chore(deps): bump the production-dependencies group across 1 directory with 8 updates

[dependabot]

Bumps the production-dependencies group with 8 updates in the / directory:

Package	From	To
@reddb-io/toon	0.13.2	0.29.8
graphql	17.0.1	17.0.2
jose	6.2.3	6.2.10
js-yaml	4.3.1	5.3.0
tsx	4.22.4	4.23.12
typescript	6.0.3	7.0.2
ws	8.21.0	8.21.3
marked	18.0.5	18.0.10

Updates @reddb-io/toon from 0.13.2 to 0.29.8

Release notes

Sourced from @​reddb-io/toon's releases.

tq v0.29.8

What's in 0.29.8

🐛 Bug fixes

• release: quarantine RPC family (#391)

Full Changelog: reddb-io/toon@v0.29.7...v0.29.8

---

TOON v4.1 checkpoint

This release closes the repository's v4.1 frontier at the official TOON v4.1.1 checkpoint: revision and reference implementation revision . The TypeScript package, Rust crate, , and editor grammar share that baseline and are validated against the vendored official corpus.

API cutovers

• TypeScript callers should use , , , , and . and are deprecated aliases for the canonical codec; old path-expanding behavior lives at .
• Rust callers should use the suffix-free and functions and canonical model methods. Compatibility entry points are explicitly named .

Extension policy

Nested field groups and keyed tabular form are official v4.1 and are selected automatically. TOONL, primitive-array columns, object-array columns, cyclic discriminated arrays, depth guards, and truncation reports remain RedDB userland features. Wire extensions are opt-in on encode and preserve a lossless canonical fallback; they are never presented as official TOON syntax.

Migration

Replace legacy root imports and Rust legacy methods with the canonical APIs, treat dotted keys literally, remove key-folding assumptions, and review inputs that depended on lenient numeric or indentation recovery. The complete before/after guide is at https://github.com/reddb-io/toon/blob/v0.29.8/docs/migration-v4.md.

Experimental upstream frontiers

The TypeScript reviver remains an experimental opt-in audited from toon-format/toon#294; it is not part of the v4.1

... (truncated)

Commits

• 615cc60 chore: release 0.29.8
• f64770c chore: release 0.29.7
• e9b3c5c chore: release 0.29.6
• 1904fbf chore: release 0.29.5
• caea506 chore: release 0.29.4
• 4cfc3c9 fix(toon-rpc): restore build and lockstep releases (#378)
• 12e4ed0 chore: release 0.29.3
• 60d824d chore: release 0.29.2
• d8ba28c chore: release 0.29.1
• da515f0 chore(toon-rpc): bump versions to 0.29.0 + add MCP/ACP/multi-protocol (#376)
• Additional commits viewable in compare view

Updates graphql from 17.0.1 to 17.0.2

Release notes

Sourced from graphql's releases.

v17.0.2 (2026-07-03)

Bug Fix 🐞

• #4832 fix: detect default-value changes on input object fields (@​spokodev)

Polish 💅

• #4829 fix(mapSchemaConfig): fix context for schema argument mapper (@​yaacovCR)

Committers: 2

• null(@​spokodev)
• Yaacov Rydzinski (@​yaacovCR)

Commits

• 71606d7 chore(release): v17.0.2
• 101de34 fix: detect default-value changes on input object fields (#4832)
• 82da713 fix(mapSchemaConfig): fix context for schema argument mapper (#4829)
• See full diff in compare view

Updates jose from 6.2.3 to 6.2.10

Release notes

Sourced from jose's releases.

v6.2.10

Fixes

• jose: consume serialization members once (9bee285)
• jose: reject empty protected and JWE AAD members (8da4145)
• jose: validate serialized header values (b711d8f)
• jwe: conceal invalid decrypted CEK lengths (41fafe0)
• jwe: enforce AES-GCM tag boundaries (9a5b744)
• jwe: validate explicit encryption parameters (7a02697)
• jwk: accept empty octet-sequence keys (3f871e7)
• jwk: normalize key resolution inputs (f54ee7b)
• jwks: enforce verification key metadata (f9ba510)
• jwks: order overlapping remote reloads (9a1a913)
• jwks: reject invalid remote duration values (7bdb9e5)
• jwk: validate ext and key_ops parameters (4d91c37)
• jws: reject mixed payload encoding modes (dc69713)
• jws: validate unencoded payload strings (541f282)
• jwt: enforce explicit verification policies (b347182)
• jwt: prevent replacing protected headers (ae07d09)
• jwt: reject invalid duration inputs (282f9aa)
• jwt: validate builder claim values (ea03f83)
• jwt: validate unsecured protected headers (230c14e)
• key: validate generation and import options (15d880e)
• reject mixed b64 modes for empty General JWS payloads (61a2ef7)
• x509: reject DER truncated past its outer length (d8db9f6)

Documentation

• jwks: correct cache timestamp units (01a44d9)

Refactor

• jose: share binary input validation (eedb124)
• jose: share compact token processing internals (85e30ed)
• jwe: consolidate CBC decryption failures (1ee6f61)
• jwe: specialize compact processing (a998927)
• jwe: streamline single-recipient encryption (290aaa6)
• jwks: compact JWK Set shape validation (930c7df), references Array#every
• jwks: compact local key selection (4cb5ae5)
• jwks: compact remote resolver state (ef5eaf4)
• jws: specialize compact processing (021abf4)
• jwt: compact claim validation helpers (f390683)
• jwt: consolidate replicated claim checks (7dd5591)
• jwt: share producer claim state (52ba159)
• key: compact JWK algorithm selection (a6b29da)
• key: compact secret length parsing (cc03be8)

v6.2.9

Fixes

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.10 (2026-08-21)

Fixes

• jose: consume serialization members once (9bee285)
• jose: reject empty protected and JWE AAD members (8da4145)
• jose: validate serialized header values (b711d8f)
• jwe: conceal invalid decrypted CEK lengths (41fafe0)
• jwe: enforce AES-GCM tag boundaries (9a5b744)
• jwe: validate explicit encryption parameters (7a02697)
• jwk: accept empty octet-sequence keys (3f871e7)
• jwk: normalize key resolution inputs (f54ee7b)
• jwks: enforce verification key metadata (f9ba510)
• jwks: order overlapping remote reloads (9a1a913)
• jwks: reject invalid remote duration values (7bdb9e5)
• jwk: validate ext and key_ops parameters (4d91c37)
• jws: reject mixed payload encoding modes (dc69713)
• jws: validate unencoded payload strings (541f282)
• jwt: enforce explicit verification policies (b347182)
• jwt: prevent replacing protected headers (ae07d09)
• jwt: reject invalid duration inputs (282f9aa)
• jwt: validate builder claim values (ea03f83)
• jwt: validate unsecured protected headers (230c14e)
• key: validate generation and import options (15d880e)
• reject mixed b64 modes for empty General JWS payloads (61a2ef7)
• x509: reject DER truncated past its outer length (d8db9f6)

Documentation

• jwks: correct cache timestamp units (01a44d9)

Refactor

• jose: share binary input validation (eedb124)
• jose: share compact token processing internals (85e30ed)
• jwe: consolidate CBC decryption failures (1ee6f61)
• jwe: specialize compact processing (a998927)
• jwe: streamline single-recipient encryption (290aaa6)
• jwks: compact JWK Set shape validation (930c7df), references Array#every
• jwks: compact local key selection (4cb5ae5)
• jwks: compact remote resolver state (ef5eaf4)
• jws: specialize compact processing (021abf4)
• jwt: compact claim validation helpers (f390683)
• jwt: consolidate replicated claim checks (7dd5591)
• jwt: share producer claim state (52ba159)
• key: compact JWK algorithm selection (a6b29da)
• key: compact secret length parsing (cc03be8)

6.2.9 (2026-08-15)

... (truncated)

Commits

• 3eab152 chore(release): 6.2.10
• 021abf4 refactor(jws): specialize compact processing
• a998927 refactor(jwe): specialize compact processing
• eedb124 refactor(jose): share binary input validation
• 52ba159 refactor(jwt): share producer claim state
• 85e30ed refactor(jose): share compact token processing internals
• 0bd81d2 test(jose): cover hidden critical-header options
• 9cf7876 test(jose): reject callable object impostors
• f23cafd test(jose): preserve resolved key data properties
• 1ee6f61 refactor(jwe): consolidate CBC decryption failures
• Additional commits viewable in compare view

Updates js-yaml from 4.3.1 to 5.3.0

Changelog

Sourced from js-yaml's changelog.

[5.3.0] - 2026-08-14

This release focuses on reworking the documentation and making small architectural improvements before moving forward.

Added

• Added completely new documentation.
• Exported DUMP_SCHEMA, the default schema used by the dumper.
• Added YAMLException.throwAt() for throwing an error at a source position.

Changed

• Changed flat constant exports to grouped exports: EVENT_ID, SCALAR_STYLE, COLLECTION_STYLE, and CHOMPING_MODE, along with their value types. The old exports are still preserved, but deprecated.
• Made identify mandatory for custom tag definitions. Use identify: () => false for load-only tags.

Deprecated

• Deprecated flat constant exports. Use grouped ones instead.

Removed

• Removed the MERGE_KEY export (not used anymore after last fixes).

Fixed

• Validate << sequence items at merge time, so aliased merge sources are checked too.
• Resolve << outside of a mapping key as the plain string '<<', matching v4, instead of leaking an internal symbol into the result.

[5.2.3] - 2026-08-01

Fixed

• Prevent prototype fallback when resolving tags and mapping entries, #782.
• Resolve !!timestamp years 0000-0099 correctly, #775.
• Preserve implicit null mapping values before document markers and reject unpaired mapping event streams, #784.
• Preserve folded scalar values with tab-indented lines when round-tripping a parsed AST through present(); dump() and loading are unaffected, #780.

[5.2.2] - 2026-07-24

Fixed

• Quote flow scalars where a colon precedes a flow indicator, #773.

Security

• Avoid exponential parsing time for nested flow sequence pairs.

... (truncated)

Commits

• 04db458 5.3.0 released
• 22ce0a0 Changelog update
• fae37b8 fix: << outside a mapping key no longer leaks the internal merge symbol
• b62ef83 fix: validate << sequence items at merge time, so aliased sources are check...
• cc665ec docs: review and update annotations
• 2aa24a6 Changelog update
• eec6902 Restore deprecated parser constant exports
• 03397ac Move throwErrorAt to YAMLException as throwAt
• d9dd2c7 docs: new condensed theme
• 0f898e6 docs: annotation tweaks
• Additional commits viewable in compare view

Updates tsx from 4.22.4 to 4.23.12

Release notes

Sourced from tsx's releases.

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

• shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.11

4.23.11 (2026-08-07)

Bug Fixes

• preserve async ESM require fallback (55cbece)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.10

4.23.10 (2026-08-07)

Bug Fixes

• support nyc coverage discovery (#710) (ec1bcd5)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.9

4.23.9 (2026-08-06)

Bug Fixes

• map Node test locations (2f55884)
• support data URLs in tsImport (b94f46f)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.8

... (truncated)

Commits

• ed9d330 fix: shim import.meta when tokens are split by comments or newlines (#829)
• 651f5be test: cover CommonJS TypeScript import.meta paths
• bd3bc64 test: cover CommonJS loader source fallback
• 55cbece fix: preserve async ESM require fallback
• 6c5ba85 docs: document CommonJS default interop
• ec1bcd5 fix: support nyc coverage discovery (#710)
• b6e5b48 docs: clarify CommonJS default imports
• 2f55884 fix: map Node test locations
• de935d5 docs: document Node source-map stack formatting
• b94f46f fix: support data URLs in tsImport
• Additional commits viewable in compare view

Updates typescript from 6.0.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

Commits

• 1e4744d Merge branch 'main' into ts7-release
• a5a219cmicrosoft/typescript-go#4558
• ecfe30d Update status localization
• 5de25b5 Hide executable name in TypeScript status
• d7ce74a Show bundled TypeScript version for packaged servers
• 29be66a Correct TS 7 release version to 7.0.2
• ed2bd1b Merge branch 'main' into ts7-release
• 8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
• 9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
• d4eaca5microsoft/typescript-go#4549
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Updates ws from 8.21.0 to 8.21.3

Release notes

Sourced from ws's releases.

8.21.3

Bug fixes

• The server now correctly rejects permessage-deflate offers if the incoming client_max_window_bits parameter value is smaller than its configured clientMaxWindowBits (e97a20ea).

8.21.2

Bug fixes

• Fixed a test for CITGM (2eb3be0b).

8.21.1

Bug fixes

• Empty fragments are now counted toward the limit (a2f4e7c0).
• The default values of the maxBufferedChunks and maxFragments options have been reduced (f197ac65).

Commits

• c791e70 [dist] 8.21.3
• e97a20e [fix] Reject offers with client_max_window_bits below config
• 787ebf2 [dist] 8.21.2
• b4d62eb Revert "[ci] Trust Coveralls Homebrew tap"
• e4bb883 [security] Use GitHub PVR as main reporting channel
• 2eb3be0 [test] Skip test on Node.js versions where it does not apply
• ae1de54 [dist] 8.21.1
• 8e9511b [ci] Trust Coveralls Homebrew tap
• f197ac6 [fix] Lower default values of maxBufferedChunks and maxFragments
• 8df8265 [ci] Update actions/checkout action to v7
• Additional commits viewable in compare view

Updates marked from 18.0.5 to 18.0.10

Release notes

Sourced from marked's releases.

v18.0.10

18.0.10 (2026-08-18)

Bug Fixes

• keep the em/strong mask the same length as the source (#4044) (681373c)
• parse EOF backtick fences after paragraphs (#4039) (81bd750)
• place task checkboxes after list loose is finalized (#4046) (b8cf7dc), closes #4045

v18.0.9

18.0.9 (2026-08-04)

Bug Fixes

• an unmatched strong run before emphasis stays literal (#4008) (e8544e6)
• Fix spurious deeper nesting in a blockquote continuation (#4030) (452f1ed)
• pedantic foo: and "word" emphasis parsing (#3999) (823093f)

v18.0.8

18.0.8 (2026-08-04)

Bug Fixes

• fall back to default checkbox renderer when extension returns false (#4023) (e1b6139)

v18.0.7

18.0.7 (2026-07-21)

Bug Fixes

• Avoid O(n^2) backtracking in HTML block close and tilde interrupt regexes (#4014) (f945fc5), closes #3991
• Avoid O(n^2) masked source rebuild in inline tokenizer (#4017) (9154f8f)
• keep empty list after blockquote as a sibling block (#4004) (3f144a0)
• preserve code spans adjacent to tildes (#4012) (0de7188)
• Recognize setext headings whose first line starts with # (#4015) (f056437), closes #1
• treat a line of only tabs as a blank line between paragraphs (#4007) (bc2f121)

v18.0.6

18.0.6 (2026-07-09)

Bug Fixes

• Avoid O(n^2) backtracking in inline link href regex (#4013) (a009808)
• Fix ordered lists after blockquotes (#4003) (33928d0)
• keep trailing text on HTML block close line for PI, declarations, and CDATA (#3991) (bbb84c8)

Commits

• 8698d35 chore(release): 18.0.10 [skip ci]
• 58367a5 chore(deps-dev): bump eslint from 10.8.0 to 10.8.1 (#4055)
• a426c4d chore(deps-dev): bump esbuild from 0.28.1 to 0.28.2 (#4056)
• a5cf277 chore(deps-dev): bump highlight.js from 11.11.1 to 11.12.0 (#4057)
• ca00e95 docs: replace nonexistent test:all script with npm test (#4054)
• b8cf7dc fix: place task checkboxes after list loose is finalized (#4046)
• 9552b6b chore(deps-dev): bump semantic-release from 25.0.8 to 25.0.9 (#4049)
• 681373c fix: keep the em/strong mask the same length as the source (#4044)
• 81bd750 fix: parse EOF backtick fences after paragraphs (#4039)
• 2e21cd3 docs: move theme button to menu (#4043)
• Additional commits viewable in compare view