deps(npm): bump the ui-dependencies group in /NineLanCacheUI with 6 updates by dependabot[bot] · Pull Request #205 · NinePiece2/NineLanCacheUI

dependabot · 2026-11-09T16:45:36Z

Bumps the ui-dependencies group in /NineLanCacheUI with 6 updates:

Package	From	To
framer-motion	`14.9.0`	`14.10.1`
lucide-react	`1.67.0`	`1.70.0`
next	`16.4.4`	`16.4.5`
@tailwindcss/postcss	`4.3.4`	`4.3.5`
eslint-config-next	`16.4.4`	`16.4.5`
tailwindcss	`4.3.4`	`4.3.5`

Updates framer-motion from 14.9.0 to 14.10.1

Changelog

Sourced from framer-motion's changelog.

[14.10.1] 2026-11-05

Fixed

animate: Fix not recognising timeline of only nested sequences as timeline.

Various performance-related improvements.

[14.10.0] 2026-11-05

Added

press: count, hold and repeat, for double/triple press, long press and multipress gestures.

drag: Expose getProps on the dragConstraints function context.

drag: x/y props for headless gesture tracking.

Reorder: Home and End buttons move selected item to beginning and end of list, respectively.

motion: New tap prop for configuring press gesture.

Fixed

animate: Minor fixes.

[14.9.1] 2026-11-04

Added

Ensure accelerated transform animations finish correctly.

AnimatePresence: Fix exit never starting when a child mounts already exiting.

AnimatePresence: Fix exit stuck after an open layoutId card switches to another item.

Ensure accelerated animations are cleaned up in WebKit.

Commits

78f3ff5 v14.10.1
5243b32 Updating changelog
a404e1a Merge pull request #4070 from motiondivision/claude/project-thread-e45kg1
cfdf2ef Merge branch 'main' into claude/project-thread-e45kg1
94097e4 Merge pull request #4067 from motiondivision/lean/5-binding
d95cc90 Merge pull request #4066 from motiondivision/lean/4-spans
5797936 Fix timing flake in "built when played after a pause" test
7a0a081 Merge remote-tracking branch 'origin/main' into claude/project-thread-kgyuj9
16320ad Merge pull request #4065 from motiondivision/lean/2-value
1c9194b Raise framer-motion size budgets to current sizes
Additional commits viewable in compare view

Updates lucide-react from 1.67.0 to 1.70.0

Release notes

Sourced from lucide-react's releases.

Version 1.70.0

What's Changed

fix(site): fix vercel.json redirects that land on 404 by @ericfennis in lucide-icons/lucide#5157

feat(icons): added square-dashed-search icon by @domarku in lucide-icons/lucide#5119

fix(lucide-react-native): emit runtime files for alias icon subpaths by @tlq5l in lucide-icons/lucide#5055

feat(icons): added moped icon by @jamiemlaw in lucide-icons/lucide#3373

feat(icons): added user-exclamation-point, user-round-exclamation-point icons by @ericfennis in lucide-icons/lucide#5144

feat(icons): added grid-3x3-off icon by @gridalchemy in lucide-icons/lucide#5071

New Contributors

@domarku made their first contribution in lucide-icons/lucide#5119

@tlq5l made their first contribution in lucide-icons/lucide#5055

@gridalchemy made their first contribution in lucide-icons/lucide#5071

Full Changelog: lucide-icons/lucide@1.69.0...1.70.0

Version 1.69.0

What's Changed

feat(icons): added package-pen icon by @ericfennis in lucide-icons/lucide#5154

feat(icons): added package-question-mark icon by @ericfennis in lucide-icons/lucide#5155

feat(icons): added opacity icon by @ilyavred in lucide-icons/lucide#4222

feat(icons): added circle-fading-check icon by @n2duc in lucide-icons/lucide#4089

