client-ec2: Documentation updates clarifying CancelCapacityReservation cancellable states (e3723ba7)
New Features
client-compute-optimizer: This release surfaces two new metrics Volume IOPS Exceeded and Volume Throughput Exceeded into EBS volume rightsizing recommendations. (ded6618d)
client-application-auto-scaling: Adds support for ECS high-resolution predefined scaling metrics (ECSServiceAverageCPUUtilizationHighResolution, ECSServiceAverageMemoryUtilizationHighResolution) enabling 20-second metric periods for faster scaling (95b3513a)
client-cognito-identity-provider: In order to support the new TLS Self-Service feature, this change adds SecurityPolicyType to CustomDomainConfigType. During CreateUserPoolDomain and UpdateUserPoolDomain this is used to select a custom domain's TLS enforcement, and for DescribeUserPoolDomain it informs users about the current TLS. (e8937787)
client-sagemaker: Adds support for automatic AMI patching on HyperPod clusters. Customers can configure patching strategies to automatically apply security patch with zero job termination. Customers can also specify an AMI version at instance group level and update cluster software to a certain AMI version. (fd33a5e4)
client-ecs: Amazon ECS services now support high resolution (20 second) CloudWatch metrics for CPUUtilization and MemoryUtilization. Use these metrics for faster service auto scaling. (93055ac9)
client-healthlake: Adding New Configurations to the FHIR Create Datastore. The new configurations include NLP Configuration, AnalyticsConfiguration, ProfileConfiguration (494fa59f)
client-gamelift: Amazon GameLift Servers has launched support for customizing Linux capabilities in container fleets. You can now specify additional Linux capabilities for containers in a container group definition, giving you finer control over the default Docker capabilities available to your containers. (93cefd90)
client-eks: Adds support for configurable control plane egress routing in Amazon EKS, allowing you to route control plane egress traffic through your VPC and control how the control plane reaches resources in your network such as webhook servers and OIDC providers. (693db629)
client-lambda: Converging and fixing existing documentation gaps in Lambda SDK (6555a565)
client-synthetics: CloudWatch Synthetics adds support for multi-location canaries. Customers can now monitor their endpoints from multiple locations with centralized management from a primary location. The SDK includes new parameters for configuring multiple locations and tracking their state. (f2c8b480)
client-cloudwatch-logs: Added optional startFromHead parameter to FilterLogEvents enabling descending timestamp order (newest first) when set to false. Default true preserves existing ascending order. Reverse sorting requires a startTime on or after Jan 1, 2024. (1be63ed9)
client-batch: Adds Support for ordered allocation strategies- BEST-FIT-PROGRESSIVE-ORDERED or SPOT-CAPACITY-OPTIMIZED-PRIORITIZED (0e57e53b)
For list of updated packages, view updated-packages.md in assets-3.1072.0.zip
v3.1071.0
3.1071.0(2026-06-17)
New Features
client-partnercentral-selling: Cosell Resonate AND Prospecing API Launch with ARN correction (7e8c98ab)
client-compute-optimizer-automation: This launch adds IfExists comparison operators to Compute Optimizer Automation rule criteria, so a rule can include recommended actions whose specified attribute isn't present. (ab2c616d)
client-bedrock-agent: Launching Bedrock Managed Knowledge Bases. Added support for resource-based policies on Knowledge Base resources, enabling cross-account access for Managed Knowledge Bases. (de0affe4)
client-securityagent: Updated AWS Security Agent SDK model with new APIs for threat modeling, code review, security requirements, and additional integration providers. (9c3d3351)
client-opensearch: Adds support for configuring IAM Identity Center options on existing OpenSearch applications via the UpdateApplication API. (94f06a20)
client-glue: This release adds support for Search and Discovery in AWS Glue, letting you and your applications search Data Catalog assets such as table and enrich them with business context and glossary terms. (b394fc0b)
client-bedrock-agentcore-control: AgentCore Gateway now supports inference targets to LLM providers (direct config or built-in connectors), HTTP passthrough targets with session stickiness, runtime target API schemas, AWS WAF web ACL association with configurable fail-open or fail-close modes, and interceptor payload filtering. (75f1d588)
client-devops-agent: Adds support for Remote A2A (Agent-to-Agent) agent registration and management. Adds new Release Readiness Review and Release Testing capabilities. Adds support for Git managed skills in AWS DevOps Agent. (ebc040e1)
client-bedrock-agentcore: AgentCore Harness service will be Generally Available at NYS 2026 with this Treb release. Harness will support invoking specific endpoints via the qualifier parameter, AWS Skills for pre-built agent capabilities, and improved validation for skill git source URLs. (5bf9fccc)
client-ecs: Releasing the ability to bring-your-own task-definition for CreateExpressGatewayService and UpdateGatewayExpressService (b7b9cb4f)
client-mq: This release adds private networking support for Amazon MQ for RabbitMQ. You can now associate AWS RAM resource shares with your broker and retrieve shared resource details using the new DescribeSharedResources API. (e96af450)
client-bedrock-agent-runtime: Adds new AgenticRetrieveStream API for managed knowledge bases to use conversation history and autonomously plan for multi-hop multi-KB reasoning with built-in evaluation and access-control. Updates Retrieve API for access-control-based filtering for managed knowledge bases. (557f7b32)
Tests
core:
prebuild before integration and e2e (#8111) (363f3fb7)
client-s3: Added support for annotations. You can now attach up to 1000 annotations (up to 1 MB each) directly to objects and create, retrieve, list, and delete them using new annotation APIs. Also added support for configuring an annotation table in S3 Metadata. (c555874)
Fixed several edge cases with Avatar's loading state
An avatar's fallback would not be displayed again if its image component unmounted. This is now fixed.
Rendering multiple Avatar.Image components per Avatar.Root was never supported and results in buggy, unpredictable behavior. We now warn about this in development.
Zero-sized images were treated as loading, meaning that onLoadingStatusChange is never called once loaded. A zero-sized image now triggers an error status on load.
Other updates
Fixed console warnings to show in test environments.
Added unstable RadioGroupItemProvider, RadioGroupItemTrigger and RadioGroupItemBubbleInput parts. These expose the previously internal composition of a radio item (context provider, the interactive control, and the hidden form input) so consumers can directly access and recompose them. The RadioGroupItem component continues to render them by default.
Added repository.directory to all package.json files
Allowed a Select.Item with an empty string value to act as a "clear" option. Selecting it resets the selection back to the placeholder, restoring the native <select> behavior for optional selects.
Fixed a bug where typeahead search resulted in focusing an element that no longer exists.
Added unstable Provider and BubbleInput parts to Select. Select.unstable_Provider sets up Select's context and state without implicitly rendering the hidden native select, and Select.unstable_BubbleInput exposes that previously internal native select so consumers can recompose it explicitly. Select continues to render both by default.
Added support for presence-based exit animations in Select
Fixed Select hidden input so it submits empty string when no value is selected
Fixed placeholder rendering when a controlled Select is reset to an empty value
Added missing __selectScope prop to PopperContent component
Fixed Select closing unexpectedly after touch-scrolling its content when rendered inside an open shadow DOM
Fixed a bug where iOS text selection and editing on HTML inputs within react-dialog were broken
Fixed triggers referencing a non-existent element via aria-controls when their content is removed from the DOM (credit to @dodomorandi for the original PR)
Fixed SelectValue logging invalid prop errors when used with both asChild and a placeholder
Added repository.directory to all package.json files
Added unstable Provider, Trigger and BubbleInput parts to Switch. These expose the previously internal composition (context provider, the interactive control, and the hidden form input) so consumers can directly access and recompose them. The Switch component continues to render them by default.
Added repository.directory to all package.json files
This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.
🔒 Security Fixes
Redirect Header Safety: Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (#10892)
URL And Request Hardening: Rejects malformed http: and https: URLs that omit // with ERR_INVALID_URL, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local NO_PROXY matching. (#11000)
🐛 Bug Fixes
Status Validation: Added transitional.validateStatusUndefinedResolves so applications can opt in to treating validateStatus: undefined like the option was omitted, while validateStatus: null remains the explicit way to accept every status. (#10899)
🔧 Maintenance & Chores
Documentation: Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the proxy request config as Node.js-only in the advanced docs. (#10984, #10988, #10992, #10995)
This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.
🔒 Security Fixes
Config Hardening: Guarded socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)
Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#10926)
🚀 New Features
HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding. (#6792, #10920)
🐛 Bug Fixes
Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (#10929, #10896)
Proxy TLS: Preserved user httpsAgent TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (#10957)
React Native FormData: Cleared default Content-Type for React Native FormData so multipart boundaries can be generated correctly. (#10898)
This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.
🔒 Security Fixes
Redirect Header Safety: Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (#10892)
URL And Request Hardening: Rejects malformed http: and https: URLs that omit // with ERR_INVALID_URL, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local NO_PROXY matching. (#11000)
🐛 Bug Fixes
Status Validation: Added transitional.validateStatusUndefinedResolves so applications can opt in to treating validateStatus: undefined like the option was omitted, while validateStatus: null remains the explicit way to accept every status. (#10899)
🔧 Maintenance & Chores
Documentation: Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the proxy request config as Node.js-only in the advanced docs. (#10984, #10988, #10992, #10995)
This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.
🔒 Security Fixes
Config Hardening: Guarded socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)
Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#10926)
🚀 New Features
HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding. (#6792, #10920)
🐛 Bug Fixes
Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (#10929, #10896)
Proxy TLS: Preserved user httpsAgent TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (#10957)
React Native FormData: Cleared default Content-Type for React Native FormData so multipart boundaries can be generated correctly. (#10898)
#3886e6d7fe2 Thanks @marandaneto! - Stop sending deprecated no-op top-level type, library, and library_version fields in event batch payloads. Use properties.$lib and properties.$lib_version for SDK metadata; legacy queued library and library_version values are used as fallbacks when the official $ properties are missing.
(2026-06-18)
#3845a0553b3 Thanks @marandaneto! - Add setPersonProperties() and unsetPersonProperties() helpers to manage person properties from the Node.js SDK.
(2026-06-16)
#3705d6fc0a5 Thanks @gustavohstrassburger! - feat(feature-flags): support the early_exit condition option in local evaluation. When a flag enables early exit, evaluation now stops and returns false as soon as a condition group's property filters match but the rollout percentage excludes the user, instead of falling through to later groups — matching the server-side evaluation behavior.
(2026-06-12)
#3886e6d7fe2 Thanks @marandaneto! - Stop sending deprecated no-op top-level type, library, and library_version fields in event batch payloads. Use properties.$lib and properties.$lib_version for SDK metadata; legacy queued library and library_version values are used as fallbacks when the official $ properties are missing.
(2026-06-18)
#3845a0553b3 Thanks @marandaneto! - Add setPersonProperties() and unsetPersonProperties() helpers to manage person properties from the Node.js SDK.
(2026-06-16)
#383729bf8e3 Thanks Description has been truncated
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/fosrl/pangolin/pull/3308
**Author:** [@dependabot[bot]](https://github.com/apps/dependabot)
**Created:** 6/19/2026
**Status:** 🔄 Open
**Base:** `main` ← **Head:** `dependabot/npm_and_yarn/prod-minor-updates-18d1ed5ca2`
---
### 📝 Commits (1)
- [`c88a3e4`](https://github.com/fosrl/pangolin/commit/c88a3e45494aacb2b8c7da9a2ec4d9708515fdae) Bump the prod-minor-updates group across 1 directory with 13 updates
### 📊 Changes
**2 files changed** (+1357 additions, -525 deletions)
<details>
<summary>View changed files</summary>
📝 `package-lock.json` (+1344 -512)
📝 `package.json` (+13 -13)
</details>
### 📄 Description
Bumps the prod-minor-updates group with 13 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1056.0` | `3.1072.0` |
| [@radix-ui/react-avatar](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/avatar) | `1.1.11` | `1.2.0` |
| [@radix-ui/react-radio-group](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/radio-group) | `1.3.8` | `1.4.1` |
| [@radix-ui/react-select](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/select) | `2.2.6` | `2.3.1` |
| [@radix-ui/react-slot](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/slot) | `1.2.4` | `1.3.0` |
| [@radix-ui/react-switch](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/switch) | `1.2.6` | `1.3.1` |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.100.14` | `5.101.0` |
| [axios](https://github.com/axios/axios) | `1.16.1` | `1.18.0` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.1` | `4.2.0` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.17.0` | `1.21.0` |
| [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.21.0` | `8.22.0` |
| [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.35.6` | `5.38.1` |
| [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.76.1` | `7.79.0` |
Updates `@aws-sdk/client-s3` from 3.1056.0 to 3.1072.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/aws/aws-sdk-js-v3/releases">@aws-sdk/client-s3's releases</a>.</em></p>
<blockquote>
<h2>v3.1072.0</h2>
<h4>3.1072.0(2026-06-18)</h4>
<h5>Documentation Changes</h5>
<ul>
<li><strong>client-ec2:</strong> Documentation updates clarifying CancelCapacityReservation cancellable states (<a href="https://github.com/aws/aws-sdk-js-v3/commit/e3723ba73e2f2d307254d49ec73c5b3d91b8d892">e3723ba7</a>)</li>
</ul>
<h5>New Features</h5>
<ul>
<li><strong>client-compute-optimizer:</strong> This release surfaces two new metrics Volume IOPS Exceeded and Volume Throughput Exceeded into EBS volume rightsizing recommendations. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/ded6618d5249ab413bd90b26d4cea91d5f4b9b8f">ded6618d</a>)</li>
<li><strong>client-application-auto-scaling:</strong> Adds support for ECS high-resolution predefined scaling metrics (ECSServiceAverageCPUUtilizationHighResolution, ECSServiceAverageMemoryUtilizationHighResolution) enabling 20-second metric periods for faster scaling (<a href="https://github.com/aws/aws-sdk-js-v3/commit/95b3513a224a678fb92dc623f149d24adb96ae7b">95b3513a</a>)</li>
<li><strong>client-cognito-identity-provider:</strong> In order to support the new TLS Self-Service feature, this change adds SecurityPolicyType to CustomDomainConfigType. During CreateUserPoolDomain and UpdateUserPoolDomain this is used to select a custom domain's TLS enforcement, and for DescribeUserPoolDomain it informs users about the current TLS. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/e89377876aa392ea403636b6821cdb3df253648b">e8937787</a>)</li>
<li><strong>client-sagemaker:</strong> Adds support for automatic AMI patching on HyperPod clusters. Customers can configure patching strategies to automatically apply security patch with zero job termination. Customers can also specify an AMI version at instance group level and update cluster software to a certain AMI version. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/fd33a5e46ca314f064b9149900abe4e451661b5e">fd33a5e4</a>)</li>
<li><strong>client-ecs:</strong> Amazon ECS services now support high resolution (20 second) CloudWatch metrics for CPUUtilization and MemoryUtilization. Use these metrics for faster service auto scaling. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/93055ac93bffca3e2957b2d67cb24ecdc784457a">93055ac9</a>)</li>
<li><strong>client-healthlake:</strong> Adding New Configurations to the FHIR Create Datastore. The new configurations include NLP Configuration, AnalyticsConfiguration, ProfileConfiguration (<a href="https://github.com/aws/aws-sdk-js-v3/commit/494fa59f48705e23ab79da259046966831183c71">494fa59f</a>)</li>
<li><strong>client-gamelift:</strong> Amazon GameLift Servers has launched support for customizing Linux capabilities in container fleets. You can now specify additional Linux capabilities for containers in a container group definition, giving you finer control over the default Docker capabilities available to your containers. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/93cefd905d4fc0c649b1d7ed69f4c8f0d79d3371">93cefd90</a>)</li>
<li><strong>client-eks:</strong> Adds support for configurable control plane egress routing in Amazon EKS, allowing you to route control plane egress traffic through your VPC and control how the control plane reaches resources in your network such as webhook servers and OIDC providers. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/693db62958c6818b4cb847887b8e36a66347c119">693db629</a>)</li>
<li><strong>client-lambda:</strong> Converging and fixing existing documentation gaps in Lambda SDK (<a href="https://github.com/aws/aws-sdk-js-v3/commit/6555a565348a308dad7a51c85457c2bcee87feb8">6555a565</a>)</li>
<li><strong>client-synthetics:</strong> CloudWatch Synthetics adds support for multi-location canaries. Customers can now monitor their endpoints from multiple locations with centralized management from a primary location. The SDK includes new parameters for configuring multiple locations and tracking their state. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/f2c8b480812b5ba2d1e173a8a074df6d72654239">f2c8b480</a>)</li>
<li><strong>client-cloudwatch-logs:</strong> Added optional startFromHead parameter to FilterLogEvents enabling descending timestamp order (newest first) when set to false. Default true preserves existing ascending order. Reverse sorting requires a startTime on or after Jan 1, 2024. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/1be63ed942af46df978e55df4bec6fb6c9d16e60">1be63ed9</a>)</li>
<li><strong>client-batch:</strong> Adds Support for ordered allocation strategies- BEST-FIT-PROGRESSIVE-ORDERED or SPOT-CAPACITY-OPTIMIZED-PRIORITIZED (<a href="https://github.com/aws/aws-sdk-js-v3/commit/0e57e53b1e0914a03b5b7c7d346245a1e6b6da11">0e57e53b</a>)</li>
</ul>
<hr />
<p>For list of updated packages, view <strong>updated-packages.md</strong> in <strong>assets-3.1072.0.zip</strong></p>
<h2>v3.1071.0</h2>
<h4>3.1071.0(2026-06-17)</h4>
<h5>New Features</h5>
<ul>
<li><strong>client-partnercentral-selling:</strong> Cosell Resonate AND Prospecing API Launch with ARN correction (<a href="https://github.com/aws/aws-sdk-js-v3/commit/7e8c98abe070924fbbd1ea2abc183f0715f80945">7e8c98ab</a>)</li>
<li><strong>client-compute-optimizer-automation:</strong> This launch adds IfExists comparison operators to Compute Optimizer Automation rule criteria, so a rule can include recommended actions whose specified attribute isn't present. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/ab2c616d167a0796fba91e44d1118a6a8baee60d">ab2c616d</a>)</li>
