[dependabot]

Bumps the production-minor-patch group with 23 updates:

Package	From	To
@upstash/redis	1.38.3	1.38.4
@graphql-tools/schema	10.1.0	10.1.1
zod	4.5.0-canary.20260827T054049	4.6.5
@graphql-tools/graphql-file-loader	8.1.19	8.1.20
@graphql-tools/load	8.1.16	8.1.17
@graphql-tools/utils	12.0.0	12.0.1
@upstash/ratelimit	2.0.8	2.1.0
graphql-ws	6.2.1	6.2.2
jose	6.2.10	6.2.12
@nosecone/next	1.11.0	1.13.0
@sentry/nextjs	10.71.0	10.75.0
@tanstack/react-virtual	3.14.10	3.14.13
katex	0.18.4	0.18.7
lucide-react	1.34.0	1.47.0
modern-cmdk	1.2.1	1.2.2
motion	13.1.1	13.4.0
next-intl	4.14.0	4.14.5
nosecone	1.11.0	1.13.0
tailwind-merge	3.6.0	3.7.0
three	0.185.1	0.186.0
@hono/zod-validator	0.9.0	0.9.1
hono	4.13.5	4.13.8
modern-pdf-lib	0.40.2	0.40.3

Updates @upstash/redis from 1.38.3 to 1.38.4

Release notes

Sourced from @​upstash/redis's releases.

@​upstash/redis@​1.38.4

Patch Changes

• 7ac8182: Fix read-your-writes sending a stale upstash-sync-token

  A read issued straight after a write travelled with the token from before that write, so the server was under no obligation to serve the write and readYourWrites silently did not hold.

  HttpClient.request() snapshotted the outgoing headers with mergeHeaders(this.headers, ...) and only afterwards wrote the freshest token into this.headers, so the token learned from response N first shipped with request N+2. The assignment now happens before the merge.

  This regressed in 1.34.5. In 1.34.0–1.34.4 the request options held headers: this.headers by reference, so the late write was still picked up before fetch; 1.34.5 introduced per-request header merging, which turned that reference into a copy without moving the assignment.

Commits

• 73fbe1a chore: version packages (#1448)
• 7ac8182 DX-2995: fix read-your-writes sending a stale upstash-sync-token (#1447)
• 1bec566 ci: poll npm for the ci version instead of a fixed sleep (#1444)
• See full diff in compare view

Updates @graphql-tools/schema from 10.1.0 to 10.1.1

Changelog

Sourced from @​graphql-tools/schema's changelog.

10.1.1

Patch Changes

• Updated dependencies [2262087, 5523c4b, 60db079, 57e316d, 1c1c5a0, 1c1c5a0, 0b9529f]:
  • @​graphql-tools/merge@​9.2.4
  • @​graphql-tools/utils@​12.0.1

Commits

• 8b9b7df chore(release): update monorepo packages versions (#8365)
• 23ca392 chore(deps): update dependency graphql-scalars to v2 (#8385)
• ce2470a build(deps): bump the actions-deps group with 8 updates (#8377)
• 0f00a44 chore: use HTTPS git URLs for package repository metadata (#8376)
• See full diff in compare view

Updates zod from 4.5.0-canary.20260827T054049 to 4.6.5

Release notes

Sourced from zod's releases.

v4.6.5

Commits:

• d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post
• f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
• de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)
• 56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)
• ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"
• cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""
• 0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5
• 59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

• d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)
• ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)
• 2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
• f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

• 413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged
• 75d63ee1 docs: show only the .properties() method form in the 4.6 post
• 46da9572 docs: match the error-message examples to what the parsers emit

v4.6.2

A patch on top of 4.6.1.

• 9446b5cc fix: preserve undefined prefault outputs and object keys (#6587) — closes #6585
• 0c483c58 docs: the Zod 4.6 announcement post (#6546)
• a00c3f34 docs: use Trigger.dev's brand-kit lockups for the platinum card

v4.6.1

A patch on top of 4.6.0.

• b12aa523 fix: preserve unique tags with defaulted discriminators (#6582) — closes #6577
• dd9c36fa fix(v4): defer recursive object index inference (#6580)
• 3b154992 feat(lang): add Tajik (tg) locale (#6581) by @​ismoil77
• 2efa8b80 ci: give the npm wait a real budget and drop the back-publish path (#6583)

v4.6.0

Zod 4.6 is now available.

npm install zod@latest

At a glance:

... (truncated)

Commits

• See full diff in compare view

Updates @graphql-tools/graphql-file-loader from 8.1.19 to 8.1.20

Changelog

Sourced from @​graphql-tools/graphql-file-loader's changelog.

8.1.20

Patch Changes

• #8383 04e8159 Thanks @​ardatan! - # import "./file.graphql" (space after #) is a valid default import, and #import is processed even when it is not the first non-blank line of the file.
• Updated dependencies [04e8159, 04e8159, 04e8159, 04e8159, 04e8159, 60db079, 57e316d, 1c1c5a0, 1c1c5a0, 0b9529f]:
  • @​graphql-tools/import@​7.2.0
  • @​graphql-tools/utils@​12.0.1

Commits

• 8b9b7df chore(release): update monorepo packages versions (#8365)
• 04e8159 fix(import): union interfaces, require: paths, comments, webpack esModule (#8...
• 0f00a44 chore: use HTTPS git URLs for package repository metadata (#8376)
• See full diff in compare view

Updates @graphql-tools/load from 8.1.16 to 8.1.17

Changelog

Sourced from @​graphql-tools/load's changelog.

8.1.17

Patch Changes

• #6660 12df2f5 Thanks @​eirikur-nc! - Load custom schema/document loaders with import() after createRequire, so ESM loader files and packages work with async load (including graphql-codegen). Closes #6656.

• #8370 1c1c5a0 Thanks @​ardatan! - Always include "Failed to find any GraphQL type definitions" context when loaders error, even if there is only one error. Fixes #7406.

• Updated dependencies [60db079, 57e316d, 1c1c5a0, 1c1c5a0, 0b9529f]:

  • @​graphql-tools/utils@​12.0.1
  • @​graphql-tools/schema@​10.1.1

Commits

• 8b9b7df chore(release): update monorepo packages versions (#8365)
• 12df2f5 fix(load): support ESM custom loaders (#6660)
• 04e8159 fix(import): union interfaces, require: paths, comments, webpack esModule (#8...
• 0f00a44 chore: use HTTPS git URLs for package repository metadata (#8376)
• 1c1c5a0 fix: load errors, observable cleanup, descriptions, and import attributes (#8...
• See full diff in compare view

Updates @graphql-tools/utils from 12.0.0 to 12.0.1

Changelog

Sourced from @​graphql-tools/utils's changelog.

12.0.1

Patch Changes

• #8368 60db079 Thanks @​ardatan! - Omit mutation/subscription from printSchemaWithDirectives when those root types are no longer present on the schema (e.g. after pruneSchema).

• #8366 57e316d Thanks @​ardatan! - Allow % in paths checked by isValidPath (e.g. directories from URL-encoded repo names).

• #8370 1c1c5a0 Thanks @​ardatan! - Clean up observableToAsyncIterable queues and unsubscribe when the observable completes, so iterators do not retain references after done. Fixes leak detection flakes related to #8057.

• #8370 1c1c5a0 Thanks @​ardatan! - Prefer runtime description values over stale astNode descriptions in printSchemaWithDirectives / getDescriptionNode. Fixes #5508.

• #8423 0b9529f Thanks @​enisdenjo! - Fix prototype pollution in mergeDeep

  Source keys named __proto__, constructor or prototype are now skipped at every recursion level, and the check for an existing key uses hasOwnProperty instead of in, so inherited properties are never used as merge targets.

  Previously, merging untrusted data such as JSON.parse('{"constructor":{"__proto__":{"call":"x"}}}') could reach and overwrite properties on Object.prototype or Function.prototype.

Commits

• 8b9b7df chore(release): update monorepo packages versions (#8365)
• 0b9529f Fix prototype pollution in mergeDeep (#8423)
• 23ca392 chore(deps): update dependency graphql-scalars to v2 (#8385)
• 60db079 fix(utils): omit pruned root operations from printSchemaWithDirectives (#8368)
• ce2470a build(deps): bump the actions-deps group with 8 updates (#8377)
• 0f00a44 chore: use HTTPS git URLs for package repository metadata (#8376)
• 1c1c5a0 fix: load errors, observable cleanup, descriptions, and import attributes (#8...
• 57e316d fix: optimize descriptions, isValidPath %, and mock resolverValidationOptions...
• See full diff in compare view

Updates @upstash/ratelimit from 2.0.8 to 2.1.0

Release notes

Sourced from @​upstash/ratelimit's releases.

v2.1.0

What's Changed

• DX-2363: add skill files by @​CahidArda in upstash/ratelimit-js#148
• DX-2278: update release to use npm OIDC by @​CahidArda in upstash/ratelimit-js#149
• DX-2861: add sdk telemetry by @​ytkimirti in upstash/ratelimit-js#153
• chore: add npm bugs and homepage metadata, fix repository URL by @​XananasX7 in upstash/ratelimit-js#152
• DX-2954: poll npm for the ci version instead of a fixed sleep by @​CahidArda in upstash/ratelimit-js#155
• feat: run lua scripts with allow-key-locking flag by @​CahidArda in upstash/ratelimit-js#154

New Contributors

• @​XananasX7 made their first contribution in upstash/ratelimit-js#152

Full Changelog: upstash/ratelimit-js@v2.0.8...v2.1.0

v2.1.0-rc

What's Changed

• DX-2363: add skill files by @​CahidArda in upstash/ratelimit-js#148
• DX-2278: update release to use npm OIDC by @​CahidArda in upstash/ratelimit-js#149
• DX-2861: add sdk telemetry by @​ytkimirti in upstash/ratelimit-js#153

Full Changelog: upstash/ratelimit-js@v2.0.8...v2.1.0-rc

Commits

• 7e071b9 feat: run lua scripts with allow-key-locking flag (#154)
• 89c481b DX-2954: poll npm for the ci version instead of a fixed sleep (#155)
• 91c0bad chore: add npm bugs and homepage metadata, fix repository URL (#152)
• f2fc2c7 DX-2861: add sdk telemetry (#153)
• 5b5448a DX-2479: fix package.version
• 589cc3e Rename skill from 'ratelimit-ts' to 'upstash-ratelimit-ts'
• 8db1d8d DX-2278: update release to use npm OIDC (#149)
• dbed170 feat: add skill files (#148)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​upstash/ratelimit since your current version.

Updates graphql-ws from 6.2.1 to 6.2.2

Release notes

Sourced from graphql-ws's releases.

v6.2.2

Patch Changes

• #690 1029314 Thanks @​Haasini-kudala! - Support crossws 0.4 by selecting the GraphQL WebSocket subprotocol during the upgrade handshake. Preserve automatic protocol negotiation in the legacy crossws 0.3 Node and uWebSockets adapters.

• #686 536960e Thanks @​cpruijsen! - Fix the CrossWS adapter ignoring socket closes issued from server.opened

  makeHooks only registered the peer in the clients map after server.opened returned, while send/close no-op'd unless the peer was already in that map. A protocol-mismatch close (and any other close from inside opened) was therefore dropped, the WebSocket stayed open, and no ConnectionAck was ever sent because the message handler was never installed.

Changelog

Sourced from graphql-ws's changelog.

6.2.2

Patch Changes

• #690 1029314 Thanks @​Haasini-kudala! - Support crossws 0.4 by selecting the GraphQL WebSocket subprotocol during the upgrade handshake. Preserve automatic protocol negotiation in the legacy crossws 0.3 Node and uWebSockets adapters.

• #686 536960e Thanks @​cpruijsen! - Fix the CrossWS adapter ignoring socket closes issued from server.opened

  makeHooks only registered the peer in the clients map after server.opened returned, while send/close no-op'd unless the peer was already in that map. A protocol-mismatch close (and any other close from inside opened) was therefore dropped, the WebSocket stayed open, and no ConnectionAck was ever sent because the message handler was never installed.

Commits

• 0c1765e Upcoming Release Changes (#687)
• 1029314 fix(crossws): support version 0.4 protocol negotiation (#690)
• 34cddf6 Update example to remove AsyncGenerator (#654) (#655)
• 3649fab Update recipes.mdx abruptly closed example (#664)
• 536960e fix(crossws): close the socket even if server.opened closes immediately (#686)
• See full diff in compare view

Updates jose from 6.2.10 to 6.2.12

Release notes

Sourced from jose's releases.

v6.2.12

Documentation

• clarify and shorten public API guidance (be62530)

Refactor

• simplify JWS and JWE operation cores (92e9640)

Performance

• avoid copying AES-GCM output (6925d43)
• deduplicate pending jwks key imports (bf5138b)
• encode single-signature JWS input once (7bc9a33)
• normalize General JWE shared headers once (78637bd)
• normalize jwks selection metadata once (fd3ae3f)
• use native encoding for larger ASCII strings (b23a6f3)

v6.2.11

Documentation

• render subpath indexes as tables (94589ee)
• shorten API index descriptions (681482f)

Refactor

• model JWE key management modes (e01dda6)
• types: reduce declaration repetition (55b970f)

Changelog

Sourced from jose's changelog.