New Contributors

@ilyavred made their first contribution in lucide-icons/lucide#4222

@n2duc made their first contribution in lucide-icons/lucide#4089

Full Changelog: lucide-icons/lucide@1.68.0...1.69.0

Version 1.68.0

What's Changed

fix(site): keep sponsor tiers within content width by @ffgenius in lucide-icons/lucide#5149

feat(icons): added mango icon by @Prsenapati09 in lucide-icons/lucide#4902

chore(icons): Renamed *-warning and *-alert to *-exclamation-point by @ericfennis in lucide-icons/lucide#5143

New Contributors

@ffgenius made their first contribution in lucide-icons/lucide#5149

@Prsenapati09 made their first contribution in lucide-icons/lucide#4902

Full Changelog: lucide-icons/lucide@1.67.0...1.68.0

Commits

See full diff in compare view

Updates next from 16.4.4 to 16.4.5

Release notes

Sourced from next's releases.

v16.4.5

This release contains security fixes for the following advisories:

Moderate

Cross-tenant sensitive information disclosure in Next.js 'use cache' when called through unstable_cache

Cache leak across root param values in nested 'use cache' functions (follow-up)

Cache poisoning of shared fallback shells in Cache Components via request-supplied placeholder route params

Cross-user cache disclosure and poisoning in Next.js use cache with binary arguments

Cross-client response injection and disclosure in self-hosted Next.js applications forwarding fetched responses

SVG rejection bypass in Next.js image optimization

HttpOnly cookie exposure through internal response header on Next.js Edge runtime routes

Commits

4e5335a v16.4.5
809be72 [lts-active] Strip internal middleware cookie headers from edge responses (#282)
2842833 [lts-active] Fix stale compressed framing for forwarded fetch responses (#281)
6596840 [lts-active] [use cache] Fix cache key when binary args are used (#280)
18eeffb [lts-active] Fix shared shell poisoning from request-supplied placeholder par...
e66e656 [lts-active] [next/image] Fix false-positive AVIF/HEIC detection (#278)
d605874 [lts-active] Fix unstable_cache leaking cold 'use cache' fills across roo...
80c96ed [lts-active] Fix outer 'use cache' entries reused across root param values ...
See full diff in compare view

Updates @tailwindcss/postcss from 4.3.4 to 4.3.5

Release notes

Sourced from @tailwindcss/postcss's releases.

v4.3.5

Fixed

Canonicalization: improve performance in projects with many functional variant values (e.g. a matchVariant plugin with thousands of values) (#20663)

Don't crash or create a fallback with the wrong color for a color-mix(…) without a color interpolation method (e.g. color-mix(var(--color-red-500)) or color-mix(currentcolor 50%, transparent)) (#20658, #20666)

Ensure @tailwindcss/oxide-wasm32-wasi loads instead of hanging forever (e.g. with NAPI_RS_FORCE_WASI=error or in WebContainers) (#20667)

Remove as: '*.css' from the @tailwindcss/turbopack setup in its README, because it breaks CSS modules (#20660)

Ignore  between top-level rules in CSS instead of throwing or swallowing the next rule (e.g. a { color: red } --> b { color: blue }) (#20665)

Ensure @tailwindcss/oxide-wasm32-wasi detects changed and new source files after the first scan (e.g. in WebContainers) (#20487)

Prevent type errors with skipLibCheck: false caused by imports of unshipped modules in the @tailwindcss/node type declarations (#20632)

Changelog

Sourced from @tailwindcss/postcss's changelog.

[4.3.5] - 2026-11-06

Fixed

Canonicalization: improve performance in projects with many functional variant values (e.g. a matchVariant plugin with thousands of values) (#20663)

Don't crash or create a fallback with the wrong color for a color-mix(…) without a color interpolation method (e.g. color-mix(var(--color-red-500)) or color-mix(currentcolor 50%, transparent)) (#20658, #20666)

Ensure @tailwindcss/oxide-wasm32-wasi loads instead of hanging forever (e.g. with NAPI_RS_FORCE_WASI=error or in WebContainers) (#20667)

Remove as: '*.css' from the @tailwindcss/turbopack setup in its README, because it breaks CSS modules (#20660)

Ignore  between top-level rules in CSS instead of throwing or swallowing the next rule (e.g. a { color: red } --> b { color: blue }) (#20665)

Ensure @tailwindcss/oxide-wasm32-wasi detects changed and new source files after the first scan (e.g. in WebContainers) (#20487)

Prevent type errors with skipLibCheck: false caused by imports of unshipped modules in the @tailwindcss/node type declarations (#20632)

Commits

9b2c925 4.3.5 (#20672)
See full diff in compare view

Updates eslint-config-next from 16.4.4 to 16.4.5

Release notes

Sourced from eslint-config-next's releases.

v16.4.5

This release contains security fixes for the following advisories:

Moderate

Cross-tenant sensitive information disclosure in Next.js 'use cache' when called through unstable_cache

Cache leak across root param values in nested 'use cache' functions (follow-up)

Cache poisoning of shared fallback shells in Cache Components via request-supplied placeholder route params

Cross-user cache disclosure and poisoning in Next.js use cache with binary arguments

Cross-client response injection and disclosure in self-hosted Next.js applications forwarding fetched responses

SVG rejection bypass in Next.js image optimization

HttpOnly cookie exposure through internal response header on Next.js Edge runtime routes

Commits

4e5335a v16.4.5
See full diff in compare view

Updates tailwindcss from 4.3.4 to 4.3.5

Release notes

Sourced from tailwindcss's releases.

v4.3.5

Fixed

Canonicalization: improve performance in projects with many functional variant values (e.g. a matchVariant plugin with thousands of values) (#20663)

Don't crash or create a fallback with the wrong color for a color-mix(…) without a color interpolation method (e.g. color-mix(var(--color-red-500)) or color-mix(currentcolor 50%, transparent)) (#20658, #20666)

Ensure @tailwindcss/oxide-wasm32-wasi loads instead of hanging forever (e.g. with NAPI_RS_FORCE_WASI=error or in WebContainers) (#20667)

Remove as: '*.css' from the @tailwindcss/turbopack setup in its README, because it breaks CSS modules (#20660)

Ignore  between top-level rules in CSS instead of throwing or swallowing the next rule (e.g. a { color: red } --> b { color: blue }) (#20665)

Ensure @tailwindcss/oxide-wasm32-wasi detects changed and new source files after the first scan (e.g. in WebContainers) (#20487)

Prevent type errors with skipLibCheck: false caused by imports of unshipped modules in the @tailwindcss/node type declarations (#20632)

Changelog

Sourced from tailwindcss's changelog.

[4.3.5] - 2026-11-06

Fixed

Canonicalization: improve performance in projects with many functional variant values (e.g. a matchVariant plugin with thousands of values) (#20663)

Don't crash or create a fallback with the wrong color for a color-mix(…) without a color interpolation method (e.g. color-mix(var(--color-red-500)) or color-mix(currentcolor 50%, transparent)) (#20658, #20666)

Ensure @tailwindcss/oxide-wasm32-wasi loads instead of hanging forever (e.g. with NAPI_RS_FORCE_WASI=error or in WebContainers) (#20667)

Remove as: '*.css' from the @tailwindcss/turbopack setup in its README, because it breaks CSS modules (#20660)

Ignore  between top-level rules in CSS instead of throwing or swallowing the next rule (e.g. a { color: red } --> b { color: blue }) (#20665)

Ensure @tailwindcss/oxide-wasm32-wasi detects changed and new source files after the first scan (e.g. in WebContainers) (#20487)

Prevent type errors with skipLibCheck: false caused by imports of unshipped modules in the @tailwindcss/node type declarations (#20632)

