chore(deps): bump the minor-and-patch group across 1 directory with 9 updates by dependabot[bot] · Pull Request #34 · darkroomengineering/spargo

dependabot · 2026-08-03T08:17:23Z

Bumps the minor-and-patch group with 9 updates in the / directory:

Package	From	To
hamo	`1.0.0-dev.13`	`1.0.1`
next	`16.2.9`	`16.2.12`
react	`19.2.7`	`19.2.8`
@types/react	`19.2.17`	`19.2.18`
react-dom	`19.2.7`	`19.2.8`
three	`0.184.0`	`0.185.1`
@biomejs/biome	`2.5.1`	`2.5.6`
@next/bundle-analyzer	`16.2.9`	`16.2.12`
@types/three	`0.184.1`	`0.185.1`

Updates hamo from 1.0.0-dev.13 to 1.0.1

Commits

See full diff in compare view

Updates next from 16.2.9 to 16.2.12

Release notes

Sourced from next's releases.

v16.2.12

What's Changed

Backport/docs fixes 16.2 - July round by @icyJoseph in vercel/next.js#96031

[Backport] Fixes to support TypeScript 7 by @lukesandberg in vercel/next.js#95831

Full Changelog: vercel/next.js@v16.2.11...v16.2.12

v16.2.11

This release contains security fixes for the following advisories:

High:

Denial of Service in App Router using Server Actions

Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Server-Side Request Forgery in Server Actions on custom servers

Moderate:

Cache confusion of response bodies for requests with bodies

Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Denial of Service in the Image Optimization API using SVGs

Unauthenticated disclosure of internal Server Function endpoints

Unbounded Server Action payload in Edge runtime

v16.2.10

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 16.2.4.

Commits

2234717 v16.2.12
957f5ed [Backport] Fixes to support TypeScript 7 (#95831)
b56eb16 Backport/docs fixes 16.2 - July round (#96031)
9beca08 v16.2.11
3c48c7a [16.x] Fix Turbopack middleware matcher with i18n single locale
ac1eff3 [16.x] Improve performance of checking valid MPA form submissions
9a4651e [16.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
b512063 [16.x] Set correct origin for internal redirects in custom server
d303326 [16.x] Ensure exotic rewrite param values are properly encoded
73b9487 [16.x] fix(fetch-cache): key fetch(Request, init) by the effective request
Additional commits viewable in compare view

Updates react from 19.2.7 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

Performance improvements when decoding (#37087 by @eps1lon)

Commits

1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
See full diff in compare view

Updates @types/react from 19.2.17 to 19.2.18

Commits

See full diff in compare view

Updates react-dom from 19.2.7 to 19.2.8

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

Performance improvements when decoding (#37087 by @eps1lon)

Commits

1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
See full diff in compare view

Updates three from 0.184.0 to 0.185.1

Commits

See full diff in compare view

Updates @biomejs/biome from 2.5.1 to 2.5.6

Release notes

Sourced from @biomejs/biome's releases.

Biome CLI v2.5.6

2.5.6

Patch Changes
#11035 0e4b03b Thanks @ematipico! - Fixed a performance regression in noMisusedPromises that caused type inference to run repeatedly while linting a file.
#11043 22ec076 Thanks @denbezrukov! - Fixed CSS formatting for multiline function arguments preceded by comments:
 .example {
   value: outer(
     1,
     /* comment */
     nested(
-      first,
-      second
-    )
+        first,
+        second
+      )
   );
 }
#11007 c9acb25 Thanks @BTF-Kabir-2020! - Fixed #9195: useHookAtTopLevel no longer reports hooks in named forwardRef components that receive a ref parameter.

#10152 50a9bd8 Thanks @Zelys-DFKH! - Fixed #10131: Biome now correctly parses curried arrow functions in ternary consequents when the inner arrow's parameters use a destructuring pattern, e.g. cond ? (x) => ({ a, b }) => body : alt.

#11105 8ffe2b9 Thanks @dadavidtseng! - Fixed #11092: The noUselessTernary quick fix now preserves operator spacing when simplifying or inverting boolean ternary expressions.

