build(deps): bump the prod-deps group with 6 updates by dependabot[bot] · Pull Request #2027 · chaynHQ/bloom-frontend

dependabot · 2026-11-09T09:07:37Z

Bumps the prod-deps group with 6 updates:

Package	From	To
@next/third-parties	`16.4.4`	`16.4.5`
@reduxjs/toolkit	`2.13.0`	`2.14.0`
@storyblok/react	`7.4.0`	`7.5.0`
firebase	`13.1.0`	`13.2.0`
newrelic	`14.10.0`	`14.11.0`
next	`16.4.4`	`16.4.5`

Updates @next/third-parties from 16.4.4 to 16.4.5

Release notes

Sourced from @next/third-parties's releases.

v16.4.5

This release contains security fixes for the following advisories:

Moderate

Cross-tenant sensitive information disclosure in Next.js 'use cache' when called through unstable_cache

Cache leak across root param values in nested 'use cache' functions (follow-up)

Cache poisoning of shared fallback shells in Cache Components via request-supplied placeholder route params

Cross-user cache disclosure and poisoning in Next.js use cache with binary arguments

Cross-client response injection and disclosure in self-hosted Next.js applications forwarding fetched responses

SVG rejection bypass in Next.js image optimization

HttpOnly cookie exposure through internal response header on Next.js Edge runtime routes

Commits

4e5335a v16.4.5
See full diff in compare view

Updates @reduxjs/toolkit from 2.13.0 to 2.14.0

Release notes

Sourced from @reduxjs/toolkit's releases.

v2.14.0

This feature release speeds up the dispatch path and RTK Query's Api type checking, shrinks createSlice in esbuild bundles, adds RTK-owned Draft and Patch types so emitted declarations no longer reference Immer, adds removeMany({ where }) and selectByIds to the entity adapter, adds RTK Query cache entry selectors and a DevTools action sanitizer, and fixes a very long list of RTK Query lifecycle, polling, upsert, timer, hook and fetchBaseQuery bugs.

Note that we just announced our roadmap to Redux Toolkit 3.0, which includes both a large set of planned 2.x features and improvements, and planned 3.0 breaking changes. The fixes and updates in this release help pave the way for all of those efforts. We'd also appreciate feedback on the linked RTK Query usage patterns and 3.0 planned breaking changes discussion threads.

Changelog

Dispatch Performance

Every dispatched action runs through every reducer and middleware, so small costs on that path add up. We added a benchmark harness for the dispatch path and used it to find several places where RTK did work for actions it didn't care about.

createAction(...).match now compares action.type before calling isAction, so a non-matching action costs a property read. createReducer no longer allocates arrays on every dispatch to collect case and matcher reducers. Since createSlice builds its reducer with createReducer, every slice reducer gets this improvement.

The listener middleware used to copy its listener list and call every predicate for every action. It now keeps a snapshot that is rebuilt only when listeners are added or removed, and that snapshot knows which action types have type or actionCreator listeners. If an action's type isn't in that set and there are no matcher or predicate listeners, the middleware skips the loop entirely.

The RTK Query root reducer now returns the existing state for actions that none of its slices handle, instead of running all five slice reducers. It also skips rewriting a query's provided tags when the new tags are the same as the stored ones, so re-fetching a query that returns the same tags no longer creates new provided state.

Some numbers from the PR benchmarks (Node 26, ops/sec unless noted):

Scenario Before After

Listener middleware, 200 listeners, unrelated action 108K 5.34M

Listener middleware, 200 actionCreator listeners, matching action 100K 612K

createSlice, 20 slices, unrelated action 320K 394K

RTKQ store, unrelated action 352K 468K

RTKQ re-dispatch of a fulfilled query with unchanged tags, 1000 entries (ms per dispatch) 2.50 0.55

The listener middleware numbers are the biggest change, because the old cost grew with the number of listeners. Apps with a handful of listeners will see much smaller gains.

The RTK Query middleware also does less work keeping the store's subscriptions state in sync (#5499). It used to JSON-copy the whole subscriptions object and diff it with Immer every 500ms while subscriptions were changing. It now records which cache keys changed and writes one patch per key. Keys that didn't change keep their object references, so the Redux DevTools no longer receive a full copy of subscriptions on every sync. Polls, refetch() calls and tag invalidation refetches don't add subscribers, so they no longer schedule a sync at all. The visible difference: a cache key that only ever had subscribe: false requests no longer shows up as an empty {} in subscriptions.

Smaller createSlice Bundles With esbuild

createSlice references asyncThunkCreator so that create.asyncThunk works in the reducers callback. esbuild couldn't tell that the asyncThunkCreator object was free of side effects, so it always bundled createAsyncThunk along with createSlice. webpack already dropped it. We've marked it as pure, and an esbuild bundle that imports only createSlice is now about 1 kB smaller (brotli).

Faster RTK Query Api Type Checking

The Api type combines every registered module (core, React hooks, and any third-party modules) by running UnionToIntersection over the module names. TanStack Table hit the same cost with the same design, and found that writing out the known intersection and adding variance annotations helped a lot.

We've done the same thing here: Api uses the core module type directly, and ApiModules has in out variance annotations. On a test app with one ~50-endpoint createApi, type instantiations dropped 22% and check time dropped about 25% on TS 6, and about 18% on the TS 7 native preview. Third-party modules like ngrx-rtk-query saw 7-8% fewer instantiations. There are no runtime changes.

RTK-Owned Draft and Patch Types

RTK used to re-export Immer's Draft type, and used Immer's types in signatures like CaseReducer and PatchCollection. That meant the .d.ts files TypeScript generated for your slices referenced immer. With a package manager layout where immer isn't hoisted, those declarations failed to build with TS2883 (#5516). Re-exporting doesn't fix that, so RTK now declares its own Draft, WritableDraft and Patch types with the same shapes as Immer's. Emitted declarations now point at @reduxjs/toolkit instead. Our type tests check that RTK's Draft and Immer's Draft stay interchangeable, so code that mixes castDraft or current with RTK's types keeps working. We also bumped the immer dependency to ^11.2.9.

There are a few other type additions in this release:

ApiRootState replaces RTK Query's RootState type, which is now deprecated. RootState will be removed in 3.0.

TypedAddListenerAction and TypedRemoveListenerAction describe the actions that addListener and removeListener actually dispatch. The default payload type of TypedAddListener and TypedRemoveListener is now the listener options object, so addListener.match(action) no longer claims action.payload has fields like id and unsubscribe that don't exist at runtime.

dispatch(removeListener(...)) is typed as returning boolean and dispatch(clearAllListeners()) as returning void, matching the runtime.

... (truncated)

Commits

ec4a1a1 Release 2.14.0
705e349 fix(toolkit): respect skipToken in infinite query triggers (#5464)
6d845b7 Add simpler Basic Usage example for createListener Middleware (#4836)
4bbdb3d Fix isLoading staying false when refetching after an error with no data (...
3abefe7 docs(codegen): document the remaining config options (#5367)
7bd07e7 docs: fix LazyInfiniteQueryTrigger docs (#5261)
cc1e048 docs(codegen): document the config option types in src/types.ts (#5373)
9b3cb8c docs(codegen): fix malformed config options block (#5366)
193bfaa docs: selectInvalidedBy for multiple cache updates across queries (#5226)
687819b docs: clarify useLazyQuery data is undefined until trigger (#5348)
Additional commits viewable in compare view

Updates @storyblok/react from 7.4.0 to 7.5.0

Release notes

Sourced from @storyblok/react's releases.

@storyblok/react@7.5.0

7.5.0 (2026-11-05)

🚀 Features

js,capi-client,mapi-client,richtext,react,vue: deprecate the CJS builds with a warning (bae10d7aa)

🧱 Updated Dependencies

Updated @storyblok/lint-config to 0.1.1

Updated @storyblok/richtext to 5.5.0

Updated @storyblok/js to 6.5.0

❤️ Thank You

Manuel Timelthaler

Commits

072b12c chore(release): publish
bae10d7 feat(js,capi-client,mapi-client,richtext,react,vue): deprecate the CJS builds...
e9e0a50 chore(tools): move the CJS build helpers into tools/cjs
f7aeebb chore(tools): apply cjs-interop plugin to remaining CJS builds
See full diff in compare view

Updates firebase from 13.1.0 to 13.2.0

Release notes

Sourced from firebase's releases.

firebase@13.2.0

For more detailed release notes, see Firebase JavaScript SDK Release Notes.

What's Changed

@firebase/crashlytics@0.1.0

Minor Changes

fe5dd06 #10548 - First release of Crashlytics for public preview

firebase@13.2.0

Minor Changes

fe5dd06 #10548 - First release of Crashlytics for public preview

Patch Changes

Updated dependencies [3da3c2b, fe5dd06, 3a5d6a0, 0079975]:

@firebase/auth@1.13.9

@firebase/app@0.16.5

@firebase/crashlytics@0.1.0

@firebase/firestore@4.19.1

@firebase/auth-compat@0.6.14

@firebase/app-compat@0.5.21

@firebase/firestore-compat@0.4.17

@firebase/app@0.16.5

Patch Changes

fe5dd06 #10548 - First release of Crashlytics for public preview

@firebase/app-compat@0.5.21

Patch Changes

Updated dependencies [fe5dd06]:

@firebase/app@0.16.5

@firebase/auth@1.13.9

Patch Changes

3da3c2b #10535 - Update the on-demand ID token expiration buffer (Buffer.TOKEN_REFRESH) from 30 seconds to 5 minutes to match User.getIdToken() documentation and the proactive refresh offset.

0079975 #10393 - - Fix an unhandled exception when a popup or redirect operation (e.g., signInWithPopup) is cancelled by a second call before the first operation finishes initializing.

Fix an unhandled promise rejection during initial IndexedDB cache population if the page navigates away or is backgrounded while loading.

Fix an uncatchable unhandled promise rejection when background reCAPTCHA Enterprise token verification fails during initializeRecaptchaConfig or signInWithPhoneNumber.

@firebase/auth-compat@0.6.14

Patch Changes

... (truncated)

Commits

632df79 Version Packages (#10567)
a160057 Merge main into release
fe5dd06 Merge branch "crashlytics2" into main (#10548)
7b67f3b test(messaging): remove integration/messaging test dir (#10537)
0079975 test(auth): migrate tests to Vitest (#10393)
3da3c2b fix(auth): update token expiration buffer to 5 minutes (#10535)
9e34f34 ci: bump CI Node to 24.22.1 (Oct 2026 security release) (#10506)
598d636 test(rules-unit-testing): migrate unit and emulator tests from Mocha to Vites...
3a5d6a0 fix(firestore): graduate pipeline search from preview to GA (#10519)
af652d9 chore: upgrade playwright to 1.64.1 (#10505)
Additional commits viewable in compare view

Updates newrelic from 14.10.0 to 14.11.0

Release notes

Sourced from newrelic's releases.

v14.11.0 (2026-11-05)

Features

Removed duplicate setting of fields in initInternalFields (#4417) (b46df72)

Bug fixes

Stopped span event aggregator from stripping span links and timed events from queued spans (#4426) (24f9a15)

Code refactoring

Replaced @newrelic/native-metrics with pure-JS VM metrics (#4416) (09b90d4)

Documentation

Clarified datastore reporting configuration (#4434) (ec469e2)

Updated compatibility report (#4415) (07a4437)

Tests

Moved http tests to test/integration/core/http. Also split out unit and integration tests accordingly (#4418) (3127658)

Support statement:

We recommend updating to the latest agent version as soon as it's available. If you can't upgrade to the latest version, update your agents to a version no more than 90 days old. Read more about keeping agents up to date. (https://docs.newrelic.com/docs/new-relic-solutions/new-relic-one/install-configure/update-new-relic-agent/)

See the New Relic Node.js agent EOL policy for information about agent releases and support dates. (https://docs.newrelic.com/docs/apm/agents/nodejs-agent/getting-started/nodejs-agent-eol-policy/)

Changelog

Sourced from newrelic's changelog.

v14.11.0 (2026-11-05)

Features

Removed duplicate setting of fields in initInternalFields (#4417) (b46df72)

Bug fixes

Stopped span event aggregator from stripping span links and timed events from queued spans (#4426) (24f9a15)

Code refactoring

Replaced @newrelic/native-metrics with pure-JS VM metrics (#4416) (09b90d4)

Documentation

Clarified datastore reporting configuration (#4434) (ec469e2)

Updated compatibility report (#4415) (07a4437)

Tests

Moved http tests to test/integration/core/http. Also split out unit and integration tests accordingly (#4418) (3127658)

Commits

fefb4ba chore: release v14.11.0 (#4437)
09b90d4 refactor: Replaced @newrelic/native-metrics with pure-JS VM metrics (#4416)
bbed6e7 ci(deps): bump actions/setup-dotnet from 5.4.0 to 6.1.0 (#4431)
f28cd7b ci(deps): bump actions/setup-node from 6.5.0 to 7.1.0 (#4429)
5ba3092 ci(deps): bump jaxxstorm/action-install-gh-release from 3.0.0 to 4.0.0 (#4430)
ee2afcf ci(deps): bump marocchino/sticky-pull-request-comment from 3.0.4 to 3.0.5 (#4...
0e47999 ci(deps): bump dorny/paths-filter from 4.0.1 to 4.0.3 (#4432)
d8af4db ci: Skipped smoke tests job for Dependabot-authored branches (#4435)
ec469e2 docs: clarify datastore reporting configuration (#4434)
05fbdcd ci: Enabled Dependabot version updates for github-actions (#4428)
Additional commits viewable in compare view

Updates next from 16.4.4 to 16.4.5

Release notes

Sourced from next's releases.

v16.4.5

This release contains security fixes for the following advisories:

Moderate

Cross-tenant sensitive information disclosure in Next.js 'use cache' when called through unstable_cache

Cache leak across root param values in nested 'use cache' functions (follow-up)

Cache poisoning of shared fallback shells in Cache Components via request-supplied placeholder route params

Cross-user cache disclosure and poisoning in Next.js use cache with binary arguments

Cross-client response injection and disclosure in self-hosted Next.js applications forwarding fetched responses

SVG rejection bypass in Next.js image optimization

HttpOnly cookie exposure through internal response header on Next.js Edge runtime routes

Commits

4e5335a v16.4.5
809be72 [lts-active] Strip internal middleware cookie headers from edge responses (#282)
2842833 [lts-active] Fix stale compressed framing for forwarded fetch responses (#281)
6596840 [lts-active] [use cache] Fix cache key when binary args are used (#280)
18eeffb [lts-active] Fix shared shell poisoning from request-supplied placeholder par...
e66e656 [lts-active] [next/image] Fix false-positive AVIF/HEIC detection (#278)
d605874 [lts-active] Fix unstable_cache leaking cold 'use cache' fills across roo...
80c96ed [lts-active] Fix outer 'use cache' entries reused across root param values ...
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the prod-deps group with 6 updates: | Package | From | To | | --- | --- | --- | | [@next/third-parties](https://github.com/vercel/next.js/tree/HEAD/packages/third-parties) | `16.4.4` | `16.4.5` | | [@reduxjs/toolkit](https://github.com/reduxjs/redux-toolkit) | `2.13.0` | `2.14.0` | | [@storyblok/react](https://github.com/storyblok/monoblok/tree/HEAD/packages/react) | `7.4.0` | `7.5.0` | | [firebase](https://github.com/firebase/firebase-js-sdk) | `13.1.0` | `13.2.0` | | [newrelic](https://github.com/newrelic/node-newrelic) | `14.10.0` | `14.11.0` | | [next](https://github.com/vercel/next.js) | `16.4.4` | `16.4.5` | Updates `@next/third-parties` from 16.4.4 to 16.4.5 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.4.5/packages/third-parties) Updates `@reduxjs/toolkit` from 2.13.0 to 2.14.0 - [Release notes](https://github.com/reduxjs/redux-toolkit/releases) - [Commits](reduxjs/redux-toolkit@v2.13.0...v2.14.0) Updates `@storyblok/react` from 7.4.0 to 7.5.0 - [Release notes](https://github.com/storyblok/monoblok/releases) - [Commits](https://github.com/storyblok/monoblok/commits/@storyblok/react@7.5.0/packages/react) Updates `firebase` from 13.1.0 to 13.2.0 - [Release notes](https://github.com/firebase/firebase-js-sdk/releases) - [Changelog](https://github.com/firebase/firebase-js-sdk/blob/main/CHANGELOG.md) - [Commits](https://github.com/firebase/firebase-js-sdk/compare/firebase@13.1.0...firebase@13.2.0) Updates `newrelic` from 14.10.0 to 14.11.0 - [Release notes](https://github.com/newrelic/node-newrelic/releases) - [Changelog](https://github.com/newrelic/node-newrelic/blob/main/NEWS.md) - [Commits](newrelic/node-newrelic@v14.10.0...v14.11.0) Updates `next` from 16.4.4 to 16.4.5 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.4.4...v16.4.5) --- updated-dependencies: - dependency-name: "@next/third-parties" dependency-version: 16.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-deps - dependency-name: "@reduxjs/toolkit" dependency-version: 2.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-deps - dependency-name: "@storyblok/react" dependency-version: 7.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-deps - dependency-name: firebase dependency-version: 13.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-deps - dependency-name: newrelic dependency-version: 14.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-deps - dependency-name: next dependency-version: 16.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-deps ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2026-11-09T09:07:39Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
bloom-frontend	Ready	Preview	Nov 9, 2026 9:15am UTC

cypress · 2026-11-09T09:23:19Z

Bloom frontend Run #2270

Run Properties: Passed #2270 • 5937696415: build(deps): bump the prod-deps group with 6 updates

Project	`Bloom frontend`
Branch Review	`dependabot/npm_and_yarn/prod-deps-42e9f64143`
Run status	`Passed #2270`
Run duration	`06m 05s`
Commit	`5937696415: build(deps): bump the prod-deps group with 6 updates`
Committer	`dependabot[bot]`
View all properties for this run ↗︎

Test results
Failures	`0`
Flaky	`0`
Pending	`12`
Skipped	`0`
Passing	`136`
⚠️ You've recorded test results over your free plan limit. Upgrade your plan to view test results.
View all changes introduced in this branch ↗︎

dependabot Bot assigned annachayn Nov 9, 2026

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Nov 9, 2026

vercel Bot deployed to Preview November 9, 2026 09:15

View deployment

Navigation Menu

Repository navigation

build(deps): bump the prod-deps group with 6 updates - #2027

build(deps): bump the prod-deps group with 6 updates#2027
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/prod-deps-42e9f64143

dependabot Bot commented on behalf of github Nov 9, 2026

Uh oh!

vercel Bot commented Nov 9, 2026 •

edited

Loading

Uh oh!

cypress Bot commented Nov 9, 2026

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Scenario	Before	After
Listener middleware, 200 listeners, unrelated action	108K	5.34M
Listener middleware, 200 `actionCreator` listeners, matching action	100K	612K
`createSlice`, 20 slices, unrelated action	320K	394K
RTKQ store, unrelated action	352K	468K
RTKQ re-dispatch of a fulfilled query with unchanged tags, 1000 entries (ms per dispatch)	2.50	0.55

Conversation

dependabot Bot commented on behalf of github Nov 9, 2026

v16.4.5

Moderate

v2.14.0

Changelog

Dispatch Performance

Smaller createSlice Bundles With esbuild

Faster RTK Query Api Type Checking

RTK-Owned Draft and Patch Types

@​storyblok/react@​7.5.0

7.5.0 (2026-11-05)

🚀 Features

🧱 Updated Dependencies

❤️ Thank You

firebase@13.2.0

What's Changed

@​firebase/crashlytics@​0.1.0

Minor Changes

firebase@13.2.0

Minor Changes

Patch Changes

@​firebase/app@​0.16.5

Patch Changes

@​firebase/app-compat@​0.5.21

Patch Changes

@​firebase/auth@​1.13.9

Patch Changes

@​firebase/auth-compat@​0.6.14

Patch Changes

Features

Bug fixes

Code refactoring

Documentation

Tests

Support statement:

v14.11.0 (2026-11-05)

Features

Bug fixes

Code refactoring

Documentation

Tests

v16.4.5

Moderate

Uh oh!

vercel Bot commented Nov 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cypress Bot commented Nov 9, 2026

Bloom frontend Run #2270

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Smaller `createSlice` Bundles With esbuild

Faster RTK Query `Api` Type Checking

RTK-Owned `Draft` and `Patch` Types

`@storyblok/react@7`.5.0

`@firebase/crashlytics@0`.1.0

`@firebase/app@0`.16.5

`@firebase/app-compat@0`.5.21

`@firebase/auth@1`.13.9

`@firebase/auth-compat@0`.6.14

vercel Bot commented Nov 9, 2026 •

edited

Loading