<li><strong>client-bedrock-agent:</strong> Launching Bedrock Managed Knowledge Bases. Added support for resource-based policies on Knowledge Base resources, enabling cross-account access for Managed Knowledge Bases. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/de0affe4ad738b7f07d91574e2b2cfd83a447d44">de0affe4</a>)</li>
<li><strong>client-securityagent:</strong> Updated AWS Security Agent SDK model with new APIs for threat modeling, code review, security requirements, and additional integration providers. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/9c3d3351842902b1ea1e8be52c4e7f40b868daae">9c3d3351</a>)</li>
<li><strong>client-opensearch:</strong> Adds support for configuring IAM Identity Center options on existing OpenSearch applications via the UpdateApplication API. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/94f06a20a15ab75302088d5f3c31d708a8256e5c">94f06a20</a>)</li>
<li><strong>client-glue:</strong> This release adds support for Search and Discovery in AWS Glue, letting you and your applications search Data Catalog assets such as table and enrich them with business context and glossary terms. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/b394fc0b39c814d5f72593dfc4db5ff5c2cbe643">b394fc0b</a>)</li>
<li><strong>client-bedrock-agentcore-control:</strong> AgentCore Gateway now supports inference targets to LLM providers (direct config or built-in connectors), HTTP passthrough targets with session stickiness, runtime target API schemas, AWS WAF web ACL association with configurable fail-open or fail-close modes, and interceptor payload filtering. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/75f1d588d526de04060ebd653ca1a96e7ea75ff6">75f1d588</a>)</li>
<li><strong>client-devops-agent:</strong> Adds support for Remote A2A (Agent-to-Agent) agent registration and management. Adds new Release Readiness Review and Release Testing capabilities. Adds support for Git managed skills in AWS DevOps Agent. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/ebc040e1f3fc292d3eee1a9b146c972338e14807">ebc040e1</a>)</li>
<li><strong>client-bedrock-agentcore:</strong> AgentCore Harness service will be Generally Available at NYS 2026 with this Treb release. Harness will support invoking specific endpoints via the qualifier parameter, AWS Skills for pre-built agent capabilities, and improved validation for skill git source URLs. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/5bf9fcccc3b4cc204df57caea2adcf254c5d3846">5bf9fccc</a>)</li>
<li><strong>client-ecs:</strong> Releasing the ability to bring-your-own task-definition for CreateExpressGatewayService and UpdateGatewayExpressService (<a href="https://github.com/aws/aws-sdk-js-v3/commit/b7b9cb4f46a34c4ab0fedf2138a9a5ba17bdd731">b7b9cb4f</a>)</li>
<li><strong>client-mq:</strong> This release adds private networking support for Amazon MQ for RabbitMQ. You can now associate AWS RAM resource shares with your broker and retrieve shared resource details using the new DescribeSharedResources API. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/e96af4503bfea9a6f211bc905b8e949af6cc38d7">e96af450</a>)</li>
<li><strong>client-bedrock-agent-runtime:</strong> Adds new AgenticRetrieveStream API for managed knowledge bases to use conversation history and autonomously plan for multi-hop multi-KB reasoning with built-in evaluation and access-control. Updates Retrieve API for access-control-based filtering for managed knowledge bases. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/557f7b3246fb6530fb8dcb481f1035d7827d2a1e">557f7b32</a>)</li>
</ul>
<h5>Tests</h5>
<ul>
<li><strong>core:</strong>
<ul>
<li>prebuild before integration and e2e (<a href="https://redirect.github.com/aws/aws-sdk-js-v3/pull/8111">#8111</a>) (<a href="https://github.com/aws/aws-sdk-js-v3/commit/363f3fb7165d327e3ca24b3d7beffb19cc528c31">363f3fb7</a>)</li>
<li>prebuild core before unit tests (<a href="https://redirect.github.com/aws/aws-sdk-js-v3/pull/8108">#8108</a>) (<a href="https://github.com/aws/aws-sdk-js-v3/commit/5f789e7fe2089eacff868a6e1d0b6c2c11313bbc">5f789e7f</a>)</li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md">@aws-sdk/client-s3's changelog</a>.</em></p>
<blockquote>
<h1><a href="https://github.com/aws/aws-sdk-js-v3/compare/v3.1071.0...v3.1072.0">3.1072.0</a> (2026-06-18)</h1>
<p><strong>Note:</strong> Version bump only for package <code>@aws-sdk/client-s3</code></p>
<h1><a href="https://github.com/aws/aws-sdk-js-v3/compare/v3.1070.0...v3.1071.0">3.1071.0</a> (2026-06-17)</h1>
<p><strong>Note:</strong> Version bump only for package <code>@aws-sdk/client-s3</code></p>
<h1><a href="https://github.com/aws/aws-sdk-js-v3/compare/v3.1069.0...v3.1070.0">3.1070.0</a> (2026-06-16)</h1>
<h3>Features</h3>
<ul>
<li><strong>client-s3:</strong> Added support for annotations. You can now attach up to 1000 annotations (up to 1 MB each) directly to objects and create, retrieve, list, and delete them using new annotation APIs. Also added support for configuring an annotation table in S3 Metadata. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/c555874690846b81904a2c0c1e96130bd03bbeaa">c555874</a>)</li>
</ul>
<h1><a href="https://github.com/aws/aws-sdk-js-v3/compare/v3.1068.0...v3.1069.0">3.1069.0</a> (2026-06-15)</h1>
<p><strong>Note:</strong> Version bump only for package <code>@aws-sdk/client-s3</code></p>
<h1><a href="https://github.com/aws/aws-sdk-js-v3/compare/v3.1067.0...v3.1068.0">3.1068.0</a> (2026-06-12)</h1>
<p><strong>Note:</strong> Version bump only for package <code>@aws-sdk/client-s3</code></p>
<h1><a href="https://github.com/aws/aws-sdk-js-v3/compare/v3.1066.0...v3.1067.0">3.1067.0</a> (2026-06-11)</h1>
<p><strong>Note:</strong> Version bump only for package <code>@aws-sdk/client-s3</code></p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/aws/aws-sdk-js-v3/commit/501cd332619533ae96f154d7c226dc2f7bf8d615"><code>501cd33</code></a> Publish v3.1072.0</li>
<li><a href="https://github.com/aws/aws-sdk-js-v3/commit/3ce820aa54c953459eb58abe4f06e28ba4ceb87d"><code>3ce820a</code></a> Publish v3.1071.0</li>
<li><a href="https://github.com/aws/aws-sdk-js-v3/commit/4f2cfe1cfc420d0b5bfa226ae6619dd67de73ccc"><code>4f2cfe1</code></a> Publish v3.1070.0</li>
<li><a href="https://github.com/aws/aws-sdk-js-v3/commit/c555874690846b81904a2c0c1e96130bd03bbeaa"><code>c555874</code></a> feat(client-s3): Added support for annotations. You can now attach up to 1000...</li>
<li><a href="https://github.com/aws/aws-sdk-js-v3/commit/7058d13814795c6ff06a960077269458520bf161"><code>7058d13</code></a> Publish v3.1069.0</li>
<li><a href="https://github.com/aws/aws-sdk-js-v3/commit/67981c5a65d6dd797a065df034a8d0fcdaa9b7bd"><code>67981c5</code></a> chore(scripts): tuning the build graph (<a href="https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3/issues/8095">#8095</a>)</li>
<li><a href="https://github.com/aws/aws-sdk-js-v3/commit/0632f6dc8842caaa916c5f43a5043342ff9ba6bb"><code>0632f6d</code></a> Publish v3.1068.0</li>
<li><a href="https://github.com/aws/aws-sdk-js-v3/commit/0a3246f174335af55a6981b4891f0f4c10dfe4c4"><code>0a3246f</code></a> Publish v3.1067.0</li>
<li><a href="https://github.com/aws/aws-sdk-js-v3/commit/4b11912aef8adc845f81b7e9922bd180c5cf1d90"><code>4b11912</code></a> Publish v3.1066.0</li>
<li><a href="https://github.com/aws/aws-sdk-js-v3/commit/e4ef6c57d8fd97d15e0a7a27a24396990d704307"><code>e4ef6c5</code></a> test: use crypto.randomUUID for resource names in e2e tests (<a href="https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3/issues/8091">#8091</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/aws/aws-sdk-js-v3/commits/v3.1072.0/clients/client-s3">compare view</a></li>
</ul>
</details>
<br />
Updates `@radix-ui/react-avatar` from 1.1.11 to 1.2.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/radix-ui/primitives/blob/main/packages/react/avatar/CHANGELOG.md">@radix-ui/react-avatar's changelog</a>.</em></p>
<blockquote>
<h2>1.2.0</h2>
<ul>
<li>Fixed several edge cases with Avatar's loading state
<ul>
<li>An avatar's fallback would not be displayed again if its image component unmounted. This is now fixed.</li>
<li>Rendering multiple <code>Avatar.Image</code> components per <code>Avatar.Root</code> was never supported and results in buggy, unpredictable behavior. We now warn about this in development.</li>
<li>Zero-sized images were treated as <code>loading</code>, meaning that <code>onLoadingStatusChange</code> is never called once loaded. A zero-sized image now triggers an <code>error</code> status on load.</li>
</ul>
</li>
</ul>
<h3>Other updates</h3>
<ul>
<li>Fixed console warnings to show in test environments.</li>
<li>Updated dependencies: <code>@radix-ui/react-primitive@2.1.6</code></li>
</ul>
<h2>1.1.12</h2>
<ul>
<li>Added repository.directory to all package.json files</li>
<li>Updated dependencies: <code>@radix-ui/react-context@1.1.4</code>, <code>@radix-ui/react-primitive@2.1.5</code>, <code>@radix-ui/react-use-callback-ref@1.1.2</code>, <code>@radix-ui/react-use-is-hydrated@0.1.1</code>, <code>@radix-ui/react-use-layout-effect@1.1.2</code></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a href="https://github.com/radix-ui/primitives/commits/HEAD/packages/react/avatar">compare view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for <code>@radix-ui/react-avatar</code> since your current version.</p>
</details>
<br />
Updates `@radix-ui/react-radio-group` from 1.3.8 to 1.4.1
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/radix-ui/primitives/blob/main/packages/react/radio-group/CHANGELOG.md">@radix-ui/react-radio-group's changelog</a>.</em></p>
