Skip to content

chore(deps)(deps): bump the runtime-minor group with 6 updates#49

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/runtime-minor-b213c81423
Open

chore(deps)(deps): bump the runtime-minor group with 6 updates#49
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/runtime-minor-b213c81423

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 15, 2026

Copy link
Copy Markdown

Bumps the runtime-minor group with 6 updates:

Package From To
@react-navigation/native 7.3.1 7.3.3
axios 1.17.0 1.18.0
react-native-reanimated 4.3.1 4.4.1
react-native-safe-area-context 5.7.0 5.8.0
react-native-svg 15.15.4 15.15.5
sharp 0.34.5 0.35.1

Updates @react-navigation/native from 7.3.1 to 7.3.3

Release notes

Sourced from @​react-navigation/native's releases.

@​react-navigation/native@​7.3.2

7.3.2 (2026-06-14)

Bug Fixes

Changelog

Sourced from @​react-navigation/native's changelog.

7.3.3 (2026-06-15)

Note: Version bump only for package @​react-navigation/native

7.3.2 (2026-06-14)

Bug Fixes

Commits
  • f4af343 chore: publish
  • 6a17f49 refactor: avoid relying on sync update for prevent remove check
  • c9ddec7 chore: publish
  • 045720a fix: rollback history if update was prevented
  • See full diff in compare view

Updates axios from 1.17.0 to 1.18.0

Release notes

Sourced from axios's releases.

v1.18.0 — June 13, 2026

This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.

🔒 Security Fixes

  • Redirect Header Safety: Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (#10892)

  • URL And Request Hardening: Rejects malformed http: and https: URLs that omit // with ERR_INVALID_URL, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local NO_PROXY matching. (#11000)

🐛 Bug Fixes

  • Status Validation: Added transitional.validateStatusUndefinedResolves so applications can opt in to treating validateStatus: undefined like the option was omitted, while validateStatus: null remains the explicit way to accept every status. (#10899)

🔧 Maintenance & Chores

  • Documentation: Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the proxy request config as Node.js-only in the advanced docs. (#10984, #10988, #10992, #10995)

  • Dependencies: Bumped @babel/core, @babel/preset-env, @commitlint/cli, @commitlint/config-conventional, @rollup/plugin-babel, @rollup/plugin-commonjs, @vitest/browser, @vitest/browser-playwright, eslint, lint-staged, rollup, vitest, and actions/checkout. (#10989, #10996, #10997)

  • Release Metadata: Prepared the 1.18.0 release by updating package metadata and the runtime VERSION value. (#11003)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog

Changelog

Sourced from axios's changelog.

Changelog

Commits
  • 2d06f96 chore(release): prepare release 1.18.0 (#11003)
  • 32fc489 fix: malformed http urls (#11000)
  • b40ce49 chore(deps-dev): bump the development_dependencies group with 10 updates (#10...
  • fe964f9 docs: mark proxy config as Node.js only (#10995)
  • 5f229d2 chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions ...
  • fae9d4e docs: clarify package update PR policy (#10992)
  • 28ab2ce chore(deps-dev): bump the development_dependencies group with 2 updates (#10989)
  • a8e4f13 fix(core): keep default validateStatus when request passes undefined (#10899)
  • 614f455 docs: publish v1.17.0 release notes (#10988)
  • 6bb12c1 fix: custom auth headers not stripped on cross-origin redirects (#10892)
  • Additional commits viewable in compare view

Updates react-native-reanimated from 4.3.1 to 4.4.1

Release notes

Sourced from react-native-reanimated's releases.

Reanimated - 4.4.1

What's Changed

Full Changelog: software-mansion/react-native-reanimated@4.4.0...4.4.1

Reanimated - 4.4.0

Key changes

iOS CSS Core Animation

Reanimated 4.4.0 introduces a new platform-backed CSS animation engine on iOS that runs animations directly on Core Animation layers instead of going through the JS-driven update loop. It is hidden behind the IOS_CSS_CORE_ANIMATION static feature flag.

Animation Backend

A new Animation Backend has been integrated behind a feature flag, which will help greatly with the flow of updating the Shadow Tree in animations.

New useTimestamp hook

A new useTimestamp hook exposes the current frame timestamp as a Shared Value that updates every frame with the time elapsed since the first frame, with an isActive flag to pause and resume updates.

Precompiled headers on Android

Reanimated's native build on Android now uses precompiled headers (ReanimatedPCH.h), significantly reducing C++ compile times for both fresh and incremental builds.

Other changes

... (truncated)

Commits
  • 2daa6e5 feat: web support for CSS transition callbacks (#9555)
  • de1f2e2 [Web LA] Fix interaction with react-freeze (#7114)
  • ca1aae2 chore: add tests for web CSS transition and animation managers (#9556)
  • 0442a77 fix(Reanimated): mapperRun race condition (#9595)
  • da9571e chore: Deduplicate CSSLengthArray and SVGStrokeDashArray (#9553)
  • 2e5ae27 chore: replace Sets in CSS guards with switches and array lookups (#9554)
  • 7fd03f5 feat: animate open/closed SVG path morphs and missing strokeDasharray endpoin...
  • 37cf203 feat: route pseudo-selector transitions through platform (#9560)
  • abba6a0 feat: register remaining react-native-svg components for web CSS animations (...
  • d0a7ceb feat: web CSS animation support for SVG Circle (#9548)
  • Additional commits viewable in compare view

Updates react-native-safe-area-context from 5.7.0 to 5.8.0

Release notes

Sourced from react-native-safe-area-context's releases.

Release 5.8.0

5.8.0 (2026-05-18)

Changes

  • remove UIImplementation usage from SafeAreaView (#730) (ef89f4d)
Commits

Updates react-native-svg from 15.15.4 to 15.15.5

Release notes

Sourced from react-native-svg's releases.

v15.15.5

This release includes minor fixes and improvements across all platforms, along with the OIDC setup.

What's Changed

New Contributors

Full Changelog: software-mansion/react-native-svg@v15.15.4...v15.15.5

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react-native-svg since your current version.


Updates sharp from 0.34.5 to 0.35.1

Release notes

Sourced from sharp's releases.

v0.35.1

  • TypeScript: Ensure type definitions are published for both ESM and CJS. #4537

  • WebAssembly: Ensure wrapper file is published. #4538

v0.35.1-rc.1

  • TypeScript: Ensure type definitions are published for both ESM and CJS. #4537

  • WebAssembly: Ensure wrapper file is published. #4538

v0.35.1-rc.0

  • TypeScript: Ensure type definitions are published #4537

  • WebAssembly: Ensure wrapper file is published. #4538

v0.35.0

  • Breaking: Drop support for Node.js 18, now requires Node.js >= 20.9.0.

  • Breaking: Remove install script from package.json file. Compiling from source is now opt-in via the build script.

  • Breaking: Lossy AVIF output is now tuned using SSIMULACRA2-based iq quality metrics.

  • Breaking: Add limitInputChannels with a default value of 5.

  • Breaking: Remove deprecated failOnError constructor property.

  • Breaking: Remove deprecated paletteBitDepth from metadata response.

  • Breaking: Remove deprecated properties from sharpen operation.

  • Breaking: Rename format.jp2k as format.jp2 for API consistency.

  • Upgrade to libvips v8.18.3 for upstream bug fixes.

  • Remove experimental status from WebAssembly binaries.

  • Add prebuilt binaries for FreeBSD (WebAssembly).

  • Deprecate Windows 32-bit (win32-ia32) prebuilt binaries.

  • Ensure TIFF output bitdepth option is limited to 1, 2 or 4.

  • Add AVIF/HEIF tune option for control over quality metrics.

... (truncated)

Commits
  • d781a2d Release v0.35.1
  • 84fa853 Prerelease v0.35.1-rc.1
  • 21263c3 TypeScript: Switch type defs to ESM, convert back to CJS #4537
  • 8deceb4 Docs: fix link in changelog (#4541)
  • c9f08eb Revert "Docs: Highlight that Windows ARM64 support is experimental" (#4540)
  • 3ec892f Prerelease v0.35.1-rc.0
  • fbdeac5 CI: Run packaging linter on sub-packages
  • 1da92b3 WebAssembly: Ensure wrapper file is published #4538
  • 32c029e Add packaging linter to help prevent regression e.g. #4537
  • 98dc1df TypeScript: Ensure type definitions are published #4537
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps)(deps): bump the runtime-minor group with 6 updates
390ed9f 
Bumps the runtime-minor group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [@react-navigation/native](https://github.com/react-navigation/react-navigation/tree/HEAD/packages/native) | `7.3.1` | `7.3.3` |
| [axios](https://github.com/axios/axios) | `1.17.0` | `1.18.0` |
| [react-native-reanimated](https://github.com/software-mansion/react-native-reanimated/tree/HEAD/packages/react-native-reanimated) | `4.3.1` | `4.4.1` |
| [react-native-safe-area-context](https://github.com/AppAndFlow/react-native-safe-area-context) | `5.7.0` | `5.8.0` |
| [react-native-svg](https://github.com/software-mansion/react-native-svg) | `15.15.4` | `15.15.5` |
| [sharp](https://github.com/lovell/sharp) | `0.34.5` | `0.35.1` |


Updates `@react-navigation/native` from 7.3.1 to 7.3.3
- [Release notes](https://github.com/react-navigation/react-navigation/releases)
- [Changelog](https://github.com/react-navigation/react-navigation/blob/@react-navigation/native@7.3.3/packages/native/CHANGELOG.md)
- [Commits](https://github.com/react-navigation/react-navigation/commits/@react-navigation/native@7.3.3/packages/native)

Updates `axios` from 1.17.0 to 1.18.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.17.0...v1.18.0)

Updates `react-native-reanimated` from 4.3.1 to 4.4.1
- [Release notes](https://github.com/software-mansion/react-native-reanimated/releases)
- [Changelog](https://github.com/software-mansion/react-native-reanimated/blob/main/packages/react-native-reanimated/RELEASE.md)
- [Commits](https://github.com/software-mansion/react-native-reanimated/commits/4.4.1/packages/react-native-reanimated)

Updates `react-native-safe-area-context` from 5.7.0 to 5.8.0
- [Release notes](https://github.com/AppAndFlow/react-native-safe-area-context/releases)
- [Commits](AppAndFlow/react-native-safe-area-context@v5.7.0...v5.8.0)

Updates `react-native-svg` from 15.15.4 to 15.15.5
- [Release notes](https://github.com/software-mansion/react-native-svg/releases)
- [Commits](software-mansion/react-native-svg@v15.15.4...v15.15.5)

Updates `sharp` from 0.34.5 to 0.35.1
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.34.5...v0.35.1)

---
updated-dependencies:
- dependency-name: "@react-navigation/native"
  dependency-version: 7.3.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: runtime-minor
- dependency-name: axios
  dependency-version: 1.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime-minor
- dependency-name: react-native-reanimated
  dependency-version: 4.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime-minor
- dependency-name: react-native-safe-area-context
  dependency-version: 5.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime-minor
- dependency-name: react-native-svg
  dependency-version: 15.15.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: runtime-minor
- dependency-name: sharp
  dependency-version: 0.35.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the javascript Pull requests that update javascript code label Jun 15, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jun 15, 2026

Copy link
Copy Markdown
Author

Labels

The following labels could not be found: deps. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants