Skip to content

build(deps): bump the ui-package-dependencies group in /ui-package with 6 updates#690

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/ui-package/ui-package-dependencies-65b8371902
Open

build(deps): bump the ui-package-dependencies group in /ui-package with 6 updates#690
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/ui-package/ui-package-dependencies-65b8371902

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 11, 2026

Bumps the ui-package-dependencies group in /ui-package with 6 updates:

Package From To
@rainbow-me/rainbowkit 2.2.10 2.2.11
react 19.2.5 19.2.6
react-dom 19.2.5 19.2.6
viem 2.48.8 2.48.11
@babel/preset-env 7.29.3 7.29.5
sass-loader 16.0.7 16.0.8

Updates @rainbow-me/rainbowkit from 2.2.10 to 2.2.11

Release notes

Sourced from @​rainbow-me/rainbowkit's releases.

@​rainbow-me/rainbowkit@​2.2.11

Patch Changes

  • a40b1f4: Migrate the Base connector to canonical base naming, while preserving backwards-compatible aliases baseAccount and coinbaseWallet.

  • 3672dc6: Added Anchorage Digital wallet support with the anchorageDigitalWallet wallet connector.

  • 1043d88: Added MeCo Wallet support with mecoWallet wallet connector.

  • f52657f: Exposed RainbowKitProviderProps and WalletButtonRendererProps as public type exports to support Custom Wallet Button scenarios.

  • 4f2de17: Fixed a crash that could occur when selecting a wallet while multiple browser wallet extensions were installed and the specific injected wallet was missing. Wallet-specific injected connectors now bind only to their matching provider instead of falling back to available defaults.

  • bc4625c: Fix recent transaction tracking so failed transactions no longer prevent an app's own transaction receipt wait from settling.

  • 25c4c2b: Improved SSR safety to prevent WalletConnect initialization warnings and mitigate localStorage API availability changes in Node.js v25 and above.

  • f52657f: Fixed useWindowSize triggering a state update after unmount, which could surface as a React warning.

  • eb4251d: The AuthenticationAdapter.createMessage API can now return a promise, so dApps can fetch or construct a custom SIWE message asynchronously. This enables server-side SIWE message creation before prompting the wallet, while preserving existing synchronous behavior.

    See the server-side message creation docs for guidance.

  • b0f6d52: fix: harden useCoolMode against malicious wallet icon URLs

    The cool mode particle animation built image elements via innerHTML, which parses its input as HTML. A malicious EIP-6963 wallet could supply a crafted icon URL containing injected attributes (e.g. onerror) that would execute in the dApp's origin when a user interacts with the wallet button.

    Switched to document.createElement('img') with property assignment so the icon value is always treated as a plain URL rather than markup.

  • f2523a9: Updated MetaMask wallet icon

Changelog

Sourced from @​rainbow-me/rainbowkit's changelog.

2.2.11

Patch Changes

  • a40b1f4: Migrate the Base connector to canonical base naming, while preserving backwards-compatible aliases baseAccount and coinbaseWallet.

  • 3672dc6: Added Anchorage Digital wallet support with the anchorageDigitalWallet wallet connector.

  • 1043d88: Added MeCo Wallet support with mecoWallet wallet connector.

  • f52657f: Exposed RainbowKitProviderProps and WalletButtonRendererProps as public type exports to support Custom Wallet Button scenarios.

  • 4f2de17: Fixed a crash that could occur when selecting a wallet while multiple browser wallet extensions were installed and the specific injected wallet was missing. Wallet-specific injected connectors now bind only to their matching provider instead of falling back to available defaults.

  • bc4625c: Fix recent transaction tracking so failed transactions no longer prevent an app's own transaction receipt wait from settling.

  • 25c4c2b: Improved SSR safety to prevent WalletConnect initialization warnings and mitigate localStorage API availability changes in Node.js v25 and above.

  • f52657f: Fixed useWindowSize triggering a state update after unmount, which could surface as a React warning.

  • eb4251d: The AuthenticationAdapter.createMessage API can now return a promise, so dApps can fetch or construct a custom SIWE message asynchronously. This enables server-side SIWE message creation before prompting the wallet, while preserving existing synchronous behavior.

    See the server-side message creation docs for guidance.

  • b0f6d52: fix: harden useCoolMode against malicious wallet icon URLs

    The cool mode particle animation built image elements via innerHTML, which parses its input as HTML. A malicious EIP-6963 wallet could supply a crafted icon URL containing injected attributes (e.g. onerror) that would execute in the dApp's origin when a user interacts with the wallet button.

    Switched to document.createElement('img') with property assignment so the icon value is always treated as a plain URL rather than markup.

  • f2523a9: Updated MetaMask wallet icon

Commits

Updates react from 19.2.5 to 19.2.6

Release notes

Sourced from react's releases.

19.2.6 (May 6th, 2026)

React Server Components

Commits

Updates react-dom from 19.2.5 to 19.2.6

Release notes

Sourced from react-dom's releases.

19.2.6 (May 6th, 2026)

React Server Components

Commits

Updates viem from 2.48.8 to 2.48.11

Release notes

Sourced from viem's releases.

viem@2.48.11

Patch Changes

Commits

Updates @babel/preset-env from 7.29.3 to 7.29.5

Release notes

Sourced from @​babel/preset-env's releases.

v7.29.5 (2026-05-05)

🏠 Internal

  • babel-preset-env
    • Update @babel/* dependencies

v7.29.4 (2026-05-05)

🐛 Bug Fix

  • babel-plugin-transform-modules-systemjs
    • #17974 [7.x backport]fix(systemjs): improve module string name support (@​JLHwung)

Committers: 1

Commits

Updates sass-loader from 16.0.7 to 16.0.8

Release notes

Sourced from sass-loader's releases.

v16.0.8

16.0.8 (2026-05-08)

Bug Fixes

Changelog

Sourced from sass-loader's changelog.

16.0.8 (2026-05-08)

Bug Fixes

Commits
  • 4f00ed5 chore(release): 16.0.8
  • 90e349d fix: normalize separators in getPossibleRequests for Windows (#1308) (#1309)
  • cda2078 chore(deps-dev): bump follow-redirects from 1.15.9 to 1.16.0 (#1306)
  • 128abc0 chore(deps): bump lodash from 4.17.23 to 4.18.1 (#1305)
  • e3df97d chore(deps-dev): bump node-forge from 1.3.3 to 1.4.0 (#1304)
  • ff8005b chore(deps): bump serialize-javascript and terser-webpack-plugin (#1299)
  • 7dd2827 chore(deps-dev): bump flatted from 3.3.2 to 3.4.2 (#1301)
  • 9e6a5e5 chore(deps): bump picomatch (#1300)
  • a488645 chore(deps): bump immutable from 5.0.3 to 5.1.5 (#1298)
  • fe6fe07 chore(deps-dev): bump js-yaml from 3.14.1 to 3.14.2 (#1297)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the ui-package-dependencies group
b9faef9 
Bumps the ui-package-dependencies group in /ui-package with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [@rainbow-me/rainbowkit](https://github.com/rainbow-me/rainbowkit/tree/HEAD/packages/rainbowkit) | `2.2.10` | `2.2.11` |
| [react](https://github.com/facebook/react/tree/HEAD/packages/react) | `19.2.5` | `19.2.6` |
| [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) | `19.2.5` | `19.2.6` |
| [viem](https://github.com/wevm/viem) | `2.48.8` | `2.48.11` |
| [@babel/preset-env](https://github.com/babel/babel/tree/HEAD/packages/babel-preset-env) | `7.29.3` | `7.29.5` |
| [sass-loader](https://github.com/webpack/sass-loader) | `16.0.7` | `16.0.8` |


Updates `@rainbow-me/rainbowkit` from 2.2.10 to 2.2.11
- [Release notes](https://github.com/rainbow-me/rainbowkit/releases)
- [Changelog](https://github.com/rainbow-me/rainbowkit/blob/main/packages/rainbowkit/CHANGELOG.md)
- [Commits](https://github.com/rainbow-me/rainbowkit/commits/@rainbow-me/rainbowkit@2.2.11/packages/rainbowkit)

Updates `react` from 19.2.5 to 19.2.6
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.6/packages/react)

Updates `react-dom` from 19.2.5 to 19.2.6
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.6/packages/react-dom)

Updates `viem` from 2.48.8 to 2.48.11
- [Release notes](https://github.com/wevm/viem/releases)
- [Commits](https://github.com/wevm/viem/compare/viem@2.48.8...viem@2.48.11)

Updates `@babel/preset-env` from 7.29.3 to 7.29.5
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.5/packages/babel-preset-env)

Updates `sass-loader` from 16.0.7 to 16.0.8
- [Release notes](https://github.com/webpack/sass-loader/releases)
- [Changelog](https://github.com/webpack/sass-loader/blob/main/CHANGELOG.md)
- [Commits](webpack/sass-loader@v16.0.7...v16.0.8)

---
updated-dependencies:
- dependency-name: "@rainbow-me/rainbowkit"
  dependency-version: 2.2.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ui-package-dependencies
- dependency-name: react
  dependency-version: 19.2.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ui-package-dependencies
- dependency-name: react-dom
  dependency-version: 19.2.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ui-package-dependencies
- dependency-name: viem
  dependency-version: 2.48.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ui-package-dependencies
- dependency-name: "@babel/preset-env"
  dependency-version: 7.29.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: ui-package-dependencies
- dependency-name: sass-loader
  dependency-version: 16.0.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: ui-package-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels May 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants