websockets"
  dependency-version: 10.1.22
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@nestjs/common"
  dependency-version: 12.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@nestjs/core"
  dependency-version: 12.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@nestjs/platform-express"
  dependency-version: 12.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@next/third-parties"
  dependency-version: 16.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@types/node"
  dependency-version: 26.6.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: bitcoinjs-lib
  dependency-version: 7.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: fumadocs-core
  dependency-version: 16.17.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: fumadocs-mdx
  dependency-version: 15.4.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: fumadocs-ui
  dependency-version: 16.17.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: libp2p
  dependency-version: 3.3.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: lucide-react
  dependency-version: 1.56.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: mermaid
  dependency-version: 12.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: next
  dependency-version: 16.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: prettier
  dependency-version: 3.9.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: zod
  dependency-version: 4.6.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore(deps): bump the production-dependencies group with 22 updates chore(deps): bump the production-dependencies group across 1 directory with 22 updates Oct 15, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/dev/production-dependencies-963ffabc86 branch from 9754991 to 7e1cec8 Compare October 15, 2026 11:44
@Hanssen0-Alter-Ego ChatGPT Codex Connector

Hanssen0-Alter-Ego commented Oct 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Related: #581 (#581), which migrates to @scure/btc-signer. Let's hold the bitcoinjs-lib bump in this PR and coordinate it with that migration, so we avoid upgrading the dependency only to remove it immediately afterward. The other dependency updates can be assessed separately.

Review evidence from 2026-10-16

Sharing the recorded dependency-review results here so they are available to other reviewers.

  • Reviewed head: 7e1cec87086b5a7f8c68b1c180d2b20c9d7ca785
  • Reviewed base: ce8856238126dd67569671667ffdf5695a2dbbac
  • Both refs were rechecked on 2026-10-17 and still match. This publication does not represent a new test run.
  • Scope: all 22 dependency updates; the PR changes three private-app manifests and pnpm-lock.yaml, not application/SDK implementation.

The recorded review found no reproducible PR-introduced defect requiring an additional CCC implementation change or a dependency split, within the coverage below. The coordination/hold for #581 above remains in place. This comment records evidence, not a merge action or formal approval.

Results and important limits

Base and head each passed 60 test files / 623 tests, SDK builds and CJS/ESM consumers. The review also exercised Bitcoin PSBT cases, real browser libp2p relay traffic, docs/search/diagrams, Playground formatting/execution and the faucet controller.

Coverage is qualified:

  • Real wallets and transaction broadcast were not tested.
  • WebRTC UDP direct connections failed in both revisions in the restricted test environment; a native browser-only reproduction also gathered no ICE candidates. Relay success is not direct-connection success. UDP/NAT/STUN/TURN and Safari/Firefox remain unverified.
  • Docs builds used the same local font fixture after original Google Fonts fetches failed in both revisions. Playground used installed matching Monaco assets after its CDN was blocked. These results do not verify external fonts/CDN availability.
  • Bitcoin npm artifacts were compared and registry signatures/integrity verified, but their reported gitHead commits were not retrievable from the official repository at review time. Source-to-published-build provenance was not established.
  • pnpm audit exited 1 on both revisions because existing advisories remain; this is not a clean security audit.

The historical CI evidence is Actions run 38729451793: its recorded job ran install, pnpm build:all, pnpm lint and pnpm test:ci. That run used merge commit c8da7ebae4e44f2750b899dee62221ad0e96a25d; this update does not claim to have rerun or verified CI for a newly generated merge commit.

Executed repository commands and results

Run repository commands from the matching base/head checkout. The primary recorded local toolchain was Node 24.19 / pnpm 11.19. A separate head install and test:ci used the CI-matching Node 26.12.0 / pnpm 11.8.0. Installation deliberately disabled lifecycle scripts; builds were run explicitly.

Check Recorded scope/result
pnpm install --frozen-lockfile --ignore-scripts Base/head passed; head also passed with the CI-matching toolchain
pnpm build Base/head SDK builds passed
pnpm lint Head passed
pnpm exec vitest run Base/head each passed 60 files / 623 tests
pnpm -C packages/tests test Base/head CJS and ESM consumers passed
pnpm test:ci Head passed with Node 26.12.0 / pnpm 11.8.0, including CJS/ESM and 60 files / 623 tests
Production builds Head app, playground, faucet and examples passed; base playground and faucet passed
pnpm -C packages/docs build Original network-dependent builds failed in both revisions; both passed with the same local font fixture, generating 284 pages each
pnpm -C packages/docs types:check Head passed
pnpm -C packages/docs verify-llm against the completed local production build Base/head passed LLM endpoints, content negotiation and 45 internal Markdown links
pnpm audit --json Both exited 1; advisory count changed 34 to 33 with no added advisory ID

The fixtures and standalone diagnostic harnesses used for the targeted checks below are separate from these repository commands. Their complete source/raw logs are not attached to this comment, so the descriptions below are recorded test evidence, not a self-contained downloadable reproduction bundle.

Targeted base/head checks and observed outcomes

Bitcoin / Xverse-compatible PSBT behavior

  • Actual npm 7.0.2/7.0.3/7.0.4 CJS and ESM artifacts were compared. This is a v7-to-v7 update; bigint/Uint8Array APIs already existed in the base.
  • Using real cryptographic libraries with synthetic UTXOs: P2PKH, P2WPKH, P2SH-P2WPKH, consistent dual-UTXO and Taproot keypath cases all signed/finalized successfully, with identical final transaction bytes across base/head.
  • Three inconsistent-UTXO/stale-cache cases were accepted by the old version and correctly rejected by the new version: conflicting dual UTXOs, cached values followed by updateInput, and cached values followed by combine.
  • The changed transitive integer-reading implementation was checked with 144,000 deterministic signed/unsigned, LE/BE, Buffer/Uint8Array/subarray reads against the old version and Node Buffer; values matched. Both versions rejected 120 invalid offsets.
  • Existing Xverse mock-provider tests are included in the 623-test suite; no real wallet or broadcast was used.

libp2p

  • Two Chromium pages used CCC pairingService, JsonRpcService and JsonRpcTransportLibp2p with a localhost WebSocket relay.
  • Base/head both passed pairing, echo, a 131,072-byte payload round trip and 10 concurrent requests with the local diagnostic relay quota set to 8 MiB.
  • The default 128 KiB relay quota initially caused EOF on the large round trip in both revisions. Only the diagnostic relay quota was increased; this was not a production change.
  • Full direct-WebRTC attempts timed out in both revisions. The direct-connect limitation stated above remains open.

Docs / Playground / app

  • Base/head English and Chinese search returned HTTP 200; Chromium search and Mermaid SVG rendering passed without page errors.
  • New CSS Highlight API behavior worked in Chromium despite the CSS optimizer warning; the two versions use different highlighting mechanisms.
  • With the local Monaco fixture, base/head editor load, Format and Run succeeded and printed the expected 1.
  • Head app home and Khie UI mounted; this did not connect a real wallet.

Faucet / icons

  • Real compiled Nest controller and ValidationPipe with a fake TapService: base/head returned the expected 200, 400 for missing amount, and 404 for an unknown route.
  • All 69 statically imported Lucide icons rendered with SSR in both versions; no old exports were removed.
Dependency decisions and follow-up work
  • libp2p family: the WebRTC addition is webRTC-direct-v2; CCC uses webRTC(), not webRTCDirect(). No transport-config migration was supported by the reviewed changes. The intermediate “abort only after ping failure” behavior was reverted in the reviewed range. Correct per-package comparisons were used rather than the mismatched compare links in parts of the generated PR description.
  • Next / @next/third-parties: reviewed together; Cache Components/partialPrefetching did not become automatically enabled in CCC's existing configuration. No evidence required changing the existing bundler workaround.
  • Fumadocs core / UI / MDX: current peer requirements are satisfied and the set should remain coordinated. CCC uses the standard provider/search server, not the removed custom-search interfaces. No custom search adapter was required.
  • Mermaid / Zod / Prettier: exercised through docs compilation/diagrams and Playground formatting. No CCC call-site migration was supported by the checks.
  • Nest common / core / platform-express: controller/validation checks and builds passed; no additional CCC DI or middleware change was identified.
  • Lucide / @types/node: used icons remained available; the reviewed type changes did not require adapting CCC's existing calls.
  • bitcoinjs-lib: the reviewed behavior changes tighten UTXO consistency and invalidate stale caches. They did not require a bigint/Uint8Array migration. The published Xverse dependency range remains ^7.0.1, so this lockfile update does not force existing downstream lockfiles to use 7.0.4.
  • Across the 22 updates, no new direct Node-engine floor or unmet peer requirement was identified. All 104 added lockfile resolutions matched registry integrity metadata; 44 old/new version records passed registry-signature verification. These checks do not establish reproducible builds or the absence of malicious behavior.
  • The changed manifests are private applications; public SDK runtime dependencies remain external. No additional SDK changeset was supported solely by this lockfile/private-app update.

Nonblocking follow-ups from the original review:

  1. Preserve the five valid and three invalid Bitcoin cases as repository regression tests, including requested-input finalization behavior.
  2. Run direct-WebRTC base/head tests in a normal UDP-capable environment, verifying a direct connection and echo, then relay fallback. Cross-NAT and additional browsers need separate coverage.
  3. Promote docs/search/Mermaid and Playground Format/Run diagnostics into repeatable browser tests with controlled fixtures.
  4. Obtain accessible upstream Bitcoin source refs/build provenance for comparison with the published artifacts.

These are follow-up test/provenance tasks, not newly discovered P0–P3 defects. Any later head change requires an incremental recheck.

Generated by ChatGPT · Alter Ego

This was referenced Oct 17, 2026
Closed
Merged
@dependabot @github

dependabot Bot commented on behalf of github Oct 17, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are no longer updatable, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 17, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/dev/production-dependencies-963ffabc86 branch October 17, 2026 19:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Hanssen0-Alter-Ego