Skip to content

chore(deps)(deps): bump the prod-deps group across 1 directory with 6 updates - #35

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/prod-deps-11cf94a877
Open

chore(deps)(deps): bump the prod-deps group across 1 directory with 6 updates#35
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/prod-deps-11cf94a877

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 10, 2026

Copy link
Copy Markdown
Contributor

Bumps the prod-deps group with 6 updates in the / directory:

Package From To
ioredis 5.11.1 6.0.0
js.foresight 3.5.0 4.2.1
nanoid 5.1.16 6.0.1
next 16.2.1 16.3.0
react 19.2.4 19.2.8
react-dom 19.2.4 19.2.8

Updates ioredis from 5.11.1 to 6.0.0

Release notes

Sourced from ioredis's releases.

v6.0.0

6.0.0 (2026-07-31)

Bug Fixes

  • clear stale socket timeout on reconnect (#2148) (6455dbe)
  • cluster: recreate stale connection on circular MOVED (#2135) (08c8967)
  • cluster: validate MOVED slot to prevent Array.prototype pollution (#2151) (9618206), closes #1267
  • command: serialize large integer arguments in decimal notation (#2136) (09b8d04)
  • redis: keep reconnecting when connection closes during client setup (#2099) (#2123) (f9a66bc)
  • sentinel: preserve zero preferred slave priority (#2129) (a3f9f2d)
  • tracing: redact values for GETSET and PSETEX (#2134) (832765d)
  • types: export ScanStreamOptions, RedisStatus and ClusterStatus (#2158) (cf3bf71)

Features

BREAKING CHANGES

  • ioredis now requires Node.js 20 or newer and uses RESP3 by default. Set protocol: 2 to retain the v5 wire protocol.

v6.0.0-beta.1

6.0.0-beta.1 (2026-07-29)

Bug Fixes

  • clear stale socket timeout on reconnect (#2148) (6455dbe)
  • cluster: recreate stale connection on circular MOVED (#2135) (08c8967)
  • cluster: validate MOVED slot to prevent Array.prototype pollution (#2151) (9618206), closes #1267
  • command: serialize large integer arguments in decimal notation (#2136) (09b8d04)
  • redis: keep reconnecting when connection closes during client setup (#2099) (#2123) (f9a66bc)
  • sentinel: preserve zero preferred slave priority (#2129) (a3f9f2d)
  • tracing: redact values for GETSET and PSETEX (#2134) (832765d)

... (truncated)

Changelog

Sourced from ioredis's changelog.

6.0.0 (2026-07-31)

Bug Fixes

  • clear stale socket timeout on reconnect (#2148) (6455dbe)
  • cluster: recreate stale connection on circular MOVED (#2135) (08c8967)
  • cluster: validate MOVED slot to prevent Array.prototype pollution (#2151) (9618206), closes #1267
  • command: serialize large integer arguments in decimal notation (#2136) (09b8d04)
  • redis: keep reconnecting when connection closes during client setup (#2099) (#2123) (f9a66bc)
  • sentinel: preserve zero preferred slave priority (#2129) (a3f9f2d)
  • tracing: redact values for GETSET and PSETEX (#2134) (832765d)
  • types: export ScanStreamOptions, RedisStatus and ClusterStatus (#2158) (cf3bf71)

Features

BREAKING CHANGES

  • ioredis now requires Node.js 20 or newer and uses RESP3 by default. Set protocol: 2 to retain the v5 wire protocol.
Commits

Updates js.foresight from 3.5.0 to 4.2.1

Release notes

Sourced from js.foresight's releases.

js.foresight@4.2.1

Patch Changes

  • #168 dfb88f3 Thanks @​spaansba! - Fix lazy predictor connects leaking global listeners when a handler disconnects mid-import. DesktopHandler.connectTabPredictor/connectScrollPredictor and TouchDeviceHandler.setTouchPredictor now re-check isConnected after the dynamic import() resolves, so a predictor whose handler disconnected during loading no longer attaches keydown/focusin/pointerdown listeners that never get aborted.