<blockquote>
<h2>1.4.1</h2>
<ul>
<li>Updated dependencies: <code>@radix-ui/react-primitive@2.1.6</code>, <code>@radix-ui/react-roving-focus@1.1.13</code></li>
</ul>
<h2>1.4.0</h2>
<ul>
<li>Added unstable <code>RadioGroupItemProvider</code>, <code>RadioGroupItemTrigger</code> and <code>RadioGroupItemBubbleInput</code> parts. These expose the previously internal composition of a radio item (context provider, the interactive control, and the hidden form input) so consumers can directly access and recompose them. The <code>RadioGroupItem</code> component continues to render them by default.</li>
<li>Added repository.directory to all package.json files</li>
<li>Updated dependencies: <code>@radix-ui/react-presence@1.1.6</code>, <code>@radix-ui/react-direction@1.1.2</code>, <code>@radix-ui/primitive@1.1.4</code>, <code>@radix-ui/react-compose-refs@1.1.3</code>, <code>@radix-ui/react-context@1.1.4</code>, <code>@radix-ui/react-primitive@2.1.5</code>, <code>@radix-ui/react-roving-focus@1.1.12</code>, <code>@radix-ui/react-use-controllable-state@1.2.3</code>, <code>@radix-ui/react-use-previous@1.1.2</code>, <code>@radix-ui/react-use-size@1.1.2</code></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a href="https://github.com/radix-ui/primitives/commits/HEAD/packages/react/radio-group">compare view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for <code>@radix-ui/react-radio-group</code> since your current version.</p>
</details>
<br />
Updates `@radix-ui/react-select` from 2.2.6 to 2.3.1
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/radix-ui/primitives/blob/main/packages/react/select/CHANGELOG.md">@radix-ui/react-select's changelog</a>.</em></p>
<blockquote>
<h2>2.3.1</h2>
<ul>
<li>Allowed a <code>Select.Item</code> with an empty string value to act as a "clear" option. Selecting it resets the selection back to the placeholder, restoring the native <code><select></code> behavior for optional selects.</li>
<li>Fixed a bug where typeahead search resulted in focusing an element that no longer exists.</li>
<li>Updated dependencies: <code>@radix-ui/react-slot@1.3.0</code>, <code>@radix-ui/react-popper@1.3.1</code>, <code>@radix-ui/react-dismissable-layer@1.1.13</code>, <code>@radix-ui/react-primitive@2.1.6</code>, <code>@radix-ui/react-collection@1.1.10</code>, <code>@radix-ui/react-focus-scope@1.1.10</code>, <code>@radix-ui/react-portal@1.1.12</code>, <code>@radix-ui/react-visually-hidden@1.2.6</code></li>
</ul>
<h2>2.3.0</h2>
<ul>
<li>Added unstable <code>Provider</code> and <code>BubbleInput</code> parts to Select. <code>Select.unstable_Provider</code> sets up Select's context and state without implicitly rendering the hidden native <code>select</code>, and <code>Select.unstable_BubbleInput</code> exposes that previously internal native <code>select</code> so consumers can recompose it explicitly. <code>Select</code> continues to render both by default.</li>
<li>Added support for presence-based exit animations in Select</li>
<li>Fixed Select hidden input so it submits empty string when no value is selected</li>
<li>Fixed placeholder rendering when a controlled Select is reset to an empty value</li>
<li>Added missing <code>__selectScope</code> prop to <code>PopperContent</code> component</li>
<li>Fixed <code>Select</code> closing unexpectedly after touch-scrolling its content when rendered inside an open shadow DOM</li>
<li>Fixed a bug where iOS text selection and editing on HTML inputs within <code>react-dialog</code> were broken</li>
<li>Fixed triggers referencing a non-existent element via <code>aria-controls</code> when their content is removed from the DOM (credit to <a href="https://github.com/dodomorandi"><code>@dodomorandi</code></a> for the <a href="https://redirect.github.com/radix-ui/primitives/pull/3243">original PR</a>)</li>
<li>Fixed <code>SelectValue</code> logging invalid prop errors when used with both <code>asChild</code> and a placeholder</li>
<li>Added repository.directory to all package.json files</li>
<li>Updated dependencies: <code>@radix-ui/react-presence@1.1.6</code>, <code>@radix-ui/react-popper@1.3.0</code>, <code>@radix-ui/react-slot@1.2.5</code>, <code>@radix-ui/react-focus-guards@1.1.4</code>, <code>@radix-ui/react-dismissable-layer@1.1.12</code>, <code>@radix-ui/react-collection@1.1.9</code>, <code>@radix-ui/react-direction@1.1.2</code>, <code>@radix-ui/number@1.1.2</code>, <code>@radix-ui/primitive@1.1.4</code>, <code>@radix-ui/react-compose-refs@1.1.3</code>, <code>@radix-ui/react-context@1.1.4</code>, <code>@radix-ui/react-focus-scope@1.1.9</code>, <code>@radix-ui/react-id@1.1.2</code>, <code>@radix-ui/react-portal@1.1.11</code>, <code>@radix-ui/react-primitive@2.1.5</code>, <code>@radix-ui/react-use-callback-ref@1.1.2</code>, <code>@radix-ui/react-use-controllable-state@1.2.3</code>, <code>@radix-ui/react-use-layout-effect@1.1.2</code>, <code>@radix-ui/react-use-previous@1.1.2</code>, <code>@radix-ui/react-visually-hidden@1.2.5</code></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a href="https://github.com/radix-ui/primitives/commits/HEAD/packages/react/select">compare view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for <code>@radix-ui/react-select</code> since your current version.</p>
</details>
<br />
Updates `@radix-ui/react-slot` from 1.2.4 to 1.3.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/radix-ui/primitives/blob/main/packages/react/slot/CHANGELOG.md">@radix-ui/react-slot's changelog</a>.</em></p>
<blockquote>
<h2>1.3.0</h2>
<h3>Added generic type arguments for <code>SlotProps</code> and <code>createSlot</code></h3>
<p><code>SlotProps</code> and <code>createSlot</code> now accept generic type arguments to specify the type of element a slot should render, as well as its props.</p>
<pre lang="tsx"><code>const Slot = createSlot<HTMLButtonElement, MyCustomButtonProps>("Slot");
</code></pre>
<h2>1.2.5</h2>
<ul>
<li>Fixed infinite re-render loop in React 19 caused by <code>Slot</code> creating a new ref callback on every render</li>
<li>Added support for nested <code>Slottable</code> via a render prop, so a slotted element can be wrapped while still merging Slot props and refs onto it</li>
<li>Added repository.directory to all package.json files</li>
<li>Improved error messages for invalid slot children</li>
<li>Updated dependencies: <code>@radix-ui/react-compose-refs@1.1.3</code></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a href="https://github.com/radix-ui/primitives/commits/HEAD/packages/react/slot">compare view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for <code>@radix-ui/react-slot</code> since your current version.</p>
</details>
<br />
Updates `@radix-ui/react-switch` from 1.2.6 to 1.3.1
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/radix-ui/primitives/blob/main/packages/react/switch/CHANGELOG.md">@radix-ui/react-switch's changelog</a>.</em></p>
<blockquote>
<h2>1.3.1</h2>
<ul>
<li>Updated dependencies: <code>@radix-ui/react-primitive@2.1.6</code></li>
</ul>
<h2>1.3.0</h2>
<ul>
<li>Added unstable <code>Provider</code>, <code>Trigger</code> and <code>BubbleInput</code> parts to Switch. These expose the previously internal composition (context provider, the interactive control, and the hidden form input) so consumers can directly access and recompose them. The <code>Switch</code> component continues to render them by default.</li>
<li>Added repository.directory to all package.json files</li>
<li>Updated dependencies: <code>@radix-ui/primitive@1.1.4</code>, <code>@radix-ui/react-compose-refs@1.1.3</code>, <code>@radix-ui/react-context@1.1.4</code>, <code>@radix-ui/react-primitive@2.1.5</code>, <code>@radix-ui/react-use-controllable-state@1.2.3</code>, <code>@radix-ui/react-use-previous@1.1.2</code>, <code>@radix-ui/react-use-size@1.1.2</code></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a href="https://github.com/radix-ui/primitives/commits/HEAD/packages/react/switch">compare view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for <code>@radix-ui/react-switch</code> since your current version.</p>
</details>
<br />
Updates `@tanstack/react-query` from 5.100.14 to 5.101.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/TanStack/query/releases">@tanstack/react-query's releases</a>.</em></p>
<blockquote>
<h2><code>@tanstack/react-query-devtools</code><a href="https://github.com/5"><code>@5</code></a>.101.0</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a href="https://github.com/TanStack/query/commit/3042860e3c8731c94ca4dec0e277e415d0484fce"><code>3042860</code></a>, <a href="https://github.com/TanStack/query/commit/e631dc3fa17bff71f413246b7a770a730016d346"><code>e631dc3</code></a>]:
<ul>
<li><code>@tanstack/query-devtools</code><a href="https://github.com/5"><code>@5</code></a>.101.0</li>
<li><code>@tanstack/react-query</code><a href="https://github.com/5"><code>@5</code></a>.101.0</li>
</ul>
</li>
</ul>
<h2><code>@tanstack/react-query-next-experimental</code><a href="https://github.com/5"><code>@5</code></a>.101.0</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a href="https://redirect.github.com/TanStack/query/pull/10857">#10857</a> <a href="https://github.com/TanStack/query/commit/7cf5923308fb91f3eff0fe952d8c64676e2bdad7"><code>7cf5923</code></a> - fix(react-query-next-experimental): replace deprecated 'isServer' with 'environmentManager.isServer()'</p>
</li>
<li>
<p>Updated dependencies []:</p>
<ul>
<li><code>@tanstack/react-query</code><a href="https://github.com/5"><code>@5</code></a>.101.0</li>
</ul>
</li>
