Skip to content

[Docs Site] Bump the npm_and_yarn group across 1 directory with 15 updates#56

Open
dependabot[bot] wants to merge 1 commit intoproductionfrom
dependabot/npm_and_yarn/npm_and_yarn-7afc11494f
Open

[Docs Site] Bump the npm_and_yarn group across 1 directory with 15 updates#56
dependabot[bot] wants to merge 1 commit intoproductionfrom
dependabot/npm_and_yarn/npm_and_yarn-7afc11494f

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Jan 1, 2026

Bumps the npm_and_yarn group with 10 updates in the / directory:

Package From To
astro 5.4.1 5.16.6
mermaid 11.5.0 11.10.0
vitest 2.1.6 2.1.9
undici 5.28.5 5.29.0
undici 6.21.1 6.22.0
devalue 4.3.3 5.6.1
axios 1.7.9 1.13.2
cookie 0.5.0 1.1.1
glob 10.4.5 10.5.0
mdast-util-to-hast 13.2.0 13.2.1
qs 6.9.7 6.14.1

Updates astro from 5.4.1 to 5.16.6

Release notes

Sourced from astro's releases.

astro@5.16.6

Patch Changes

  • #14982 6849e38 Thanks @​Princesseuh! - Fixes images outside the project directory not working when using astro:assets in development mode

  • #14987 9dd9fca Thanks @​Princesseuh! - Fixes SVGs not working in dev mode when using the passthrough image service

  • #15014 a178422 Thanks @​delucis! - Adds support for extending the type of the props accepted by Astro’s <Image> component, <Picture> component, and getImage() API.

astro@5.16.5

Patch Changes

  • #14985 c016f10 Thanks @​florian-lefebvre! - Fixes a case where JSDoc annotations wouldn't show for fonts related APIs in the Astro config

  • #14973 ed7cc2f Thanks @​amankumarpandeyin! - Fixes performance regression and OOM errors when building medium-sized blogs with many content entries. Replaced O(n²) object spread pattern with direct mutation in generateLookupMap.

  • #14958 70eb542 Thanks @​ascorbic! - Gives a helpful error message if a user sets output: "hybrid" in their Astro config.

    The option was removed in Astro 5, but lots of content online still references it, and LLMs often suggest it. It's not always clear that the replacement is output: "static", rather than output: "server". This change adds a helpful error message to guide humans and robots.

  • #14901 ef53716 Thanks @​Darknab! - Updates the glob() loader to log a warning when duplicated IDs are detected

  • Updated dependencies [d8305f8]:

    • @​astrojs/markdown-remark@​6.3.10

astro@5.16.4

Patch Changes

  • #14940 2cf79c2 Thanks @​ematipico! - Fixes a bug where Astro didn't properly combine CSP resources from the csp configuration with those added using the runtime API (Astro.csp.insertDirective()) to form grammatically correct CSP headers

    Now Astro correctly deduplicate CSP resources. For example, if you have a global resource in the configuration file, and then you add a a new one using the runtime APIs.

astro@5.16.3

Patch Changes

  • #14889 4bceeb0 Thanks @​florian-lefebvre! - Fixes actions types when using specific TypeScript configurations

  • #14929 e0f277d Thanks @​matthewp! - Fixes authentication bypass via double URL encoding in middleware

    Prevents attackers from bypassing path-based authentication checks using multi-level URL encoding (e.g., /%2561dmin instead of /%61dmin). Pathnames are now validated after decoding to ensure no additional encoding remains.

astro@5.16.2

Patch Changes

astro@5.16.1

... (truncated)

Changelog

Sourced from astro's changelog.

5.16.6

Patch Changes

  • #14982 6849e38 Thanks @​Princesseuh! - Fixes images outside the project directory not working when using astro:assets in development mode

  • #14987 9dd9fca Thanks @​Princesseuh! - Fixes SVGs not working in dev mode when using the passthrough image service

  • #15014 a178422 Thanks @​delucis! - Adds support for extending the type of the props accepted by Astro’s <Image> component, <Picture> component, and getImage() API.

5.16.5

Patch Changes

  • #14985 c016f10 Thanks @​florian-lefebvre! - Fixes a case where JSDoc annotations wouldn't show for fonts related APIs in the Astro config

  • #14973 ed7cc2f Thanks @​amankumarpandeyin! - Fixes performance regression and OOM errors when building medium-sized blogs with many content entries. Replaced O(n²) object spread pattern with direct mutation in generateLookupMap.

  • #14958 70eb542 Thanks @​ascorbic! - Gives a helpful error message if a user sets output: "hybrid" in their Astro config.

    The option was removed in Astro 5, but lots of content online still references it, and LLMs often suggest it. It's not always clear that the replacement is output: "static", rather than output: "server". This change adds a helpful error message to guide humans and robots.

  • #14901 ef53716 Thanks @​Darknab! - Updates the glob() loader to log a warning when duplicated IDs are detected

  • Updated dependencies [d8305f8]:

    • @​astrojs/markdown-remark@​6.3.10

5.16.4

Patch Changes

  • #14940 2cf79c2 Thanks @​ematipico! - Fixes a bug where Astro didn't properly combine CSP resources from the csp configuration with those added using the runtime API (Astro.csp.insertDirective()) to form grammatically correct CSP headers

    Now Astro correctly deduplicate CSP resources. For example, if you have a global resource in the configuration file, and then you add a a new one using the runtime APIs.

5.16.3

Patch Changes

  • #14889 4bceeb0 Thanks @​florian-lefebvre! - Fixes actions types when using specific TypeScript configurations

  • #14929 e0f277d Thanks @​matthewp! - Fixes authentication bypass via double URL encoding in middleware

    Prevents attackers from bypassing path-based authentication checks using multi-level URL encoding (e.g., /%2561dmin instead of /%61dmin). Pathnames are now validated after decoding to ensure no additional encoding remains.

5.16.2

Patch Changes

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for astro since your current version.


Updates mermaid from 11.5.0 to 11.10.0

Release notes

Sourced from mermaid's releases.

mermaid@11.10.0

Minor Changes

Patch Changes

... (truncated)

Commits
  • 96778f7 Merge pull request #6880 from mermaid-js/changeset-release/master
  • d4c058b Version Packages
  • b638a0a temp: Remove peerDeps from examples
  • fd9aa36 chore: Update peerDependencies for examples
  • 46a9f1b temp: Disable cspell check as it's blocking release
  • 83c6224 Merge pull request #6878 from mermaid-js/develop
  • d8161b1 fix: move fourcube to contributor
  • 8223141 chore: add fourcube to cspell
  • 99f98a6 Merge pull request #6877 from mermaid-js/update-timings
  • ef28f54 chore: update E2E timings
  • Additional commits viewable in compare view

Updates vitest from 2.1.6 to 2.1.9

Release notes

Sourced from vitest's releases.

v2.1.9

This release includes security patches for:

   🐞 Bug Fixes

    View changes on GitHub

v2.1.8

   🐞 Bug Fixes

    View changes on GitHub

v2.1.7

   🐞 Bug Fixes

  • Revert support for Vite 6  -  by @​sheremet-va (fbe5c)
    • This introduced some breaking changes (vitest-dev/vitest#6992). We will enable support for it later. In the meantime, you can still use pnpm.overrides or yarn resolutions to override the vite version in the vitest package - the APIs are compatible.
    View changes on GitHub
Commits

Updates undici from 5.28.5 to 5.29.0

Release notes

Sourced from undici's releases.

v5.29.0

What's Changed

Full Changelog: nodejs/undici@v5.28.5...v5.29.0

Commits

Updates undici from 6.21.1 to 6.22.0

Release notes

Sourced from undici's releases.

v5.29.0

What's Changed

Full Changelog: nodejs/undici@v5.28.5...v5.29.0

Commits

Updates devalue from 4.3.3 to 5.6.1

Release notes

Sourced from devalue's releases.

v5.6.1

Patch Changes

  • 2161d44: fix: add hasOwn check before calling reviver

v5.6.0

Minor Changes

  • a3d09d4: feat: expose DevalueError for instanceof checks in catch clauses
  • a3d09d4: feat: add value and root properties in DevalueError instances

v5.5.0

Minor Changes

  • 828fa1c: Enable support for custom reducer/reviver for "function" values

v5.4.2

Patch Changes

  • 5c26c0d: fix: allow custom revivers to revive things serialized by builtin reducers

v5.4.1

Patch Changes

  • ca3c7b6: chore: Remove impossible void type from replacer's uneval

v5.4.0

Minor Changes

  • 9306d09: feat: pass uneval to replacer, for handling nested custom types

Patch Changes

  • b617c7c: perf: shrink uneval output with null-proto objects

v5.3.2

Patch Changes

  • 0623a47: fix: disallow array method access when parsing
  • 0623a47: fix: disallow __proto__ properties on objects

v5.3.1

Patch Changes

  • ae904c5: fix: correctly differentiate between +0 and -0

v5.3.0

Minor Changes

  • 2896e7b: feat: support Temporal

... (truncated)

Changelog

Sourced from devalue's changelog.

5.6.1

Patch Changes

  • 2161d44: fix: add hasOwn check before calling reviver

5.6.0

Minor Changes

  • a3d09d4: feat: expose DevalueError for instanceof checks in catch clauses
  • a3d09d4: feat: add value and root properties in DevalueError instances

5.5.0

Minor Changes

  • 828fa1c: Enable support for custom reducer/reviver for "function" values

5.4.2

Patch Changes

  • 5c26c0d: fix: allow custom revivers to revive things serialized by builtin reducers

5.4.1

Patch Changes

  • ca3c7b6: chore: Remove impossible void type from replacer's uneval

5.4.0

Minor Changes

  • 9306d09: feat: pass uneval to replacer, for handling nested custom types

Patch Changes

  • b617c7c: perf: shrink uneval output with null-proto objects

5.3.2

Patch Changes

  • 0623a47: fix: disallow array method access when parsing
  • 0623a47: fix: disallow __proto__ properties on objects

5.3.1

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for devalue since your current version.


Updates esbuild from 0.24.2 to 0.21.5

Changelog

Sourced from esbuild's changelog.

0.24.2

  • Fix regression with --define and import.meta (#4010, #4012, #4013)

    The previous change in version 0.24.1 to use a more expression-like parser for define values to allow quoted property names introduced a regression that removed the ability to use --define:import.meta=.... Even though import is normally a keyword that can't be used as an identifier, ES modules special-case the import.meta expression to behave like an identifier anyway. This change fixes the regression.

    This fix was contributed by @​sapphi-red.

0.24.1

  • Allow es2024 as a target in tsconfig.json (#4004)

    TypeScript recently added es2024 as a compilation target, so esbuild now supports this in the target field of tsconfig.json files, such as in the following configuration file:

    {
  "compilerOptions": {
    "target": "ES2024"
  }
}

    As a reminder, the only thing that esbuild uses this field for is determining whether or not to use legacy TypeScript behavior for class fields. You can read more in the documentation.

    This fix was contributed by @​billyjanitsch.

  • Allow automatic semicolon insertion after get/set

    This change fixes a grammar bug in the parser that incorrectly treated the following code as a syntax error:

    class Foo {
  get
  *x() {}
  set
  *y() {}
}

    The above code will be considered valid starting with this release. This change to esbuild follows a similar change to TypeScript which will allow this syntax starting with TypeScript 5.7.

  • Allow quoted property names in --define and --pure (#4008)

    The define and pure API options now accept identifier expressions containing quoted property names. Previously all identifiers in the identifier expression had to be bare identifiers. This change now makes --define and --pure consistent with --global-name, which already supported quoted property names. For example, the following is now possible:

    // The following code now transforms to "return true;\n"
console.log(esbuild.transformSync(
  `return process.env['SOME-TEST-VAR']`,
  { define: { 'process.env["SOME-TEST-VAR"]': 'true' } },

... (truncated)

Commits
  • fc37c2f publish 0.21.5 to npm
  • cb11924 fix Symbol.metadata errors in decorator tests
  • b93a2a9 fix #3781: add metadata to all decorated classes
  • 953dae9 fix #3797: import attributes and glob-style import
  • 98cb2ed fix #3782: support ${configDir} in tsconfig.json
  • 8e6603b run make update-compat-table
  • db1b8ca fix #3792: import attributes and the copy loader
  • de572d0 fix non-deterministic import attribute plugin test
  • ae8d1b4 fix #3794: --supported:object-accessors=false
  • 67cbf87 publish 0.21.4 to npm
  • Additional commits viewable in compare view

Updates axios from 1.7.9 to 1.13.2

Release notes

Sourced from axios's releases.

Release v1.13.2

Release notes:

Bug Fixes

  • http: fix 'socket hang up' bug for keep-alive requests when using timeouts; (#7206) (8d37233)
  • http: use default export for http2 module to support stubs; (#7196) (0588880)

Performance Improvements

Contributors to this release

Release v1.13.1

Release notes:

Bug Fixes

  • http: fixed a regression that caused the data stream to be interrupted for responses with non-OK HTTP statuses; (#7193) (bcd5581)

Contributors to this release

Release v1.13.0

Release notes:

Bug Fixes

  • fetch: prevent TypeError when config.env is undefined (#7155) (015faec)
  • resolve issue #7131 (added spacing in mergeConfig.js) (#7133) (9b9ec98)

Features

Contributors to this release

... (truncated)

Changelog

Sourced from axios's changelog.

1.13.2 (2025-11-04)

Bug Fixes

  • http: fix 'socket hang up' bug for keep-alive requests when using timeouts; (#7206) (8d37233)
  • http: use default export for http2 module to support stubs; (#7196) (0588880)

Performance Improvements

Contributors to this release

1.13.1 (2025-10-28)

Bug Fixes

  • http: fixed a regression that caused the data stream to be interrupted for responses with non-OK HTTP statuses; (#7193) (bcd5581)

Contributors to this release

1.13.0 (2025-10-27)

Bug Fixes

  • fetch: prevent TypeError when config.env is undefined (#7155) (015faec)
  • resolve issue #7131 (added spacing in mergeConfig.js) (#7133) (9b9ec98)

Features

Contributors to this release

... (truncated)

Commits
  • 08b84b5 chore(release): v1.13.2 (#7207)
  • 8d37233 fix(http): fix 'socket hang up' bug for keep-alive requests when using timeou...
  • 12c314b perf(http): fix early loop exit; (#7202)
  • f6d79e7 chore(sponsor): update sponsor block (#7203)
  • 0588880 fix(http): use default export for http2 module to support stubs; (#7196)
  • 1ef8e72 chore(release): v1.13.1 (#7194)
  • bcd5581 fix(http): fixed a regression that caused the data stream to be interrupted f...
  • c9b3371 chore: enhance styling and responsiveness in client.html (#7173)
  • 9ead04d [Release] v1.13.0 (#7189)
  • d000fbf fix(http2): fix possible race condition when handling http2 stream on almost ...
  • Additional commits viewable in compare view

Updates cookie from 0.5.0 to 1.1.1

Release notes

Sourced from cookie's releases.

v1.1.1

Fixed

  • Overwrite value in passed in options (#253) c66147c
    • When value was provided in serialize(key, value, { value }) the value in options was used instead of the value passed as an argument

jshttp/cookie@v1.1.0...v1.1.1

v1.1.0

Added:

  • Add stringifyCookie and parseSetCookie methods (#244, #214)
  • Rename existing methods for clarity (old method names remain for backward compatibility)
    • parse → parseCookie
    • serialize → stringifySetCookie
  • Add side effects field (#245) 00b0327

jshttp/cookie@v1.0.2...v1.1.0

v1.0.2

Fixed

  • Loosen cookie name/value validation (#210)
  • fix: options.priority used incorrect fallback (#207) by @​jonchurch

Added

jshttp/cookie@v1.0.1...v1.0.2

v1.0.1

Added

jshttp/cookie@v1.0.0...v1.0.1

v1.0.0

Breaking changes

  • Use modern JS features, ship TypeScript definition (#175) 1cc64ff
    • Adds __esModule marker, imports need to use import { parse, serialize } or import * as cookie
  • Minimum node.js v18
  • Uses null prototype object for parse return value
  • Changes strict and priority to match the lower case strings (i.e. low, not LOW or Low)

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by blakeembrey, a new releaser for cookie since your current version.


Updates form-data from 4.0.1 to 4.0.5

Release notes

Sourced from form-data's releases.

v4.0.4

v4.0.4 - 2025-07-16

Commits

  • [meta] add auto-changelog 811f682
  • [Tests] handle predict-v8-randomness failures in node < 17 and node > 23 1d11a76
  • [Fix] Switch to using crypto random for boundary value...

