Skip to content

chore: bump the production-dependencies group across 1 directory with 8 updates#608

Open
dependabot[bot] wants to merge 1 commit into
v2from
dependabot/npm_and_yarn/v2/production-dependencies-6ce14e8ef0
Open

chore: bump the production-dependencies group across 1 directory with 8 updates#608
dependabot[bot] wants to merge 1 commit into
v2from
dependabot/npm_and_yarn/v2/production-dependencies-6ce14e8ef0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 25, 2026

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 8 updates in the / directory:

Package From To
@mui/x-charts 8.27.0 9.3.0
@mui/x-data-grid 8.27.1 9.3.0
@shikijs/monaco 3.22.0 4.1.0
lodash-es 4.17.23 4.18.1
mobx 6.15.0 6.15.4
react-error-boundary 6.1.1 6.1.2
react-i18next 16.5.4 17.0.8
shiki 3.22.0 4.1.0

Updates @mui/x-charts from 8.27.0 to 9.3.0

Release notes

Sourced from @​mui/x-charts's releases.

v9.3.0

We'd like to extend a big thank you to the 16 contributors who made this release possible. Here are some highlights ✨:

  • 📆 Refactor Calendar Range drag editing to use Pointer Events instead of drag and touch events combination (#22279)
  • ✨ Apply lazy loading to EventTimelinePremium (#22308)
  • 🐞 Bugfixes
  • 📚 Documentation improvements
  • 🌎 Added Norwegian bokmål (nb-NO) locale to the Scheduler
  • 🌎 Improved Swedish (sv-SE) locale on the Data Grid

Special thanks go out to these community members for their valuable contributions: @​Anexus5919, @​jvskriubakken, @​oscar-b, @​rin, @​viktormelin

The following team members contributed to this release: @​aemartos, @​alexfauquette, @​arminmeh, @​Janpot, @​JCQuintas, @​LukasTy, @​mj12albert, @​oliviertassinari, @​rita-codes, @​romgrk, @​sai6855

Data Grid

@mui/x-data-grid@9.3.0

@mui/x-data-grid-pro@9.3.0 pro

Same changes as in @mui/x-data-grid@9.3.0.

@mui/x-data-grid-premium@9.3.0 premium

Same changes as in @mui/x-data-grid-pro@9.3.0.

Date and Time Pickers

@mui/x-date-pickers@9.3.0

  • [pickers] Fix disabled state styling for PickersTextField standard and filled variants (#22189) @​LukasTy
  • [pickers] Fix previous month disabled state calculation (#22524) @​mj12albert
  • [pickers] Merge slotProps.sectionContent in PickersInputBase (#22324) @​rin

@mui/x-date-pickers-pro@9.3.0 pro

Same changes as in @mui/x-date-pickers@9.3.0, plus:

Charts

@mui/x-charts@9.3.0

... (truncated)

Changelog

Sourced from @​mui/x-charts's changelog.

9.3.0

May 21, 2026

We'd like to extend a big thank you to the 16 contributors who made this release possible. Here are some highlights ✨:

  • 📆 Refactor Calendar Range drag editing to use Pointer Events instead of drag and touch events combination (#22279)
  • ✨ Apply lazy loading to EventTimelinePremium (#22308)
  • 🐞 Bugfixes
  • 📚 Documentation improvements
  • 🌎 Added Norwegian bokmål (nb-NO) locale to the Scheduler
  • 🌎 Improved Swedish (sv-SE) locale on the Data Grid

Special thanks go out to these community members for their valuable contributions: @​Anexus5919, @​jvskriubakken, @​oscar-b, @​rin, @​viktormelin

The following team members contributed to this release: @​aemartos, @​alexfauquette, @​arminmeh, @​Janpot, @​JCQuintas, @​LukasTy, @​mj12albert, @​oliviertassinari, @​rita-codes, @​romgrk, @​sai6855

Data Grid

@mui/x-data-grid@9.3.0

@mui/x-data-grid-pro@9.3.0 pro

Same changes as in @mui/x-data-grid@9.3.0.

@mui/x-data-grid-premium@9.3.0 premium

Same changes as in @mui/x-data-grid-pro@9.3.0.

Date and Time Pickers

@mui/x-date-pickers@9.3.0

  • [pickers] Fix disabled state styling for PickersTextField standard and filled variants (#22189) @​LukasTy
  • [pickers] Fix previous month disabled state calculation (#22524) @​mj12albert
  • [pickers] Merge slotProps.sectionContent in PickersInputBase (#22324) @​rin

@mui/x-date-pickers-pro@9.3.0 pro

Same changes as in @mui/x-date-pickers@9.3.0, plus:

Charts

... (truncated)

Commits
  • 1eb0ba2 [release] v9.3.0 (#22540)
  • ca688af [charts] Fix highlighted item crash (#22539)
  • 341b5f9 [charts] Fix the line and mark class (#22526)
  • 5405089 [charts] Add data-series to elements of radar chart (#22523)
  • 30d0bd5 [code-infra] Make generated propTypes union order deterministic (#22521)
  • 033f9bc [charts] Chart seriesConfig deduplication for lines an bars (#22257)
  • 4359d56 [code-infra] Enable mui/no-presentation-role lint rule (#22360)
  • c15aff8 [charts] Add environment check for warning messages in axis and radar hooks (...
  • 29b59b4 [charts] Improve performance of evaluateCurveY function (#22407)
  • bced0c8 [release] v9.2.0 (#22436)
  • Additional commits viewable in compare view

Updates @mui/x-data-grid from 8.27.1 to 9.3.0

Release notes

Sourced from @​mui/x-data-grid's releases.

v9.3.0

We'd like to extend a big thank you to the 16 contributors who made this release possible. Here are some highlights ✨:

  • 📆 Refactor Calendar Range drag editing to use Pointer Events instead of drag and touch events combination (#22279)
  • ✨ Apply lazy loading to EventTimelinePremium (#22308)
  • 🐞 Bugfixes
  • 📚 Documentation improvements
  • 🌎 Added Norwegian bokmål (nb-NO) locale to the Scheduler
  • 🌎 Improved Swedish (sv-SE) locale on the Data Grid

Special thanks go out to these community members for their valuable contributions: @​Anexus5919, @​jvskriubakken, @​oscar-b, @​rin, @​viktormelin

The following team members contributed to this release: @​aemartos, @​alexfauquette, @​arminmeh, @​Janpot, @​JCQuintas, @​LukasTy, @​mj12albert, @​oliviertassinari, @​rita-codes, @​romgrk, @​sai6855

Data Grid

@mui/x-data-grid@9.3.0

@mui/x-data-grid-pro@9.3.0 pro

Same changes as in @mui/x-data-grid@9.3.0.

@mui/x-data-grid-premium@9.3.0 premium

Same changes as in @mui/x-data-grid-pro@9.3.0.

Date and Time Pickers

@mui/x-date-pickers@9.3.0

  • [pickers] Fix disabled state styling for PickersTextField standard and filled variants (#22189) @​LukasTy
  • [pickers] Fix previous month disabled state calculation (#22524) @​mj12albert
  • [pickers] Merge slotProps.sectionContent in PickersInputBase (#22324) @​rin

@mui/x-date-pickers-pro@9.3.0 pro

Same changes as in @mui/x-date-pickers@9.3.0, plus:

Charts

@mui/x-charts@9.3.0

... (truncated)

Changelog

Sourced from @​mui/x-data-grid's changelog.