</ul>
<h2><code>@tanstack/react-query-persist-client</code><a href="https://github.com/5"><code>@5</code></a>.101.0</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies []:
<ul>
<li><code>@tanstack/query-persist-client-core</code><a href="https://github.com/5"><code>@5</code></a>.101.0</li>
<li><code>@tanstack/react-query</code><a href="https://github.com/5"><code>@5</code></a>.101.0</li>
</ul>
</li>
</ul>
<h2><code>@tanstack/react-query</code><a href="https://github.com/5"><code>@5</code></a>.101.0</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies []:
<ul>
<li><code>@tanstack/query-core</code><a href="https://github.com/5"><code>@5</code></a>.101.0</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md">@tanstack/react-query's changelog</a>.</em></p>
<blockquote>
<h2>5.101.0</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies []:
<ul>
<li><code>@tanstack/query-core</code><a href="https://github.com/5"><code>@5</code></a>.101.0</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/TanStack/query/commit/f3d8d2abbf15bf81ff7575d3be9845d7b402f25a"><code>f3d8d2a</code></a> ci: Version Packages (<a href="https://github.com/TanStack/query/tree/HEAD/packages/react-query/issues/10774">#10774</a>)</li>
<li><a href="https://github.com/TanStack/query/commit/532bb298fba15e945e69c6ee4edc0c759ff21324"><code>532bb29</code></a> fix(tests): disable local coverage instrumentation (<a href="https://github.com/TanStack/query/tree/HEAD/packages/react-query/issues/10776">#10776</a>)</li>
<li>See full diff in <a href="https://github.com/TanStack/query/commits/@tanstack/react-query@5.101.0/packages/react-query">compare view</a></li>
</ul>
</details>
<br />
Updates `axios` from 1.16.1 to 1.18.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/axios/axios/releases">axios's releases</a>.</em></p>
<blockquote>
<h2>v1.18.0 — June 13, 2026</h2>
<p>This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.</p>
<h2>🔒 Security Fixes</h2>
<ul>
<li>
<p><strong>Redirect Header Safety:</strong> Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (<strong><a href="https://redirect.github.com/axios/axios/issues/10892">#10892</a></strong>)</p>
</li>
<li>
<p><strong>URL And Request Hardening:</strong> Rejects malformed <code>http:</code> and <code>https:</code> URLs that omit <code>//</code> with <code>ERR_INVALID_URL</code>, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local <code>NO_PROXY</code> matching. (<strong><a href="https://redirect.github.com/axios/axios/issues/11000">#11000</a></strong>)</p>
</li>
</ul>
<h2>🐛 Bug Fixes</h2>
<ul>
<li><strong>Status Validation:</strong> Added <code>transitional.validateStatusUndefinedResolves</code> so applications can opt in to treating <code>validateStatus: undefined</code> like the option was omitted, while <code>validateStatus: null</code> remains the explicit way to accept every status. (<strong><a href="https://redirect.github.com/axios/axios/issues/10899">#10899</a></strong>)</li>
</ul>
<h2>🔧 Maintenance & Chores</h2>
<ul>
<li>
<p><strong>Documentation:</strong> Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the <code>proxy</code> request config as Node.js-only in the advanced docs. (<strong><a href="https://redirect.github.com/axios/axios/issues/10984">#10984</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10988">#10988</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10992">#10992</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10995">#10995</a></strong>)</p>
</li>
<li>
<p><strong>Dependencies:</strong> Bumped <code>@babel/core</code>, <code>@babel/preset-env</code>, <code>@commitlint/cli</code>, <code>@commitlint/config-conventional</code>, <code>@rollup/plugin-babel</code>, <code>@rollup/plugin-commonjs</code>, <code>@vitest/browser</code>, <code>@vitest/browser-playwright</code>, <code>eslint</code>, <code>lint-staged</code>, <code>rollup</code>, <code>vitest</code>, and <code>actions/checkout</code>. (<strong><a href="https://redirect.github.com/axios/axios/issues/10989">#10989</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10996">#10996</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10997">#10997</a></strong>)</p>
</li>
<li>
<p><strong>Release Metadata:</strong> Prepared the 1.18.0 release by updating package metadata and the runtime <code>VERSION</code> value. (<strong><a href="https://redirect.github.com/axios/axios/issues/11003">#11003</a></strong>)</p>
</li>
</ul>
<h2>🌟 New Contributors</h2>
<p>We are thrilled to welcome our new contributors. Thank you for helping improve axios:</p>
<ul>
<li><strong><a href="https://github.com/drori12"><code>@drori12</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10984">#10984</a></strong>)</li>
<li><strong><a href="https://github.com/eyupcanakman"><code>@eyupcanakman</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10899">#10899</a></strong>)</li>
<li><strong><a href="https://github.com/Adi-Beker"><code>@Adi-Beker</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10995">#10995</a></strong>)</li>
</ul>
<p><a href="https://github.com/axios/axios/compare/v1.17.0...v1.18.0">Full Changelog</a></p>
<h2>v1.17.0 — June 1, 2026</h2>
<p>This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.</p>
<h2>🔒 Security Fixes</h2>
<ul>
<li><strong>Config Hardening:</strong> Guarded <code>socketPath</code>, <code>params</code>, and <code>paramsSerializer</code> reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (<strong><a href="https://redirect.github.com/axios/axios/issues/10901">#10901</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10922">#10922</a></strong>)</li>
<li><strong>Release Publishing:</strong> Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (<strong><a href="https://redirect.github.com/axios/axios/issues/10926">#10926</a></strong>)</li>
</ul>
<h2>🚀 New Features</h2>
<ul>
<li><strong>HTTP Compression:</strong> Added Node HTTP adapter support for zstd response decompression, with <code>transitional.advertiseZstdAcceptEncoding</code> controlling whether <code>zstd</code> is advertised in <code>Accept-Encoding</code>. (<strong><a href="https://redirect.github.com/axios/axios/issues/6792">#6792</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10920">#10920</a></strong>)</li>
</ul>
<h2>🐛 Bug Fixes</h2>
<ul>
<li><strong>Authentication Handling:</strong> Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (<strong><a href="https://redirect.github.com/axios/axios/issues/10929">#10929</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10896">#10896</a></strong>)</li>
<li><strong>Proxy TLS:</strong> Preserved user <code>httpsAgent</code> TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (<strong><a href="https://redirect.github.com/axios/axios/issues/10957">#10957</a></strong>)</li>
<li><strong>React Native FormData:</strong> Cleared default <code>Content-Type</code> for React Native <code>FormData</code> so multipart boundaries can be generated correctly. (<strong><a href="https://redirect.github.com/axios/axios/issues/10898">#10898</a></strong>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/axios/axios/blob/v1.x/CHANGELOG.md">axios's changelog</a>.</em></p>
<blockquote>
<h2>v1.18.0 — June 13, 2026</h2>
<p>This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.</p>
<h2>🔒 Security Fixes</h2>
<ul>
<li>
<p><strong>Redirect Header Safety:</strong> Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (<strong><a href="https://redirect.github.com/axios/axios/issues/10892">#10892</a></strong>)</p>
</li>
<li>
<p><strong>URL And Request Hardening:</strong> Rejects malformed <code>http:</code> and <code>https:</code> URLs that omit <code>//</code> with <code>ERR_INVALID_URL</code>, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local <code>NO_PROXY</code> matching. (<strong><a href="https://redirect.github.com/axios/axios/issues/11000">#11000</a></strong>)</p>
</li>
</ul>
<h2>🐛 Bug Fixes</h2>
<ul>
<li><strong>Status Validation:</strong> Added <code>transitional.validateStatusUndefinedResolves</code> so applications can opt in to treating <code>validateStatus: undefined</code> like the option was omitted, while <code>validateStatus: null</code> remains the explicit way to accept every status. (<strong><a href="https://redirect.github.com/axios/axios/issues/10899">#10899</a></strong>)</li>
</ul>
<h2>🔧 Maintenance & Chores</h2>
<ul>
<li>
<p><strong>Documentation:</strong> Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the <code>proxy</code> request config as Node.js-only in the advanced docs. (<strong><a href="https://redirect.github.com/axios/axios/issues/10984">#10984</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10988">#10988</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10992">#10992</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10995">#10995</a></strong>)</p>
</li>
<li>
<p><strong>Dependencies:</strong> Bumped <code>@babel/core</code>, <code>@babel/preset-env</code>, <code>@commitlint/cli</code>, <code>@commitlint/config-conventional</code>, <code>@rollup/plugin-babel</code>, <code>@rollup/plugin-commonjs</code>, <code>@vitest/browser</code>, <code>@vitest/browser-playwright</code>, <code>eslint</code>, <code>lint-staged</code>, <code>rollup</code>, <code>vitest</code>, and <code>actions/checkout</code>. (<strong><a href="https://redirect.github.com/axios/axios/issues/10989">#10989</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10996">#10996</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10997">#10997</a></strong>)</p>
</li>
<li>
<p><strong>Release Metadata:</strong> Prepared the 1.18.0 release by updating package metadata and the runtime <code>VERSION</code> value. (<strong><a href="https://redirect.github.com/axios/axios/issues/11003">#11003</a></strong>)</p>
</li>
</ul>
<h2>🌟 New Contributors</h2>
<p>We are thrilled to welcome our new contributors. Thank you for helping improve axios:</p>
<ul>
<li><strong><a href="https://github.com/drori12"><code>@drori12</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10984">#10984</a></strong>)</li>
<li><strong><a href="https://github.com/eyupcanakman"><code>@eyupcanakman</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10899">#10899</a></strong>)</li>
<li><strong><a href="https://github.com/Adi-Beker"><code>@Adi-Beker</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10995">#10995</a></strong>)</li>
</ul>
<p><a href="https://github.com/axios/axios/compare/v1.17.0...v1.18.0">Full Changelog</a></p>
<h2>v1.17.0 — June 1, 2026</h2>
<p>This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.</p>
<h2>🔒 Security Fixes</h2>
<ul>
<li><strong>Config Hardening:</strong> Guarded <code>socketPath</code>, <code>params</code>, and <code>paramsSerializer</code> reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (<strong><a href="https://redirect.github.com/axios/axios/issues/10901">#10901</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10922">#10922</a></strong>)</li>
<li><strong>Release Publishing:</strong> Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (<strong><a href="https://redirect.github.com/axios/axios/issues/10926">#10926</a></strong>)</li>
</ul>
<h2>🚀 New Features</h2>
<ul>
<li><strong>HTTP Compression:</strong> Added Node HTTP adapter support for zstd response decompression, with <code>transitional.advertiseZstdAcceptEncoding</code> controlling whether <code>zstd</code> is advertised in <code>Accept-Encoding</code>. (<strong><a href="https://redirect.github.com/axios/axios/issues/6792">#6792</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10920">#10920</a></strong>)</li>
</ul>
<h2>🐛 Bug Fixes</h2>
<ul>
<li><strong>Authentication Handling:</strong> Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (<strong><a href="https://redirect.github.com/axios/axios/issues/10929">#10929</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10896">#10896</a></strong>)</li>
<li><strong>Proxy TLS:</strong> Preserved user <code>httpsAgent</code> TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (<strong><a href="https://redirect.github.com/axios/axios/issues/10957">#10957</a></strong>)</li>
<li><strong>React Native FormData:</strong> Cleared default <code>Content-Type</code> for React Native <code>FormData</code> so multipart boundaries can be generated correctly. (<strong><a href="https://redirect.github.com/axios/axios/issues/10898">#10898</a></strong>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/axios/axios/commit/2d06f96e8602c2db13b65a26340ee4a1bbc0b61f"><code>2d06f96</code></a> chore(release): prepare release 1.18.0 (<a href="https://redirect.github.com/axios/axios/issues/11003">#11003</a>)</li>
<li><a href="https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2"><code>32fc489</code></a> fix: malformed http urls (<a href="https://redirect.github.com/axios/axios/issues/11000">#11000</a>)</li>
<li><a href="https://github.com/axios/axios/commit/b40ce498abfa10d90b873b4fd08f520afa5d2545"><code>b40ce49</code></a> chore(deps-dev): bump the development_dependencies group with 10 updates (<a href="https://redirect.github.com/axios/axios/issues/10">#10</a>...</li>
<li><a href="https://github.com/axios/axios/commit/fe964f960ecb52c3e1155b0daf7be77541956b01"><code>fe964f9</code></a> docs: mark proxy config as Node.js only (<a href="https://redirect.github.com/axios/axios/issues/10995">#10995</a>)</li>
<li><a href="https://github.com/axios/axios/commit/5f229d2d1f018d1db3dab6bbe034dbf3f9041b99"><code>5f229d2</code></a> chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions ...</li>
<li><a href="https://github.com/axios/axios/commit/fae9d4e7db6a858c407c75e607a071c533c5c4f6"><code>fae9d4e</code></a> docs: clarify package update PR policy (<a href="https://redirect.github.com/axios/axios/issues/10992">#10992</a>)</li>
<li><a href="https://github.com/axios/axios/commit/28ab2ced820e55192806c53472ab3eb0cbb68dc2"><code>28ab2ce</code></a> chore(deps-dev): bump the development_dependencies group with 2 updates (<a href="https://redirect.github.com/axios/axios/issues/10989">#10989</a>)</li>
<li><a href="https://github.com/axios/axios/commit/a8e4f13aeecc45a3b8fab3ecfd9ddb5d70fb772b"><code>a8e4f13</code></a> fix(core): keep default validateStatus when request passes undefined (<a href="https://redirect.github.com/axios/axios/issues/10899">#10899</a>)</li>
<li><a href="https://github.com/axios/axios/commit/614f4552a17de757d4171ad7c3bd38c9c1025fd8"><code>614f455</code></a> docs: publish v1.17.0 release notes (<a href="https://redirect.github.com/axios/axios/issues/10988">#10988</a>)</li>
<li><a href="https://github.com/axios/axios/commit/6bb12c191f5380fad321322fb90216ae0dc36985"><code>6bb12c1</code></a> fix: custom auth headers not stripped on cross-origin redirects (<a href="https://redirect.github.com/axios/axios/issues/10892">#10892</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/axios/axios/compare/v1.16.1...v1.18.0">compare view</a></li>
</ul>
</details>
<br />
Updates `js-yaml` from 4.1.1 to 4.2.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md">js-yaml's changelog</a>.</em></p>
<blockquote>
<h2>[4.2.0] - 2026-06-01</h2>
<h3>Added</h3>
<ul>
<li>Added <code>docs/safety.md</code> with notes about processing untrusted YAML.</li>
<li>Added <code>maxDepth</code> (100) loader option. Not a problem, but gives a better
exception instead of RangeError on stack overflow.</li>
<li>Added <code>maxMergeSeqLength</code> (20) loader option. Not a problem after <code>merge</code> fix,
but an additional restriction for safety.</li>
<li>Added sourcemaps to <code>dist/</code> builds.</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Stop resolving numbers with underscores as numeric scalars, <a href="https://redirect.github.com/nodeca/js-yaml/issues/627">#627</a>.</li>
<li>Switched dev toolchains to Vite / neostandard.</li>
<li>Updated demo.</li>
<li>Reorganized tests.</li>
<li><code>dist/</code> files are no longer kept in the repository.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix parsing of properties on the first implicit block mapping key, <a href="https://redirect.github.com/nodeca/js-yaml/issues/62">#62</a>.</li>
<li>Fix trailing whitespace handling when folding flow scalar lines, <a href="https://redirect.github.com/nodeca/js-yaml/issues/307">#307</a>.</li>
<li>Reject top-level block scalars without content indentation, <a href="https://redirect.github.com/nodeca/js-yaml/issues/280">#280</a>.</li>
<li>Ensure numbers survive round-trip, <a href="https://redirect.github.com/nodeca/js-yaml/issues/737">#737</a>.</li>
<li>Fix test coverage for issue <a href="https://redirect.github.com/nodeca/js-yaml/issues/221">#221</a>.</li>
<li>Fix flow scalar trailing whitespace folding, <a href="https://redirect.github.com/nodeca/js-yaml/issues/307">#307</a>.</li>
<li>Fix digits in YAML named tag handles.</li>
</ul>
<h3>Security</h3>
<ul>
<li>Fix potential DoS via quadratic complexity in merge - deduplicate repeated
elements (makes sense for malformed files > 10K).</li>
</ul>
<h2>[3.14.2] - 2025-11-15</h2>
<h3>Security</h3>
<ul>
<li>Backported v4.1.1 fix to v3</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a href="https://github.com/nodeca/js-yaml/commits">compare view</a></li>
</ul>
</details>
<br />
Updates `lucide-react` from 1.17.0 to 1.21.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/lucide-icons/lucide/releases">lucide-react's releases</a>.</em></p>
<blockquote>
<h2>Version 1.21.0</h2>
<h2>What's Changed</h2>
<ul>
<li>ci(release.yml): Remove new-version in release flow by <a href="https://github.com/ericfennis"><code>@ericfennis</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4478">lucide-icons/lucide#4478</a></li>
<li>ci(release.yml): Fix workflow and remove <code>version</code> scripts in package scripts by <a href="https://github.com/ericfennis"><code>@ericfennis</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4479">lucide-icons/lucide#4479</a></li>
<li>fix(docs): rename navigation category label by <a href="https://github.com/Hsiii"><code>@Hsiii</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4483">lucide-icons/lucide#4483</a></li>
<li>feat(icons): added <code>broken-bone</code> icon by <a href="https://github.com/Patolord"><code>@Patolord</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4131">lucide-icons/lucide#4131</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Hsiii"><code>@Hsiii</code></a> made their first contribution in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4483">lucide-icons/lucide#4483</a></li>
<li><a href="https://github.com/Patolord"><code>@Patolord</code></a> made their first contribution in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4131">lucide-icons/lucide#4131</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/lucide-icons/lucide/compare/1.20.0...1.21.0">https://github.com/lucide-icons/lucide/compare/1.20.0...1.21.0</a></p>
<h2>Version 1.20.0</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(icons): decreased size of arrows inside <code>square-arrow-*</code> icons by <a href="https://github.com/jguddas"><code>@jguddas</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/3926">lucide-icons/lucide#3926</a></li>
