Skip to content

chore(deps): bump deepmerge-ts and shepherd.js in /ui - #4993

Open
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/npm_and_yarn/ui/multi-da4a9a25e2
Open

chore(deps): bump deepmerge-ts and shepherd.js in /ui#4993
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/npm_and_yarn/ui/multi-da4a9a25e2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps deepmerge-ts to 8.0.2 and updates ancestor dependency shepherd.js. These dependencies need to be updated together.

Updates deepmerge-ts from 5.1.0 to 8.0.2

Release notes

Sourced from deepmerge-ts's releases.

v8.0.2

8.0.2 (2026-08-21)

Bug Fixes

  • correct node engine requirement to >=16.9.0 (ef54ea6)

v8.0.1

8.0.1 (2026-08-16)

Bug Fixes

v8.0.0

8.0.0 (2026-08-16)

Breaking Changes

  • Deep Map value merging. Map values are now deep-merged by default, matching how records are handled. Nested Maps and plain objects inside a Map are merged recursively rather than the source Map simply replacing the target. The old behaviour can be recreated with deepmergeCustom({ mergeMaps: false }).
  • DeepMergeMetaMetaData renamed to DeepMergeMergeInfo. A deprecated alias for the old name is still exported for backwards compatibility, but it will be removed in a future major version. The rename better reflects the structure's expanded role, including hierarchy tracking, in custom merging and the metadata passed to custom merge functions. The MetaDataUpdater callback's metaMeta parameter is now mergeInfo, and the MM generic shorthand is now MI.
  • DeepMergeIntoFunctionUtils renamed to DeepMergeIntoUtils. No alias is kept for the old name.
  • deepmergeInto no longer leak-mutates the input objects. Previously deepmergeInto would mutate the first object's nested containers (arrays, Maps, Sets, and objects) in place, potentially corrupting the input. It is now fixed.

Features

  • Circular reference support. deepmergeCustom and deepmergeIntoCustom now handle circular references, configurable via a new maxDepth option and a new mergeCircularReferences merge-function option. The merge metadata also now tracks the merge hierarchy.
  • New fast entrypoints. deepmergeFastUnsafe and deepmergeIntoFastUnsafe are drop-in replacements for deepmerge and deepmergeInto with prototype-pollution interception, circular-reference handling, and metadata tracking removed for maximum throughput. They should only be used with trusted data. Each ships with a *Custom constructor (deepmergeFastUnsafeCustom and deepmergeIntoFastUnsafeCustom) for customisation.

Bug Fixes

  • deepmergeInto no longer leak-mutates the input objects. (As described in Breaking Changes.)

Performance

  • Much faster type checking. The following numbers are the type-checking cost, comparing this release against v7.1.6 (measured with TypeScript 5.9.3):

    Scenario Types Instantiations Total time
    wide 256k -> 26k (-90%) 6.5M -> 83k (-98.7%) 10.5s -> 0.94s (-91%)
    deep 64k -> 26k (-60%) 438k -> 67k (-85%) 1.82s -> 0.87s (-52%)
    optional 45k -> 27k (-40%) 172k -> 78k (-55%) 1.39s -> 0.89s (-36%)
    unions 40k -> 26k (-36%) 118k -> 69k (-42%) 1.26s -> 0.92s (-27%)
    collections 37k -> 26k (-29%) 95k -> 69k (-28%) 1.22s -> 1.06s (-13%)
    custom 38k -> 26k (-31%) 100k -> 69k (-31%) 1.22s -> 1.02s (-16%)
    into 35k -> 25k (-27%) 76k -> 64k (-15%) 1.20s -> 0.87s (-28%)

  • Runtime performance. Compared to v7.1.6, deepmerge-ts v8.0.0 is roughly 40% faster when merging two objects and ~5-10% faster on multi-object merges, while deepmergeInto performs about the same (its leak-mutation fix adds a little clone work). Memory use is markedly lower as well: on the largest benchmark dataset, v7.1.6 runs into Node's default heap limit, whereas the same workload completes with a peak of roughly half a gigabyte.

... (truncated)

Changelog

Sourced from deepmerge-ts's changelog.

8.0.2 (2026-08-21)

Bug Fixes

  • correct node engine requirement to >=16.9.0 (ef54ea6)

8.0.1 (2026-08-16)

Bug Fixes

8.0.0 (2026-08-16)

Bug Fixes

  • stop deepmergeInto from leak-mutating nested input containers (2cd7824)

Code Refactoring

  • rename mergeInfo system and align shorthand, add JSDoc examples (590ed9b)

Features

  • add circular reference support, maxDepth option, and hierarchy tracking (#707) (3984927)
  • add deepmergeFastUnsafe and deepmergeIntoFastUnsafe entrypoints (#708) (df9b11c)
  • support deep map value merging (ac4bf7a), closes #705

Performance Improvements

  • add a dedicated fast path for merging 2 records (4dbcea7)
  • avoid array reallocation when no undefined values exist (99f2241), closes #696
  • optimize array and set merging (8d435f9), closes #698
  • optimize map merging and remove dead code (14e1604), closes #702
  • optimize record key and type detection (fa85462), closes #694
  • reduce benchmark sample count so the bench fits in 512MB heap (66635e3)
  • reduce type-level work and shortcut same-type merges (473a971)
  • speed up the mergeUnknowns hot path (95b2964), closes #699

BREAKING CHANGES

  • deepmergeInto no longer leak-mutates input containers. Code that depended on inputs being merged into the target through alias

... (truncated)

Commits
  • cbfd03b chore(release): 8.0.2 [skip ci]
  • 6095149 chore(deps-dev): update @​rebeccastevens/eslint-config to 4.0.2 and fix lint i...
  • ef54ea6 fix: correct node engine requirement to >=16.9.0
  • ef97b92 chore(release): 8.0.1 [skip ci]
  • b307b77 fix: typescript 7 support (#714)
  • 42eae21 style: enforce no-explicit-any in src (#713)
  • 188dba4 chore(release): 8.0.0 [skip ci]
  • 57e4403 Merge pull request #712 from RebeccaStevens/dev
  • f7ebf92 test: cover semantics, containers, and types across all variants
  • af8e57e chore: update the type benchmark baseline
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for deepmerge-ts since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates shepherd.js from 13.0.3 to 15.3.0

Release notes

Sourced from shepherd.js's releases.

v1.3.1-@​shepherdpro/pro-js

Release (2024-08-05)

@​shepherdpro/pro-js 1.3.1 (patch) react-shepherd 6.1.1 (patch) shepherd.js 13.0.3 (patch)

🏠 Internal

Committers: 1

v1.3.0-@​shepherdpro/pro-js

Release (2024-07-25)

@​shepherdpro/pro-js 1.3.0 (minor) react-shepherd 6.1.0 (minor)

🚀 Enhancement

📝 Documentation

🏠 Internal

Committers: 3

v1.2.2-@​shepherdpro/pro-js

Release (2024-07-24)

@​shepherdpro/pro-js 1.2.2 (patch) react-shepherd 6.0.8 (patch) shepherd.js 13.0.2 (patch)

🏠 Internal

... (truncated)

Changelog

Sourced from shepherd.js's changelog.

Changelog

Release (2026-08-24)

  • react-shepherd 7.0.6 (patch)
  • shepherd.js 15.3.0 (minor)

🚀 Enhancement

🐛 Bug Fix

🏠 Internal

Committers: 1

Release (2026-08-10)

  • react-shepherd 7.0.5 (patch)
  • shepherd.js 15.2.3 (patch)

🐛 Bug Fix

🏠 Internal

Committers: 1

Release (2026-03-11)

  • react-shepherd 7.0.4 (patch)

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for shepherd.js since your current version.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Sep 18, 2026
@dependabot
chore(deps): bump deepmerge-ts and shepherd.js in /ui
d38af6e 
Bumps [deepmerge-ts](https://github.com/RebeccaStevens/deepmerge-ts) to 8.0.2 and updates ancestor dependency [shepherd.js](https://github.com/shipshapecode/shepherd). These dependencies need to be updated together.


Updates `deepmerge-ts` from 5.1.0 to 8.0.2
- [Release notes](https://github.com/RebeccaStevens/deepmerge-ts/releases)
- [Changelog](https://github.com/RebeccaStevens/deepmerge-ts/blob/main/CHANGELOG.md)
- [Commits](RebeccaStevens/deepmerge-ts@v5.1.0...v8.0.2)

Updates `shepherd.js` from 13.0.3 to 15.3.0
- [Release notes](https://github.com/shipshapecode/shepherd/releases)
- [Changelog](https://github.com/shipshapecode/shepherd/blob/main/CHANGELOG.md)
- [Commits](https://github.com/shipshapecode/shepherd/commits)

---
updated-dependencies:
- dependency-name: deepmerge-ts
  dependency-version: 8.0.2
  dependency-type: indirect
- dependency-name: shepherd.js
  dependency-version: 15.3.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/ui/multi-da4a9a25e2 branch from 80b4ee7 to d38af6e Compare September 21, 2026 16:07
@SvenO3 SvenO3 linked an issue Sep 22, 2026 that may be closed by this pull request
Address Shepherd.js license incompatibility with ASF policy #4990
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Address Shepherd.js license incompatibility with ASF policy

0 participants