Skip to content

build(deps): bump the prod-dependencies group across 1 directory with 6 updates#1598

Open
dependabot[bot] wants to merge 1 commit intodependency-updatesfrom
dependabot/npm_and_yarn/dependency-updates/prod-dependencies-64c4b44d30
Open

build(deps): bump the prod-dependencies group across 1 directory with 6 updates#1598
dependabot[bot] wants to merge 1 commit intodependency-updatesfrom
dependabot/npm_and_yarn/dependency-updates/prod-dependencies-64c4b44d30

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 1, 2026

Bumps the prod-dependencies group with 6 updates in the / directory:

Package From To
jquery 3.7.1 4.0.0
lodash 4.17.21 4.18.1
react-datepicker 8.10.0 9.1.0
react-diff-viewer-continued 3.4.0 4.2.2
react-dropzone 14.3.8 15.0.0
use-debounce 10.0.3 10.1.1

Updates jquery from 3.7.1 to 4.0.0

Release notes

Sourced from jquery's releases.

Release 4.0.0

Changelog

https://blog.jquery.com/2026/01/17/jquery-4-0-0/

Ajax

  • Don't treat array data as binary (992a1911)
  • Allow processData: true even for binary data (ce264e07)
  • Support binary data (including FormData) (a7ed9a7b)
  • Support headers for script transport even when cross-domain (#5142, 6d136443)
  • Support null as success functions in jQuery.get (#4989, 74978b7e)
  • Don't auto-execute scripts unless dataType provided (#4822, 025da4dd)
  • Make responseJSON work for erroneous same-domain JSONP requests (68b4ec59)
  • Execute JSONP error script responses (#4771, a1e619b0)
  • Avoid CSP errors in the script transport for async requests (#3969, 07a8e4a1)
  • Drop the json to jsonp auto-promotion logic (#1799, #3376, e7b3bc48)
  • Overwrite s.contentType with content-type header value, if any (#4119, 7fb90a6b)
  • Deprecate AJAX event aliases, inline event/alias into deprecated (23d53928)
  • Do not execute scripts for unsuccessful HTTP responses (#4250, 50871a5a)
  • Simplify jQuery.ajaxSettings.xhr (#1967, abdc89ac)

Attributes

  • Make .attr( name, false ) remove for all non-ARIA attrs (#5388, 063831b6)
  • Shave off a couple of bytes (b40a4807)
  • Don't stringify attributes in the setter (#4948, 4250b628)
  • Drop the toggleClass(boolean|undefined) signature (#3388, a4421101)
  • Refactor val(): don't strip carriage return, isolate IE workarounds (ff281991)
  • Don't set the type attr hook at all outside of IE (9e66fe9a)

CSS

  • Fix dimensions of table <col> elements (#5628, eca2a564)
  • Drop the cache in finalPropName (640d5825)
  • Tests: Fix tests & support tests under CSS Zoom (#5489, 071f6dba)
  • Fix reliableTrDimensions support test for initially hidden iframes (b1e66a5f)
  • Selector: Align with 3.x, remove the outer selector.js wrapper (53cf7244)
  • Make the reliableTrDimensions support test work with Bootstrap CSS (#5270, 65b85031)
  • Make offsetHeight( true ), etc. include negative margins (#3982, bce13b72)
  • Return undefined for whitespace-only CSS variable values (#5120) (7eb00196)
  • Don’t trim whitespace of undefined custom property (#5105, ed306c02)
  • Skip falsy values in addClass( array ), compress code (#4998, a338b407)
  • Justify use of rtrim on CSS property values (655c0ed5)
  • Trim whitespace surrounding CSS Custom Properties values (#4926, efadfe99)
  • Include show, hide & toggle methods in the jQuery slim build (297d18dd)
  • Remove the opacity CSS hook (865469f5)
  • Workaround buggy getComputedStyle on table rows in IE/Edge (#4490, 26415e08)
  • Don't automatically add "px" to properties with a few exceptions (#2795, 00a9c2e5)

... (truncated)

Commits
  • 4f2fae0 Release: 4.0.0
  • c838cfb Release: remove dist files from main branch
  • 9752519 Release: 4.0.0-rc.2
  • c128d5d Release: Update AUTHORS.txt
  • 5fe9c29 Build: De-dupe three authors via mailmap
  • afdd032 Build: Post beta browser tests errors to jquery/dev on Matrix
  • 546a1eb Build: Bump the github-actions group with 4 updates
  • ec738b3 Build: Fix Chrome beta tests
  • c28c26a Build: Add periodic tests on beta versions of browsers
  • f513413 Build: Bump the github-actions group with 2 updates
  • Additional commits viewable in compare view

Updates lodash from 4.17.21 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

  • Add security notice for _.template in threat model and API docs (#6099)
  • Document lower > upper behavior in _.random (#6115)
  • Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

Commits
  • cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
  • 75535f5 chore: prune stale advisory refs (#6170)
  • 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
  • 59be2de release(minor): bump to 4.18.0 (#6161)
  • af63457 fix: broken tests for _.template 879aaa9
  • 1073a76 fix: linting issues
  • 879aaa9 fix: validate imports keys in _.template
  • fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
  • 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
  • b819080 ci: add dist sync validation workflow (#6137)
  • Additional commits viewable in compare view

Updates react-datepicker from 8.10.0 to 9.1.0

Release notes

Sourced from react-datepicker's releases.

9.1.0

Highlights

This release includes important bug fixes, TypeScript improvements, and a new feature. Most notably, it restores date parsing behavior that was accidentally removed in v8.0.0.

New Feature

Allow onClickOutside to prevent calendar from closing (#6179)

The onClickOutside callback can now prevent the calendar from closing by calling event.preventDefault(). This is useful when using custom portal-based dropdowns in the calendar header.

  <DatePicker                                                                                                                                                                           
    onClickOutside={(event) => {                                                                                                                                                        
      if (myPortalRef.current?.contains(event.target)) {                                                                                                                                
        event.preventDefault(); // Keeps calendar open                                                                                                                                  
      }                                                                                                                                                                                 
    }}                                                                                                                                                                                  
  />

Full Changelog

What's Changed

New Contributors

Full Changelog: Hacker0x01/react-datepicker@v9.0.0...v9.1.0

🎄 React Datepicker v9.0.0 - Holiday Release 🎁

🌟 Major New Features

🌍 Timezone Support (Finally!)

... (truncated)

Commits
  • 0a3fa07 9.1.0
  • 75a4ed1 Merge pull request #6172 from Hacker0x01/fix/restore-native-date-fallback-6164
  • d4625d4 Merge pull request #6180 from Hacker0x01/fix/issue-5814-mask-input-clearing
  • 668468a Merge pull request #6179 from Hacker0x01/fix/prevent-close-on-click-outside
  • e5d4948 fix: clear selection when masked input is cleared on blur
  • 3700259 feat: allow onClickOutside to prevent calendar from closing
  • 0231bbd Merge pull request #6177 from Hacker0x01/test/datepicker-format-weekday-prop
  • 344d1ed test: add formatWeekDay prop test for DatePicker component
  • 041f1ac chore: dedupe yarn.lock for @​typescript-eslint/parser
  • de00ec3 Merge pull request #6176 from Hacker0x01/dependabot/npm_and_yarn/types/node-2...
  • Additional commits viewable in compare view

Updates react-diff-viewer-continued from 3.4.0 to 4.2.2

Release notes

Sourced from react-diff-viewer-continued's releases.

Release 4.2.2

Bug Fixes

  • strict typescript types, and visible loader

Release 4.2.0

Features

  • export computeStyles and add missing style override properties

Bug Fixes

  • add .js extensions to relative imports for Node.js ESM compatibility

Release 4.1.3

Bug Fixes

  • attempt to fix worker import issue

Release 4.1.2

Bug Fixes

  • fix virtualization offsets and missing key display on structural json diff
  • bundle worker code as a blob

Release 4.1.1

Bug Fixes

  • fix problem with missing worker in compiled version

Release 4.1.0

Features

  • merge compute worker PR and optimize to use virtualization
  • use just-release instead of semantic-release, still semantic, simpler

Bug Fixes

  • ordering and syntax highlighting fixes
  • need to actually push your new workflows if you want to use them

v4.0.6

4.0.6 (2025-05-13)

Bug Fixes

  • allow non-string rendered contents (a0ab52d)
  • fixup #68 for non-string wordDiff.value (3678e02)

... (truncated)

Changelog

Sourced from react-diff-viewer-continued's changelog.

4.2.2 (2026-04-23)

Bug Fixes

  • strict typescript types, and visible loader

4.2.1 (2026-04-23)

Bug Fixes

  • make overscan configurable
  • handle ' HTML entity in diff view to prevent "undefined" suffix
  • mousedown and mouseup
  • do not show content while scrolling fast outside the overscan area
  • update dependencies
  • clean up old package-lock.json

4.2.0 (2026-03-10)

Features

  • export computeStyles and add missing style override properties

Bug Fixes

  • add .js extensions to relative imports for Node.js ESM compatibility

4.1.3 (2026-02-07)

Bug Fixes

  • attempt to fix worker import issue

4.1.2 (2026-02-07)

Bug Fixes

  • fix virtualization offsets and missing key display on structural json diff
  • bundle worker code as a blob

4.1.1 (2026-02-07)

Bug Fixes

  • fix problem with missing worker in compiled version

4.1.0 (2026-02-04)

Features

... (truncated)

Commits
  • cac8c8e release: 4.2.2
  • e849850 fix: strict typescript types, and visible loader
  • 99b4a05 release: 4.2.1
  • b6717c2 fix: clean up old package-lock.json
  • b020f9e fix: update dependencies
  • b1f83e2 fix: do not show content while scrolling fast outside the overscan area
  • c9b512f fix(select): mousedown and mouseup
  • 6893303 fix: handle ' HTML entity in diff view to prevent "undefined" suffix
  • c020300 fix: make overscan configurable
  • 98526e0 release: 4.2.0
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react-diff-viewer-continued since your current version.


Updates react-dropzone from 14.3.8 to 15.0.0

Release notes

Sourced from react-dropzone's releases.

v15.0.0

15.0.0 (2026-02-10)

  • fix!: reset isDragReject after drop (c9d1c31)

BREAKING CHANGES

  • isDragReject only reflects active drag state and is cleared after drop. Use fileRejections or onDropRejected/onDrop for post-drop rejection UI.

v14.4.1

14.4.1 (2026-02-10)

Bug Fixes

  • prevent tarball from being included in published package (7919a23)

v14.4.0

14.4.0 (2026-01-29)

Bug Fixes

  • accept files with empty type during drag events (eaa8ba5)
  • correct dragLeave filter logic and add dragend test (273aff4)

Features

  • add isDragGlobal state for document-level drag detection (f0874b0)
Commits
  • 7f17a88 style: remove trailing newline in index.js
  • aad0135 chore: remove .rebase-note
  • ec9467b chore: apply semantic commit format to all commits
  • e60a016 chore: finalize semantic commit rebase
  • ac76751 chore: rebase commits to use semantic commit format
  • ea137b3 chore: remove CHANGELOG.md in favor of semantic commits
  • 1dc5ef3 docs: clarify isDragReject post-drop behavior
  • c9d1c31 fix!: reset isDragReject after drop
  • 9247d71 chore: add *.tgz to .gitignore
  • 7919a23 fix: prevent tarball from being included in published package
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react-dropzone since your current version.


Updates use-debounce from 10.0.3 to 10.1.1

Release notes

Sourced from use-debounce's releases.

10.0.6

What's Changed

Full Changelog: xnimorz/use-debounce@10.0.5...10.0.6

10.0.5

What's Changed

New Contributors

Full Changelog: xnimorz/use-debounce@10.0.4...10.0.5

v10.0.4

  • Fix behaviour for strictMode react when leading is set to true and trailing is true
Changelog

Sourced from use-debounce's changelog.

10.1.1

  • replace global with globalThis which is defined in all possible environments (browser, node, workers) to address xnimorz/use-debounce#212

10.1.0

  • New parameter introduced: flushOnExit. See issue #205 for details. This parameter allows the callback to be executed on component unmount or page exit, enabling specific side-effect such as persistence or other required I/O operations. Thanks to @​h for the contribution. PR

10.0.5

10.0.4

  • Fix behaviour for strictMode react when leading is set to true and trailing is true
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the prod-dependencies group across 1 directory with…
f3d9675 
… 6 updates

Bumps the prod-dependencies group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [jquery](https://github.com/jquery/jquery) | `3.7.1` | `4.0.0` |
| [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.18.1` |
| [react-datepicker](https://github.com/Hacker0x01/react-datepicker) | `8.10.0` | `9.1.0` |
| [react-diff-viewer-continued](https://github.com/Aeolun/react-diff-viewer-continued) | `3.4.0` | `4.2.2` |
| [react-dropzone](https://github.com/react-dropzone/react-dropzone) | `14.3.8` | `15.0.0` |
| [use-debounce](https://github.com/xnimorz/use-debounce) | `10.0.3` | `10.1.1` |



Updates `jquery` from 3.7.1 to 4.0.0
- [Release notes](https://github.com/jquery/jquery/releases)
- [Changelog](https://github.com/jquery/jquery/blob/main/changelog.md)
- [Commits](jquery/jquery@3.7.1...4.0.0)

Updates `lodash` from 4.17.21 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.18.1)

Updates `react-datepicker` from 8.10.0 to 9.1.0
- [Release notes](https://github.com/Hacker0x01/react-datepicker/releases)
- [Commits](Hacker0x01/react-datepicker@v8.10.0...v9.1.0)

Updates `react-diff-viewer-continued` from 3.4.0 to 4.2.2
- [Release notes](https://github.com/Aeolun/react-diff-viewer-continued/releases)
- [Changelog](https://github.com/Aeolun/react-diff-viewer-continued/blob/main/CHANGELOG.md)
- [Commits](Aeolun/react-diff-viewer-continued@v3.4.0...v4.2.2)

Updates `react-dropzone` from 14.3.8 to 15.0.0
- [Release notes](https://github.com/react-dropzone/react-dropzone/releases)
- [Commits](react-dropzone/react-dropzone@v14.3.8...v15.0.0)

Updates `use-debounce` from 10.0.3 to 10.1.1
- [Release notes](https://github.com/xnimorz/use-debounce/releases)
- [Changelog](https://github.com/xnimorz/use-debounce/blob/master/CHANGELOG.md)
- [Commits](https://github.com/xnimorz/use-debounce/commits)

---
updated-dependencies:
- dependency-name: jquery
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: prod-dependencies
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-dependencies
- dependency-name: react-datepicker
  dependency-version: 9.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: prod-dependencies
- dependency-name: react-diff-viewer-continued
  dependency-version: 4.2.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: prod-dependencies
- dependency-name: react-dropzone
  dependency-version: 15.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: prod-dependencies
- dependency-name: use-debounce
  dependency-version: 10.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code type:maintenance labels May 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code type:maintenance

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants