Skip to content

chore(deps): Bump the npm-minor-patch group across 1 directory with 13 updates - #170

Open
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-dd2694f5e7
Open

chore(deps): Bump the npm-minor-patch group across 1 directory with 13 updates#170
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-dd2694f5e7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-minor-patch group with 13 updates in the / directory:

Package From To
@biomejs/biome 2.5.6 2.5.12
publint 0.3.22 0.3.24
vitest 4.1.10 4.1.11
@types/node 26.1.2 26.4.1
tsx 4.23.1 4.23.13
hono 4.12.32 4.13.7
@axe-core/playwright 4.12.1 4.13.0
@cloudflare/workers-types 5.20260708.1 5.20260904.1
axe-core 4.12.1 4.13.0
playwright 1.61.1 1.62.1
smol-toml 1.7.1 1.8.0
wrangler 4.114.0 4.129.0
@cloudflare/vitest-pool-workers 0.18.8 0.22.0

Updates @biomejs/biome from 2.5.6 to 2.5.12

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.12

2.5.12

Patch Changes

  • #11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute expressions rejecting TypeScript and JSX syntax that is accepted in text expressions.

    <Component icon={<Icon />} count={total as number} onSelect={(e: Event) => e} />

  • #11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute names being split on : and . inside an expression, such as {x && <button x-on:keyup.enter={go} client:load.foo />}.

  • #11440 b88f1ea Thanks @​Princesseuh! - Fixed a bare > in the children of an Astro expression being treated as markup, such as {x && <div>a > b</div>}.

  • #11440 b88f1ea Thanks @​Princesseuh! - Fixed HTML comments inside an Astro expression failing to parse. They are now read as trivia, wherever they appear among the children.

    {x && <div><!-- first -->text<!-- last --></div>}
{cond && <a></a><!-- c --><b></b>}

  • #11440 b88f1ea Thanks @​Princesseuh! - Fixed is:raw children inside an Astro expression being read as JSX, such as {x && <div is:raw>{not js} < & text</div>}.

  • #11440 b88f1ea Thanks @​Princesseuh! - Fixed an apostrophe or quote in the text of a JSX element inside an Astro expression ending the expression early, such as {items.map((i) => <li>it's {i}</li>)}.

  • #11440 b88f1ea Thanks @​Princesseuh! - Fixed the children of a <script> or <style> inside an Astro expression being read as JSX. Their contents are text, so braces and comparisons no longer have to be escaped.

    {cond && <style>a { color: red }</style>}
{cond && <script>let x = {a: 1};</script>}

  • #11440 b88f1ea Thanks @​Princesseuh! - Added support for template literal attribute values inside an Astro expression, such as {x && <C data-x=`t${x}` />}.

  • #11440 b88f1ea Thanks @​Princesseuh! - Fixed unquoted attribute values being rejected inside an Astro expression, such as {x && <a class=foo maxlength=255 href=/about>go</a>}.

  • #11440 b88f1ea Thanks @​Princesseuh! - Fixed a template literal nested inside ${} breaking the rest of an Astro file, such as const href = `/blog${page === 0 ? '' : `/${page + 1}`}`;.

  • #11440 b88f1ea Thanks @​Princesseuh! - Fixed a quote inside a regex character class breaking the rest of an Astro file, such as const unsafe = /[/"]/;.

  • #11508 54f3a2e Thanks @​dyc3! - Added the nursery rule useFlatMathMinMax. Because Math.min() and Math.max() accept any number of arguments, the rule reports unnecessary nested calls to the same method:

    Math.max(Math.max(a, b), c);

    The fix flattens this expression to Math.max(a, b, c).

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.12

Patch Changes

  • #11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute expressions rejecting TypeScript and JSX syntax that is accepted in text expressions.

    <Component icon={<Icon />} count={total as number} onSelect={(e: Event) => e} />

  • #11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute names being split on : and . inside an expression, such as {x && <button x-on:keyup.enter={go} client:load.foo />}.

  • #11440 b88f1ea Thanks @​Princesseuh! - Fixed a bare > in the children of an Astro expression being treated as markup, such as {x && <div>a > b</div>}.

  • #11440 b88f1ea Thanks @​Princesseuh! - Fixed HTML comments inside an Astro expression failing to parse. They are now read as trivia, wherever they appear among the children.

    {x && <div><!-- first -->text<!-- last --></div>}
{cond && <a></a><!-- c --><b></b>}

  • #11440 b88f1ea Thanks @​Princesseuh! - Fixed is:raw children inside an Astro expression being read as JSX, such as {x && <div is:raw>{not js} < & text</div>}.

  • #11440 b88f1ea Thanks @​Princesseuh! - Fixed an apostrophe or quote in the text of a JSX element inside an Astro expression ending the expression early, such as {items.map((i) => <li>it's {i}</li>)}.

  • #11440 b88f1ea Thanks @​Princesseuh! - Fixed the children of a <script> or <style> inside an Astro expression being read as JSX. Their contents are text, so braces and comparisons no longer have to be escaped.

    {cond && <style>a { color: red }</style>}
{cond && <script>let x = {a: 1};</script>}

  • #11440 b88f1ea Thanks @​Princesseuh! - Added support for template literal attribute values inside an Astro expression, such as {x && <C data-x=`t${x}` />}.

  • #11440 b88f1ea Thanks @​Princesseuh! - Fixed unquoted attribute values being rejected inside an Astro expression, such as {x && <a class=foo maxlength=255 href=/about>go</a>}.

  • #11440 b88f1ea Thanks @​Princesseuh! - Fixed a template literal nested inside ${} breaking the rest of an Astro file, such as const href = `/blog${page === 0 ? '' : `/${page + 1}`}`;.

  • #11440 b88f1ea Thanks @​Princesseuh! - Fixed a quote inside a regex character class breaking the rest of an Astro file, such as const unsafe = /[/"]/;.

  • #11508 54f3a2e Thanks @​dyc3! - Added the nursery rule useFlatMathMinMax. Because Math.min() and Math.max() accept any number of arguments, the rule reports unnecessary nested calls to the same method:

    Math.max(Math.max(a, b), c);

    The fix flattens this expression to Math.max(a, b, c).

  • #11585 c5c8315 Thanks @​Netail! - Fixed #11475: noUnresolvedImports no longer reports Bun runtime built-in modules (bun, bun:bundle, bun:ffi, bun:jsc, bun:sqlite, bun:test).

... (truncated)

Commits

Updates publint from 0.3.22 to 0.3.24

Release notes

Sourced from publint's releases.

publint@0.3.24

Patch Changes

  • #257 7c4d25a - Check the repository.url value even when repository.type is omitted. type is optional and defaults to git, so packages using the object form without it were previously skipped for the deprecated-protocol, invalid-git-url, and shorthand-URL checks.

publint@0.3.23

Patch Changes

  • #248 9ff88ac - Recursively detect test files (e.g. *.test.js, *.spec.ts) for the USE_FILES suggestion.

  • #245 ad737a3 - The USE_FILES message now reports which internal files or directories triggered it via args.internalFilePaths

Changelog

Sourced from publint's changelog.

0.3.24

Patch Changes

  • #257 7c4d25a - Check the repository.url value even when repository.type is omitted. type is optional and defaults to git, so packages using the object form without it were previously skipped for the deprecated-protocol, invalid-git-url, and shorthand-URL checks.

0.3.23

Patch Changes

  • #248 9ff88ac - Recursively detect test files (e.g. *.test.js, *.spec.ts) for the USE_FILES suggestion.

  • #245 ad737a3 - The USE_FILES message now reports which internal files or directories triggered it via args.internalFilePaths

Commits

Updates vitest from 4.1.10 to 4.1.11

Release notes

Sourced from vitest's releases.

v4.1.11

   🐞 Bug Fixes

    View changes on GitHub
Commits
  • 9bd8d46 chore: release v4.1.11 (#10995)
  • 9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
  • See full diff in compare view

Updates @types/node from 26.1.2 to 26.4.1

Commits

Updates tsx from 4.23.1 to 4.23.13

Release notes

Sourced from tsx's releases.

v4.23.13

4.23.13 (2026-08-30)

Bug Fixes

  • cache: bound shared transform cache memory (#835) (28e1f12)

This release is also available on:

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

  • shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

This release is also available on:

v4.23.11

4.23.11 (2026-08-07)

Bug Fixes

  • preserve async ESM require fallback (55cbece)

This release is also available on:

v4.23.10

4.23.10 (2026-08-07)

Bug Fixes

This release is also available on:

v4.23.9

4.23.9 (2026-08-06)

... (truncated)

Commits
  • 28e1f12 fix(cache): bound shared transform cache memory (#835)
  • ed9d330 fix: shim import.meta when tokens are split by comments or newlines (#829)
  • 651f5be test: cover CommonJS TypeScript import.meta paths
  • bd3bc64 test: cover CommonJS loader source fallback
  • 55cbece fix: preserve async ESM require fallback
  • 6c5ba85 docs: document CommonJS default interop
  • ec1bcd5 fix: support nyc coverage discovery (#710)
  • b6e5b48 docs: clarify CommonJS default imports
  • 2f55884 fix: map Node test locations
  • de935d5 docs: document Node source-map stack formatting
  • Additional commits viewable in compare view

Updates hono from 4.12.32 to 4.13.7

Release notes

Sourced from hono's releases.

v4.13.7

Security fixes

This release includes a fix for the following security issue:

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

v4.13.6

What's Changed

Full Changelog: honojs/hono@v4.13.5...v4.13.6

v4.13.5

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

v4.13.4

What's Changed

  • fix(request): handle params on unmatched requests in honojs/hono#5268
  • fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in honojs/hono#5264
  • fix(reg-exp-router): associate wildcard middleware with matching routes in honojs/hono#5266
  • perf(router): share null object creation in honojs/hono#5267

... (truncated)

Commits

Updates @axe-core/playwright from 4.12.1 to 4.13.0

Release notes

Sourced from @​axe-core/playwright's releases.

Release 4.13.0

What's Changed

Full Changelog: dequelabs/axe-core-npm@v4.11.3...v4.13.0

Changelog

Sourced from @​axe-core/playwright's changelog.

4.13.0 (2026-08-10)

Features

Commits

Updates @cloudflare/workers-types from 5.20260708.1 to 5.20260904.1

Commits

Updates axe-core from 4.12.1 to 4.13.0

Release notes

Sourced from axe-core's releases.

Release 4.13.0

In summary, this release adds:

  1. Support Element Internals: A modern way for building accessible component libraries Axe-core is the first accessibility tool to support this major new web feature! Thanks to RedHat and Adobe for working with us to figure out the right way forward.

  2. A new Swedish translation, thanks to our a community contribution

  3. A new Finish contribution (not open source), thanks to our Scandinavian partner

  4. 10 False positives closed, including all the critical ones!

  5. And 13 updates to get Axe-core consistent with the latest web standards

This release is one of the bigger changes we've done in a few years, so likely issue numbers are going to change in adopting this version.

Features

  • aria-actions: add aria-actions to allowed ARIA attributes (#5200) (029655d), closes #4584 #5199, references #5215 #5215
  • aria-allowed-attr: flag deprecated ARIA attributes as needs-review (#5246) (518f3cc), closes #3341
  • aria-prohibited-attr: allow many elements to be named and disallow label and body from being named (#5259) (d8b1ea5)
  • aria-roles: add sectionheader and sectionfooter roles (#5238) (c36c109), closes #4734, references #4734
  • aria/get-aria-value: new function to get aria values of a node (#5109) (a7d8f3e), references #5042
  • aria/has-attr-value: new function to check if node has aria value (#5136) (61f2624), references #5109
  • aria: support role=image as equivalent to role=img (#5248) (5aa8aaf), closes #4656, references #5272
  • checks/aria: support ARIA element internals properties (#5172) (9b7f754)
  • checks/label: support ARIA element internals properties (#5170) (21c5f8b)
  • checks/navigation: support ARIA element internals properties (#5167) (2c3a98f)
  • commons/aria: support ARIA element internals properties (#5171) (31f09e7)
  • commons/dom: support ARIA element internals properties (#5163) (f0a12cf)
  • commons/forms: support ARIA element internals properties (#5165) (27a4686)
  • commons/matches/fromPrimative: deprecate in favor of correct spelling (#5270) (31cfb2e)
  • commons/text: support ARIA element internals properties (#5169) (e841a33)
  • commons/text: support form-associated labels via element internals (#5182) (57cfe0a), closes #5045, references #5170 #5039 #5151 #5039
  • dom/getResolvedRefs: new function to get the resolved virtual nodes of idrefs (#5151) (489cdea), references #5109
  • element-internals: enable ElementInternals by default (#5284) (2740d42), closes #5277
  • i18n: Add Swedish locale (#5190) (dcd13f2), references #5189
  • matches: add inSectioningContent, hasChild, and isSummaryForDetails matches (#5262) (c47cdcd)
  • rules: support ARIA element internals properties (#5168) (065baf7)
  • standards/ariaAttrs: add caseInsensitive property for attributes (#5224) (bcd791c)

Bug Fixes

  • aria-allowed-role: allow roles on a non-details summary (#5242) (3bd9875), closes #3911, references #3443 #3911
  • aria-allowed-role: restrict figure roles with child figcaption (#5240) (178a635), closes #3443
  • aria-prohibited-attr: visible aria-labelledby requires review only (#5285) (fd6fa9f)
  • axe.d.ts: make enabled property of RuleMetadata optional (#5129) (90fce18)
  • color-contrast: fix various stacking context bugs (#5214) (d5e5b04), references #8 #5213

... (truncated)

Changelog

Sourced from axe-core's changelog.

4.13.0 (2026-08-05)

Features

  • aria-actions: add aria-actions to allowed ARIA attributes (#5200) (029655d), closes #4584 #5199, references #5215 #5215
  • aria-allowed-attr: flag deprecated ARIA attributes as needs-review (#5246) (518f3cc), closes #3341
  • aria-prohibited-attr: allow many elements to be named and disallow label and body from being named (#5259) (d8b1ea5)
  • aria-roles: add sectionheader and sectionfooter roles (#5238) (c36c109), closes #4734, references #4734
  • aria/get-aria-value: new function to get aria values of a node (#5109) (a7d8f3e), references #5042
  • aria/has-attr-value: new function to check if node has aria value (#5136) (61f2624), references #5109
  • aria: support role=image as equivalent to role=img (#5248) (5aa8aaf), closes #4656, references #5272
  • checks/aria: support ARIA element internals properties (#5172) (9b7f754)
  • checks/label: support ARIA element internals properties (#5170) (21c5f8b)
  • checks/navigation: support ARIA element internals properties (#5167) (2c3a98f)
  • commons/aria: support ARIA element internals properties (#5171) (31f09e7)
  • commons/dom: support ARIA element internals properties (#5163) (f0a12cf)
  • commons/forms: support ARIA element internals properties (#5165) (27a4686)
  • commons/matches/fromPrimative: deprecate in favor of correct spelling (#5270) (31cfb2e)
  • commons/text: support ARIA element internals properties (#5169) (e841a33)
  • commons/text: support form-associated labels via element internals (#5182) (57cfe0a)...

    Description has been truncated

@dependabot
chore(deps): Bump the npm-minor-patch group across 1 directory with 1…
a1ed6c7 
…3 updates

Bumps the npm-minor-patch group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.6` | `2.5.12` |
| [publint](https://github.com/publint/publint/tree/HEAD/packages/publint) | `0.3.22` | `0.3.24` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.10` | `4.1.11` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.2` | `26.4.1` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.1` | `4.23.13` |
| [hono](https://github.com/honojs/hono) | `4.12.32` | `4.13.7` |
| [@axe-core/playwright](https://github.com/dequelabs/axe-core-npm) | `4.12.1` | `4.13.0` |
| [@cloudflare/workers-types](https://github.com/cloudflare/workerd) | `5.20260708.1` | `5.20260904.1` |
| [axe-core](https://github.com/dequelabs/axe-core) | `4.12.1` | `4.13.0` |
| [playwright](https://github.com/microsoft/playwright) | `1.61.1` | `1.62.1` |
| [smol-toml](https://github.com/squirrelchat/smol-toml) | `1.7.1` | `1.8.0` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.114.0` | `4.129.0` |
| [@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers) | `0.18.8` | `0.22.0` |



Updates `@biomejs/biome` from 2.5.6 to 2.5.12
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.12/packages/@biomejs/biome)

Updates `publint` from 0.3.22 to 0.3.24
- [Release notes](https://github.com/publint/publint/releases)
- [Changelog](https://github.com/publint/publint/blob/master/packages/publint/CHANGELOG.md)
- [Commits](https://github.com/publint/publint/commits/publint@0.3.24/packages/publint)

Updates `vitest` from 4.1.10 to 4.1.11
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest)

Updates `@types/node` from 26.1.2 to 26.4.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `tsx` from 4.23.1 to 4.23.13
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.23.1...v4.23.13)

Updates `hono` from 4.12.32 to 4.13.7
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.32...v4.13.7)

Updates `@axe-core/playwright` from 4.12.1 to 4.13.0
- [Release notes](https://github.com/dequelabs/axe-core-npm/releases)
- [Changelog](https://github.com/dequelabs/axe-core-npm/blob/develop/CHANGELOG.md)
- [Commits](https://github.com/dequelabs/axe-core-npm/commits/v4.13.0)

Updates `@cloudflare/workers-types` from 5.20260708.1 to 5.20260904.1
- [Release notes](https://github.com/cloudflare/workerd/releases)
- [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md)
- [Commits](https://github.com/cloudflare/workerd/commits)

Updates `axe-core` from 4.12.1 to 4.13.0
- [Release notes](https://github.com/dequelabs/axe-core/releases)
- [Changelog](https://github.com/dequelabs/axe-core/blob/develop/CHANGELOG.md)
- [Commits](dequelabs/axe-core@v4.12.1...v4.13.0)

Updates `playwright` from 1.61.1 to 1.62.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.61.1...v1.62.1)

Updates `smol-toml` from 1.7.1 to 1.8.0
- [Release notes](https://github.com/squirrelchat/smol-toml/releases)
- [Commits](squirrelchat/smol-toml@v1.7.1...v1.8.0)

Updates `wrangler` from 4.114.0 to 4.129.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.129.0/packages/wrangler)

Updates `@cloudflare/vitest-pool-workers` from 0.18.8 to 0.22.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Changelog](https://github.com/cloudflare/workers-sdk/blob/@cloudflare/vitest-pool-workers@0.22.0/packages/vitest-pool-workers/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vitest-pool-workers@0.22.0/packages/vitest-pool-workers)

---
updated-dependencies:
- dependency-name: "@biomejs/biome"
  dependency-version: 2.5.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: publint
  dependency-version: 0.3.24
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: vitest
  dependency-version: 4.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@types/node"
  dependency-version: 26.4.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: tsx
  dependency-version: 4.23.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: hono
  dependency-version: 4.13.7
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@axe-core/playwright"
  dependency-version: 4.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@cloudflare/workers-types"
  dependency-version: 5.20260904.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: axe-core
  dependency-version: 4.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: playwright
  dependency-version: 1.62.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: smol-toml
  dependency-version: 1.8.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: wrangler
  dependency-version: 4.129.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@cloudflare/vitest-pool-workers"
  dependency-version: 0.22.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 11, 2026
@lukaso-bot lukaso-bot mentioned this pull request Sep 16, 2026
Open
liveapp-bot @claude
fix(deps): override fflate >=0.7.5 and js-yaml ^4.3.2 to clear two Hi…
bd986a9 
…gh advisories

fflate@0.7.4 (GHSA-px8p-9vwx-vf98) and js-yaml@4.3.1 (GHSA-2883-xcg3-v3hh)
were the only failing check on this PR (osv dependency scan). The fflate
override is parent-scoped to @shuding/opentype.js (0.8.0-0.8.2 are also
vulnerable, so the range is capped below 0.8.0). This re-applies the fix
that Dependabot's recreate of #167 dropped.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Sep 16, 2026

Copy link
Copy Markdown
Contributor

Preview deployed

Federated GitLab lookups (freedesktop / GNOME) degrade to the "use the CLI" card — the Anubis relay is off in preview. GitHub lookups, permalinks, and OG render work once INTERNAL_SECRET/GITHUB_TOKEN are set on the preview env.

@lukaso-bot

lukaso-bot commented Sep 16, 2026

Copy link
Copy Markdown
Collaborator

Loop fix-forward on this branch: bd986a9. The only red check was osv dependency scan. It is green now, and all 10 checks pass.

Two High advisories were in the lockfile. Both are also on main:

The change is in pnpm.overrides:

  • added "@shuding/opentype.js>fflate": ">=0.7.5 <0.8.0". It is scoped to the one package that uses fflate. The cap is below 0.8.0 because 0.8.0 to 0.8.2 are also vulnerable.
  • changed "js-yaml@4" from ^4.3.1 to ^4.3.2

The lockfile diff changes only these two packages and the overrides block.

Evidence:

⚠️ This is a commit by the loop on a Dependabot branch. Merging #170 is what puts the fix on main. If Dependabot recreates this branch before the merge, it drops the commit, the osv check fails again, and the loop adds the fix again. That already happened once: #167 lost it on 2026-09-11.

This comment also reports a stuck state. The engine reported this PR as "adoption owed" for 37 cycles. The loop was not running for five of those days (2026-09-10 to 2026-09-16), so nothing was done.

@lukaso-bot

lukaso-bot commented Sep 16, 2026

Copy link
Copy Markdown
Collaborator

liveapp adoption pass @ bd986a9: adopted — all 13 group bumps kept; bd986a9 adds fflate>=0.7.5 (opentype-scoped) + js-yaml ^4.3.2 overrides, osv green, 10/10 checks, OG preview verified

@lukaso-bot lukaso-bot added the user action needed The liveapp engine is blocked on the human — the issue body carries the exact action needed label Sep 16, 2026
@lukaso-bot lukaso-bot mentioned this pull request Sep 16, 2026
Open
@lukaso-bot

lukaso-bot commented Sep 17, 2026

Copy link
Copy Markdown
Collaborator

Deadline: this branch is rewritten tomorrow, Friday 2026-09-18 at ~21:52Z (~24h from now).

Dependabot runs weekly and every run so far has landed at that time (2026-09-04, 2026-09-11). If it
recreates this branch before you merge, bd986a9 goes with it and both High advisories are back:
fflate@0.7.4 (GHSA-px8p-9vwx-vf98) and js-yaml@4.3.1 (GHSA-2883-xcg3-v3hh). That is exactly
what happened to #167 on 2026-09-11.

State right now: 10/10 checks green at bd986a9, MERGEABLE. The "Rebase and merge" button is
blocked by rebase conflicts, but squash and merge-commit are both enabled and work.

One action, before Friday evening: merge #170. It is also the unblock for the rest of the queue —
#144, #158 and #163 each carry a stale-green osv from late August (their runs predate both
advisories), and they go properly green on an "Update branch" click once this is on main.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code user action needed The liveapp engine is blocked on the human — the issue body carries the exact action needed

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@lukaso-bot