9.3.0

May 21, 2026

We'd like to extend a big thank you to the 16 contributors who made this release possible. Here are some highlights ✨:

  • 📆 Refactor Calendar Range drag editing to use Pointer Events instead of drag and touch events combination (#22279)
  • ✨ Apply lazy loading to EventTimelinePremium (#22308)
  • 🐞 Bugfixes
  • 📚 Documentation improvements
  • 🌎 Added Norwegian bokmål (nb-NO) locale to the Scheduler
  • 🌎 Improved Swedish (sv-SE) locale on the Data Grid

Special thanks go out to these community members for their valuable contributions: @​Anexus5919, @​jvskriubakken, @​oscar-b, @​rin, @​viktormelin

The following team members contributed to this release: @​aemartos, @​alexfauquette, @​arminmeh, @​Janpot, @​JCQuintas, @​LukasTy, @​mj12albert, @​oliviertassinari, @​rita-codes, @​romgrk, @​sai6855

Data Grid

@mui/x-data-grid@9.3.0

@mui/x-data-grid-pro@9.3.0 pro

Same changes as in @mui/x-data-grid@9.3.0.

@mui/x-data-grid-premium@9.3.0 premium

Same changes as in @mui/x-data-grid-pro@9.3.0.

Date and Time Pickers

@mui/x-date-pickers@9.3.0

  • [pickers] Fix disabled state styling for PickersTextField standard and filled variants (#22189) @​LukasTy
  • [pickers] Fix previous month disabled state calculation (#22524) @​mj12albert
  • [pickers] Merge slotProps.sectionContent in PickersInputBase (#22324) @​rin

@mui/x-date-pickers-pro@9.3.0 pro

Same changes as in @mui/x-date-pickers@9.3.0, plus:

Charts

... (truncated)

Commits

Updates @shikijs/monaco from 3.22.0 to 4.1.0

Release notes

Sourced from @​shikijs/monaco's releases.

v4.1.0

   🐞 Bug Fixes

    View changes on GitHub

v4.0.2

   🐞 Bug Fixes

    View changes on GitHub

v4.0.1

   🐞 Bug Fixes

    View changes on GitHub

v4.0.0

   🚨 Breaking Changes

   🚀 Features

    View changes on GitHub

v3.23.0

   🚀 Features

   🐞 Bug Fixes

    View changes on GitHub
Commits

Updates lodash-es from 4.17.23 to 4.18.1

Release notes

Sourced from lodash-es's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

  • Add security notice for _.template in threat model and API docs (#6099)
  • Document lower > upper behavior in _.random (#6115)
  • Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

Commits
  • cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
  • 75535f5 chore: prune stale advisory refs (#6170)
  • 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
  • 59be2de release(minor): bump to 4.18.0 (#6161)
  • af63457 fix: broken tests for _.template 879aaa9
  • 1073a76 fix: linting issues
  • 879aaa9 fix: validate imports keys in _.template
  • fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
  • 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
  • b819080 ci: add dist sync validation workflow (#6137)
  • Additional commits viewable in compare view

Updates mobx from 6.15.0 to 6.15.4

Release notes

Sourced from mobx's releases.

mobx@6.15.4

Patch Changes

mobx@6.15.3

Patch Changes

mobx@6.15.2

Patch Changes

mobx@6.15.1

Patch Changes

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for mobx since your current version.


Updates react-error-boundary from 6.1.1 to 6.1.2

Release notes

Sourced from react-error-boundary's releases.

6.1.2

README and doc comment updates

Commits
  • 90b9a7e 6.1.1 -> 6.1.2
  • 7d29d50 Update react-lib-tools from 0.0.47 to 0.0.53
  • 09b1522 Refresh error boundary docs and examples (#240)
  • 9db16fd Upgrade react-lib-tools to improve site-search
  • 4f541a4 Add note about ESM to home page and README
  • f3f9582 Update CONTRIBUTING.md
  • ecaf925 Update example
  • 70902a9 Fix JSX attribute in ErrorBoundary example (#239)
  • f964b1c Update react-lib-tools dep
  • e7b8fe2 Update react-lib-tools to better respect prefers-reduced-motion: reduce setting
  • See full diff in compare view

Updates react-i18next from 16.5.4 to 17.0.8

Changelog

Sourced from react-i18next's changelog.

17.0.8

  • fix(types): <Trans i18nKey={$ => ...}> now typechecks under enableSelector: 'strict'. The Trans component's conditional type was gated on _EnableSelector extends true | 'optimize', excluding 'strict' and falling back to the legacy string-key signature. Runtime was already correct (it calls keyFromSelector(i18nKey) whenever typeof i18nKey === 'function'); this is a type-only fix that widens the conditional to include 'strict'. Thanks @​Faithfinder (#1921)

17.0.7

  • feat: useTranslation([nsA, nsB, ...]) now passes its full namespace list to getFixedT via the new scopeNs opt (requires i18next ≥ v26.0.10). This makes selector calls with a secondary-namespace prefix resolve correctly under default nsMode: t($ => $.nsB.foo) previously missed silently because the bound ns was the primary string only and i18next's selector rewrite needed an array. Resolution semantics are unchanged — plain t('key') lookups still stay isolated to the primary namespace by default; use nsMode: 'fallback' to opt into multi-ns fallback resolution as before. Fixes i18next#2429 for useTranslation-based callers.

17.0.6

  • fix: restore the v17 nodesToString output format consumed by i18next-cli's extractor while still rendering 1919 correctly
    • 17.0.5 fixed 1919 by changing what nodesToString produced, which inadvertently changed the extracted translation strings for keep-tags wrapping non-keep React elements
    • The fix now lives in the renderer: indexed <N> placeholders nested inside a keep-tag are scoped to that tag's own original React children (matching kept tags by name and positional occurrence at each level), so the translation string format produced by nodesToString is unchanged

17.0.5

  • fix: <Trans /> no longer breaks child rendering when a kept HTML node (transKeepBasicHtmlNodesFor) wraps a non-keep React element 1919 — superseded by 17.0.6, which keeps the same runtime fix without changing the nodesToString output

17.0.4

  • fix: avoid React does not recognize the 'i18nIsDynamicList' prop on a DOM element warning 1915

17.0.3

  • fix: avoid invalid prop on React.Fragment inside <Trans /> 1914

17.0.2

  • fix(types): values prop on <Trans /> now only requires interpolation variables for the specific i18nKey, not all variables in the namespace 1913

17.0.1

  • chore: bump minimum i18next peer dependency to >= 26.0.1 (forgot to do it in last version)
  • fix: migrate test setup from removed legacy interpolation.format to i18n.services.formatter.add() (i18next v26)

17.0.0

Potentially breaking changes

  • fix: transKeepBasicHtmlNodesFor now correctly preserves HTML tag names when children contain interpolations or mixed content 230
    • Previously, <strong>{{name}}</strong> was incorrectly serialized as <1>{{name}}</1> — the tag name was only preserved for plain string children
    • This bug existed since the feature was introduced and affects auto-generated keys (when no explicit i18nKey is provided)
    • If you rely on auto-generated Trans keys containing indexed tags for kept HTML elements with interpolation children, you will need to update your translation files

Other changes

  • updated dev dependencies (vitest, rollup plugins, happy-dom, typescript, etc.)

16.6.6

... (truncated)

Commits
  • a46ad23 17.0.8
  • f715031 update i18next dep
  • a515d5b changelog: 17.0.8 entry for #1921
  • d5ab7c8 fix(types): accept selector i18nKey on <Trans> under enableSelector: 'strict'...
  • b91ba36 Add Locize advice section near the top of README
  • 5e892a2 17.0.7
  • c8f4c6b feat: useTranslation([nsA,nsB]) routes selector secondary-ns prefix via getFi...
  • 084f9a6 Modernize locize.com URLs and refresh UTM tags
  • cb20d18 17.0.6
  • b8ad5e4 fix: scope indexed placeholders inside keep-tags at render time #1919
  • Additional commits viewable in compare view

Updates shiki from 3.22.0 to 4.1.0

Release notes

Sourced from shiki's releases.

v4.1.0

   🐞 Bug Fixes

    View changes on GitHub

v4.0.2

   🐞 Bug Fixes

    View changes on GitHub

v4.0.1

   🐞 Bug Fixes

    View changes on GitHub

v4.0.0

   🚨 Breaking Changes

   🚀 Features

    View changes on GitHub

v3.23.0

   🚀 Features

   🐞 Bug Fixes

    View changes on GitHub
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore: bump the production-dependencies group across 1 directory with…
94b2464 
… 8 updates

Bumps the production-dependencies group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@mui/x-charts](https://github.com/mui/mui-x/tree/HEAD/packages/x-charts) | `8.27.0` | `9.3.0` |
| [@mui/x-data-grid](https://github.com/mui/mui-x/tree/HEAD/packages/x-data-grid) | `8.27.1` | `9.3.0` |
| [@shikijs/monaco](https://github.com/shikijs/shiki/tree/HEAD/packages/monaco) | `3.22.0` | `4.1.0` |
| [lodash-es](https://github.com/lodash/lodash) | `4.17.23` | `4.18.1` |
| [mobx](https://github.com/mobxjs/mobx) | `6.15.0` | `6.15.4` |
| [react-error-boundary](https://github.com/bvaughn/react-error-boundary) | `6.1.1` | `6.1.2` |
| [react-i18next](https://github.com/i18next/react-i18next) | `16.5.4` | `17.0.8` |
| [shiki](https://github.com/shikijs/shiki/tree/HEAD/packages/shiki) | `3.22.0` | `4.1.0` |



Updates `@mui/x-charts` from 8.27.0 to 9.3.0
- [Release notes](https://github.com/mui/mui-x/releases)
- [Changelog](https://github.com/mui/mui-x/blob/master/CHANGELOG.md)
- [Commits](https://github.com/mui/mui-x/commits/v9.3.0/packages/x-charts)

Updates `@mui/x-data-grid` from 8.27.1 to 9.3.0
- [Release notes](https://github.com/mui/mui-x/releases)
- [Changelog](https://github.com/mui/mui-x/blob/master/CHANGELOG.md)
- [Commits](https://github.com/mui/mui-x/commits/v9.3.0/packages/x-data-grid)

Updates `@shikijs/monaco` from 3.22.0 to 4.1.0
- [Release notes](https://github.com/shikijs/shiki/releases)
- [Commits](https://github.com/shikijs/shiki/commits/v4.1.0/packages/monaco)

Updates `lodash-es` from 4.17.23 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.23...4.18.1)

Updates `mobx` from 6.15.0 to 6.15.4
- [Release notes](https://github.com/mobxjs/mobx/releases)
- [Commits](https://github.com/mobxjs/mobx/commits/mobx@6.15.4)

Updates `react-error-boundary` from 6.1.1 to 6.1.2
- [Release notes](https://github.com/bvaughn/react-error-boundary/releases)
- [Commits](bvaughn/react-error-boundary@6.1.1...6.1.2)

Updates `react-i18next` from 16.5.4 to 17.0.8
- [Changelog](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/react-i18next@v16.5.4...v17.0.8)

Updates `shiki` from 3.22.0 to 4.1.0
- [Release notes](https://github.com/shikijs/shiki/releases)
- [Commits](https://github.com/shikijs/shiki/commits/v4.1.0/packages/shiki)

---
updated-dependencies:
- dependency-name: "@mui/x-charts"
  dependency-version: 9.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: "@mui/x-data-grid"
  dependency-version: 9.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: "@shikijs/monaco"
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: lodash-es
  dependency-version: 4.18.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: mobx
  dependency-version: 6.15.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: react-error-boundary
  dependency-version: 6.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: react-i18next
  dependency-version: 17.0.8
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: shiki
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels May 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants