Update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@apollo/client (source)	4.1.2 → 4.1.3			dependencies	patch	4.1.4
@sentry/react (source)	10.36.0 → 10.38.0			dependencies	minor
@types/react (source)	19.2.9 → 19.2.10			dependencies	patch	19.2.13 (+2)
axios (source)	1.13.3 → 1.13.4			dependencies	patch	1.13.5
docker/login-action	v3.6.0 → v3.7.0			action	minor
firebase-functions	7.0.3 → 7.0.5			dependencies	patch
graphql-ws (source)	6.0.6 → 6.0.7			dependencies	patch
next (source)	16.1.5 → 16.1.6			dependencies	patch
react (source)	19.2.3 → 19.2.4			dependencies	patch
react-dom (source)	19.2.3 → 19.2.4			dependencies	patch

---

Release Notes

apollographql/apollo-client (@​apollo/client)

v4.1.3

Compare Source

Patch Changes

• #​13111 bf46fe0 Thanks @​RogerHYang! - Fix createFetchMultipartSubscription to support cancellation via AbortController

  Previously, calling dispose() or unsubscribe() on a subscription created by createFetchMultipartSubscription had no effect - the underlying fetch request would continue running until completion. This was because no AbortController was created or passed to fetch(), and no cleanup function was returned from the Observable.

getsentry/sentry-javascript (@​sentry/react)

v10.38.0

Compare Source

Important Changes

• feat(tanstackstart-react): Auto-instrument request middleware (#​18989)

  The sentryTanstackStart Vite plugin now automatically instruments middleware arrays in createFileRoute(). This captures performance data without requiring manual wrapping with wrapMiddlewaresWithSentry().

Other Changes

• feat: Use v4.8.0 bundler plugins (#​18993)
• feat(browser): Add logs.metrics bundle (#​19020)
• feat(browser): Add replay.logs.metrics bundle (#​19021)
• feat(browser): Add tracing.replay.logs.metrics bundle (#​19039)
• feat(deps): bump import-in-the-middle from 2.0.1 to 2.0.6 (#​19042)
• feat(node): Add AI manual instrumentation exports to Node (#​19063)
• feat(wasm): initialised sentryWasmImages for webworkers (#​18812)
• fix(core): Classify custom AggregateErrors as exception groups (#​19053)
• fix(nextjs): Turn off debugID injection if sourcemaps are explicitly disabled (#​19010)
• fix(react): Avoid String(key) to fix Symbol conversion error (#​18982)
• fix(react): Prevent lazy route handlers from updating wrong navigation span (#​18898)

Internal Changes

- feat(deps-dev): bump @​types/rsvp from 4.0.4 to 4.0.9 ([#​19038](https://redirect.github.com/getsentry/sentry-javascript/pull/19038)) - ci(build): Run full test suite on new bundle with logs+metrics ([#​19065](https://redirect.github.com/getsentry/sentry-javascript/pull/19065)) - ci(deps): bump actions/create-github-app-token from 1 to 2 ([#​19028](https://redirect.github.com/getsentry/sentry-javascript/pull/19028)) - ci(deps): bump peter-evans/create-pull-request from 8.0.0 to 8.1.0 ([#​19029](https://redirect.github.com/getsentry/sentry-javascript/pull/19029)) - chore: Add external contributor to CHANGELOG.md ([#​19005](https://redirect.github.com/getsentry/sentry-javascript/pull/19005)) - chore(aws-serverless): Fix local cache issues ([#​19081](https://redirect.github.com/getsentry/sentry-javascript/pull/19081)) - chore(dependabot): Allow all packages to update ([#​19024](https://redirect.github.com/getsentry/sentry-javascript/pull/19024)) - chore(dependabot): Update ignore patterns and add more groups ([#​19037](https://redirect.github.com/getsentry/sentry-javascript/pull/19037)) - chore(dependabot): Update ignore patterns and add more groups ([#​19043](https://redirect.github.com/getsentry/sentry-javascript/pull/19043)) - chore(deps-dev): bump @​edge-runtime/types from 3.0.1 to 4.0.0 ([#​19032](https://redirect.github.com/getsentry/sentry-javascript/pull/19032)) - chore(deps-dev): bump @​vercel/nft from 0.29.4 to 1.3.0 ([#​19030](https://redirect.github.com/getsentry/sentry-javascript/pull/19030)) - chore(deps): bump @​actions/artifact from 2.1.11 to 5.0.3 ([#​19031](https://redirect.github.com/getsentry/sentry-javascript/pull/19031)) - chore(deps): bump hono from 4.11.4 to 4.11.7 in /dev-packages/e2e-tests/test-applications/cloudflare-hono ([#​19009](https://redirect.github.com/getsentry/sentry-javascript/pull/19009)) - chore(deps): bump next from 16.0.9 to 16.1.5 in /dev-packages/e2e-tests/test-applications/nextjs-16-cacheComponents ([#​19012](https://redirect.github.com/getsentry/sentry-javascript/pull/19012)) - chore(deps): Bump trpc v11 dependency in e2e test ([#​19061](https://redirect.github.com/getsentry/sentry-javascript/pull/19061)) - chore(deps): Bump wrangler to 4.61.0 ([#​19023](https://redirect.github.com/getsentry/sentry-javascript/pull/19023)) - chore(deps): Upgrade @​remix-run deps to 2.17.4 ([#​19040](https://redirect.github.com/getsentry/sentry-javascript/pull/19040)) - chore(deps): Upgrade `next` versions 15 and 16 ([#​19057](https://redirect.github.com/getsentry/sentry-javascript/pull/19057)) - chore(deps): Upgrade Lerna to v8 ([#​19050](https://redirect.github.com/getsentry/sentry-javascript/pull/19050)) - chore(deps): Upgrade next to 14.2.35 ([#​19055](https://redirect.github.com/getsentry/sentry-javascript/pull/19055)) - chore(deps): Upgrade react-router, @​react-router/node, @​react-router/serve, @​react-router/dev to 7.13.0 ([#​19026](https://redirect.github.com/getsentry/sentry-javascript/pull/19026)) - chore(llm): Add claude skill + cursor command for adding new cdn bundles ([#​19048](https://redirect.github.com/getsentry/sentry-javascript/pull/19048)) - chore(llm): Ignore local Claude settings ([#​18893](https://redirect.github.com/getsentry/sentry-javascript/pull/18893)) - chore(react): Update react-router-5 dev dependency to another than 5.0.0 ([#​19047](https://redirect.github.com/getsentry/sentry-javascript/pull/19047)) - chore(release): Add generate-changelog script ([#​18999](https://redirect.github.com/getsentry/sentry-javascript/pull/18999)) - chore(remix): Upgrade @​remix-run/router to ^1.23.2 ([#​19045](https://redirect.github.com/getsentry/sentry-javascript/pull/19045)) - chore(solidstart): Bump peer dependencies of @​solidjs/start ([#​19051](https://redirect.github.com/getsentry/sentry-javascript/pull/19051)) - chore(solidstart): Upgrade Vinxi to update h3 peer dependency ([#​19018](https://redirect.github.com/getsentry/sentry-javascript/pull/19018)) - chore(tests): Reject messages from unknown origins in integration tests ([#​19016](https://redirect.github.com/getsentry/sentry-javascript/pull/19016))

Work in this release was contributed by @​harshit078. Thank you for your contribution!

v10.37.0

Compare Source

Important Changes

• feat(core): Introduces a new Sentry.setConversationId() API to track multi turn AI conversations across API calls. (#​18909)

  You can now set a conversation ID that will be automatically applied to spans within that scope. This allows you to link traces from the same conversation together.

  import * as Sentry from '@​sentry/node';
  
  // Set conversation ID for all subsequent spans
  Sentry.setConversationId('conv_abc123');
  
  // All AI spans will now include the gen_ai.conversation.id attribute
  await openai.chat.completions.create({...});

  This is particularly useful for tracking multiple AI API calls that are part of the same conversation, allowing you to analyze entire conversation flows in Sentry.
  The conversation ID is stored on the isolation scope and automatically applied to spans via the new conversationIdIntegration.

• feat(tanstackstart-react): Auto-instrument global middleware in sentryTanstackStart Vite plugin (#​18844)

  The sentryTanstackStart Vite plugin now automatically instruments requestMiddleware and functionMiddleware arrays in createStart(). This captures performance data without requiring manual wrapping.

  Auto-instrumentation is enabled by default. To disable it:

  // vite.config.ts
  sentryTanstackStart({
    authToken: process.env.SENTRY_AUTH_TOKEN,
    org: 'your-org',
    project: 'your-project',
    autoInstrumentMiddleware: false,
  });

Other Changes

• feat(core): simplify truncation logic to only keep the newest message (#​18906)
• feat(core): Support new client discard reason invalid (#​18901)
• feat(deps): Bump OpenTelemetry instrumentations (#​18934)
• feat(nextjs): Update default ignore list for sourcemaps (#​18938)
• feat(node): pass prisma instrumentation options through (#​18900)
• feat(nuxt): Don't run source maps related code on Nuxt "prepare" (#​18936)
• feat(replay): Update client report discard reason for invalid sessions (#​18796)
• feat(winston): Add customLevelMap for winston transport (#​18922)
• feat(react-router): Add support for React Router instrumentation API (#​18580)
• fix(astro): Do not show warnings for valid options (#​18947)
• fix(core): Report well known values in gen_ai.operation.name attribute (#​18925)
• fix(node-core): ignore vercel AbortError by default on unhandled rejection (#​18973)
• fix(nuxt): include sentry.config.server.ts in nuxt app types (#​18971)
• fix(profiling): Add platform to envelope item header (#​18954)
• fix(react): Defer React Router span finalization until lazy routes load (#​18881)
• ref(core): rename gen_ai.input.messages.original_length to sentry.sdk_meta.gen_ai.input.messages.original_length (#​18970)
• ref(core): rename gen_ai.request.messages to gen_ai.input.messages (#​18944)
• ref(core): Set system message as separate attribute (#​18978)
• deps: Bump version of sentry-bundler-plugins (#​18972)

Internal Changes

• chore(e2e): Add e2e claude skill (#​18957)
• chore(e2e): Add Makefile to make running specific e2e test apps easier (#​18953)
• chore(e2e): Modify e2e skill to also account for untracked files (#​18959)
• ref(tests): use constants in ai integration tests and add missing ones (#​18945)
• test(nextjs): Added nextjs CF workers test app (#​18928)
• test(prisma): Move to yarn prisma (#​18975)

Work in this release was contributed by @​sebws, @​harshit078, and @​fedetorre. Thank you for your contributions!

axios/axios (axios)

v1.13.4

Compare Source

Overview

The release addresses issues discovered in v1.13.3 and includes significant CI/CD improvements.

Full Changelog: v1.13.3...v1.13.4

What's New in v1.13.4

Bug Fixes

• fix: issues with version 1.13.3 (#​7352) (ee90dfc)
  • Fixed issues discovered in v1.13.3 release
  • Cleaned up interceptor test files
  • Improved workflow configurations

Infrastructure & CI/CD

• refactor: ci and build (#​7340) (8ff6c19)

  • Major refactoring of CI/CD workflows
  • Consolidated workflow files for better maintainability
  • Added mise configuration for the development environment
  • Improved sponsor block update automation
  • Enhanced issue and PR templates
  • Added automatic release notes generation
  • Implemented workflow cancellation for concurrent runs

• chore: codegen and some updates to workflows (76cf77b)

  • Code generation improvements
  • Workflow optimisations

Migration Notes

Breaking Changes

None in this release.

Deprecations

None in this release.

Contributors

Thank you to all contributors who made this release possible! Special thanks to:

• jasonsaayman - Release management and CI/CD improvements

docker/login-action (docker/login-action)

v3.7.0

Compare Source

• Add scope input to set scopes for the authentication token by @​crazy-max in #​912
• Add support for AWS European Sovereign Cloud ECR by @​dphi in #​914
• Ensure passwords are redacted with registry-auth input by @​crazy-max in #​911
• build(deps): bump lodash from 4.17.21 to 4.17.23 in #​915

Full Changelog: docker/login-action@v3.6.0...v3.7.0

firebase/firebase-functions (firebase-functions)

v7.0.5

Compare Source

• Fixed issue with missing dependency on graphql. (#​1795)
• Internal improvements (#​1800)

v7.0.4

Compare Source

enisdenjo/graphql-ws (graphql-ws)

v6.0.7

Compare Source

Patch Changes

• #​665 5536292 Thanks @​enisdenjo! - Remove uWebSockets.js from peer dependencies in package.json

  It does not exist on NPM anymore and could lead to weird behavior when installing dependencies with npm. Nothing else changes, using graphql-ws with uWebSockets.js still works.

vercel/next.js (next)

v16.1.6

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Upgrade to swc 54 (#​88207)
• implement LRU cache with invocation ID scoping for minimal mode response cache (#​88509)
• tweak LRU sentinel key (#​89123)

Credits

Huge thanks to @​mischnic, @​wyattjoh, and @​ztanner for helping!

facebook/react (react)

v19.2.4: 19.2.4 (January 26th, 2026)

Compare Source

React Server Components

• Add more DoS mitigations to Server Actions, and harden Server Components (#​35632 by @​gnoff, @​lubieowoce, @​sebmarkbage, @​unstubbable)

---

Configuration

📅 Schedule: Branch creation - "before 6:00am on Monday" in timezone America/New_York, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.