#10533 5809875 Thanks @Mokto! - Fixed #10515: biome check --write was not idempotent on Svelte files — multi-line template literals in <script> blocks and block comments in <style> blocks gained an extra indent level on every run.

#11040 0abb620 Thanks @Mokto! - Fixed an issue where the HTML formatter would duplicate a comment placed directly before a Svelte {@const ...} or {@debug ...} block. The duplication compounded on every subsequent --write, causing the file to grow exponentially.

#10858 6d18204 Thanks @ruidosujeira! - Fixed #10839: Svelte {#each} array destructuring no longer includes spaces inside square brackets, and multiline bind function expressions now indent their getter, setter, and function body correctly.
#11009 2c36626 Thanks @ematipico! - Improved the accuracy of type-aware lint rules by resolving more inferred types. For example, noFloatingPromises now detects floating Promises returned by aliased callbacks and arrays of Promises created by async mapping callbacks.

The following statements are now reported:
type AsyncCallback = () => Promise<void>;
declare const callback: AsyncCallback;
callback();
[1, 2, 3].map(async (value) => value);

... (truncated)

Changelog

Sourced from @biomejs/biome's changelog.

2.5.6

Patch Changes
#11035 0e4b03b Thanks @ematipico! - Fixed a performance regression in noMisusedPromises that caused type inference to run repeatedly while linting a file.
#11043 22ec076 Thanks @denbezrukov! - Fixed CSS formatting for multiline function arguments preceded by comments:
 .example {
   value: outer(
     1,
     /* comment */
     nested(
-      first,
-      second
-    )
+        first,
+        second
+      )
   );
 }
#11007 c9acb25 Thanks @BTF-Kabir-2020! - Fixed #9195: useHookAtTopLevel no longer reports hooks in named forwardRef components that receive a ref parameter.

#10152 50a9bd8 Thanks @Zelys-DFKH! - Fixed #10131: Biome now correctly parses curried arrow functions in ternary consequents when the inner arrow's parameters use a destructuring pattern, e.g. cond ? (x) => ({ a, b }) => body : alt.

#11105 8ffe2b9 Thanks @dadavidtseng! - Fixed #11092: The noUselessTernary quick fix now preserves operator spacing when simplifying or inverting boolean ternary expressions.

#10533 5809875 Thanks @Mokto! - Fixed #10515: biome check --write was not idempotent on Svelte files — multi-line template literals in <script> blocks and block comments in <style> blocks gained an extra indent level on every run.

#11040 0abb620 Thanks @Mokto! - Fixed an issue where the HTML formatter would duplicate a comment placed directly before a Svelte {@const ...} or {@debug ...} block. The duplication compounded on every subsequent --write, causing the file to grow exponentially.

#10858 6d18204 Thanks @ruidosujeira! - Fixed #10839: Svelte {#each} array destructuring no longer includes spaces inside square brackets, and multiline bind function expressions now indent their getter, setter, and function body correctly.
#11009 2c36626 Thanks @ematipico! - Improved the accuracy of type-aware lint rules by resolving more inferred types. For example, noFloatingPromises now detects floating Promises returned by aliased callbacks and arrays of Promises created by async mapping callbacks.

The following statements are now reported:
type AsyncCallback = () => Promise<void>;
declare const callback: AsyncCallback;
callback();
[1, 2, 3].map(async (value) => value);
#10973 9cb044c Thanks @ematipico! - Fixed false positives in noMisleadingReturnType when generic-constraint, normalization, substitution, or structural return-type comparison cannot complete. The rule now suppresses diagnostics rather than suggesting a return type derived from partial information. For example, this unresolved return type is no longer reported:

... (truncated)

Commits

1139f1c ci: release (#11022)
781d68d feat(lint/js): add noRestrictedProperties (#9806)
412a0e9 ci: release (#10948)
b3b12b3 feat(lint): add noNegationInEqualityCheck rule (#10915)
9a66bc7 chore: add latitude to sponsors (#10947)
bfc3f3d ci: release (#10887)
9e1999f chore: revert the revert
0b0fd8d chore: revert
0afa35a ci: release (#10817)
3447b2f feat(useDomQuerySelector): add ignore option (#10835)
Additional commits viewable in compare view