  • #158 8250ad8 Thanks @​spaansba! - CircularBuffer now exposes peekWriteSlot() for zero-allocation slot reuse and drops the unused getFirstLast() tuple accessor in favor of getFirst()/getLast().

  • #163 53ef414 Thanks @​spaansba! - Drop 4 redundant if (!this.isSetup) guards around initializeGlobalListeners(). The method already self-guards on isSetup, so the outer checks were dead weight.

  • #167 21f066a Thanks @​spaansba! - Store event listeners in a Set instead of an array. Iterating a Set during emit means a listener that unsubscribes another mid-dispatch no longer causes the next listener to be skipped, and registration now dedupes like the DOM addEventListener.

  • #171 31d9222 Thanks @​spaansba! - Derive ForesightEvent from keyof ForesightEventMap instead of hand-duplicating the event names, so adding an event to the map no longer requires updating the union in lockstep.

  • #159 1de7d1c Thanks @​spaansba! - Skip building the callbackInvoked and callbackCompleted event payloads when no one is subscribed. Both emits now sit behind a hasListeners guard, avoiding a per-callback object allocation and, for callbackCompleted, the activeElementCount scan that fed its wasLastActiveElement field.

  • #174 f1e06e6 Thanks @​spaansba! - Element state and bounds subscriber Sets are now created on first subscribe instead of eagerly at registration. Headless and plain-JS usage that registers elements but never subscribes to reactive state (the common case outside the framework wrappers) no longer allocates two empty Sets per element.

  • #166 ef09598 Thanks @​spaansba! - Simplify loadedPredictors.mouse to a constant since mousePredictor is never null.

  • #157 502cb8d Thanks @​spaansba! - Register the global pointermove listener as passive, letting the browser dispatch high-frequency pointer events without treating them as cancelable. Reduces main-thread scheduling pressure during fast mouse movement and scrolling.

  • #162 b6c50f1 Thanks @​spaansba! - Remove unused CircularBuffer members (clear, size, isFull, isEmpty) that were only referenced by tests.

  • #170 8dc9f8e Thanks @​spaansba! - The mouse trajectory scan now iterates a precomputed set of scannable elements (on-screen, active, not yet predicted) instead of walking the full registry and re-checking those flags every pointer move. Membership is kept in sync on registration, state changes, and unregistration. Cost now scales with the number of visible elements rather than the total registered, so pages with many registered but few on-screen elements run the per-frame scan dramatically faster with no change at small element counts.

  • #164 4dd5947 Thanks @​spaansba! - Extract scheduleReactivateTimeout to remove three copy-pasted reactivation-timeout setTimeout blocks, mirroring the existing clearReactivateTimeout.

  • #169 b46a3fd Thanks @​spaansba! - ScrollPredictor no longer caches a "none" scroll direction for the whole handlePositionChange batch. A non-moving element (e.g. position:fixed) returning "none" used to poison the cached direction and silently disable scroll prefetch for every later element that actually moved. The direction is now only locked in once a real direction is found.

  • #161 ab0798f Thanks @​spaansba! - predictNextScrollPosition now writes into a caller-owned out point instead of allocating a new one per call, matching predictNextMousePosition. ScrollPredictor reuses a single predicted-point object across the batch, removing the per-scroll-batch allocation.

  • #174 5cbefa6 Thanks @​spaansba! - applySettingsChanges now returns just the changed-settings array instead of that array plus six hand-wired side-effect booleans. alterGlobalSettings derives a Set of changed keys and checks changed.has(...), so adding a setting no longer means keeping a parallel flag struct in sync in three places.

  • #173 51cd5fd Thanks @​spaansba! - Share a base factory between createElementInternal and createUnregisteredSnapshot so the full ForesightElementState field list is only written once, preventing the snapshot from silently drifting when a field is added.

  • #174 f1e06e6 Thanks @​spaansba! - Share a single frozen empty meta object across element states instead of allocating a fresh {} per element. The state snapshot is immutable and meta is never mutated in place, so registered elements without a meta and unregistered snapshots now reuse one object.

Changelog

Sourced from js.foresight's changelog.

4.2.1

Patch Changes

  • #168 dfb88f3 Thanks @​spaansba! - Fix lazy predictor connects leaking global listeners when a handler disconnects mid-import. DesktopHandler.connectTabPredictor/connectScrollPredictor and TouchDeviceHandler.setTouchPredictor now re-check isConnected after the dynamic import() resolves, so a predictor whose handler disconnected during loading no longer attaches keydown/focusin/pointerdown listeners that never get aborted.

  • #158 8250ad8 Thanks @​spaansba! - CircularBuffer now exposes peekWriteSlot() for zero-allocation slot reuse and drops the unused getFirstLast() tuple accessor in favor of getFirst()/getLast().

  • #163 53ef414 Thanks @​spaansba! - Drop 4 redundant if (!this.isSetup) guards around initializeGlobalListeners(). The method already self-guards on isSetup, so the outer checks were dead weight.

  • #167 21f066a Thanks @​spaansba! - Store event listeners in a Set instead of an array. Iterating a Set during emit means a listener that unsubscribes another mid-dispatch no longer causes the next listener to be skipped, and registration now dedupes like the DOM addEventListener.

  • #171 31d9222 Thanks @​spaansba! - Derive ForesightEvent from keyof ForesightEventMap instead of hand-duplicating the event names, so adding an event to the map no longer requires updating the union in lockstep.

  • #159 1de7d1c Thanks @​spaansba! - Skip building the callbackInvoked and callbackCompleted event payloads when no one is subscribed. Both emits now sit behind a hasListeners guard, avoiding a per-callback object allocation and, for callbackCompleted, the activeElementCount scan that fed its wasLastActiveElement field.

  • #174 f1e06e6 Thanks @​spaansba! - Element state and bounds subscriber Sets are now created on first subscribe instead of eagerly at registration. Headless and plain-JS usage that registers elements but never subscribes to reactive state (the common case outside the framework wrappers) no longer allocates two empty Sets per element.

  • #166 ef09598 Thanks @​spaansba! - Simplify loadedPredictors.mouse to a constant since mousePredictor is never null.

  • #157 502cb8d Thanks @​spaansba! - Register the global pointermove listener as passive, letting the browser dispatch high-frequency pointer events without treating them as cancelable. Reduces main-thread scheduling pressure during fast mouse movement and scrolling.

  • #162 b6c50f1 Thanks @​spaansba! - Remove unused CircularBuffer members (clear, size, isFull, isEmpty) that were only referenced by tests.

  • #170 8dc9f8e Thanks @​spaansba! - The mouse trajectory scan now iterates a precomputed set of scannable elements (on-screen, active, not yet predicted) instead of walking the full registry and re-checking those flags every pointer move. Membership is kept in sync on registration, state changes, and unregistration. Cost now scales with the number of visible elements rather than the total registered, so pages with many registered but few on-screen elements run the per-frame scan dramatically faster with no change at small element counts.

  • #164 4dd5947 Thanks @​spaansba! - Extract scheduleReactivateTimeout to remove three copy-pasted reactivation-timeout setTimeout blocks, mirroring the existing clearReactivateTimeout.

  • #169 b46a3fd Thanks @​spaansba! - ScrollPredictor no longer caches a "none" scroll direction for the whole handlePositionChange batch. A non-moving element (e.g. position:fixed) returning "none" used to poison the cached direction and silently disable scroll prefetch for every later element that actually moved. The direction is now only locked in once a real direction is found.

  • #161 ab0798f Thanks @​spaansba! - predictNextScrollPosition now writes into a caller-owned out point instead of allocating a new one per call, matching predictNextMousePosition. ScrollPredictor reuses a single predicted-point object across the batch, removing the per-scroll-batch allocation.

  • #174 5cbefa6 Thanks @​spaansba! - applySettingsChanges now returns just the changed-settings array instead of that array plus six hand-wired side-effect booleans. alterGlobalSettings derives a Set of changed keys and checks changed.has(...), so adding a setting no longer means keeping a parallel flag struct in sync in three places.

  • #173 51cd5fd Thanks @​spaansba! - Share a base factory between createElementInternal and createUnregisteredSnapshot so the full ForesightElementState field list is only written once, preventing the snapshot from silently drifting when a field is added.

  • #174 f1e06e6 Thanks @​spaansba! - Share a single frozen empty meta object across element states instead of allocating a fresh {} per element. The state snapshot is immutable and meta is never mutated in place, so registered elements without a meta and unregistered snapshots now reuse one object.

Commits
  • 4cb8dc7 Version Packages
  • f1e06e6 test
  • 5cbefa6 Refactor editing global settings
  • 51cd5fd Share a base factory between createElementInternal and `createUnregisteredS...
  • 5c28875 Merge pull request #171 from spaansba/foresight-event-type-fix
  • 31d9222 Derive ForesightEvent from keyof ForesightEventMap
  • 8dc9f8e The mouse trajectory scan now iterates a precomputed set of scannable elements
  • b46a3fd ScrollPredictor no longer caches a "none" scroll direction
  • 0d37719 Merge pull request #168 from spaansba/fix-lazy-predictor-leak
  • dfb88f3 Fix lazy predictor connects leaking global listeners
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for js.foresight since your current version.


Updates nanoid from 5.1.16 to 6.0.1

Release notes

Sourced from nanoid's releases.

6.0.1

  • Fixed docs.

6.0.0

  • Made nanoid() and customAlphabet() 4 times faster (by @​orhanayd).
  • Removed Node.js 18 and 20 support.
Changelog

Sourced from nanoid's changelog.

6.0.1

  • Fixed docs.

6.0.0

  • Made nanoid() and customAlphabet() 4 times faster (by @​orhanayd).
  • Removed Node.js 18 and 20 support.
Commits

Updates next from 16.2.1 to 16.3.0

Release notes

Sourced from next's releases.

v16.3.0

Core Changes

  • Update vendored lodash to 4.17.23 to fix CVE-2025-13465: #91558
  • Fix invalid HTML response for route-level RSC requests in deployment adapter: #91541
  • Normalize encoded dynamic placeholders in app routes: #91603
  • Fix(pages-router): restore Content-Length and ETag for /_next/data/ JSON responses: #90304
  • Update tokio from 1.43.0 to 1.47.3: #90945
  • [turbopack] Simplify snapshotting logic: #91178
  • Turbopack: enable server HMR for app route handlers: #91466
  • turbo-tasks-backend: batch find_and_schedule_dirty using for_each_task_meta: #91497
  • [turbopack] Use bail! instead of panic! for duplicate module ident error: #91636
  • Skip loadBindings() Lightning CSS check during next start: #91538
  • turbo-tasks-backend: batch schedule dirty tasks in aggregation_update: #91461
  • Turbopack: Add importModule() support to webpack loaders: #89630
  • turbo-persistence: fix mmap page alignment and improve error context in MetaFile::open_internal: #91640
  • turbopack-css: demote recoverable CSS parse warnings to Warning severity: #91524
  • feat(node-streams): add config flag, define-env, and env precedence test: #90427
  • Rename /_next/webpack-hmr to /_next/hmr: #91415
  • Add per-slot error attribution for instant validation using slot markers and config depth preference: #91610
  • Handle encoded params further: #91627
  • [turbopack] Respect {eval:true} in worker_threads constructors: #91666
  • Fix missing route in otel spans without base-server: #91665
  • [turbopack] Optimize compaction cpu usage: #91468
  • Fix layout segment optimization: move app-page imports to server-utility transition: #91701
  • Fix server actions in standalone mode with cacheComponents: #91711
  • turbo-persistence: remove Unmergeable mmap advice: #91713
  • turbopack: move "compact database" tracing span to backend layer: #91693
  • Turbopack: lazy require metadata and handle TLA: #91705
  • Fix adapter outputs for dynamic metadata routes: #91680
  • Turbopack: fix webpack loader runner layer: #91727
  • [turbopack] Remove incorrect debug_assert in try_read_task_cell: #91699
  • Add module count field to module graph tracing spans: #91697
  • turbopack-cli: add --persistent-caching flag for filesystem-backed cache: #91657
  • Turbopack: pull in updated vercel/nft tests: #91651
  • [turbopack] Improve regressed build speed on cross-compiled MUSL: #91477
  • [Segment Bundling] [Scaffolding] Ensure inlining hint correctness: #91320
  • [Segment Bundling] [Scaffolding] Track which segments can be omitted from prefetch: #91438
  • Avoid deprecated TS node10 moduleResolution defaults: #91847
  • [turbopack] Rebuild the docker build scripts: #91799
  • Fix TS6 baseUrl deprecation for extended tsconfig: #91855
  • Add next internal post-build CLI command for Turbopack database compaction: #91336
  • Turbopack: Define Effect as a trait instead of a closure: #89080
  • Turbopack: Implement TraceRawVcs and NonLocalValue correctly for Effects: #89133
  • turbo-tasks-backend: improve print_cache_item_size instrumentation: #91742
  • Turbopack: switch from base40 to base38 hash encoding (remove ~ and . from charset): #91832
  • Use charCodeAt for normalizePathTrailingSlash: #91380
  • Turbopack: Only patch lockfile when bindings fails to load: #91379
  • [create-next-app] Skip interactive prompts when CLI flags are provided: #91840
  • [devtools] Make instant navs panel draggable: #91914
  • [Segment Bundling] Bundle static prefetches based on size: #91439

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.


Updates react from 19.2.4 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

19.2.7 (June 1st, 2026)

React Server Components

19.2.6 (May 6th, 2026)

React Server Components

19.2.5 (April 8th, 2026)

React Server Components

Changelog

Sourced from react's changelog.

19.2.7 (June 1, 2026)

React Server Components

19.2.6 (May 6, 2026)

React Server Components

19.2.5 (March 18, 2026)

React Server Components

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react since your current version.


Updates react-dom from 19.2.4 to 19.2.8

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

19.2.7 (June 1st, 2026)

React Server Components

19.2.6 (May 6th, 2026)

React Server Components

19.2.5 (April 8th, 2026)

React Server Components

Changelog

Sourced from react-dom's changelog.

19.2.7 (June 1, 2026)

React Server Components

19.2.6 (May 6, 2026)

React Server Components

19.2.5 (March 18, 2026)

React Server Components

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react-dom since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps)(deps): bump the prod-deps group across 1 directory with 6…
255a48e 
… updates

Bumps the prod-deps group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [ioredis](https://github.com/redis/ioredis) | `5.11.1` | `6.0.0` |
| [js.foresight](https://github.com/spaansba/ForesightJS/tree/HEAD/packages/js.foresight) | `3.5.0` | `4.2.1` |
| [nanoid](https://github.com/ai/nanoid) | `5.1.16` | `6.0.1` |
| [next](https://github.com/vercel/next.js) | `16.2.1` | `16.3.0` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.4` | `19.2.8` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.4` | `19.2.8` |



Updates `ioredis` from 5.11.1 to 6.0.0
- [Release notes](https://github.com/redis/ioredis/releases)
- [Changelog](https://github.com/redis/ioredis/blob/main/CHANGELOG.md)
- [Commits](redis/ioredis@v5.11.1...v6.0.0)

Updates `js.foresight` from 3.5.0 to 4.2.1
- [Release notes](https://github.com/spaansba/ForesightJS/releases)
- [Changelog](https://github.com/spaansba/ForesightJS/blob/main/packages/js.foresight/CHANGELOG.md)
- [Commits](https://github.com/spaansba/ForesightJS/commits/js.foresight@4.2.1/packages/js.foresight)

Updates `nanoid` from 5.1.16 to 6.0.1
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md)
- [Commits](ai/nanoid@5.1.16...6.0.1)

Updates `next` from 16.2.1 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.2.1...v16.3.0)

Updates `react` from 19.2.4 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react)

Updates `react-dom` from 19.2.4 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom)

---
updated-dependencies:
- dependency-name: ioredis
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: prod-deps
- dependency-name: js.foresight
  dependency-version: 4.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: prod-deps
- dependency-name: nanoid
  dependency-version: 6.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: prod-deps
- dependency-name: next
  dependency-version: 16.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-deps
- dependency-name: react
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-deps
- dependency-name: react-dom
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies javascript Pull requests that update javascript code labels Aug 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants