Skip to content

chore(deps-dev): bump the dev-dependencies group across 1 directory with 12 updates - #390

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-2b557be379
Closed

chore(deps-dev): bump the dev-dependencies group across 1 directory with 12 updates#390
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-2b557be379

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the dev-dependencies group with 12 updates in the / directory:

Package From To
@commitlint/cli 21.1.0 21.2.1
@commitlint/config-conventional 21.1.0 21.2.0
@semantic-release/github 12.0.8 12.0.9
prettier 3.9.4 3.9.6
semantic-release 25.0.5 25.0.8
@typescript-eslint/eslint-plugin 8.62.0 8.65.0
@typescript-eslint/parser 8.62.0 8.65.0
vite 8.1.0 8.1.5
@docusaurus/module-type-aliases 3.10.1 3.10.2
@docusaurus/types 3.10.1 3.10.2
@types/node 26.0.1 26.1.1
wait-on 9.0.10 9.1.0

Updates @commitlint/cli from 21.1.0 to 21.2.1

Release notes

Sourced from @​commitlint/cli's releases.

v21.2.1

21.2.0 (2026-06-30)

Features

  • resolve-extends: resolve pure-ESM presets (conventional-changelog v7/v9/v10) (#4859) (fdb566f)

Chore, doc, etc.

New Contributors

Full Changelog: conventional-changelog/commitlint@v21.2.0...v21.2.1

v21.2.0

21.2.0 (2026-06-30)

Features

Chore

Full Changelog: conventional-changelog/commitlint@v21.1.0...v21.2.0

Changelog

Sourced from @​commitlint/cli's changelog.

21.2.1 (2026-07-08)

Note: Version bump only for package @​commitlint/cli

21.2.0 (2026-06-30)

Features

  • resolve-extends: resolve pure-ESM presets (conventional-changelog v7/v9/v10) (#4859) (fdb566f)
Commits

Updates @commitlint/config-conventional from 21.1.0 to 21.2.0

Release notes

Sourced from @​commitlint/config-conventional's releases.

v21.2.0

21.2.0 (2026-06-30)

Features

Chore

Full Changelog: conventional-changelog/commitlint@v21.1.0...v21.2.0

Changelog

Sourced from @​commitlint/config-conventional's changelog.

21.2.0 (2026-06-30)

Features

  • resolve-extends: resolve pure-ESM presets (conventional-changelog v7/v9/v10) (#4859) (fdb566f)
Commits
  • 1b4e5bc v21.2.0
  • fdb566f feat(resolve-extends): resolve pure-ESM presets (conventional-changelog v7/v9...
  • See full diff in compare view

Updates @semantic-release/github from 12.0.8 to 12.0.9

Release notes

Sourced from @​semantic-release/github's releases.

v12.0.9

12.0.9 (2026-07-01)

Bug Fixes

  • asset-upload: stop setting content-length header manually (241f966), closes #1224
  • local-undici: always use the locally installed undici instead of the node built-in version (40973e3), closes #1224
  • publish: handle content-length header properly for asset uploads (#1260) (28e3741), closes #1224 #1224
Commits
  • 28e3741 fix(publish): handle content-length header properly for asset uploads (#1260)
  • 241f966 fix(asset-upload): stop setting content-length header manually
  • 40973e3 fix(local-undici): always use the locally installed undici instead of the nod...
  • 8879ae4 chore(deps): update dependency prettier to v3.9.1 (#1259)
  • bf720e2 chore(deps): update dependency prettier to v3.9.0 (#1258)
  • b34e0ec chore(deps): update dependency prettier to v3.8.5 (#1257)
  • b445fa0 chore(deps): update dependency ls-engines to v0.10.1 (#1256)
  • 4ca0ef4 chore(deps): lock file maintenance (#1255)
  • bb9fdb3 chore(deps): update dependency undici to v7.28.0 [security] (#1254)
  • 059c6ce ci(action): update actions/checkout action to v7 (#1252)
  • Additional commits viewable in compare view

Updates prettier from 3.9.4 to 3.9.6

Release notes

Sourced from prettier's releases.

3.9.6

What's Changed

🔗 Changelog

3.9.5

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.6

diff

TypeScript: Preserve quotes for methods named new (#19621 by @​kovsu)

// Input
interface Container {
  "new"(id: string): number;
}
// Prettier 3.9.5
interface Container {
new(id: string): number;
}
// Prettier 3.9.6
interface Container {
"new"(id: string): number;
}

TypeScript: Support import defer (#19624, #19675 by @​fisker)

// Input
import defer * as foo from "foo";
// Prettier 3.9.5
import * as foo from "foo";
// Prettier 3.9.6
import defer * as foo from "foo";

JavaScript: Added a new official plugin @prettier/plugin-yuku (#19628, #19629 by @​fisker)

@prettier/plugin-yuku is powered by Yuku (A high-performance JavaScript/TypeScript compiler toolchain written in Zig).

This plugin includes two new parsers: yuku (JavaScript syntax) and yuku-ts (TypeScript syntax).

To use this plugin:

  1. Install the plugin:

    yarn add --dev prettier @prettier/plugin-yuku

... (truncated)

Commits

Updates semantic-release from 25.0.5 to 25.0.8

Release notes

Sourced from semantic-release's releases.

v25.0.8

25.0.8 (2026-07-18)

Bug Fixes

  • handle potential null values in commit message and gitTags trimming (0a60004)
  • hide-sensitive: mask key/auth/webhook env vars (973d763)
  • mask sensitive environment variables and improve commit handling (#4252) (1bfdc52)
  • prevent template evaluation syntax in branch expansion and tag formatting (f121540)

v25.0.7

25.0.7 (2026-07-13)

Bug Fixes

  • argument Injection via repositoryUrl in package.json (#4245) (c46dbda)

v25.0.6

25.0.6 (2026-07-10)

Bug Fixes

  • ensure encoded secrets get masked (8e28dd3)
Commits
  • 1bfdc52 fix: mask sensitive environment variables and improve commit handling (#4252)
  • 0a60004 fix: handle potential null values in commit message and gitTags trimming
  • f121540 fix: prevent template evaluation syntax in branch expansion and tag formatting
  • 973d763 fix(hide-sensitive): mask key/auth/webhook env vars
  • 474e5a3 ci(action): update github/codeql-action action to v4.37.1 (#4254)
  • fc9382c docs: fix issue template links (#4251)
  • e34c52d ci(action): update actions/setup-node action to v7 (#4250)
  • 8020ec6 ci(action): update actions/setup-node action to v6.5.0 (#4249)
  • 956baf4 chore(deps): update npm to v12.0.1 (#4247)
  • c46dbda fix: argument Injection via repositoryUrl in package.json (#4245)
  • Additional commits viewable in compare view

Updates @typescript-eslint/eslint-plugin from 8.62.0 to 8.65.0

Release notes

Sourced from @​typescript-eslint/eslint-plugin's releases.

v8.65.0

8.65.0 (2026-07-20)

🚀 Features

  • add warning when TS 7 is detected (#12529)
  • eslint-plugin: [no-restricted-imports] deprecate extension rule (#12527, #19562, #11889)
  • eslint-plugin: [no-shadow] specialized error on enum declaration and member shadowing (#12578)
  • parser: add onUnsupportedTypeScriptVersion option to error on unsupported TypeScript versions (#12465)
  • typescript-estree: throw for invalid import defer syntax (#12552)

🩹 Fixes

  • eslint-plugin: [prefer-string-starts-ends-with] handle escaped $ ending regex literals (#12515)
  • eslint-plugin: [unbound-method] report unbound methods accessed via member expression on union types (#12448)
  • eslint-plugin: [no-unnecessary-parameter-property-assignment] don't flag computed assignments with a variable key (#12568)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.64.0

8.64.0 (2026-07-13)

🚀 Features

  • support parsing import defer (#12513)
  • eslint-plugin: [no-loop-func] support using / await using declarations and deprecate the rule (#12500)
  • typescript-estree: throw for invalid definite assignment in class properties (#12543)

🩹 Fixes

  • eslint-plugin: [require-array-sort-compare] handle constrained arrays (#12512)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

... (truncated)

Changelog

Sourced from @​typescript-eslint/eslint-plugin's changelog.

8.65.0 (2026-07-20)

🚀 Features

  • eslint-plugin: [no-shadow] specialized error on enum declaration and member shadowing (#12578)
  • add warning when TS 7 is detected (#12529)
  • eslint-plugin: [no-restricted-imports] deprecate extension rule (#12527, #19562, #11889)

🩹 Fixes

  • eslint-plugin: [no-unnecessary-parameter-property-assignment] don't flag computed assignments with a variable key (#12568)
  • eslint-plugin: [unbound-method] report unbound methods accessed via member expression on union types (#12448)
  • eslint-plugin: [prefer-string-starts-ends-with] handle escaped $ ending regex literals (#12515)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.64.0 (2026-07-13)

🚀 Features

  • eslint-plugin: [no-loop-func] support using / await using declarations and deprecate the rule (#12500)
  • typescript-estree: throw for invalid definite assignment in class properties (#12543)

🩹 Fixes

  • eslint-plugin: [require-array-sort-compare] handle constrained arrays (#12512)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.63.0 (2026-07-06)

🚀 Features

... (truncated)

Commits
  • 63ba81b chore(release): publish 8.65.0
  • aa602bd fix(eslint-plugin): [no-unnecessary-parameter-property-assignment] don't flag...
  • 1e90d67 feat(eslint-plugin): [no-shadow] specialized error on enum declaration and me...
  • b32fb34 docs: fix broken code samples in no-extraneous-class and prefer-function-type...
  • eaf4576 feat: add warning when TS 7 is detected (#12529)
  • 18c01c7 feat(eslint-plugin): [no-restricted-imports] deprecate extension rule (#12527)
  • 96e8fe2 fix(eslint-plugin): [unbound-method] report unbound methods accessed via memb...
  • 0d06406 chore: add attw validation to repo (#12437)
  • 9d9973b fix(eslint-plugin): [prefer-string-starts-ends-with] handle escaped $ ending ...
  • c2386e4 chore(deps): update dependency prettier to v3.9.5 (#12486)
  • Additional commits viewable in compare view

Updates @typescript-eslint/parser from 8.62.0 to 8.65.0

Release notes

Sourced from @​typescript-eslint/parser's releases.

v8.65.0

8.65.0 (2026-07-20)

🚀 Features

  • add warning when TS 7 is detected (#12529)
  • eslint-plugin: [no-restricted-imports] deprecate extension rule (#12527, #19562, #11889)
  • eslint-plugin: [no-shadow] specialized error on enum declaration and member shadowing (#12578)
  • parser: add onUnsupportedTypeScriptVersion option to error on unsupported TypeScript versions (#12465)
  • typescript-estree: throw for invalid import defer syntax (#12552)

🩹 Fixes

  • eslint-plugin: [prefer-string-starts-ends-with] handle escaped $ ending regex literals (#12515)
  • eslint-plugin: [unbound-method] report unbound methods accessed via member expression on union types (#12448)
  • eslint-plugin: [no-unnecessary-parameter-property-assignment] don't flag computed assignments with a variable key (#12568)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.64.0

8.64.0 (2026-07-13)

🚀 Features

  • support parsing import defer (#12513)
  • eslint-plugin: [no-loop-func] support using / await using declarations and deprecate the rule (#12500)
  • typescript-estree: throw for invalid definite assignment in class properties (#12543)

🩹 Fixes

  • eslint-plugin: [require-array-sort-compare] handle constrained arrays (#12512)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

... (truncated)

Changelog

Sourced from @​typescript-eslint/parser's changelog.

8.65.0 (2026-07-20)

🚀 Features

  • add warning when TS 7 is detected (#12529)
  • parser: add onUnsupportedTypeScriptVersion option to error on unsupported TypeScript versions (#12465)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.64.0 (2026-07-13)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.63.0 (2026-07-06)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.62.1 (2026-06-29)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits
  • 63ba81b chore(release): publish 8.65.0
  • eaf4576 feat: add warning when TS 7 is detected (#12529)
  • d8f1044 feat(parser): add onUnsupportedTypeScriptVersion option to error on unsupport...
  • 0d06406 chore: add attw validation to repo (#12437)
  • c2386e4 chore(deps): update dependency prettier to v3.9.5 (#12486)
  • 414d9ab chore(release): publish 8.64.0
  • 290cf6c chore(release): publish 8.63.0
  • 3ea32f4 chore(release): publish 8.62.1
  • See full diff in compare view

Updates vite from 8.1.0 to 8.1.5

Release notes

Sourced from vite's releases.

v8.1.5

Please refer to CHANGELOG.md for details.

v8.1.4

Please refer to CHANGELOG.md for details.

v8.1.3

Please refer to CHANGELOG.md for details.

v8.1.2

Please refer to CHANGELOG.md for details.

v8.1.1

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.1.5 (2026-07-16)

Bug Fixes

  • bundled-dev: avoid duplicated buildEnd (#22931) (8100320)
  • client: overlay error message format align rolldown (#22869) (5a72b87)
  • deps: update all non-major dependencies (#22921) (fef682d)
  • deps: update rolldown-related dependencies (#22922) (3c345e4)
  • module-runner: don't crash stack-trace source mapping when globalThis.Buffer is absent (#22945) (f8b38e3)
  • optimizer: respect importer module format for dynamic import interop with CJS deps (#22951) (6c08c39)
  • ssr: scope switch-case declarations to the switch, not the function (#22893) (b59a73f)

Documentation

  • build: fix incorrect @default for build.cssMinify (#22948) (c88c236)
  • build: fix incorrect @default for build.lib.formats (#22911) (369ed60)

Tests

  • avoid scanner scanning all files under __tests__ (#22912) (c961cae)

8.1.4 (2026-07-09)

Features

Bug Fixes

  • build: add workaround for building on stackblitz (#22840) (575c32c)
  • build: keep import.meta.url in preload function as-is (#22839) (f1f90ed)
  • deps: update all non-major dependencies (#22865) (d4295a9)
  • deps: update rolldown-related dependencies (#22866) (7cf07e4)
  • html: avoid backtracking in import-only check (#22848) (b5868c0)
  • optimizer: avoid optimizer run for transform request before init (#22852) (72a5e21)
  • ssr: align named export function call stacktrace column with Node (#22829) (173a1b6)
  • strip pure CSS chunk imports when chunkImportMap is enabled (#22841) (648bd04)

Documentation

Miscellaneous Chores

  • deps: update dependency postcss-modules to v9 (#22867) (a9539d6)

Code Refactoring

Tests

... (truncated)

Commits
  • 5e7fe12 release: v8.1.5
  • 6c08c39 fix(optimizer): respect importer module format for dynamic import interop wit...
  • 5a72b87 fix(client): overlay error message format align rolldown (#22869)
  • f8b38e3 fix(module-runner): don't crash stack-trace source mapping when globalThis.Bu...
  • 8100320 fix(bundled-dev): avoid duplicated buildEnd (#22931)
  • c88c236 docs(build): fix incorrect @default for build.cssMinify (#22948)
  • b59a73f fix(ssr): scope switch-case declarations to the switch, not the function (#22...
  • fef682d fix(deps): update all non-major dependencies (#22921)
  • 3c345e4 fix(deps): update rolldown-related dependencies (#22922)
  • 369ed60 docs(build): fix incorrect @default for build.lib.formats (#22911)
  • Additional commits viewable in compare view

Updates @docusaurus/module-type-aliases from 3.10.1 to 3.10.2

Release notes

Sourced from @​docusaurus/module-type-aliases's releases.

3.10.2 (2026-07-10)

Backport and cherry-pick commits from main for v3.10.2 patch release:

Changelog

Sourced from @​docusaurus/module-type-aliases's changelog.

3.10.2 (2026-07-10)

Backport and cherry-pick commits from main for v3.10.2 patch release:

Commits

Updates @docusaurus/types from 3.10.1 to 3.10.2

Release notes

Sourced from @​docusaurus/types's releases.

3.10.2 (2026-07-10)

Backport and cherry-pick commits from main for v3.10.2 patch release:

  • [fix(bundler): do not import Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 24, 2026
@socket-security

socket-security Bot commented Jul 24, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Added@​docusaurus/​module-type-aliases@​3.10.21001006998100
Added@​docusaurus/​types@​3.10.2991007298100
Added@​commitlint/​cli@​21.2.11001007396100
Added@​types/​node@​26.1.11001008195100
Addedwait-on@​9.1.09910010091100
Added@​semantic-release/​github@​12.0.99810010095100
Added@​commitlint/​config-conventional@​21.2.010010010095100
Addedsemantic-release@​25.0.89710010097100

View full report

@socket-security

socket-security Bot commented Jul 24, 2026 •
edited
Loading

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm webpack is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yaml → npm/@docusaurus/core@3.10.1 → npm/@docusaurus/theme-common@3.10.1 → npm/@docusaurus/theme-live-codeblock@3.10.1 → npm/@docusaurus/preset-classic@3.10.1 → npm/@storybook/addon-docs@10.4.6 → npm/@storybook/react-vite@10.4.6 → npm/@docusaurus/types@3.10.2 → npm/raw-loader@4.0.2 → npm/webpack@5.108.4

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/webpack@5.108.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@dependabot
chore(deps-dev): bump the dev-dependencies group across 1 directory w…
528936f 
…ith 12 updates

Bumps the dev-dependencies group with 12 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@commitlint/cli](https://github.com/conventional-changelog/commitlint/tree/HEAD/@commitlint/cli) | `21.1.0` | `21.2.1` |
| [@commitlint/config-conventional](https://github.com/conventional-changelog/commitlint/tree/HEAD/@commitlint/config-conventional) | `21.1.0` | `21.2.0` |
| [@semantic-release/github](https://github.com/semantic-release/github) | `12.0.8` | `12.0.9` |
| [prettier](https://github.com/prettier/prettier) | `3.9.4` | `3.9.6` |
| [semantic-release](https://github.com/semantic-release/semantic-release) | `25.0.5` | `25.0.8` |
| [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.62.0` | `8.65.0` |
| [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.62.0` | `8.65.0` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.1.0` | `8.1.5` |
| [@docusaurus/module-type-aliases](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-module-type-aliases) | `3.10.1` | `3.10.2` |
| [@docusaurus/types](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-types) | `3.10.1` | `3.10.2` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.0.1` | `26.1.1` |
| [wait-on](https://github.com/jeffbski/wait-on) | `9.0.10` | `9.1.0` |



Updates `@commitlint/cli` from 21.1.0 to 21.2.1
- [Release notes](https://github.com/conventional-changelog/commitlint/releases)
- [Changelog](https://github.com/conventional-changelog/commitlint/blob/master/@commitlint/cli/CHANGELOG.md)
- [Commits](https://github.com/conventional-changelog/commitlint/commits/v21.2.1/@commitlint/cli)

Updates `@commitlint/config-conventional` from 21.1.0 to 21.2.0
- [Release notes](https://github.com/conventional-changelog/commitlint/releases)
- [Changelog](https://github.com/conventional-changelog/commitlint/blob/master/@commitlint/config-conventional/CHANGELOG.md)
- [Commits](https://github.com/conventional-changelog/commitlint/commits/v21.2.0/@commitlint/config-conventional)

Updates `@semantic-release/github` from 12.0.8 to 12.0.9
- [Release notes](https://github.com/semantic-release/github/releases)
- [Commits](semantic-release/github@v12.0.8...v12.0.9)

Updates `prettier` from 3.9.4 to 3.9.6
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.9.4...3.9.6)

Updates `semantic-release` from 25.0.5 to 25.0.8
- [Release notes](https://github.com/semantic-release/semantic-release/releases)
- [Commits](semantic-release/semantic-release@v25.0.5...v25.0.8)

Updates `@typescript-eslint/eslint-plugin` from 8.62.0 to 8.65.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.65.0/packages/eslint-plugin)

Updates `@typescript-eslint/parser` from 8.62.0 to 8.65.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.65.0/packages/parser)

Updates `vite` from 8.1.0 to 8.1.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.1.5/packages/vite)

Updates `@docusaurus/module-type-aliases` from 3.10.1 to 3.10.2
- [Release notes](https://github.com/facebook/docusaurus/releases)
- [Changelog](https://github.com/facebook/docusaurus/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/docusaurus/commits/v3.10.2/packages/docusaurus-module-type-aliases)

Updates `@docusaurus/types` from 3.10.1 to 3.10.2
- [Release notes](https://github.com/facebook/docusaurus/releases)
- [Changelog](https://github.com/facebook/docusaurus/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/docusaurus/commits/v3.10.2/packages/docusaurus-types)

Updates `@types/node` from 26.0.1 to 26.1.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `wait-on` from 9.0.10 to 9.1.0
- [Release notes](https://github.com/jeffbski/wait-on/releases)
- [Commits](jeffbski/wait-on@v9.0.10...v9.1.0)

---
updated-dependencies:
- dependency-name: "@commitlint/cli"
  dependency-version: 21.2.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@commitlint/config-conventional"
  dependency-version: 21.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@docusaurus/module-type-aliases"
  dependency-version: 3.10.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: "@docusaurus/types"
  dependency-version: 3.10.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: "@semantic-release/github"
  dependency-version: 12.0.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: "@types/node"
  dependency-version: 26.1.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@typescript-eslint/eslint-plugin"
  dependency-version: 8.65.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@typescript-eslint/parser"
  dependency-version: 8.65.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: prettier
  dependency-version: 3.9.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: semantic-release
  dependency-version: 25.0.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: vite
  dependency-version: 8.1.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: wait-on
  dependency-version: 9.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/dev-dependencies-2b557be379 branch from 5bf280a to 528936f Compare July 25, 2026 01:37
@allxsmith allxsmith mentioned this pull request Jul 27, 2026
Merged
9 tasks done
allxsmith added a commit that referenced this pull request Jul 27, 2026
@allxsmith
chore: apply grouped dependency updates from #388 and #390 (#393)
2fb0a1a 
Consolidates dependabot's production-dependencies (#388) and dev-dependencies (#390) grouped updates, bumps the prettier override to 3.9.6 in lockstep with the new manifest floors, and removes the expired brace-expansion cooldown-bypass entry (the >=5.0.8 security override stays).
@allxsmith Claude

allxsmith commented Jul 27, 2026

Copy link
Copy Markdown
Owner

Closing as superseded by #393 (merged as 2fb0a1a): all twelve dev bumps in this group landed there, plus one change this PR couldn't make — pnpm-workspace.yaml pins prettier exactly via overrides, so raising the manifest floors to ^3.9.6 alone would have silently kept 3.9.4 installed. #393 bumped the override to 3.9.6 in the same commit (zero formatting churn).

Generated by Claude Code

@allxsmith allxsmith closed this Jul 27, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jul 27, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/dev-dependencies-2b557be379 branch July 27, 2026 23:13
This was referenced Jul 28, 2026
Closed
Merged
allxsmith added a commit that referenced this pull request Aug 1, 2026
@allxsmith
chore(deps): consolidate the dependabot backlog, require Node 22 in b…
e68148c 
…oth CLIs (#447)

* chore(deps): consolidate dependabot updates, pin patched minimatch and yaml

Consolidates #427, #428, #431, #432 and #440 into one PR so the shared
pnpm-lock.yaml is regenerated once instead of forcing dependabot to rebase
six branches serially. Same approach as #393 for #388/#390.

docusaurus-plugin-llms 0.5.x pins its own dependencies exactly rather than by
range, which dragged minimatch back to 9.0.3 (three high ReDoS advisories) and
yaml to 2.8.1, failing both `pnpm audit --audit-level=high` and Dependency
Review on #440. Two scoped overrides restore the patched versions; the rest of
that group was already clean.

@semantic-release/changelog 7 and @semantic-release/git 11 are the same
CJS-to-ESM wave and are taken together. Every option the release configs
actually pass (changelogFile, assets, message) is unchanged, and both declare
a semantic-release peer of >=20.1.0, satisfied by ^25.0.8.

@testing-library/jest-dom 7 removes no matchers; the new required peer
@testing-library/dom is already resolved at 10.4.1 via @testing-library/react.

Claude-Session: https://claude.ai/code/session_01TGA6sFTUGsJ6oXhfpjKEnh

* feat(create-bestax): require Node 22 and take chalk 6

chalk 6 drops support for Node below 22. The API surface this package uses is
unchanged — every call site is a default import using .red/.yellow/.green and
friends — so no calling code changes.

Raising engines.node to >=22 brings the manifest in line with what the docs
have claimed all along: the installation guide already states "Node.js: 22.0.0
or higher (the current LTS baseline)".

The version guard in src/index.ts moves ahead of every import and stops using
chalk. Import declarations are hoisted and evaluated before any statement in
the module, and chalk 6 itself requires Node >= 22 — so a static import would
fail to load on exactly the runtimes the guard exists to catch, replacing a
clear message with an opaque loader error. ./cli.js is now imported
dynamically for the same reason.

BREAKING CHANGE: create-bestax now requires Node.js 22 or newer. Node 18 and 20
are both past end-of-life. Running it on an older runtime prints an explicit
upgrade message and exits 1.

Claude-Session: https://claude.ai/code/session_01TGA6sFTUGsJ6oXhfpjKEnh

* feat(bestax-migrate): require Node 22 and take chalk 6

chalk 6 drops support for Node below 22. The API surface this package uses is
unchanged, so no calling code changes.

The version guard in src/index.ts moves ahead of every import and no longer
depends on anything: import declarations are hoisted and evaluated before any
statement in the module, and chalk 6 itself requires Node >= 22, so a static
import would fail to load on exactly the runtimes the guard exists to catch.
./cli.js is now imported dynamically for the same reason.

@babel/parser deliberately stays on 7.x. Babel 8 removes the
`deprecatedImportAssert` plugin with no replacement, and this package parses
the legacy `import x from 'y' assert { type: 'json' }` form on purpose — a
codemod that migrates older codebases must not crash on the syntax those
codebases still contain. There is a regression test for it ("parses the legacy
import-assert syntax"), which Babel 8 fails outright. jscodeshift 17 bundles
its own Babel 7 regardless, so staying on 7 also keeps a single parser in the
tree rather than two.

BREAKING CHANGE: bestax-migrate now requires Node.js 22 or newer. Node 18 and
20 are both past end-of-life. Running it on an older runtime prints an explicit
upgrade message and exits 1.

Claude-Session: https://claude.ai/code/session_01TGA6sFTUGsJ6oXhfpjKEnh
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@allxsmith