8000 chore(deps): bump the npm_and_yarn group across 1 directory with 24 updates by dependabot[bot] · Pull Request #18 · ncouture/gemini-cli · GitHub
[go: up one dir, main page]
Skip to content

chore(deps): bump the npm_and_yarn group across 1 directory with 24 updates - #18

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-f6225908ee
Open

chore(deps): bump the npm_and_yarn group across 1 directory with 24 updates#18
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-f6225908ee

Conversation

@dependabot
@dependabot dependabot Bot commented on behalf of github Sep 29, 2026
Copy link
Copy Markdown

Bumps the npm_and_yarn group with 24 updates in the / directory:

Package From To
vitest 3.2.4 3.2.7
tar 7.5.1 7.5.22
shell-quote 1.8.3 1.11.0
undici 7.15.0 7.30.0
fast-uri 3.0.6 3.1.8
ws 8.18.3 8.22.0
ws 7.5.10 7.5.13
@grpc/grpc-js 1.13.4 1.14.5
@humanfs/node 0.16.6 0.16.8
body-parser 2.2.0 2.3.0
body-parser 1.20.3 1.20.8
qs 6.13.0 6.16.0
@opentelemetry/core 2.0.1 2.11.0
@opentelemetry/exporter-prometheus 0.203.0 0.222.0
@opentelemetry/propagator-jaeger 2.0.1 2.11.0
js-yaml 3.14.1 3.15.2
form-data 2.5.5 2.5.6
form-data 4.0.4 4.0.6
brace-expansion 1.1.12 1.1.21
@vitest/mocker 3.2.4 3.2.7
linkify-it 5.0.0 5.0.2
markdown-it 14.1.0 14.3.2
nanoid 3.3.11 3.3.19
postcss 8.5.6 8.5.28
protobufjs 7.5.3 7.6.6
tmp 0.2.5 0.2.7
vite 7.1.9 7.3.6

Updates vitest from 3.2.4 to 3.2.7

Release notes

Sourced from vitest's releases.

v3.2.7

   🐞 Bug Fixes

    View changes on GitHub

v3.2.6

   🐞 Bug Fixes

    View changes on GitHub

v3.2.5

   🚀 Features

   🐞 Bug Fixes

    View changes on GitHub
Commits
  • c0c203d chore: release v3.2.7 (#10719)
  • b6d56f8 chore: release v3.2.6
  • 16f120d fix: pin last supported vite-node version
  • 2cbad0a chore: release v3.2.5
  • 385a1ae fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
  • af88b1f feat(api): add allowWrite and allowExec options to api [backport to v3]...
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vitest since your current version.


Updates tar from 7.5.1 to 7.5.22

Commits
Maintainer changes

This version was pushed to npm by isaacs, a new releaser for tar since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates shell-quote from 1.8.3 to 1.11.0

Changelog

Sourced from shell-quote's changelog.

v1.11.0 - 2026-09-29

Fixed

Commits

  • [Fix] quote: reject line terminators in tokens after a comment 6002b2e
  • [Fix] parse: preserve text after special shell parameters 81b08a5
  • [Fix] parse: an escaped backslash does not escape the character after it d708019
  • [Fix] quote: preserve ! in arguments that also contain ' ad39927
  • [Fix] parse: treat $_name as a variable name, not $_ followed by text 28f88cd
  • [Fix] quote: preserve empty glob patterns 35c9b97
  • [Fix] quote: escape ~ in glob patterns to prevent shell tilde-expansion 239d49c
  • [Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, evalmd b1e406e
  • [meta] npmignore some files ebfc308
  • [actions] add permissions 3429b0d
  • [actions] set least-privilege cache-mode 36f2394
  • [Dev Deps] update eslint 6de9a41

v1.10.0 - 2026-07-10

Merged

Commits

  • [Fix] parse: match nested ${...} braces so nested parameter expansion is consumed as one substitution c0842c8
  • [Tests] parse: pin single-quote literalness and unmatched-quote handling a0d03e3
  • [readme] remove the space in js code fences so evalmd evaluates them 2116fa3
  • [Tests] quote: pin conservative escaping of =, @, ^, ,, :, ! (#11) 1c36f3f
  • [readme] document that quote outputs POSIX quoting, not cmd.exe/PowerShell 100e96e
  • [readme] document parse's supported parameter-expansion subset e1c75cd
  • [Fix] parse: a backslash inside single quotes must not escape the closing quote 5d460a3
  • [readme] fix stale example outputs 2de86f5
  • [Tests] quote: pin that a backslash with whitespace is not doubled in single quotes (#14) 190e236
  • [readme] quote: use output verbatim; do not re-quote it (#11) 1b36468
  • [Refactor] parse: fix swapped SINGLE_QUOTE/DOUBLE_QUOTE variable names 801af5c
  • [types] fix an error TS v6 ignores but v7 fails on 59bbf8b
  • [Dev Deps] update @arethetypeswrong/cli, evalmd a04d475
  • [Dev Deps] update @arethetypeswrong/ci, eslint d390f9a
  • [Tests] quote: the tilde test escapes every ~, not just a leading one (#9) 617d119

v1.9.0 - 2026-06-24

Commits

... (truncated)

Commits
  • 88241f8 v1.11.0
  • ebfc308 [meta] npmignore some files
  • c4385ec [Refactor] quote: drop a replace that can never match in the single-quote b...
  • e455649 [New] parse: support bash ANSI-C quoting ($'...')
  • d708019 [Fix] parse: an escaped backslash does not escape the character after it
  • b1e406e [Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, evalmd
  • ad39927 [Fix] quote: preserve ! in arguments that also contain '
  • 6002b2e [Fix] quote: reject line terminators in tokens after a comment
  • 36f2394 [actions] set least-privilege cache-mode
  • 28f88cd [Fix] parse: treat $_name as a variable name, not $_ followed by text
  • Additional commits viewable in compare view

Updates undici from 7.15.0 to 7.30.0

Release notes

Sourced from undici's releases.

v7.30.0

What's Changed

Full Changelog: nodejs/undici@v7.29.1...v7.30.0

v7.29.1

⚠️ Security fixes

High severity

  • GHSA-w293-vg96-wgc3: BalancedPool could drop function-valued connection options while cloning its configuration, including custom TLS certificate validation callbacks. Undici now preserves connect and legacy tls options when creating upstreams. Fixed by f690157d.
  • GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught TypeError that could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 6615e017.

Medium severity

  • GHSA-3wwx-pv8p-q78v: a malformed permessage-deflate payload exceeding the configured decompression limit could emit an unhandled zlib error and terminate the process. Undici now destroys the inflater after reaching the limit. Fixed by 63cf698b.
  • GHSA-rx4f-c7p8-82vq: an unclean WebSocketStream close could create an unobserved rejected promise when its writable stream was locked, potentially terminating the process. Undici now propagates the failure through the retained writable stream controller. Fixed by 1858656e.
  • GHSA-2jfj-6hjv-fm6j: shared caches could store and replay responses containing Set-Cookie, disclosing one user's cookies to another caller. Undici now excludes these responses from shared caches, including existing entries and revalidation paths. Fixed by b6c5a002.
  • GHSA-3xpg-4rpp-hhhm: the decompression interceptor did not bound decoded output, allowing compressed responses to consume excessive memory. Undici now limits every decompression stage to 64 MiB by default and supports a configurable maxSize. Fixed by 2c7d7e12.
  • GHSA-pmjh-fq2x-6v4x: a terminal retry failure after response headers were exposed could orphan the original response body, causing consumers to hang indefinitely. Undici now propagates the terminal error to the exposed body. Fixed by 3c672659.

Low severity

  • GHSA-8436-99hf-9mmv: cache interceptors could store and replay responses to unsafe HTTP methods such as POST or DELETE. Undici now restricts cache reads and writes to safe methods while preserving invalidation by successful unsafe requests. Fixed by b61d9432.
  • GHSA-2gqq-gqf2-x968: the dump interceptor could treat an oversized chunked response as successfully truncated when no Content-Length was present. Undici now enforces maxSize against received bytes and aborts oversized responses. Fixed by 21693f40.
  • GHSA-r53p-7pc4-xj5r: the retry interceptor could concatenate a resumed response with inconsistent framing into downstream output, enabling response splitting or corruption. Undici now validates Content-Range against the original response framing before resuming. Fixed by cd8af90b.

What's Changed

Full Changelog: nodejs/undici@v7.29.0...v7.29.1

v7.29.0

⚠️ Security fixes

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for undici since your current version.


Updates fast-uri from 3.0.6 to 3.1.8

Release notes

Sourced from fast-uri's releases.

v3.1.8

⚠️ Security Warning

This security release fixes the following medium-severity security advisory:

Users of the v3.x release line should upgrade to v3.1.8.

Full Changelog: fastify/fast-uri@v3.1.7...v3.1.8

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

v3.1.6

⚠️ Security Warning

This release addresses the following high-severity security advisories:

Users of the v3.x release line should upgrade to v3.1.6.

Full Changelog: fastify/fast-uri@v3.1.5...v3.1.6

v3.1.5

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

... (truncated)

Commits
  • ead3ab7 Bumped v3.1.8
  • c88b59e fix: normalize decoded reg-name case
  • 412e40a Bumped v3.1.7
  • 9f4c943 fix: backport port and IP-literal validation to v3.x (#216)
  • 1eb3ce4 fix: treat unterminated bracket hosts as reg-names again (#214)
  • 6f970b2 Bumped v3.1.6
  • d941579 fix: never run IDN canonicalization on bracketed IP literals
  • c0f0279 test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)
  • 37f3417 Merge commit from fork
  • 607bfbe Merge commit from fork
  • Additional commits viewable in compare view

Updates ws from 8.18.3 to 8.22.0

Release notes

Sourced from ws's releases.

8.22.0

Features

  • Introduced the protocols option (8b918b01).

Bug fixes

  • Calling websocket.close() with invalid arguments no longer transitions the state to WebSocket.CLOSING (#2337).

8.21.3

Bug fixes

  • The server now correctly rejects permessage-deflate offers if the incoming client_max_window_bits parameter value is smaller than its configured clientMaxWindowBits (e97a20ea).

8.21.2

Bug fixes

  • Fixed a test for CITGM (2eb3be0b).

8.21.1

Bug fixes

  • Empty fragments are now counted toward the limit (a2f4e7c0).
  • The default values of the maxBufferedChunks and maxFragments options have been reduced (f197ac65).

8.21.0

Features

  • Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

  • Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
</tr></table>

... (truncated)

Commits
  • 297202c [dist] 8.22.0
  • 8b918b0 [feature] Introduce the protocols option
  • 73e03eb [ci] Update actions/setup-node action to v7
  • d9b8954 [fix] Change the ready state after validating the arguments (#2337)
  • c791e70 [dist] 8.21.3
  • e97a20e [fix] Reject offers with client_max_window_bits below config
  • 787ebf2 [dist] 8.21.2
  • b4d62eb Revert "[ci] Trust Coveralls Homebrew tap"
  • e4bb883 [security] Use GitHub PVR as main reporting channel
  • 2eb3be0 [test] Skip test on Node.js versions where it does not apply
  • Additional commits viewable in compare view

Updates ws from 7.5.10 to 7.5.13

Release notes

Sourced from ws's releases.

8.22.0

Features

  • Introduced the protocols option (8b918b01).

Bug fixes

  • Calling websocket.close() with invalid arguments no longer transitions the state to WebSocket.CLOSING (#2337).

8.21.3

Bug fixes

  • The server now correctly rejects permessage-deflate offers if the incoming client_max_window_bits parameter value is smaller than its configured clientMaxWindowBits (e97a20ea).

8.21.2

Bug fixes

  • Fixed a test for CITGM (2eb3be0b).

8.21.1

Bug fixes

  • Empty fragments are now counted toward the limit (a2f4e7c0).
  • The default values of the maxBufferedChunks and maxFragments options have been reduced (f197ac65).

8.21.0

Features

  • Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

  • Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
</tr></table>

... (truncated)

Commits
  • 297202c [dist] 8.22.0
  • 8b918b0 [feature] Introduce the protocols option
  • 73e03eb [ci] Update actions/setup-node action to v7
  • d9b8954 [fix] Change the ready state after validating the arguments (#2337)
  • c791e70 [dist] 8.21.3
  • e97a20e [fix] Reject offers with client_max_window_bits below config
  • 787ebf2 [dist] 8.21.2
  • b4d62eb Revert "[ci] Trust Coveralls Homebrew tap"
  • e4bb883 [security] Use GitHub PVR as main reporting channel
  • 2eb3be0 [test] Skip test on Node.js versions where it does not apply
  • Additional commits viewable in compare view

Updates @grpc/grpc-js from 1.13.4 to 1.14.5

Release notes

Sourced from @​grpc/grpc-js's releases.

@​grpc/grpc-js 1.14.5

  • Fix a bug that caused clients to automatically transmit excessive error details to clients by default (advisory GHSA-f596-whhp-79r4)
  • Fix a bug that caused getAuthContext to return unverified certificates as though they were verified in some configurations (advisory GHSA-m9gg-hp2v-232j)
  • Fix a bug that could cause stale call data to accumulate if a channel failed to connect for a long period of time (#3078)
  • Fix a bug that could cause call status to be reported with expected fields missing (#3079)
  • Avoid redundant end() calls on completed HTTP/2 streams (#3082 contributed by @​olavloite)
  • Unify call numbers and avoid disabled trace allocations (#3084 contributed by @​olavloite)

@​grpc/grpc-js 1.14.4

@​grpc/grpc-js 1.14.3

  • Send halfClose immediately after messages to prevent late halfClose issues with Envoy (#3031 contributed by @​serkanerip)

@​grpc/grpc-js 1.14.2

@​grpc/grpc-js 1.14.1

  • Fix a regression of the settings used internally for HTTP/2 sessions (#3023)

@​grpc/grpc-js-xds 1.14.1

@​grpc/grpc-js-xds 1.14.0

  • Implement RBAC support (gRFC A41) (#2939, #2945)
  • Add weighted_round_robin to LB policy registry (#3001) (currently experimental, enabled by the environment variable GRPC_EXPERIMENTAL_XDS_WRR_LB)
  • Add wrr_locality to LB policy registry (#3003)

@​grpc/gr F438 pc-js 1.14.0

Changelog

  • Add getAuthContext method to client and server call classes (more details can be found in gRFC L35) (#2920)
  • Implement custom backend metrics support (gRFC A51) (#2978, #2983, #2985, #2986, #2999)
  • Add getConnectionInfo method to the ServerInterceptingCall class (#2922)
  • Implement the weighted_round_robin load balancing policy (#2998)
  • Fix jitter behavior for client retries (#2960 contributed by @​ekscentrysytet)
  • Start connecting from a random index in the round_robin LB policy (#2979)
  • Send connection-level WINDOW_UPDATE at session start (#2971 contributed by @​KoenRijpstra)

Experimental API Changes

Added:

  • CHANNEL_ARGS_CONFIG_SELECTOR_KEY
  • StatusOr<T>
  • CallStream
  • statusOrFromValue
  • statusOrFromError

... (truncated)

Commits
  • 56567d9 Merge pull request #3086 from murgatroid99/grpc-js_1.14.5
  • 748ae86 Merge pull request #3088 from murgatroid99/grpc-js_perf_improvement_backport
  • 526702d test(grpc-js): fix type errors in client stream lifecycle tests
  • 26a8d3d fix(grpc-js): avoid redundant end() calls on completed HTTP/2 streams
  • 152eebd chore(grpc-js): unify call numbers and avoid disabled trace allocations
  • c5ae750 grpc-js(-xds): Increment version numbers (1.14.x)
  • 735a09a Merge commit from fork
  • af9b140 Merge commit from fork
  • 45ac33e Merge commit from fork
  • 9df49e3 Merge pull request #3081 from murgatroid99/grpc-js-xds_weighted_target_fix_ba...
  • Additional commits viewable in compare view
Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates @humanfs/node from 0.16.6 to 0.16.8

Release notes

Sourced from @​humanfs/node's releases.

node: v0.16.8

0.16.8 (2026-04-17)

Bug Fixes

  • Include type dependencies at runtime (956ce7a), closes #145

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​humanfs/core bumped from ^0.19.1 to ^0.19.2

node: v0.16.7

0.16.7 (2024-11-27)

Bug Fixes

  • Add directory to package.json (f691b60)
Changelog

Sourced from @​humanfs/node's changelog.

0.16.8 (2026-04-17)

Bug Fixes

  • Ensure symlinks are copied as symlinks in copy() and copyAll() (22bbaa44)
  • Include type dependencies at runtime (956ce7a), closes #145

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​humanfs/core bumped from ^0.19.1 to ^0.19.2

0.16.7 (2024-11-27)

Bug Fixes

  • Add directory to package.json (f691b60)
Commits

Updates body-parser from 2.2.0 to 2.3.0

Release notes

Sourced from body-parser's releases.

v2.3.0

Important: Security

What's Changed

New Contributors

Full Changelog: expressjs/body-parser@v2.2.2...v2.3.0

v2.2.2

What's Changed

@dependabot
chore(deps): bump the npm_and_yarn group across 1 directory with 24 u…
1521b30 
…pdates

Bumps the npm_and_yarn group with 24 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `3.2.4` | `3.2.7` |
| [tar](https://github.com/isaacs/node-tar) | `7.5.1` | `7.5.22` |
| [shell-quote](https://github.com/ljharb/shell-quote) | `1.8.3` | `1.11.0` |
| [undici](https://github.com/nodejs/undici) | `7.15.0` | `7.30.0` |
| [fast-uri](https://github.com/fastify/fast-uri) | `3.0.6` | `3.1.8` |
| [ws](https://github.com/websockets/ws) | `8.18.3` | `8.22.0` |
| [ws](https://github.com/websockets/ws) | `7.5.10` | `7.5.13` |
| [@grpc/grpc-js](https://github.com/grpc/grpc-node) | `1.13.4` | `1.14.5` |
| [@humanfs/node](https://github.com/humanwhocodes/humanfs/tree/HEAD/packages/node) | `0.16.6` | `0.16.8` |
| [body-parser](https://github.com/expressjs/body-parser) | `2.2.0` | `2.3.0` |
| [body-parser](https://github.com/expressjs/body-parser) | `1.20.3` | `1.20.8` |
| [qs](https://github.com/ljharb/qs) | `6.13.0` | `6.16.0` |
| [@opentelemetry/core](https://github.com/open-telemetry/opentelemetry-js) | `2.0.1` | `2.11.0` |
| [@opentelemetry/exporter-prometheus](https://github.com/open-telemetry/opentelemetry-js) | `0.203.0` | `0.222.0` |
| [@opentelemetry/propagator-jaeger](https://github.com/open-telemetry/opentelemetry-js) | `2.0.1` | `2.11.0` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.1` | `3.15.2` |
| [form-data](https://github.com/form-data/form-data) | `2.5.5` | `2.5.6` |
| [form-data](https://github.com/form-data/form-data) | `4.0.4` | `4.0.6` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.12` | `1.1.21` |
| [@vitest/mocker](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker) | `3.2.4` | `3.2.7` |
| [linkify-it](https://github.com/markdown-it/linkify-it) | `5.0.0` | `5.0.2` |
| [markdown-it](https://github.com/markdown-it/markdown-it) | `14.1.0` | `14.3.2` |
| [nanoid](https://github.com/ai/nanoid) | `3.3.11` | `3.3.19` |
| [postcss](https://github.com/postcss/postcss) | `8.5.6` | `8.5.28` |
| [protobufjs](https://github.com/protobufjs/protobuf.js) | `7.5.3` | `7.6.6` |
| [tmp](https://github.com/raszi/node-tmp) | `0.2.5` | `0.2.7` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `7.1.9` | `7.3.6` |



Updates `vitest` from 3.2.4 to 3.2.7
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v3.2.7/packages/vitest)

Updates `tar` from 7.5.1 to 7.5.22
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-tar@v7.5.1...v7.5.22)

Updates `shell-quote` from 1.8.3 to 1.11.0
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.8.3...v1.11.0)

Updates `undici` from 7.15.0 to 7.30.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.15.0...v7.30.0)

Updates `fast-uri` from 3.0.6 to 3.1.8
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.0.6...v3.1.8)

Updates `ws` from 8.18.3 to 8.22.0
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.18.3...8.22.0)

Updates `ws` from 7.5.10 to 7.5.13
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.18.3...8.22.0)

Updates `@grpc/grpc-js` from 1.13.4 to 1.14.5
- [Release notes](https://github.com/grpc/grpc-node/releases)
- [Commits](https://github.com/grpc/grpc-node/compare/@grpc/grpc-js@1.13.4...@grpc/grpc-js@1.14.5)

Updates `@humanfs/node` from 0.16.6 to 0.16.8
- [Release notes](https://github.com/humanwhocodes/humanfs/releases)
- [Changelog](https://github.com/humanwhocodes/humanfs/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/humanwhocodes/humanfs/commits/node-v0.16.8/packages/node)

Updates `body-parser` from 2.2.0 to 2.3.0
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@v2.2.0...v2.3.0)

Updates `body-parser` from 1.20.3 to 1.20.8
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@v2.2.0...v2.3.0)

Updates `qs` from 6.13.0 to 6.16.0
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.16.0)

Updates `@opentelemetry/core` from 2.0.1 to 2.11.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@v2.0.1...v2.11.0)

Updates `@opentelemetry/exporter-prometheus` from 0.203.0 to 0.222.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@experimental/v0.203.0...experimental/v0.222.0)

Updates `@opentelemetry/propagator-jaeger` from 2.0.1 to 2.11.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@v2.0.1...v2.11.0)

Updates `js-yaml` from 3.14.1 to 3.15.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.14.1...3.15.2)

Updates `form-data` from 2.5.5 to 2.5.6
- [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md)
- [Commits](form-data/form-data@v2.5.5...v2.5.6)

Updates `form-data` from 4.0.4 to 4.0.6
- [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md)
- [Commits](form-data/form-data@v2.5.5...v2.5.6)

Updates `brace-expansion` from 1.1.12 to 1.1.21
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.21)

Updates `@vitest/mocker` from 3.2.4 to 3.2.7
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v3.2.7/packages/mocker)

Updates `linkify-it` from 5.0.0 to 5.0.2
- [Changelog](https://github.com/markdown-it/linkify-it/blob/master/CHANGELOG.md)
- [Commits](markdown-it/linkify-it@5.0.0...5.0.2)

Updates `markdown-it` from 14.1.0 to 14.3.2
- [Changelog](https://github.com/markdown-it/markdown-it/blob/14.3.2/CHANGELOG.md)
- [Commits](markdown-it/markdown-it@14.1.0...14.3.2)

Updates `nanoid` from 3.3.11 to 3.3.19
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md)
- [Commits](ai/nanoid@3.3.11...3.3.19)

Updates `postcss` from 8.5.6 to 8.5.28
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.6...8.5.28)

Updates `protobufjs` from 7.5.3 to 7.6.6
- [Release notes](https://github.com/protobufjs/protobuf.js/releases)
- [Changelog](https://github.com/protobufjs/protobuf.js/blob/protobufjs-v7.6.6/CHANGELOG.md)
- [Commits](protobufjs/protobuf.js@protobufjs-v7.5.3...protobufjs-v7.6.6)

Updates `tmp` from 0.2.5 to 0.2.7
- [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md)
- [Commits](raszi/node-tmp@v0.2.5...v0.2.7)

Updates `vite` from 7.1.9 to 7.3.6
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v7.3.6/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v7.3.6/packages/vite)

---
updated-dependencies:
- dependency-name: vitest
  dependency-version: 3.2.7
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: tar
  dependency-version: 7.5.22
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: shell-quote
  dependency-version: 1.11.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 7.30.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: fast-uri
  dependency-version: 3.1.8
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version: 8.22.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version: 7.5.13
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@grpc/grpc-js"
  dependency-version: 1.14.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@humanfs/node"
  dependency-version: 0.16.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: body-parser
  dependency-version: 2.3.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: body-parser
  dependency-version: 1.20.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.16.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@opentelemetry/core"
  dependency-version: 2.11.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@opentelemetry/exporter-prometheus"
  dependency-version: 0.222.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@opentelemetry/propagator-jaeger"
  dependency-version: 2.11.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 3.15.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: form-data
  dependency-version: 2.5.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: form-data
  dependency-version: 4.0.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 1.1.21
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@vitest/mocker"
  dependency-version: 3.2.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: linkify-it
  dependency-version: 5.0.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: markdown-it
  dependency-version: 14.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: nanoid
  dependency-version: 3.3.19
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: postcss
  dependency-version: 8.5.28
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: protobufjs
  dependency-version: 7.6.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: tmp
  dependency-version: 0.2.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 7.3.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 29, 2026
This was referenced Sep 29, 2026
Closed
Closed
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants

0