<li>chore(tags): Add tags to <code>search-</code> icons by <a href="https://github.com/jamiemlaw"><code>@jamiemlaw</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4099">lucide-icons/lucide#4099</a></li>
<li>feat(icons): added <code>save-check</code> icon by <a href="https://github.com/Konixy"><code>@Konixy</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/3120">lucide-icons/lucide#3120</a></li>
<li>feat(icons): added <code>tag-plus</code> and <code>tag-x</code> icons by <a href="https://github.com/adam-kov"><code>@adam-kov</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/3980">lucide-icons/lucide#3980</a></li>
<li>feat(icons): added <code>banknote-check</code> icon by <a href="https://github.com/mfjramirezf"><code>@mfjramirezf</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/3956">lucide-icons/lucide#3956</a></li>
<li>feat(icons): added <code>clock-arrow-in</code> icon by <a href="https://github.com/jguddas"><code>@jguddas</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/2403">lucide-icons/lucide#2403</a></li>
<li>feat(icons): added <code>summary</code> icon by <a href="https://github.com/jpjacobpadilla"><code>@jpjacobpadilla</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/3114">lucide-icons/lucide#3114</a></li>
<li>feat(icons): added <code>user-round-arrow-in</code> icon by <a href="https://github.com/jguddas"><code>@jguddas</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/2283">lucide-icons/lucide#2283</a></li>
<li>feat(icons): added <code>clock-arrow-out</code> icon by <a href="https://github.com/jguddas"><code>@jguddas</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/2404">lucide-icons/lucide#2404</a></li>
<li>docs(docs): fix broken Svelte package source link in README by <a href="https://github.com/SRKrukowski"><code>@SRKrukowski</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4468">lucide-icons/lucide#4468</a></li>
<li>chore(deps-dev): bump <code>@angular/compiler</code> from 21.2.5 to 21.2.17 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4474">lucide-icons/lucide#4474</a></li>
<li>chore(deps-dev): bump <code>@angular/core</code> from 21.2.5 to 21.2.17 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4470">lucide-icons/lucide#4470</a></li>
<li>chore(deps-dev): bump vitest from 4.0.12 to 4.1.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4429">lucide-icons/lucide#4429</a></li>
<li>chore(deps-dev): bump markdown-it from 14.1.1 to 14.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4475">lucide-icons/lucide#4475</a></li>
<li>chore(deps-dev): bump <code>@angular/common</code> from 21.2.5 to 21.2.17 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4471">lucide-icons/lucide#4471</a></li>
<li>feat(icons): added <code>pencil-sparkles</code> icon by <a href="https://github.com/jennieboops"><code>@jennieboops</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4445">lucide-icons/lucide#4445</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Konixy"><code>@Konixy</code></a> made their first contribution in <a href="https://redirect.github.com/lucide-icons/lucide/pull/3120">lucide-icons/lucide#3120</a></li>
<li><a href="https://github.com/adam-kov"><code>@adam-kov</code></a> made their first contribution in <a href="https://redirect.github.com/lucide-icons/lucide/pull/3980">lucide-icons/lucide#3980</a></li>
<li><a href="https://github.com/mfjramirezf"><code>@mfjramirezf</code></a> made their first contribution in <a href="https://redirect.github.com/lucide-icons/lucide/pull/3956">lucide-icons/lucide#3956</a></li>
<li><a href="https://github.com/SRKrukowski"><code>@SRKrukowski</code></a> made their first contribution in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4468">lucide-icons/lucide#4468</a></li>
<li><a href="https://github.com/jennieboops"><code>@jennieboops</code></a> made their first contribution in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4445">lucide-icons/lucide#4445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/lucide-icons/lucide/compare/1.19.0...1.20.0">https://github.com/lucide-icons/lucide/compare/1.19.0...1.20.0</a></p>
<h2>Version 1.19.0</h2>
<h2>What's Changed</h2>
<ul>
<li>chore(deps): upgrade pnpm to version 11.6.0 by <a href="https://github.com/ericfennis"><code>@ericfennis</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4458">lucide-icons/lucide#4458</a></li>
<li>feat(icons): added <code>star-*</code> icons by <a href="https://github.com/RajnishKMehta"><code>@RajnishKMehta</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/3918">lucide-icons/lucide#3918</a></li>
<li>chore(suggest-tags): Update metadata suggestion script by <a href="https://github.com/ericfennis"><code>@ericfennis</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4462">lucide-icons/lucide#4462</a></li>
<li>feat(icons): added <code>save-pen</code> icon by <a href="https://github.com/vaporvee"><code>@vaporvee</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4179">lucide-icons/lucide#4179</a></li>
<li>feat(icons): added <code>wrench-off</code> icon by <a href="https://github.com/nilsjonsson"><code>@nilsjonsson</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4434">lucide-icons/lucide#4434</a></li>
<li>feat(icons): added <code>ad</code> icon by <a href="https://github.com/jamiemlaw"><code>@jamiemlaw</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4323">lucide-icons/lucide#4323</a></li>
<li>feat(icons): added <code>eye-dashed</code> icon by <a href="https://github.com/karsa-mistmere"><code>@karsa-mistmere</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4415">lucide-icons/lucide#4415</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/lucide-icons/lucide/commit/5ff536e1391335e4f7dc38d244c1bc458b9443e2"><code>5ff536e</code></a> ci(release.yml): Fix workflow and remove <code>version</code> scripts in package scripts...</li>
<li>See full diff in <a href="https://github.com/lucide-icons/lucide/commits/1.21.0/packages/lucide-react">compare view</a></li>
</ul>
</details>
<br />
Updates `pg` from 8.21.0 to 8.22.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md">pg's changelog</a>.</em></p>
<blockquote>
<h2>pg@8.22.0</h2>
<ul>
<li>Add support for <a href="https://redirect.github.com/brianc/node-postgres/pull/3688">sslnegotiation=direct</a> for PostgreSQL 17+.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/brianc/node-postgres/commit/b617619f9fb6fbd231731823e2732a2927ded4be"><code>b617619</code></a> Publish</li>
<li><a href="https://github.com/brianc/node-postgres/commit/d80b2612fbe83ed8234637f20b943d85e4331094"><code>d80b261</code></a> Update docs & changelog</li>
<li><a href="https://github.com/brianc/node-postgres/commit/835fb83ab9e1cf30fa8367ba42bd633720d71832"><code>835fb83</code></a> Fix error handling for exceptions on values parsing. (<a href="https://github.com/brianc/node-postgres/tree/HEAD/packages/pg/issues/3574">#3574</a>)</li>
<li><a href="https://github.com/brianc/node-postgres/commit/f49ab4a9795ae0866409f9bfe52a68b4f65ef024"><code>f49ab4a</code></a> fix: correct spelling mistakes across codebase (<a href="https://github.com/brianc/node-postgres/tree/HEAD/packages/pg/issues/3692">#3692</a>)</li>
<li><a href="https://github.com/brianc/node-postgres/commit/d7175a4aa0347b7416109e9ecc61d4d235486d0e"><code>d7175a4</code></a> Expand CI matrix of PG versions and add direct SSL test (<a href="https://github.com/brianc/node-postgres/tree/HEAD/packages/pg/issues/3693">#3693</a>)</li>
<li><a href="https://github.com/brianc/node-postgres/commit/882fc308cce7bf136cd1448e00395f760dad3e00"><code>882fc30</code></a> Add support for sslnegotiation=direct (PostgreSQL 17) (<a href="https://github.com/brianc/node-postgres/tree/HEAD/packages/pg/issues/3688">#3688</a>)</li>
<li>See full diff in <a href="https://github.com/brianc/node-postgres/commits/pg@8.22.0/packages/pg">compare view</a></li>
</ul>
</details>
<br />
Updates `posthog-node` from 5.35.6 to 5.38.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/PostHog/posthog-js/releases">posthog-node's releases</a>.</em></p>
<blockquote>
<h2>posthog-node@5.38.1</h2>
<h2>5.38.1</h2>
<h3>Patch Changes</h3>
<ul>
<li><a href="https://redirect.github.com/PostHog/posthog-js/pull/3886">#3886</a> <a href="https://github.com/PostHog/posthog-js/commit/e6d7fe2a5f10d29b3df69392f584970e7a7a4561"><code>e6d7fe2</code></a> Thanks <a href="https://github.com/marandaneto"><code>@marandaneto</code></a>! - Stop sending deprecated no-op top-level <code>type</code>, <code>library</code>, and <code>library_version</code> fields in event batch payloads. Use <code>properties.$lib</code> and <code>properties.$lib_version</code> for SDK metadata; legacy queued <code>library</code> and <code>library_version</code> values are used as fallbacks when the official <code>$</code> properties are missing.
(2026-06-18)</li>
<li>Updated dependencies [<a href="https://github.com/PostHog/posthog-js/commit/e6d7fe2a5f10d29b3df69392f584970e7a7a4561"><code>e6d7fe2</code></a>]:
<ul>
<li><code>@posthog/core</code><a href="https://github.com/1"><code>@1</code></a>.35.2</li>
</ul>
</li>
</ul>
<h2>posthog-node@5.38.0</h2>
<h2>5.38.0</h2>
<h3>Minor Changes</h3>
<ul>
<li><a href="https://redirect.github.com/PostHog/posthog-js/pull/3845">#3845</a> <a href="https://github.com/PostHog/posthog-js/commit/a0553b305679f995e244cad7498c7521cb4c849d"><code>a0553b3</code></a> Thanks <a href="https://github.com/marandaneto"><code>@marandaneto</code></a>! - Add <code>setPersonProperties()</code> and <code>unsetPersonProperties()</code> helpers to manage person properties from the Node.js SDK.
(2026-06-16)</li>
</ul>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a href="https://github.com/PostHog/posthog-js/commit/b3ec8453d3678bd7ab6737b25bae003e61117ef9"><code>b3ec845</code></a>, <a href="https://github.com/PostHog/posthog-js/commit/c6c163aefb093d5609977ae243b056f96a2d3b4e"><code>c6c163a</code></a>]:
<ul>
<li><code>@posthog/core</code><a href="https://github.com/1"><code>@1</code></a>.33.0</li>
</ul>
</li>
</ul>
<h2>posthog-node@5.37.1</h2>
<h2>5.37.1</h2>
<h3>Patch Changes</h3>
<ul>
<li><a href="https://redirect.github.com/PostHog/posthog-js/pull/3837">#3837</a> <a href="https://github.com/PostHog/posthog-js/commit/29bf8e386a4050531e9cfd906c33b75945fcb6ad"><code>29bf8e3</code></a> Thanks <a href="https://github.com/marandaneto"><code>@marandaneto</code></a>! - Add missing bugs metadata to package manifests.
(2026-06-15)</li>
<li>Updated dependencies [<a href="https://github.com/PostHog/posthog-js/commit/29bf8e386a4050531e9cfd906c33b75945fcb6ad"><code>29bf8e3</code></a>]:
<ul>
<li><code>@posthog/core</code><a href="https://github.com/1"><code>@1</code></a>.32.4</li>
</ul>
</li>
</ul>
<h2>posthog-node@5.37.0</h2>
<h2>5.37.0</h2>
<h3>Minor Changes</h3>
<ul>
<li><a href="https://redirect.github.com/PostHog/posthog-js/pull/3705">#3705</a> <a href="https://github.com/PostHog/posthog-js/commit/d6fc0a50fa2c2650869e3444a030533753ff0b4f"><code>d6fc0a5</code></a> Thanks <a href="https://github.com/gustavohstrassburger"><code>@gustavohstrassburger</code></a>! - feat(feature-flags): support the <code>early_exit</code> condition option in local evaluation. When a flag enables early exit, evaluation now stops and returns <code>false</code> as soon as a condition group's property filters match but the rollout percentage excludes the user, instead of falling through to later groups — matching the server-side evaluation behavior.
(2026-06-12)</li>
</ul>
<h2>posthog-node@5.36.17</h2>
<h2>5.36.17</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies []:
<ul>
<li><code>@posthog/core</code><a href="https://github.com/1"><code>@1</code></a>.32.3</li>
</ul>
</li>
</ul>
<h2>posthog-node@5.36.16</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md">posthog-node's changelog</a>.</em></p>
<blockquote>
<h2>5.38.1</h2>
<h3>Patch Changes</h3>
<ul>
<li><a href="https://redirect.github.com/PostHog/posthog-js/pull/3886">#3886</a> <a href="https://github.com/PostHog/posthog-js/commit/e6d7fe2a5f10d29b3df69392f584970e7a7a4561"><code>e6d7fe2</code></a> Thanks <a href="https://github.com/marandaneto"><code>@marandaneto</code></a>! - Stop sending deprecated no-op top-level <code>type</code>, <code>library</code>, and <code>library_version</code> fields in event batch payloads. Use <code>properties.$lib</code> and <code>properties.$lib_version</code> for SDK metadata; legacy queued <code>library</code> and <code>library_version</code> values are used as fallbacks when the official <code>$</code> properties are missing.
(2026-06-18)</li>
<li>Updated dependencies [<a href="https://github.com/PostHog/posthog-js/commit/e6d7fe2a5f10d29b3df69392f584970e7a7a4561"><code>e6d7fe2</code></a>]:
<ul>
<li><code>@posthog/core</code><a href="https://github.com/1"><code>@1</code></a>.35.2</li>
</ul>
</li>
</ul>
<h2>5.38.0</h2>
<h3>Minor Changes</h3>
<ul>
<li><a href="https://redirect.github.com/PostHog/posthog-js/pull/3845">#3845</a> <a href="https://github.com/PostHog/posthog-js/commit/a0553b305679f995e244cad7498c7521cb4c849d"><code>a0553b3</code></a> Thanks <a href="https://github.com/marandaneto"><code>@marandaneto</code></a>! - Add <code>setPersonProperties()</code> and <code>unsetPersonProperties()</code> helpers to manage person properties from the Node.js SDK.
(2026-06-16)</li>
</ul>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a href="https://github.com/PostHog/posthog-js/commit/b3ec8453d3678bd7ab6737b25bae003e61117ef9"><code>b3ec845</code></a>, <a href="https://github.com/PostHog/posthog-js/commit/c6c163aefb093d5609977ae243b056f96a2d3b4e"><code>c6c163a</code></a>]:
<ul>
<li><code>@posthog/core</code><a href="https://github.com/1"><code>@1</code></a>.33.0</li>
</ul>
</li>
</ul>
<h2>5.37.1</h2>
<h3>Patch Changes</h3>
<ul>
<li><a href="https://redirect.github.com/PostHog/posthog-js/pull/3837">#3837</a> <a href="https://github.com/PostHog/posthog-js/commit/29bf8e386a4050531e9cfd906c33b75945fcb6ad"><code>29bf8e3</code></a> Thanks <a href="https://github.com/marandane...
_Description has been truncated_
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/fosrl/pangolin/pull/3308
Author: @dependabot[bot]
Created: 6/19/2026
Status: 🔄 Open
Base:
main← Head:dependabot/npm_and_yarn/prod-minor-updates-18d1ed5ca2📝 Commits (1)
c88a3e4Bump the prod-minor-updates group across 1 directory with 13 updates📊 Changes
2 files changed (+1357 additions, -525 deletions)
View changed files
📝
package-lock.json(+1344 -512)📝
package.json(+13 -13)📄 Description
Bumps the prod-minor-updates group with 13 updates in the / directory:
3.1056.03.1072.01.1.111.2.01.3.81.4.12.2.62.3.11.2.41.3.01.2.61.3.15.100.145.101.01.16.11.18.04.1.14.2.01.17.01.21.08.21.08.22.05.35.65.38.17.76.17.79.0Updates
@aws-sdk/client-s3from 3.1056.0 to 3.1072.0Release notes
Sourced from @aws-sdk/client-s3's releases.
... (truncated)
Changelog
Sourced from @aws-sdk/client-s3's changelog.
... (truncated)
Commits
501cd33Publish v3.1072.03ce820aPublish v3.1071.04f2cfe1Publish v3.1070.0c555874feat(client-s3): Added support for annotations. You can now attach up to 1000...7058d13Publish v3.1069.067981c5chore(scripts): tuning the build graph (#8095)0632f6dPublish v3.1068.00a3246fPublish v3.1067.04b11912Publish v3.1066.0e4ef6c5test: use crypto.randomUUID for resource names in e2e tests (#8091)Updates
@radix-ui/react-avatarfrom 1.1.11 to 1.2.0Changelog
Sourced from @radix-ui/react-avatar's changelog.
Commits
Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@radix-ui/react-avatarsince your current version.Updates
@radix-ui/react-radio-groupfrom 1.3.8 to 1.4.1Changelog
Sourced from @radix-ui/react-radio-group's changelog.
Commits
Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@radix-ui/react-radio-groupsince your current version.Updates
@radix-ui/react-selectfrom 2.2.6 to 2.3.1Changelog
Sourced from @radix-ui/react-select's changelog.
Commits
Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@radix-ui/react-selectsince your current version.Updates
@radix-ui/react-slotfrom 1.2.4 to 1.3.0Changelog
Sourced from @radix-ui/react-slot's changelog.
Commits
Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@radix-ui/react-slotsince your current version.Updates
@radix-ui/react-switchfrom 1.2.6 to 1.3.1Changelog
Sourced from @radix-ui/react-switch's changelog.
Commits
Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@radix-ui/react-switchsince your current version.Updates
@tanstack/react-queryfrom 5.100.14 to 5.101.0Release notes
Sourced from @tanstack/react-query's releases.
Changelog
Sourced from @tanstack/react-query's changelog.
Commits
f3d8d2aci: Version Packages (#10774)532bb29fix(tests): disable local coverage instrumentation (#10776)Updates
axiosfrom 1.16.1 to 1.18.0Release notes
Sourced from axios's releases.
... (truncated)
Changelog
Sourced from axios's changelog.
... (truncated)
Commits
2d06f96chore(release): prepare release 1.18.0 (#11003)32fc489fix: malformed http urls (#11000)b40ce49chore(deps-dev): bump the development_dependencies group with 10 updates (#10...fe964f9docs: mark proxy config as Node.js only (#10995)5f229d2chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions ...fae9d4edocs: clarify package update PR policy (#10992)28ab2cechore(deps-dev): bump the development_dependencies group with 2 updates (#10989)a8e4f13fix(core): keep default validateStatus when request passes undefined (#10899)614f455docs: publish v1.17.0 release notes (#10988)6bb12c1fix: custom auth headers not stripped on cross-origin redirects (#10892)Updates
js-yamlfrom 4.1.1 to 4.2.0Changelog
Sourced from js-yaml's changelog.
Commits
Updates
lucide-reactfrom 1.17.0 to 1.21.0Release notes
Sourced from lucide-react's releases.
... (truncated)
Commits
5ff536eci(release.yml): Fix workflow and removeversionscripts in package scripts...Updates
pgfrom 8.21.0 to 8.22.0Changelog
Sourced from pg's changelog.
Commits
b617619Publishd80b261Update docs & changelog835fb83Fix error handling for exceptions on values parsing. (#3574)f49ab4afix: correct spelling mistakes across codebase (#3692)d7175a4Expand CI matrix of PG versions and add direct SSL test (#3693)882fc30Add support for sslnegotiation=direct (PostgreSQL 17) (#3688)Updates
posthog-nodefrom 5.35.6 to 5.38.1Release notes
Sourced from posthog-node's releases.
... (truncated)
Changelog
Sourced from posthog-node's changelog.