6.2.12 (2026-09-05)

Documentation

• clarify and shorten public API guidance (be62530)

Refactor

• simplify JWS and JWE operation cores (92e9640)

Performance

• avoid copying AES-GCM output (6925d43)
• deduplicate pending jwks key imports (bf5138b)
• encode single-signature JWS input once (7bc9a33)
• normalize General JWE shared headers once (78637bd)
• normalize jwks selection metadata once (fd3ae3f)
• use native encoding for larger ASCII strings (b23a6f3)

6.2.11 (2026-09-04)

Documentation

• render subpath indexes as tables (94589ee)
• shorten API index descriptions (681482f)

Refactor

• model JWE key management modes (e01dda6)
• types: reduce declaration repetition (55b970f)

Commits

• 505a55b chore(release): 6.2.12
• 7bc9a33 perf: encode single-signature JWS input once
• 78637bd perf: normalize General JWE shared headers once
• bf5138b perf: deduplicate pending jwks key imports
• b23a6f3 perf: use native encoding for larger ASCII strings
• fd3ae3f perf: normalize jwks selection metadata once
• 6925d43 perf: avoid copying AES-GCM output
• be62530 docs: clarify and shorten public API guidance
• 1b41312 build: preserve README when generation fails
• 0b51829 build: check tree-shaking for every public binding
• Additional commits viewable in compare view

Updates @nosecone/next from 1.11.0 to 1.13.0

Release notes

Sourced from @​nosecone/next's releases.

v1.13.0

[!NOTE] Guard call labels now allow underscores. These were previously remapped to invalid-label.

1.13.0 (2026-09-16)

🚀 New Features

• guard: add actor and inputs to every adapter policy (#6277) (cd0355d)
• guard: check a guard label before sending it (#6289) (19fa51a)
• sensitive-info-rampart: add classify option for custom runtimes (#6284) (fdaeebb)

🪲 Bug Fixes

• guard: report the latest reset from a denying rate-limit rule (#6288) (4c71c9c)

📝 Documentation

• skills: sync Guard policy MCP flow and portable labels (#6293) (0943ee3)

🧹 Miscellaneous Chores

• deps-dev: bump oxlint, oxfmt, and oxlint-tsgolint (#6286) (fa54554)

📚 Tests

• track connections so HTTP/2 tests terminate in node 24.20.0 (#6285) (567dc00)

🔨 Build System

• deps: bump js-yaml (#6283) (7c999ad)

v1.12.0

1.12.0 (2026-09-08)

🔒 Security updates

Fixes GHSA-gwjv-qpf9-g36x

🚀 New Features

• expose client IP provenance and diagnostics (#6259) (b89a486)
• guard: add Claude Managed Agents as @arcjet/guard/claude-managed-agents/v0 (#6265) (b137824)

... (truncated)

Changelog

Sourced from @​nosecone/next's changelog.

1.13.0 (2026-09-16)

🧹 Miscellaneous Chores

• @​nosecone/next: Synchronize arcjet-js versions

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • nosecone bumped from 1.12.0 to 1.13.0

1.12.0 (2026-09-08)

🧹 Miscellaneous Chores

• @​nosecone/next: Synchronize arcjet-js versions

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • nosecone bumped from 1.11.0 to 1.12.0

Commits

• 894bb9d chore: Release 1.13.0 (#6278)
• b3336b0 deps: periodic dependency and security updates (#6287)
• aba86fe chore: Release 1.12.0 (#6254)
• See full diff in compare view

Updates @sentry/nextjs from 10.71.0 to 10.75.0

Release notes

Sourced from @​sentry/nextjs's releases.

10.75.0

Important Changes

• feat(v10/effect): Capture errors through the Effect v4 ErrorReporter API (#24445)

  On Effect v4, Sentry.effectLayer now registers a Sentry ErrorReporter. Failures that pass through Effect.withErrorReporting, ErrorReporter.report or the built-in HTTP and RPC reporting boundaries are captured automatically, with ErrorReporter.ignore, ErrorReporter.severity and ErrorReporter.attributes annotations respected. Nothing changes on Effect v3.

Other Changes

• feat(v10/core): Accept a CollectBehavior shorthand for dataCollection.httpHeaders (#24339)
• fix(v10/browser): Release the XHR virtualError once the request completed (#24307)
• fix(v10/browser-utils): Skip nullish LCP entries in vendored web-vitals (#24349)
• fix(v10/bundler-plugins): Stamp debug IDs onto emitted source maps when disable-upload is set (#24332)
• fix(v10/core): Don't instrument the SDK's own envelope requests (#24276)
• fix(v10/nextjs): Only include emitted chunk directories in Turbopack sourcemap upload (#24295)
• fix(v10/nitro): Import from nitro/h3 instead of h3 directly (#24444)
• fix(v10/node-core): Don't recurse in logAndExitProcess on a broken stdio pipe (#24353)
• fix(v10/nuxt): Detect Nitro version via the app's Nuxt dependency chain (#24025)
• fix(v10/replay): Don't rewrite already-emitted nodes when syncing mirror attributes (#23588)

Bundle size 📦

Path	Size
@​sentry/browser	27.18 KB
@​sentry/browser - with treeshaking flags	25.66 KB
@​sentry/browser (incl. Tracing)	45.6 KB
@​sentry/browser (incl. Tracing + Span Streaming)	47.34 KB
@​sentry/browser (incl. Tracing, Profiling)	50.24 KB
@​sentry/browser (incl. Tracing, Replay)	83.99 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags	73.84 KB
@​sentry/browser (incl. Tracing, Replay with Canvas)	88.6 KB
@​sentry/browser (incl. Tracing, Replay, Feedback)	100.94 KB
@​sentry/browser (incl. Feedback)	43.94 KB
@​sentry/browser (incl. sendFeedback)	31.87 KB
@​sentry/browser (incl. FeedbackAsync)	36.88 KB
@​sentry/browser (incl. Metrics)	28.25 KB
@​sentry/browser (incl. Logs)	28.47 KB
@​sentry/browser (incl. Metrics & Logs)	29.15 KB
@​sentry/react	28.93 KB
@​sentry/react (incl. Tracing)	47.81 KB
@​sentry/vue	32.47 KB
@​sentry/vue (incl. Tracing)	47.55 KB
@​sentry/svelte	27.21 KB
CDN Bundle	29.53 KB
CDN Bundle (incl. Tracing)	47.52 KB
CDN Bundle (incl. Logs, Metrics)	31.07 KB
CDN Bundle (incl. Tracing, Logs, Metrics)	48.81 KB
CDN Bundle (incl. Replay, Logs, Metrics)	69.49 KB
CDN Bundle (incl. Tracing, Replay)	84.22 KB

... (truncated)

Changelog

Sourced from @​sentry/nextjs's changelog.

10.75.0

Important Changes

• feat(v10/effect): Capture errors through the Effect v4 ErrorReporter API (#24445)

  On Effect v4, Sentry.effectLayer now registers a Sentry ErrorReporter. Failures that pass through Effect.withErrorReporting, ErrorReporter.report or the built-in HTTP and RPC reporting boundaries are captured automatically, with ErrorReporter.ignore, ErrorReporter.severity and ErrorReporter.attributes annotations respected. Nothing changes on Effect v3.

Other Changes

• feat(v10/core): Accept a CollectBehavior shorthand for dataCollection.httpHeaders (#24339)
• fix(v10/browser): Release the XHR virtualError once the request completed (#24307)
• fix(v10/browser-utils): Skip nullish LCP entries in vendored web-vitals (#24349)
• fix(v10/bundler-plugins): Stamp debug IDs onto emitted source maps when disable-upload is set (#24332)
• fix(v10/core): Don't instrument the SDK's own envelope requests (#24276)
• fix(v10/nextjs): Only include emitted chunk directories in Turbopack sourcemap upload (#24295)
• fix(v10/nitro): Import from nitro/h3 instead of h3 directly (#24444)
• fix(v10/node-core): Don't recurse in logAndExitProcess on a broken stdio pipe (#24353)
• fix(v10/nuxt): Detect Nitro version via the app's Nuxt dependency chain (#24025)
• fix(v10/replay): Don't rewrite already-emitted nodes when syncing mirror attributes (#23588)

10.74.0

• feat(v10): Streamline isolation scope handling & reset in isolation scopes (#24152)
• fix(server-utils): Include Gemini reasoning tokens in Vercel AI token usage (#23433)
• fix(v10/browser): Set user_agent.original on all spans for consistent filtering (#24226)
• fix(v10/cloudflare): Auto-instrument classes re-exported from the worker entry (#24181)
• fix(v10/core): Guard loadModule default parameter against ESM scope (#24154)
• fix(v10/core): Match wrapped Facebook Mobile browser errors in DEFAULT_IGNORE_ERRORS (#23877)
• fix(v10/core): Resolve MCP capture policy per operation (#23796)
• fix(v10/nextjs): Fix SDK import crashing under jsdom/happy-dom (#23906)
• fix(v10/nextjs): Keep the Pages Router runtime out of App Router client bundles (#24223)
• fix(v10/nextjs): Register Vercel AI span processors on Next.js (#23773)
• fix(v10/nuxt): Windows file:// for import-in-the-middle hook and isAbsolute for C:\ (#24026)
• fix(v10/profiling-node): Bump @​sentry/node-cpu-profiler to 2.4.4 (#24238)
• fix(v10/sveltekit): Handle SvelteKit 3 error kinds in handleErrorWithSentry (#23995)
• fix(v10/sveltekit): Read Cloudflare execution context from platform.ctx (#23994)
• fix(v10/sveltekit): Read SvelteKit config from the Vite plugin (#23998)

• test(e2e): Assert Next.js Cloudflare worker bundle stays free of orchestrion bundler plugins (#23910)

Work in this release was contributed by @​halillusion and @​zkasuran. Thank you for your contributions!

10.73.0

... (truncated)

Commits

• 9ffb58c release: 10.75.0
• 664c906 meta(changelog): Update changelog for 10.75.0 (#24446)
• e3e7acc fix(v10/nitro): Import from nitro/h3 instead of h3 directly (#24444)
• 4bb51d1 feat(v10/effect): Capture errors through the Effect v4 ErrorReporter API (#24...
• 738f17e fix(v10/core): Don't instrument the SDK's own envelope requests (#24276)
• f63c56a fix(v10/node-core): Don't recurse in logAndExitProcess on a broken stdio pipe...
• 0e24355 fix(v10/browser-utils): Skip nullish LCP entries in vendored web-vitals (#24349)
• ac3ea13 fix(v10/nuxt): Detect Nitro version via the app's Nuxt dependency chain (#24025)
• 9235d43 fix(v10/nextjs): Only include emitted chunk directories in Turbopack sourcema...
• e2deda0 feat(v10/core): Accept CollectBehavior shorthand for `dataCollection.httpHe...
• Additional commits viewable in compare view

Updates @tanstack/react-virtual from 3.14.10 to 3.14.13

Release notes

Sourced from @​tanstack/react-virtual's releases.

@​tanstack/react-virtual@​3.14.13

Patch Changes

• #1282 b48e3b0 - Skip flushSync for the synchronous notify raised from measureElement. React calls measureElement from a ref callback, i.e. while it is committing, and flushSync cannot flush there — it warns in development instead. The commit phase already runs at discrete (sync) priority, so the update lands in the same lane and the same frame without flushSync. Notifies from every other path (ResizeObserver re-measures, scroll adjustments) still flush synchronously.

• Updated dependencies [06d1b6b, 2c0a0ea]:

  • @​tanstack/virtual-core@​3.17.11

@​tanstack/react-virtual@​3.14.12

Patch Changes

• Updated dependencies [ab3278c]:
  • @​tanstack/virtual-core@​3.17.10

@​tanstack/react-virtual@​3.14.11

Patch Changes

• Updated dependencies [4a0adf3]:
  • @​tanstack/virtual-core@​3.17.9

Changelog

Sourced from @​tanstack/react-virtual's changelog.

3.14.13

Patch Changes

• #1282 b48e3b0<...

  Description has been truncated

[dependabot]

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
nextcalc-pro	Ready	Preview	Sep 21, 2026 1:20pm UTC

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.