Updates @next/bundle-analyzer from 16.2.9 to 16.2.12

Release notes

Sourced from @next/bundle-analyzer's releases.

v16.2.12

What's Changed

Backport/docs fixes 16.2 - July round by @icyJoseph in vercel/next.js#96031

[Backport] Fixes to support TypeScript 7 by @lukesandberg in vercel/next.js#95831

Full Changelog: vercel/next.js@v16.2.11...v16.2.12

v16.2.11

This release contains security fixes for the following advisories:

High:

Denial of Service in App Router using Server Actions

Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Server-Side Request Forgery in Server Actions on custom servers

Moderate:

Cache confusion of response bodies for requests with bodies

Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Denial of Service in the Image Optimization API using SVGs

Unauthenticated disclosure of internal Server Function endpoints

Unbounded Server Action payload in Edge runtime

v16.2.10

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 16.2.4.

Commits

2234717 v16.2.12
9beca08 v16.2.11
9dadfd6 v16.2.10
6e1a94d [16.2.x][ci]: fix release script to not strip newlines (#94640)
See full diff in compare view

Updates @types/react from 19.2.17 to 19.2.18

Commits

See full diff in compare view

Updates @types/three from 0.184.1 to 0.185.1

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

… updates Bumps the minor-and-patch group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [hamo](https://github.com/darkroomengineering/hamo) | `1.0.0-dev.13` | `1.0.1` | | [next](https://github.com/vercel/next.js) | `16.2.9` | `16.2.12` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.7` | `19.2.8` | | [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.17` | `19.2.18` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.7` | `19.2.8` | | [three](https://github.com/mrdoob/three.js) | `0.184.0` | `0.185.1` | | [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.1` | `2.5.6` | | [@next/bundle-analyzer](https://github.com/vercel/next.js/tree/HEAD/packages/next-bundle-analyzer) | `16.2.9` | `16.2.12` | | [@types/three](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/three) | `0.184.1` | `0.185.1` | Updates `hamo` from 1.0.0-dev.13 to 1.0.1 - [Release notes](https://github.com/darkroomengineering/hamo/releases) - [Commits](https://github.com/darkroomengineering/hamo/commits) Updates `next` from 16.2.9 to 16.2.12 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.2.9...v16.2.12) Updates `react` from 19.2.7 to 19.2.8 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react) Updates `@types/react` from 19.2.17 to 19.2.18 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `react-dom` from 19.2.7 to 19.2.8 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom) Updates `three` from 0.184.0 to 0.185.1 - [Release notes](https://github.com/mrdoob/three.js/releases) - [Commits](https://github.com/mrdoob/three.js/commits) Updates `@biomejs/biome` from 2.5.1 to 2.5.6 - [Release notes](https://github.com/biomejs/biome/releases) - [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md) - [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.6/packages/@biomejs/biome) Updates `@next/bundle-analyzer` from 16.2.9 to 16.2.12 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.2.12/packages/next-bundle-analyzer) Updates `@types/react` from 19.2.17 to 19.2.18 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `@types/three` from 0.184.1 to 0.185.1 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/three) --- updated-dependencies: - dependency-name: hamo dependency-version: 1.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: next dependency-version: 16.2.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: react dependency-version: 19.2.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@types/react" dependency-version: 19.2.18 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: react-dom dependency-version: 19.2.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: three dependency-version: 0.185.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@biomejs/biome" dependency-version: 2.5.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@next/bundle-analyzer" dependency-version: 16.2.12 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@types/react" dependency-version: 19.2.18 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@types/three" dependency-version: 0.185.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2026-08-03T08:17:28Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
gpu-dithering	Error		Aug 3, 2026 8:18am
spargo	Error		Aug 3, 2026 8:18am

darkestdarky-bot

Dependency-only bump updates hamo, next, react, react-dom, three, Biome, bundle-analyzer, and type packages. Next 16.2.12 includes security fixes and React 19.2.8 is a patch, so those are low risk. The main review risk is three 0.184.0 -> 0.185.1: 0.x minor releases can contain breaking API changes, so verify release notes and run typecheck/build. Also confirm the Bun lockfile is updated with package.json.

Review coverage: 40/40 diff lines supplied. Partial input (truncated: body, standards). Inline comments are limited to fully visible, valid right-side hunks. Reviewed commit: d54908441ef95dd53d9673c3996df2e1aebdb56e.

darkestdarky-bot · 2026-09-14T09:01:54Z

+    "react-dom": "19.2.8",
    "tempus": "1.0.0-dev.17",
-    "three": "0.184.0",
+    "three": "0.185.1",


three is still 0.x, so a minor bump (0.184.0 -> 0.185.1) can include breaking API changes. The standards require checking breaking changes before dependency upgrades; verify the three release notes and run bunx tsc --noEmit and the build before merge.

darkestdarky-bot · 2026-09-14T09:01:54Z

+    "@types/react": "19.2.18",
    "@types/react-dom": "^19.2.3",
-    "@types/three": "^0.184.0",
+    "@types/three": "^0.185.1",


@types/three uses a caret range (^0.185.1) while three is pinned exact (0.185.1). In 0.x, caret allows patch drift within 0.185.x, which can desynchronize type definitions from the runtime. Consider pinning @types/three to the exact matching version or ensure the lockfile resolves a compatible pair.

darkestdarky-bot · 2026-09-14T09:01:54Z

    "clsx": "^2.1.1",
-    "hamo": "1.0.0-dev.13",
-    "next": "16.2.9",
+    "hamo": "1.0.1",


hamo moves from a dev prerelease (1.0.0-dev.13) to stable 1.0.1. Verify the stable release does not change hook APIs used in this repo; a prerelease-to-stable jump can include breaking changes not captured by semver.

arzafran · 2026-10-01T15:06:12Z

Closing stale dependency update so the new CI gate can run on fresh ones. Dependabot will open a new PR for the next version.

dependabot · 2026-10-01T15:06:17Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Aug 3, 2026

vercel Bot had a problem deploying to Preview – spargo August 3, 2026 08:17 Failure

vercel Bot had a problem deploying to Preview – gpu-dithering August 3, 2026 08:18 Failure

darkestdarky-bot Bot reviewed Sep 14, 2026

View reviewed changes

arzafran closed this Oct 1, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/minor-and-patch-f3262ad910 branch October 1, 2026 15:06

Navigation Menu

Uh oh!

chore(deps): bump the minor-and-patch group across 1 directory with 9 updates - #34

chore(deps): bump the minor-and-patch group across 1 directory with 9 updates#34
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-f3262ad910

dependabot Bot commented on behalf of github Aug 3, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Aug 3, 2026 •

edited

Loading

Uh oh!

darkestdarky-bot Bot left a comment

Uh oh!

darkestdarky-bot Bot Sep 14, 2026

Uh oh!

darkestdarky-bot Bot Sep 14, 2026

Uh oh!

darkestdarky-bot Bot Sep 14, 2026

Uh oh!

arzafran commented Oct 1, 2026

Uh oh!

dependabot Bot commented on behalf of github Oct 1, 2026

Uh oh!

This branch had an error being deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v16.2.12

What's Changed

v16.2.11

v16.2.10

19.2.8 (July 21st, 2026)

React Server Components

19.2.8 (July 21st, 2026)

React Server Components

Biome CLI v2.5.6

2.5.6

Patch Changes

2.5.6

Patch Changes

v16.2.12

What's Changed

v16.2.11

v16.2.10

Uh oh!

vercel Bot commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

darkestdarky-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

darkestdarky-bot Bot Sep 14, 2026

Choose a reason for hiding this comment

Uh oh!

darkestdarky-bot Bot Sep 14, 2026

Choose a reason for hiding this comment

Uh oh!

darkestdarky-bot Bot Sep 14, 2026

Choose a reason for hiding this comment

Uh oh!

arzafran commented Oct 1, 2026

Uh oh!

dependabot Bot commented on behalf of github Oct 1, 2026

Uh oh!

This branch had an error being deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Aug 3, 2026 •

edited

Loading

vercel Bot commented Aug 3, 2026 •

edited

Loading