Commits

9b2c925 4.3.5 (#20672)
e0f76e9 Skip the color-mix(…) polyfill without a color interpolation method (#20666)
8c74689 Ignore \ between top-level rules in the CSS parser (#20665)
669fcc1 Don't crash on a color-mix(…) with a single color and no interpolation meth...
7edc50e Canonicalization: don't sort all parsed variants when compiling a single cand...
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the ui-dependencies group in /NineLanCacheUI with 6 updates: | Package | From | To | | --- | --- | --- | | [framer-motion](https://github.com/motiondivision/motion) | `14.9.0` | `14.10.1` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.67.0` | `1.70.0` | | [next](https://github.com/vercel/next.js) | `16.4.4` | `16.4.5` | | [@tailwindcss/postcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss) | `4.3.4` | `4.3.5` | | [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.4.4` | `16.4.5` | | [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.3.4` | `4.3.5` | Updates `framer-motion` from 14.9.0 to 14.10.1 - [Changelog](https://github.com/motiondivision/motion/blob/main/CHANGELOG.md) - [Commits](motiondivision/motion@v14.9.0...v14.10.1) Updates `lucide-react` from 1.67.0 to 1.70.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.70.0/packages/lucide-react) Updates `next` from 16.4.4 to 16.4.5 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.4.4...v16.4.5) Updates `@tailwindcss/postcss` from 4.3.4 to 4.3.5 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.5/packages/@tailwindcss-postcss) Updates `eslint-config-next` from 16.4.4 to 16.4.5 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.4.5/packages/eslint-config-next) Updates `tailwindcss` from 4.3.4 to 4.3.5 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.5/packages/tailwindcss) --- updated-dependencies: - dependency-name: framer-motion dependency-version: 14.10.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ui-dependencies - dependency-name: lucide-react dependency-version: 1.70.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ui-dependencies - dependency-name: next dependency-version: 16.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ui-dependencies - dependency-name: "@tailwindcss/postcss" dependency-version: 4.3.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: ui-dependencies - dependency-name: eslint-config-next dependency-version: 16.4.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: ui-dependencies - dependency-name: tailwindcss dependency-version: 4.3.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: ui-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-11-09T16:45:56Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
npm/next@16.4.4 ⏵ 16.4.5		⁺¹
npm/eslint-config-next@16.4.4 ⏵ 16.4.5
npm/lucide-react@1.67.0 ⏵ 1.70.0	⁺¹	⁺¹	⁺¹
npm/tailwindcss@4.3.4 ⏵ 4.3.5	⁺¹	⁺¹
npm/framer-motion@14.9.0 ⏵ 14.10.1	⁺¹	⁺¹	⁺¹
npm/@tailwindcss/postcss@4.3.4 ⏵ 4.3.5	⁺¹

View full report

dependabot Bot requested a review from NinePiece2 as a code owner November 9, 2026 16:45

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 9, 2026

NinePiece2 approved these changes Nov 9, 2026

View reviewed changes

NinePiece2 merged commit df2df7d into main Nov 9, 2026
5 checks passed

dependabot Bot deleted the dependabot/npm_and_yarn/NineLanCacheUI/ui-dependencies-4d24cc438d branch November 9, 2026 17:12

Navigation Menu

Repository navigation

deps(npm): bump the ui-dependencies group in /NineLanCacheUI with 6 updates - #205

deps(npm): bump the ui-dependencies group in /NineLanCacheUI with 6 updates#205
NinePiece2 merged 1 commit into
mainfrom
dependabot/npm_and_yarn/NineLanCacheUI/ui-dependencies-4d24cc438d

dependabot Bot commented on behalf of github Nov 9, 2026

Uh oh!

socket-security Bot commented Nov 9, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Nov 9, 2026

[14.10.1] 2026-11-05

Fixed

[14.10.0] 2026-11-05

Added

Fixed

[14.9.1] 2026-11-04

Added

Version 1.70.0

What's Changed

New Contributors

Version 1.69.0

What's Changed

New Contributors

Version 1.68.0

What's Changed

New Contributors

v16.4.5

Moderate

v4.3.5

Fixed

[4.3.5] - 2026-11-06

Fixed

v16.4.5

Moderate

v4.3.5

Fixed

[4.3.5] - 2026-11-06

Fixed

Uh oh!

socket-security Bot commented Nov 9, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant