build(deps): bump the production-dependencies group with 9 updates

[dependabot]

Bumps the production-dependencies group with 9 updates:

Package	From	To
@rolldown/binding-linux-x64-gnu	1.0.1	1.0.2
@rolldown/binding-linux-x64-musl	1.0.1	1.0.2
helmet	8.1.0	8.2.0
nodemailer	8.0.7	8.0.8
openai	6.38.0	6.39.0
swagger-jsdoc	6.2.8	6.3.0
@tanstack/react-query	5.100.10	5.100.14
@tanstack/react-query-devtools	5.100.10	5.100.14
framer-motion	12.39.0	12.40.0

Updates @rolldown/binding-linux-x64-gnu from 1.0.1 to 1.0.2

Release notes

Sourced from @​rolldown/binding-linux-x64-gnu's releases.

v1.0.2

[1.0.2] - 2026-05-20

🚀 Features

• devtools: emit package size in PackageGraphReady (#9434) by @​IWANABETHATGUY
• devtools: classify package dependency types (#9427) by @​IWANABETHATGUY
• devtools: map packages to modules and chunks (#9426) by @​IWANABETHATGUY
• devtools: mark used packages (#9423) by @​IWANABETHATGUY
• devtools: make duplicate packages discoverable (#9422) by @​IWANABETHATGUY
• devtools: emit package metadata (#9421) by @​IWANABETHATGUY
• update oxc to 0.132.0 (#9449) by @​shulaoda
• update oxc to 0.131.0 (#9424) by @​shulaoda
• allow checks.* to escalate emissions to hard errors (#9388) by @​IWANABETHATGUY
• dev: support watcher options include and exclude (#9395) by @​h-a-n-a
• emit warnings for invalid pure annotations (#9381) by @​Kyujenius

🐛 Bug Fixes

• hash: keep chunk file names stable when an unrelated entry is added (#9444) by @​hyf0
• call codeSplitting.groups[].name in deterministic order (#9457) by @​sapphi-red
• dev/lazy: make resolve_id idempotent when the resolved id is already a lazy entry (#9439) by @​h-a-n-a
• chunk-optimization: publish absorbed dynamic-entry namespace cross-chunk (#9448) by @​IWANABETHATGUY
• treeshake: propagate pure annotation through compound exprs (#9431) by @​Dunqing
• finalizer: skip redundant init call when barrel executes in same chunk (#9354) by @​IWANABETHATGUY
• linking: initialize wrapped ESM re-export owners (#9353) by @​IWANABETHATGUY
• do not inherit __toESM across chunks for named-only external imports (#9333) (#9415) by @​IWANABETHATGUY
• watcher: don't write output or emit events after close() (#9328) by @​situ2001
• chunk-optimization: avoid unsafe dynamic-only merges (#9398) by @​IWANABETHATGUY
• cjs: rename CJS-wrapped locals that would shadow chunk-scope names (#9392) by @​hyf0
• dev/lazy: watch lazy modules added in rebuilds (#9391) by @​h-a-n-a

🚜 Refactor

• rolldown_dev: move dev example to break publish cycle (#9465) by @​Boshen
• binding: drop unsafe napi string helper, hoist transform ArcStr (#9456) by @​hyf0
• ecmascript_utils: split rewrite_ident_reference off JsxExt trait (#9417) by @​IWANABETHATGUY
• use ThreadsafeFunction::call_async_catch (#9390) by @​sapphi-red

📚 Documentation

• devtools: document @​rolldown/debug usage and package graph consumption (#9435) by @​IWANABETHATGUY
• replace Inter with system font stack in OG template SVG (#9240) by @​yvbopeng
• remove output.comments warning as all issues have been resolved (#9393) by @​sapphi-red
• in-depth: clarify @PURE scope and document positions (#9389) by @​Kyujenius
• readme: remove release candidate notice (#9387) by @​shulaoda

⚡ Performance

• vite-resolve: cache importer existence checks (#9443) by @​Brooooooklyn

... (truncated)

Changelog

Sourced from @​rolldown/binding-linux-x64-gnu's changelog.

[1.0.2] - 2026-05-20

🚀 Features

• devtools: emit package size in PackageGraphReady (#9434) by @​IWANABETHATGUY
• devtools: classify package dependency types (#9427) by @​IWANABETHATGUY
• devtools: map packages to modules and chunks (#9426) by @​IWANABETHATGUY
• devtools: mark used packages (#9423) by @​IWANABETHATGUY
• devtools: make duplicate packages discoverable (#9422) by @​IWANABETHATGUY
• devtools: emit package metadata (#9421) by @​IWANABETHATGUY
• update oxc to 0.132.0 (#9449) by @​shulaoda
• update oxc to 0.131.0 (#9424) by @​shulaoda
• allow checks.* to escalate emissions to hard errors (#9388) by @​IWANABETHATGUY
• dev: support watcher options include and exclude (#9395) by @​h-a-n-a
• emit warnings for invalid pure annotations (#9381) by @​Kyujenius

🐛 Bug Fixes

• hash: keep chunk file names stable when an unrelated entry is added (#9444) by @​hyf0
• call codeSplitting.groups[].name in deterministic order (#9457) by @​sapphi-red
• dev/lazy: make resolve_id idempotent when the resolved id is already a lazy entry (#9439) by @​h-a-n-a
• chunk-optimization: publish absorbed dynamic-entry namespace cross-chunk (#9448) by @​IWANABETHATGUY
• treeshake: propagate pure annotation through compound exprs (#9431) by @​Dunqing
• finalizer: skip redundant init call when barrel executes in same chunk (#9354) by @​IWANABETHATGUY
• linking: initialize wrapped ESM re-export owners (#9353) by @​IWANABETHATGUY
• do not inherit __toESM across chunks for named-only external imports (#9333) (#9415) by @​IWANABETHATGUY
• watcher: don't write output or emit events after close() (#9328) by @​situ2001
• chunk-optimization: avoid unsafe dynamic-only merges (#9398) by @​IWANABETHATGUY
• cjs: rename CJS-wrapped locals that would shadow chunk-scope names (#9392) by @​hyf0
• dev/lazy: watch lazy modules added in rebuilds (#9391) by @​h-a-n-a

🚜 Refactor

• rolldown_dev: move dev example to break publish cycle (#9465) by @​Boshen
• binding: drop unsafe napi string helper, hoist transform ArcStr (#9456) by @​hyf0
• ecmascript_utils: split rewrite_ident_reference off JsxExt trait (#9417) by @​IWANABETHATGUY
• use ThreadsafeFunction::call_async_catch (#9390) by @​sapphi-red

📚 Documentation

• devtools: document @​rolldown/debug usage and package graph consumption (#9435) by @​IWANABETHATGUY
• replace Inter with system font stack in OG template SVG (#9240) by @​yvbopeng
• remove output.comments warning as all issues have been resolved (#9393) by @​sapphi-red
• in-depth: clarify @PURE scope and document positions (#9389) by @​Kyujenius
• readme: remove release candidate notice (#9387) by @​shulaoda

⚡ Performance

• vite-resolve: cache importer existence checks (#9443) by @​Brooooooklyn
• binding: reduce plugin string clones (#9436) by @​Brooooooklyn

... (truncated)

Commits

• f2757ed release: v1.0.2 (#9478)
• b88de34 docs(devtools): document @​rolldown/debug usage and package graph consumption ...
• 0f811f4 fix(hash): keep chunk file names stable when an unrelated entry is added (#9444)
• ed010fa feat(devtools): emit package size in PackageGraphReady (#9434)
• 2b0bb7f feat(devtools): classify package dependency types (#9427)
• ff6fff2 fix: call codeSplitting.groups[].name in deterministic order (#9457)
• 81fcc89 feat(devtools): map packages to modules and chunks (#9426)
• 98619dd feat(devtools): mark used packages (#9423)
• 0c7ac80 feat(devtools): make duplicate packages discoverable (#9422)
• 98e0620 feat(devtools): emit package metadata (#9421)
• Additional commits viewable in compare view

Updates @rolldown/binding-linux-x64-musl from 1.0.1 to 1.0.2

Release notes

Sourced from @​rolldown/binding-linux-x64-musl's releases.

v1.0.2

[1.0.2] - 2026-05-20

🚀 Features

• devtools: emit package size in PackageGraphReady (#9434) by @​IWANABETHATGUY
• devtools: classify package dependency types (#9427) by @​IWANABETHATGUY
• devtools: map packages to modules and chunks (#9426) by @​IWANABETHATGUY
• devtools: mark used packages (#9423) by @​IWANABETHATGUY
• devtools: make duplicate packages discoverable (#9422) by @​IWANABETHATGUY
• devtools: emit package metadata (#9421) by @​IWANABETHATGUY
• update oxc to 0.132.0 (#9449) by @​shulaoda
• update oxc to 0.131.0 (#9424) by @​shulaoda
• allow checks.* to escalate emissions to hard errors (#9388) by @​IWANABETHATGUY
• dev: support watcher options include and exclude (#9395) by @​h-a-n-a
• emit warnings for invalid pure annotations (#9381) by @​Kyujenius

🐛 Bug Fixes

• hash: keep chunk file names stable when an unrelated entry is added (#9444) by @​hyf0
• call codeSplitting.groups[].name in deterministic order (#9457) by @​sapphi-red
• dev/lazy: make resolve_id idempotent when the resolved id is already a lazy entry (#9439) by @​h-a-n-a
• chunk-optimization: publish absorbed dynamic-entry namespace cross-chunk (#9448) by @​IWANABETHATGUY
• treeshake: propagate pure annotation through compound exprs (#9431) by @​Dunqing
• finalizer: skip redundant init call when barrel executes in same chunk (#9354) by @​IWANABETHATGUY
• linking: initialize wrapped ESM re-export owners (#9353) by @​IWANABETHATGUY
• do not inherit __toESM across chunks for named-only external imports (#9333) (#9415) by @​IWANABETHATGUY
• watcher: don't write output or emit events after close() (#9328) by @​situ2001
• chunk-optimization: avoid unsafe dynamic-only merges (#9398) by @​IWANABETHATGUY
• cjs: rename CJS-wrapped locals that would shadow chunk-scope names (#9392) by @​hyf0
• dev/lazy: watch lazy modules added in rebuilds (#9391) by @​h-a-n-a

🚜 Refactor

• rolldown_dev: move dev example to break publish cycle (#9465) by @​Boshen
• binding: drop unsafe napi string helper, hoist transform ArcStr (#9456) by @​hyf0
• ecmascript_utils: split rewrite_ident_reference off JsxExt trait (#9417) by @​IWANABETHATGUY
• use ThreadsafeFunction::call_async_catch (#9390) by @​sapphi-red

📚 Documentation

• devtools: document @​rolldown/debug usage and package graph consumption (#9435) by @​IWANABETHATGUY
• replace Inter with system font stack in OG template SVG (#9240) by @​yvbopeng
• remove output.comments warning as all issues have been resolved (#9393) by @​sapphi-red
• in-depth: clarify @PURE scope and document positions (#9389) by @​Kyujenius
• readme: remove release candidate notice (#9387) by @​shulaoda

⚡ Performance

• vite-resolve: cache importer existence checks (#9443) by @​Brooooooklyn

... (truncated)

Changelog

Sourced from @​rolldown/binding-linux-x64-musl's changelog.

[1.0.2] - 2026-05-20

🚀 Features

• devtools: emit package size in PackageGraphReady (#9434) by @​IWANABETHATGUY
• devtools: classify package dependency types (#9427) by @​IWANABETHATGUY
• devtools: map packages to modules and chunks (#9426) by @​IWANABETHATGUY
• devtools: mark used packages (#9423) by @​IWANABETHATGUY
• devtools: make duplicate packages discoverable (#9422) by @​IWANABETHATGUY
• devtools: emit package metadata (#9421) by @​IWANABETHATGUY
• update oxc to 0.132.0 (#9449) by @​shulaoda
• update oxc to 0.131.0 (#9424) by @​shulaoda
• allow checks.* to escalate emissions to hard errors (#9388) by @​IWANABETHATGUY
• dev: support watcher options include and exclude (#9395) by @​h-a-n-a
• emit warnings for invalid pure annotations (#9381) by @​Kyujenius

🐛 Bug Fixes

• hash: keep chunk file names stable when an unrelated entry is added (#9444) by @​hyf0
• call codeSplitting.groups[].name in deterministic order (#9457) by @​sapphi-red
• dev/lazy: make resolve_id idempotent when the resolved id is already a lazy entry (#9439) by @​h-a-n-a
• chunk-optimization: publish absorbed dynamic-entry namespace cross-chunk (#9448) by @​IWANABETHATGUY
• treeshake: propagate pure annotation through compound exprs (#9431) by @​Dunqing
• finalizer: skip redundant init call when barrel executes in same chunk (#9354) by @​IWANABETHATGUY
• linking: initialize wrapped ESM re-export owners (#9353) by @​IWANABETHATGUY
• do not inherit __toESM across chunks for named-only external imports (#9333) (#9415) by @​IWANABETHATGUY
• watcher: don't write output or emit events after close() (#9328) by @​situ2001
• chunk-optimization: avoid unsafe dynamic-only merges (#9398) by @​IWANABETHATGUY
• cjs: rename CJS-wrapped locals that would shadow chunk-scope names (#9392) by @​hyf0
• dev/lazy: watch lazy modules added in rebuilds (#9391) by @​h-a-n-a

🚜 Refactor

• rolldown_dev: move dev example to break publish cycle (#9465) by @​Boshen
• binding: drop unsafe napi string helper, hoist transform ArcStr (#9456) by @​hyf0
• ecmascript_utils: split rewrite_ident_reference off JsxExt trait (#9417) by @​IWANABETHATGUY
• use ThreadsafeFunction::call_async_catch (#9390) by @​sapphi-red

📚 Documentation

• devtools: document @​rolldown/debug usage and package graph consumption (#9435) by @​IWANABETHATGUY
• replace Inter with system font stack in OG template SVG (#9240) by @​yvbopeng
• remove output.comments warning as all issues have been resolved (#9393) by @​sapphi-red
• in-depth: clarify @PURE scope and document positions (#9389) by @​Kyujenius
• readme: remove release candidate notice (#9387) by @​shulaoda

⚡ Performance

• vite-resolve: cache importer existence checks (#9443) by @​Brooooooklyn
• binding: reduce plugin string clones (#9436) by @​Brooooooklyn

... (truncated)

Commits

• f2757ed release: v1.0.2 (#9478)
• b88de34 docs(devtools): document @​rolldown/debug usage and package graph consumption ...
• 0f811f4 fix(hash): keep chunk file names stable when an unrelated entry is added (#9444)
• ed010fa feat(devtools): emit package size in PackageGraphReady (#9434)
• 2b0bb7f feat(devtools): classify package dependency types (#9427)
• ff6fff2 fix: call codeSplitting.groups[].name in deterministic order (#9457)
• 81fcc89 feat(devtools): map packages to modules and chunks (#9426)
• 98619dd feat(devtools): mark used packages (#9423)
• 0c7ac80 feat(devtools): make duplicate packages discoverable (#9422)
• 98e0620 feat(devtools): emit package metadata (#9421)
• Additional commits viewable in compare view

Updates helmet from 8.1.0 to 8.2.0

Changelog

Sourced from helmet's changelog.

8.2.0 - 2026-05-21

• Cross-Origin-Opener-Policy: support noopener-allow-popups. See #522
• Improve error message when passing duplicate options

Commits

• 638e43b 8.2.0
• fdf25a8 Update changelog for 8.2.0 release
• bd293b7 Update devDependencies to latest versions
• 81ce5cc Test supported Node versions on CI
• 807a888 Update to new URL
• d4e0128 Add direct link to FAQ
• 437d2eb Bump actions/setup-node from 6.3.0 to 6.4.0 (#537)
• a6bd779 Upgrade actions/setup-node to 6.3.0
• 1e09f5f Fix changelog typo
• d526f5c Bump Picomatch dev sub-dependency
• Additional commits viewable in compare view

Updates nodemailer from 8.0.7 to 8.0.8

Release notes

Sourced from nodemailer's releases.

v8.0.8

8.0.8 (2026-05-23)

Bug Fixes

• enforce strict TLS for OAuth2 and Ethereal credential requests (#1818) (833d6e5)
• four listener/stream leaks in SMTP transport, connection, pool (#1817) (850bb91)

Changelog

Sourced from nodemailer's changelog.

8.0.8 (2026-05-23)

Bug Fixes

• enforce strict TLS for OAuth2 and Ethereal credential requests (#1818) (833d6e5)
• four listener/stream leaks in SMTP transport, connection, pool (#1817) (850bb91)

Commits

• 15138a8 chore(master): release 8.0.8 (#1819)
• 850bb91 fix: four listener/stream leaks in SMTP transport, connection, pool (#1817)
• 833d6e5 fix: enforce strict TLS for OAuth2 and Ethereal credential requests (#1818)
• See full diff in compare view

Updates openai from 6.38.0 to 6.39.0

Release notes

Sourced from openai's releases.

v6.39.0

6.39.0 (2026-05-21)

Full Changelog: v6.38.0...v6.39.0

Features

• api: api update (33ea11f)
• api: manual updates (c210b09)
• api: manual updates (92df9dc)
• api: update OpenAPI spec or Stainless config (c7c0f52)

Bug Fixes

• types: allow runtime fetch options (8f5003d)
• typescript: upgrade tsc-multi so that it works with Node 26 (068f9c6)

Chores

• api: docs updates (9d43adb)
• tests: remove redundant File import (5465bbe)

Changelog

Sourced from openai's changelog.

6.39.0 (2026-05-21)

Full Changelog: v6.38.0...v6.39.0

Features

• api: api update (33ea11f)
• api: manual updates (c210b09)
• api: manual updates (92df9dc)
• api: update OpenAPI spec or Stainless config (c7c0f52)

Bug Fixes

• types: allow runtime fetch options (8f5003d)
• typescript: upgrade tsc-multi so that it works with Node 26 (068f9c6)

Chores

• api: docs updates (9d43adb)
• tests: remove redundant File import (5465bbe)

Commits

• 2002111 release: 6.39.0
• d6dc9b7 feat(api): manual updates
• 7444892 feat(api): api update
• f5db3f1 fix(types): allow runtime fetch options
• 33b391a chore(api): docs updates
• bfe3016 fix(typescript): upgrade tsc-multi so that it works with Node 26
• 3320b20 chore(tests): remove redundant File import
• 3250890 feat(api): manual updates
• d9fbf39 feat(api): update OpenAPI spec or Stainless config
• 8a8436e codegen metadata
• Additional commits viewable in compare view

Updates swagger-jsdoc from 6.2.8 to 6.3.0

Release notes

Sourced from swagger-jsdoc's releases.

v6.3.0

What's Changed

• Fix/extract annotations error handling by @​nejclovrencic in Surnet/swagger-jsdoc#363
• fix: Update Glob to fix memory leak issue from inflight by @​mkonikov in Surnet/swagger-jsdoc#430
• chore(deps): bump @​babel/helpers from 7.18.9 to 7.28.4 in /docusaurus by @​dependabot[bot] in Surnet/swagger-jsdoc#433
• chore(deps): bump @​babel/runtime from 7.18.9 to 7.28.4 in /docusaurus by @​dependabot[bot] in Surnet/swagger-jsdoc#434
• fix: replace mikeal/merge-release with direct npm publish, update actions to v5 by @​mkonikov in Surnet/swagger-jsdoc#448
• Fix security vulnerabilities by @​jpage-godaddy in Surnet/swagger-jsdoc#425

New Contributors

• @​nejclovrencic made their first contribution in Surnet/swagger-jsdoc#363
• @​mkonikov made their first contribution in Surnet/swagger-jsdoc#430
• @​jpage-godaddy made their first contribution in Surnet/swagger-jsdoc#425

Full Changelog: Surnet/swagger-jsdoc@v6.2.8...v6.3.0

Commits

• 04cbcb6 Version Bump
• a761cf7 Fix security vulnerabilities (#425)
• cb90faf fix: replace mikeal/merge-release with direct npm publish, update actions to ...
• 3ebd8d2 chore(deps): bump @​babel/runtime from 7.18.9 to 7.28.4 in /docusaurus (#434)
• 51f408d chore(deps): bump @​babel/helpers from 7.18.9 to 7.28.4 in /docusaurus (#433)
• 3778b42 fix: Update Glob to fix memory leak issue from inflight (#430)
• 2325600 Merge pull request #363 from nejclovrencic/fix/extract-annotations-error-hand...
• f92ee06 Update express and body-parser to fix qs vulnerability
• fc52de9 Update yarn.lock
• af64d34 Add try catch to build function for loop
• Additional commits viewable in compare view

Updates @tanstack/react-query from 5.100.10 to 5.100.14

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.100.14

Patch Changes

• Updated dependencies [ed20b6d]:
  • @​tanstack/react-query@​5.100.14
  • @​tanstack/query-devtools@​5.100.14

@​tanstack/react-query-next-experimental@​5.100.14

Patch Changes

• Updated dependencies [ed20b6d]:
  • @​tanstack/react-query@​5.100.14

@​tanstack/react-query-persist-client@​5.100.14

Patch Changes

• Updated dependencies [ed20b6d]:
  • @​tanstack/react-query@​5.100.14
  • @​tanstack/query-persist-client-core@​5.100.14

@​tanstack/react-query@​5.100.14

Patch Changes

• fix(react-query): do not go into optimistic fetching state when not subscribed (#10759)

• Updated dependencies []:

  • @​tanstack/query-core@​5.100.14

@​tanstack/react-query-devtools@​5.100.13

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-devtools@​5.100.13
  • @​tanstack/react-query@​5.100.13

@​tanstack/react-query-next-experimental@​5.100.13

Patch Changes

• Updated dependencies []:
  • @​tanstack/react-query@​5.100.13

@​tanstack/react-query-persist-client@​5.100.13

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-persist-client-core@​5.100.13
  • @​tanstack/react-query@​5.100.13

@​tanstack/react-query@​5.100.13

Patch Changes

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.100.14

Patch Changes

• fix(react-query): do not go into optimistic fetching state when not subscribed (#10759)

• Updated dependencies []:

  • @​tanstack/query-core@​5.100.14

5.100.13

Patch Changes

• Updated dependencies [d423168]:
  • @​tanstack/query-core@​5.100.13

5.100.12

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.100.12

5.100.11

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.100.11

Commits

• See full diff in compare view

Updates @tanstack/react-query-devtools from 5.100.10 to 5.100.14

Release notes

Sourced from @​tanstack/react-query-devtools's releases.

@​tanstack/react-query-devtools@​5.100.14

Patch Changes

• Updated dependencies [ed20b6d]:
  • @​tanstack/react-query@​5.100.14
  • @​tanstack/query-devtools@​5.100.14

@​tanstack/react-query-devtools@​5.100.13

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-devtools@​5.100.13
  • @​tanstack/react-query@​5.100.13

@​tanstack/react-query-devtools@​5.100.12

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-devtools@​5.100.12
  • @​tanstack/react-query@​5.100.12

@​tanstack/react-query-devtools@​5.100.11

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-devtools@​5.100.11
  • @​tanstack/react-query@​5.100.11

Changelog

Sourced from @​tanstack/react-query-devtools's changelog.

5.100.14

Patch Changes

• Updated dependencies [ed20b6d]:
  • @​tanstack/react-query@​5.100.14
  • @​tanstack/query-devtools@​5.100.14

5.100.13

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-devtools@​5.100.13
  • @​tanstack/react-query@​5.100.13

5.100.12

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-devtools@​5.100.12
  • @​tanstack/react-query@​5.100.12

5.100.11

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-devtools@​5.100.11
  • @​tanstack/react-query@​5.100.11

Commits

• See full diff in Description has been truncated

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
fin-track-web	Ready	Preview, Comment	May 24, 2026 3:10pm