⬆ Bump the bun-packages group with 3 updates

[dependabot]

Bumps the bun-packages group with 3 updates: posthog-node, lint-staged and ovsx.

Updates posthog-node from 5.46.1 to 5.47.3

Release notes

Sourced from posthog-node's releases.

posthog-node@5.47.3

5.47.3

Patch Changes

• #4349 0e2b371 Thanks @​marandaneto! - Apply the feature flag definition request timeout while consuming the response body. (2026-07-31)

• #4349 0e2b371 Thanks @​marandaneto! - Keep the feature flag definition request timeout active until the request settles. (2026-07-31)

posthog-node@5.47.2

5.47.2

Patch Changes

• #4332 b9a241e Thanks @​ioannisj! - Fix identify() leaving a user anonymous when the supplied ID already matches the persisted distinct ID (for example after a non-identified bootstrap seeded the same ID). The user is now marked identified and a person-processed $set event is captured. Ports the same fix from posthog-js (browser) to the shared core used by React Native, Node, and posthog-js-lite. (2026-07-31)
• Updated dependencies [b9a241e]:
  • @​posthog/core@​1.46.1

posthog-node@5.47.1

5.47.1

Patch Changes

• #4351 15aad20 Thanks @​marandaneto! - Isolate NestJS request context per Observable subscription. (2026-07-31)

posthog-node@5.47.0

5.47.0

Minor Changes

• #4308 6e7f3ae Thanks @​ablaszkiewicz! - Emit the release id that posthog-cli injects into your bundle as $release_id on $exception events, so PostHog can attach exceptions to a release without joining through symbol sets. Adds getInjectedReleaseId() to @posthog/core. The property is only attached when an injected release id can be read. (2026-07-30)

Patch Changes

• Updated dependencies [6e7f3ae]:
  • @​posthog/core@​1.46.0

Changelog

Sourced from posthog-node's changelog.

5.47.3

Patch Changes

• #4349 0e2b371 Thanks @​marandaneto! - Apply the feature flag definition request timeout while consuming the response body. (2026-07-31)

• #4349 0e2b371 Thanks @​marandaneto! - Keep the feature flag definition request timeout active until the request settles. (2026-07-31)

5.47.2

Patch Changes

• #4332 b9a241e Thanks @​ioannisj! - Fix identify() leaving a user anonymous when the supplied ID already matches the persisted distinct ID (for example after a non-identified bootstrap seeded the same ID). The user is now marked identified and a person-processed $set event is captured. Ports the same fix from posthog-js (browser) to the shared core used by React Native, Node, and posthog-js-lite. (2026-07-31)
• Updated dependencies [b9a241e]:
  • @​posthog/core@​1.46.1

5.47.1

Patch Changes

• #4351 15aad20 Thanks @​marandaneto! - Isolate NestJS request context per Observable subscription. (2026-07-31)

5.47.0

Minor Changes

• #4308 6e7f3ae Thanks @​ablaszkiewicz! - Emit the release id that posthog-cli injects into your bundle as $release_id on $exception events, so PostHog can attach exceptions to a release without joining through symbol sets. Adds getInjectedReleaseId() to @posthog/core. The property is only attached when an injected release id can be read. (2026-07-30)

Patch Changes

• Updated dependencies [6e7f3ae]:
  • @​posthog/core@​1.46.0

Commits

• 4e4aab7 chore: update versions and lockfile [version bump]
• 0e2b371 fix(node): keep feature flag definition timeout active (#4349)
• 557798d chore: update versions and lockfile [version bump]
• cbc7b22 chore: update versions and lockfile [version bump]
• 15aad20 fix(node): isolate NestJS context per subscription (#4351)
• 4ef8a41 chore: update versions and lockfile [version bump]
• 6e7f3ae feat: emit $release_id from the injected release id (#4308)
• 3b2e68d fix: prevent Jest worker resource leaks (#4247)
• See full diff in compare view

Updates lint-staged from 17.2.0 to 17.3.0

Release notes

Sourced from lint-staged's releases.

v17.3.0

Minor Changes

• #1825 16b3f74 - It is now possible to run multiple tasks in parallel for a single glob by configuring it with an array of tasks (which run sequentially), and then placing another array inside it (where the tasks will run in parallel). The following demonstrates the order tasks will start in:

  {
    "*.ts": ["first", "second", ["third", "third"], "fourth"]
  }

  As a concrete example, lint-staged's own configuration is:

  /** @type {import('./lib/index.js').Configuration} */
  export default {
    "*": [
      [
        "oxfmt --check --no-error-on-unmatched-pattern",
        "oxlint --no-error-on-unmatched-pattern",
      ],
    ],
    "*.ts": () => "tsc",
  };

  which means:

  1. for all staged files, run the two commands in parallel with staged filenames appended, for example:
     • oxfmt --check --no-error-on-unmatched-pattern lib/index.js
     • oxlint --no-error-on-unmatched-pattern lib/index.js
  2. additionally, if any *.ts files are staged, run tsc without appending any arguments
  3. The two sets of commands also run in parallel

Patch Changes

• #1829 15f7e53 - During an in-progress merge, files that are unchanged from the branch being merged are now skipped. Technically, files are only included if there are staged changes against both HEAD and MERGE_HEAD.

Changelog

Sourced from lint-staged's changelog.

17.3.0

Minor Changes

• #1825 16b3f74 - It is now possible to run multiple tasks in parallel for a single glob by configuring it with an array of tasks (which run sequentially), and then placing another array inside it (where the tasks will run in parallel). The following demonstrates the order tasks will start in:

  {
    "*.ts": ["first", "second", ["third", "third"], "fourth"]
  }

  As a concrete example, lint-staged's own configuration is:

  /** @type {import('./lib/index.js').Configuration} */
  export default {
    "*": [
      [
        "oxfmt --check --no-error-on-unmatched-pattern",
        "oxlint --no-error-on-unmatched-pattern",
      ],
    ],
    "*.ts": () => "tsc",
  };

  which means:

  1. for all staged files, run the two commands in parallel with staged filenames appended, for example:
     • oxfmt --check --no-error-on-unmatched-pattern lib/index.js
     • oxlint --no-error-on-unmatched-pattern lib/index.js
  2. additionally, if any *.ts files are staged, run tsc without appending any arguments
  3. The two sets of commands also run in parallel

Patch Changes

• #1829 15f7e53 - During an in-progress merge, files that are unchanged from the branch being merged are now skipped. Technically, files are only included if there are staged changes against both HEAD and MERGE_HEAD.

Commits

• d153443 Merge pull request #1828 from lint-staged/changeset-release/main
• 5162c14 chore(changeset): release
• a4db9a4 Merge pull request #1831 from lint-staged/linter-updates
• ea96cab style: enable oxlint "suspicious" category
• 2fae007 style: add @e18e/eslint-plugin
• 2280c38 Merge pull request #1829 from lint-staged/fix-merge-conflict-files
• 1453ae6 test: relax assertion so that it passes in worktree
• 15f7e53 fix: lint only files changed against HEAD and MERGE_HEAD, during a merge
• dedfc31 Merge pull request #1825 from lint-staged/parallel-tasks-inside-sequence
• 286e25c feat: allow running parallel tasks by nesting arrays
• Additional commits viewable in compare view

Updates ovsx from 1.0.2 to 1.1.0

Release notes

Sourced from ovsx's releases.

CLI v1.1.0

Added

• Add an encrypted filestore as fallback to the system keychain if it cant be accessed (#1950)
• Add --allow-missing-repository option to the publish command, passed on to vsce to package an extension whose package.json has no repository field without asking for confirmation (#1735)

Changed

• Replace keytar with cross-keychain to store credentials in the system keychain (#1950)
• Mask token input when using login command (#1966

Dependencies

• Bump js-yaml from 4.2.0 to 4.3.0 (#1976)
• Bump tar from 7.5.16 to 7.5.21 (#1987)
• Bump brace-expansion from 1.1.16 to 1.1.18 (#2031)

Frontend Library v1.1.0

Added

• Add a home page with hero search, popular searches, a category browser, curated extension rows and get-involved cards
• Add a dedicated search page under /search with query, category, sort field and sort order synced to the URL
• Add global keyboard shortcuts
• Add keyboard navigation of search results: ↑/↓
• Add a structured footer
• Add scroll-to-top on forward navigation
• Support searching users and managing their roles in the admin dashboard (#1847)
• Added an extension details page to admin dashboard and user settings (#1939)

Changed

• Redesign the web UI: new navbar with integrated search field, new theme, extension cards, category pills and page layout
• Consolidate the app-wide providers into a single AppProviders; keyboard shortcuts and search now wrap every route, including the admin dashboard
• Improve accessibility: visible focus outlines on interactive controls
• Morph the hero search into the navbar search field using the View Transitions API
• Token display in generate-token dialog now uses a masked input with show/hide toggle and copy button (#1966
• Migrate admin dashboard to use @tanstack/react-query (#1917
• Replace formatting from stylistic with prettier (#1916)
• Upgrade to vite 8+ and disable manual chunks for bundling (#1989)
• Upgrade to react-router 7: import everything from react-router instead of react-router-dom. Consumers passing additionalRoutes must upgrade to react-router 7 as well

Fixed

• Refresh the extension version list in the delete views when a delete fails with a conflict
• Keep the hero-to-navbar search morph working under react-router 7, which wraps location updates in React.startTransition

Dependencies

• Bump brace-expansion from 1.1.11 to 1.1.16 (#1981)
• Bump brace-expansion from 2.0.2 to 2.1.2 (#1944)

... (truncated)

Changelog

Sourced from ovsx's changelog.

[v1.1.0] (02/08/2026)

Added

• Add an encrypted filestore as fallback to the system keychain if it cant be accessed (#1950)
• Add --allow-missing-repository option to the publish command, passed on to vsce to package an extension whose package.json has no repository field without asking for confirmation (#1735)

Changed

• Replace keytar with cross-keychain to store credentials in the system keychain (#1950)
• Mask token input when using login command (#1966

Dependencies

• Bump js-yaml from 4.2.0 to 4.3.0 (#1976)
• Bump tar from 7.5.16 to 7.5.21 (#1987)
• Bump brace-expansion from 1.1.16 to 1.1.18 (#2031)

Commits

• 53049dc chore: prepare cli version for release
• c31e166 chore: prepare for cli-1.1.0 release
• 556069e chore(deps): bump brace-expansion in cli
• 5de3810 build(deps): bump brace-expansion from 1.1.16 to 1.1.18 in /cli (#2031)
• 36de5ac feat: add --allow-empty-repository option to ovsx publish (#2012)
• cdf4589 chore(deps): bump deps in cli
• 19f9118 build(deps): bump tar from 7.5.16 to 7.5.21 in /cli (#1987)
• f901ed5 build(deps): bump brace-expansion from 1.1.13 to 1.1.16 in /cli (#1981)
• 9a2403b fix: resolve js-yaml to ^5.2.1 to address CVE-2026-59869 (#1976)
• 643b6bd feat: masking PAT in CLI and webui (#1966)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions