fix(deps): update all non-major dependencies (patch)

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@floating-ui/react-dom (source)	2.1.4 → 2.1.6
@iconify-json/material-symbols	1.2.28 → 1.2.52
@iconify-json/mingcute	1.2.3 → 1.2.6
@mdx-js/react (source)	3.1.0 → 3.1.1
@mdx-js/rollup (source)	3.1.0 → 3.1.1
@next/bundle-analyzer (source)	15.3.4 → 15.3.8
@​openpanel/nextjs	1.0.8 → 1.0.20
@radix-ui/react-avatar (source)	1.1.10 → 1.1.11
@radix-ui/react-dialog (source)	1.1.14 → 1.1.15
@radix-ui/react-dropdown-menu (source)	2.1.15 → 2.1.16
@radix-ui/react-label (source)	2.1.7 → 2.1.8
@radix-ui/react-scroll-area (source)	1.2.9 → 1.2.10
@radix-ui/react-select (source)	2.2.5 → 2.2.6
@radix-ui/react-slider (source)	1.3.5 → 1.3.6
@radix-ui/react-switch (source)	1.2.5 → 1.2.6
@radix-ui/react-tabs (source)	1.1.12 → 1.1.13
@simplewebauthn/browser (source)	13.1.0 → 13.1.2
@tailwindcss/typography	0.5.16 → 0.5.19
@types/chroma-js (source)	3.1.1 → 3.1.2
@types/katex (source)	^0.16.7 → ^0.16.8
@types/node (source)	24.0.10 → 24.0.15
@types/react (source)	^18.3.23 → ^18.3.27
@types/react (source)	18.3.23 → 18.3.27
autoprefixer	10.4.21 → 10.4.23
chroma-js	3.1.2 → 3.1.4
code-inspector-plugin (source)	0.20.15 → 0.20.17
dayjs (source)	1.11.13 → 1.11.19
emoji-picker-react (source)	4.12.3 → 4.12.4
es-toolkit (source)	1.39.6 → 1.39.10
eslint-config-hyoban	4.0.8 → 4.0.10
foxact (source)	0.2.49 → 0.2.52
immer	^10.1.1 → ^10.1.3
katex (source)	^0.16.22 → ^0.16.27
kbar	0.1.0-beta.45 → 0.1.0-beta.48
lint-staged	16.1.2 → 16.1.6
mermaid	11.10.0 → 11.10.1
nanoid	^5.1.5 → ^5.1.6
react-error-boundary (source)	6.0.0 → 6.0.3
remove-markdown	0.6.2 → 0.6.3
simple-git-hooks	2.13.0 → 2.13.1
socket.io-client (source)	4.8.1 → 4.8.3
sonner (source)	2.0.5 → 2.0.7
tailwindcss (source)	3.4.17 → 3.4.19
unplugin-macros	0.17.0 → 0.17.2

---

Release Notes

floating-ui/floating-ui (@​floating-ui/react-dom)

v2.1.6

Compare Source

Patch Changes

• Update dependencies: @floating-ui/dom@1.7.4

v2.1.5

Compare Source

Patch Changes

• Update dependencies: @floating-ui/dom@1.7.3

mdx-js/mdx (@​mdx-js/react)

v3.1.1

Compare Source

Fix

• 3cad7d7 @mdx-js/mdx: add dependency on acorn
• 0dc4472 @mdx-js/esbuild: fix crash with esbuild loader and jsx option
  by @​egnor in #​2593
• 84ec66e @mdx-js/esbuild: refactor to improve error conversion in esbuild
  by @​egnor in #​2595
• 2b3381a @mdx-js/rollup: fix support for query parameters in Vite
  by @​markdalgleish in #​2629

Types

• 933ab44 @mdx-js/mdx: add attributes to export/import declarations

Docs

• c156a1f Add rehype-mdx-toc to list of plugin
  by @​boning-w in #​2622
• 913659c Add recma-module-to-function to list of plugins
  by @​remcohaszing in #​2605
• 67fb1d0 Remove unneeded JSX type casting in docs, tests
• f0d20da Remove local use of JSX
  by @​remcohaszing in #​2604
• 63f39ce Remove references to twitter
• 35ac59d Refactor some docs regarding recma plugins

Full Changelog: mdx-js/mdx@3.1.0...3.1.1

vercel/next.js (@​next/bundle-analyzer)

v15.3.8

Compare Source

Please see the Next.js Security Update for information about this security patch.

v15.3.7

Compare Source

v15.3.6

Compare Source

Please see CVE-2025-66478 for additional details about this release.

v15.3.5

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Turbopack: list assert/strict as external (#​80884)
• omit searchParam data from FlightRouterState before transport (#​80734)
• bugfix: propagate staleTime to seeded prefetch entry (#​81263)

Misc Changes

• document turbopack trace viewer (#​78184)

Credits

Huge thanks to @​ztanner, @​mischnic, and @​bgw for helping!

radix-ui/primitives (@​radix-ui/react-select)

v2.2.6

MasterKale/SimpleWebAuthn (@​simplewebauthn/browser)

v13.1.2

Compare Source

Changes

• [browser] [server] Exported the ResidentKeyRequirement type to help with type inference
  (#​704)

tailwindlabs/tailwindcss-typography (@​tailwindcss/typography)

v0.5.19

Compare Source

Fixed

• Fixed broken color styles (#​405)

v0.5.18

Compare Source

Fixed

• Fixed undefined variable error (#​403)

v0.5.17

Compare Source

Added

• Add modifiers for description list elements (#​357)
• Add prose-picture modifier (#​367)

Fixed

• Include unit in hr border-width value (#​379)
• Ensure <kbd> styles work with Tailwind CSS v4 (#​387)

Changed

• Remove lodash dependencies (#​402)

postcss/autoprefixer (autoprefixer)

v10.4.23

Compare Source

• Reduced dependencies (by @​hyperz111).

v10.4.22

Compare Source

• Fixed stretch prefixes on new Can I Use database.
• Updated fraction.js.

gka/chroma.js (chroma-js)

v3.1.4

Compare Source

What's Changed

• docs: fix discord link (resolves #​373) by @​gka in #​379
• feat: chroma.random accepts rng as argument by @​gka in #​378

Full Changelog: gka/chroma.js@v3.1.3...v3.1.4

iamkun/dayjs (dayjs)

v1.11.19

Compare Source

Bug Fixes

• added usage warnings for diff + updated unit tests (#​2948) (269a7a9)
• dont instantiate regexes within ar locale functions to avoid performance overhead (#​2898) (af5e9f0)
• replace italian locale "un' ora fa" with "un'ora fa", add tests for it (#​2930) (9e9f76c)
• Updated Belarusian locale with relative time (#​2656) (1d8746c)

v1.11.18

Compare Source

Bug Fixes

• error semantic-release dependency (8cfb313)

v1.11.17

Compare Source

Bug Fixes

• [en-AU] locale use the same ordinal as moment (#​2878) (1b95ecd)

v1.11.16

Compare Source

Bug Fixes

• test release workflow (no code changes) (c38c428)

v1.11.15

Compare Source

Bug Fixes

• Fix misspellings in Irish or Irish Gaelic [ga] (#​2861) (9c14a42)

v1.11.14

Compare Source

Bug Fixes

• .utcOffset(0, true) result and its clone are different bug (#​2505) (fefdcd4)

ealush/emoji-picker-react (emoji-picker-react)

v4.12.4

Compare Source

toss/es-toolkit (es-toolkit)

v1.39.10

Compare Source

Released on August 17th, 2025.

• Fixed defaultsDeep to properly handle deep merging of objects in arrays
• Fixed several documentation issues and examples across multiple functions

We sincerely thank @​wo-o29, @​thwlckd, @​kilimandzharov, and @​dayongkr for their contributions. We appreciate your great efforts!

v1.39.9

Compare Source

Released on August 10th, 2025.

• Fixed mergeWith to properly handle null values returned from customizer function.
• Fixed cloneDeepWith to properly handle customizer returning null values.
• Fixed some of the documentation issues.

We sincerely thank @​raon0211, @​joshkel, and @​Najeong-Kim for their contributions. We appreciate your great efforts!

v1.39.8

Compare Source

Released on July 25th, 2025.

• Aligned the types of fill, pullAll, pullAllBy, pullAllWith, pullAt, remove, and reverse in our compatibility library with the latest Lodash types (@types/lodash v4.17.20).

v1.39.7

Compare Source

Released on July 9th, 2025.

• Fixed a compatibility issue with Lodash's debounce and throttle functions.
• Remove useless source map for reduce bundle size.
• Fix some of the documentation issues.

We sincerely thank @​dayongkr, @​cobocho, @​raon0211, and @​D-Sketon for their contributions. We appreciate your great efforts!

hyoban/eslint-config-hyoban (eslint-config-hyoban)

v4.0.10

Compare Source

   🐞 Bug Fixes

• Update deps  -  by @​hyoban (63b8e)

    View changes on GitHub

v4.0.9

Compare Source

   🐞 Bug Fixes

• Update deps  -  by @​hyoban (8514b)

    View changes on GitHub

SukkaW/foxact (foxact)

v0.2.52

Compare Source

v0.2.51

Compare Source

v0.2.50

Compare Source

immerjs/immer (immer)

v10.1.3

Compare Source

Bug Fixes

• Mark exports as pure, for better tree-shakability (#​1124) (85faaa2)

v10.1.2

Compare Source

Bug Fixes

• non-enumerable (immutable) methods on Map/Set (#​1069) (aa24400)
• Update package.json exports for react-native (#​1159) (b2fcc66)

KaTeX/KaTeX (katex)

v0.16.27

Compare Source

Features

• support equals sign and surrounding whitespace in \htmlData attribute values (#​4112) (c77aaec)

v0.16.26

Compare Source

Bug Fixes

• \mathop followed by integral symbol (6fbad18)

v0.16.25

Compare Source

Features

• css: provide katex-swap.css that uses font-display: swap (#​3940) (b3f9ce6), closes #​2242

v0.16.24

Compare Source

Features

• support hex colors with alpha (#​4090) (8c9b306), closes #​4067 #fA6 #fA6f1

v0.16.23

Compare Source

Bug Fixes

• Support \def with arguments via macros option (#​4087) (80a8158)

timc1/kbar (kbar)

v0.1.0-beta.48

Compare Source

Bug fixes

Fixes an issue where the active index resets when actions are registered async (2473c30)

v0.1.0-beta.47

Compare Source

Bug fixes

• Fixes an issue where the active index resets when actions are registered async (2473c30)

v0.1.0-beta.46

Compare Source

lint-staged/lint-staged (lint-staged)

v16.1.6

Compare Source

Patch Changes

• #​1610 e93578e Thanks @​iiroj! - Try to improve terminating of subprocess of tasks by using SIGKILL, and only calling pidtree when the the main task process has a known pid.

v16.1.5

Compare Source

Patch Changes

• #​1608 4e3ce22 Thanks @​srsatt! - Detect the git repo's top-level directory correctly when in a worktree.

v16.1.4

Compare Source

Patch Changes

• #​1604 90b37b0 Thanks @​iiroj! - Add another types field to package.json to make even more sure NPM detects that lint-staged includes built-in TypeScript type definitions.

v16.1.3

Compare Source

Patch Changes

• #​1602 7ea700b Thanks @​dword-design! - Add the types field to package.json to make sure NPM detects lint-staged includes built-in TypeScript type definitions.

mermaid-js/mermaid (mermaid)

v11.10.1

Compare Source

Patch Changes

• #​6886 e0b45c2 Thanks @​darshanr0107! - fix: Handle arrows correctly when auto number is enabled

ai/nanoid (nanoid)

v5.1.6

Compare Source

• Fixed infinite loop on 0 size for customAlphabet.

bvaughn/react-error-boundary (react-error-boundary)

v6.0.3

Compare Source

• Removed react-dom from peer dependencies list; it was accidentally added during a previous internal refactor

v6.0.2

Compare Source

Updated README and generated TS docs

v6.0.1

Compare Source

zuchka/remove-markdown (remove-markdown)

v0.6.3

Compare Source

Added

• New separateLinksAndTexts option to replace inline links with text and URL separated by a custom string (#​101 by @​tafel)
  • Example: removeMd('[link](http://example.com)', { separateLinksAndTexts: ': ' }) returns 'link: http://example.com'

toplenboren/simple-git-hooks (simple-git-hooks)

v2.13.1

Compare Source

Patch Changes

• #​128 2ad5514 Thanks @​OlofFredriksson! - fix: postinstall should ignore adding hooks if SKIP_INSTALL_SIMPLE_GIT_HOOKS is defined

• #​130 1abdcd7 Thanks @​cexoso! - fix: only get local coore.hooksPath config

socketio/socket.io (socket.io-client)

v4.8.3

Compare Source

v4.8.2

Compare Source

Bug Fixes

• bundle: do not mangle the "_placeholder" attribute (bis) (cdae019)
• drain queue before emitting "connect" (#​5259) (d19928e)

Dependencies

• engine.io-client@~6.6.1 (no change)
• ws@~8.17.1 (no change)

emilkowalski/sonner (sonner)

v2.0.7

Compare Source

Sonner now supports multiple <Toaster /> components, see more here.

What's Changed

• feat: add testId prop for individual toast components by @​b-like-bahar in #​660
• feat(toaster): add support for multiple toasters with unique identifiers by [@​taroj1205](https://redi

---

Configuration

📅 Schedule: Branch creation - "after 9pm,before 9am" in timezone Asia/Shanghai, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
shiro	Error		Jan 20, 2026 4:51pm

[github-actions]

📦 Next.js Bundle Analysis for Shiro

This analysis was generated by the Next.js Bundle Analysis action. 🤖

This PR introduced no changes to the JavaScript bundle! 🙌

[github-actions]

📦 Next.js Bundle Analysis for Shiro

This analysis was generated by the Next.js Bundle Analysis action. 🤖

This PR introduced no changes to the JavaScript bundle! 🙌

[github-actions]

📦 Next.js Bundle Analysis for Shiro

This analysis was generated by the Next.js Bundle Analysis action. 🤖

🎉 Global Bundle Size Decreased

Page	Size (compressed)
global	87.35 KB (-2 B)

Details

The global bundle is the javascript bundle that loads alongside every page. It is in its own category because its impact is much higher - an increase to its size means that every page on your website loads slower, and a decrease means every page loads faster.

Any third party scripts you have added directly to your app using the <script> tag are not accounted for in this analysis

If you want further insight into what is behind the changes, give @next/bundle-analyzer a try!

[github-actions]

📦 Next.js Bundle Analysis for Shiro

This analysis was generated by the Next.js Bundle Analysis action. 🤖

🎉 Global Bundle Size Decreased

Page	Size (compressed)
global	87.35 KB (-2 B)

Details

The global bundle is the javascript bundle that loads alongside every page. It is in its own category because its impact is much higher - an increase to its size means that every page on your website loads slower, and a decrease means every page loads faster.

Any third party scripts you have added directly to your app using the <script> tag are not accounted for in this analysis

If you want further insight into what is behind the changes, give @next/bundle-analyzer a try!

[github-actions]

📦 Next.js Bundle Analysis for Shiro

This analysis was generated by the Next.js Bundle Analysis action. 🤖

🎉 Global Bundle Size Decreased

Page	Size (compressed)
global	87.35 KB (-1 B)

Details

The global bundle is the javascript bundle that loads alongside every page. It is in its own category because its impact is much higher - an increase to its size means that every page on your website loads slower, and a decrease means every page loads faster.

Any third party scripts you have added directly to your app using the <script> tag are not accounted for in this analysis

If you want further insight into what is behind the changes, give @next/bundle-analyzer a try!

[github-actions]

📦 Next.js Bundle Analysis for Shiro

This analysis was generated by the Next.js Bundle Analysis action. 🤖

🎉 Global Bundle Size Decreased

Page	Size (compressed)
global	87.35 KB (-2 B)

Details

The global bundle is the javascript bundle that loads alongside every page. It is in its own category because its impact is much higher - an increase to its size means that every page on your website loads slower, and a decrease means every page loads faster.

Any third party scripts you have added directly to your app using the <script> tag are not accounted for in this analysis

If you want further insight into what is behind the changes, give @next/bundle-analyzer a try!

[github-actions]

📦 Next.js Bundle Analysis for Shiro

This analysis was generated by the Next.js Bundle Analysis action. 🤖

🎉 Global Bundle Size Decreased

Page	Size (compressed)
global	87.35 KB (-1 B)

Details

The global bundle is the javascript bundle that loads alongside every page. It is in its own category because its impact is much higher - an increase to its size means that every page on your website loads slower, and a decrease means every page loads faster.

Any third party scripts you have added directly to your app using the <script> tag are not accounted for in this analysis

If you want further insight into what is behind the changes, give @next/bundle-analyzer a try!

[github-actions]

📦 Next.js Bundle Analysis for Shiro

This analysis was generated by the Next.js Bundle Analysis action. 🤖

🎉 Global Bundle Size Decreased

Page	Size (compressed)
global	87.35 KB (-2 B)

Details

The global bundle is the javascript bundle that loads alongside every page. It is in its own category because its impact is much higher - an increase to its size means that every page on your website loads slower, and a decrease means every page loads faster.

Any third party scripts you have added directly to your app using the <script> tag are not accounted for in this analysis

If you want further insight into what is behind the changes, give @next/bundle-analyzer a try!

[github-actions]

📦 Next.js Bundle Analysis for Shiro

This analysis was generated by the Next.js Bundle Analysis action. 🤖

This PR introduced no changes to the JavaScript bundle! 🙌

[github-actions]

📦 Next.js Bundle Analysis for Shiro

This analysis was generated by the Next.js Bundle Analysis action. 🤖

🎉 Global Bundle Size Decreased

Page	Size (compressed)
global	87.35 KB (-2 B)

Details

The global bundle is the javascript bundle that loads alongside every page. It is in its own category because its impact is much higher - an increase to its size means that every page on your website loads slower, and a decrease means every page loads faster.

Any third party scripts you have added directly to your app using the <script> tag are not accounted for in this analysis

If you want further insight into what is behind the changes, give @next/bundle-analyzer a try!