    Description has been truncated

@dependabot
[Docs Site] Bump the npm_and_yarn group across 1 directory with 15 up…
da0dd54 
…dates

Bumps the npm_and_yarn group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `5.4.1` | `5.16.6` |
| [mermaid](https://github.com/mermaid-js/mermaid) | `11.5.0` | `11.10.0` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `2.1.6` | `2.1.9` |
| [undici](https://github.com/nodejs/undici) | `5.28.5` | `5.29.0` |
| [undici](https://github.com/nodejs/undici) | `6.21.1` | `6.22.0` |
| [devalue](https://github.com/sveltejs/devalue) | `4.3.3` | `5.6.1` |
| [axios](https://github.com/axios/axios) | `1.7.9` | `1.13.2` |
| [cookie](https://github.com/jshttp/cookie) | `0.5.0` | `1.1.1` |
| [glob](https://github.com/isaacs/node-glob) | `10.4.5` | `10.5.0` |
| [mdast-util-to-hast](https://github.com/syntax-tree/mdast-util-to-hast) | `13.2.0` | `13.2.1` |
| [qs](https://github.com/ljharb/qs) | `6.9.7` | `6.14.1` |



Updates `astro` from 5.4.1 to 5.16.6
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@5.16.6/packages/astro)

Updates `mermaid` from 11.5.0 to 11.10.0
- [Release notes](https://github.com/mermaid-js/mermaid/releases)
- [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.5.0...mermaid@11.10.0)

Updates `vitest` from 2.1.6 to 2.1.9
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v2.1.9/packages/vitest)

Updates `undici` from 5.28.5 to 5.29.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v5.28.5...v5.29.0)

Updates `undici` from 6.21.1 to 6.22.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v5.28.5...v5.29.0)

Updates `devalue` from 4.3.3 to 5.6.1
- [Release notes](https://github.com/sveltejs/devalue/releases)
- [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md)
- [Commits](sveltejs/devalue@v4.3.3...v5.6.1)

Updates `esbuild` from 0.24.2 to 0.21.5
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md)
- [Commits](evanw/esbuild@v0.24.2...v0.21.5)

Updates `axios` from 1.7.9 to 1.13.2
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.7.9...v1.13.2)

Updates `cookie` from 0.5.0 to 1.1.1
- [Release notes](https://github.com/jshttp/cookie/releases)
- [Commits](jshttp/cookie@v0.5.0...v1.1.1)

Updates `form-data` from 4.0.1 to 4.0.5
- [Release notes](https://github.com/form-data/form-data/releases)
- [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md)
- [Commits](form-data/form-data@v4.0.1...v4.0.5)

Updates `glob` from 10.4.5 to 10.5.0
- [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md)
- [Commits](isaacs/node-glob@v10.4.5...v10.5.0)

Updates `js-yaml` from 3.14.1 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.14.1...4.1.1)

Updates `mdast-util-to-hast` from 13.2.0 to 13.2.1
- [Release notes](https://github.com/syntax-tree/mdast-util-to-hast/releases)
- [Commits](syntax-tree/mdast-util-to-hast@13.2.0...13.2.1)

Updates `prismjs` from 1.29.0 to 1.30.0
- [Release notes](https://github.com/PrismJS/prism/releases)
- [Changelog](https://github.com/PrismJS/prism/blob/v2/CHANGELOG.md)
- [Commits](PrismJS/prism@v1.29.0...v1.30.0)

Updates `qs` from 6.9.7 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.9.7...v6.14.1)

Updates `vite` from 6.2.0 to 5.4.21
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v5.4.21/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v5.4.21/packages/vite)

---
updated-dependencies:
- dependency-name: astro
  dependency-version: 5.16.6
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: mermaid
  dependency-version: 11.10.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: vitest
  dependency-version: 2.1.9
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 5.29.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 6.22.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: devalue
  dependency-version: 5.6.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-version: 0.21.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 1.13.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: cookie
  dependency-version: 1.1.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: form-data
  dependency-version: 4.0.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: glob
  dependency-version: 10.5.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.1.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: mdast-util-to-hast
  dependency-version: 13.2.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: prismjs
  dependency-version: 1.30.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.14.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 5.4.21
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jan 1, 2026
@dependabot @github
Copy link
Author

dependabot bot commented on behalf of github Jan 1, 2026

Assignees

The following users could not be added as assignees: KianNH. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jan 1, 2026
@socket-security
Copy link

socket-security bot commented Jan 1, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatednpm/​esbuild@​0.24.2 ⏵ 0.14.3992 +1997393100
Updatednpm/​esbuild@​0.24.2 ⏵ 0.27.092 +1100 +273 +193100
Updatednpm/​@​cloudflare/​vitest-pool-workers@​0.8.2 ⏵ 0.8.7199 +110078 +3100100
Addednpm/​@​actions/​github@​5.0.39810010086100
Updatednpm/​astro@​5.4.1 ⏵ 5.16.697100 +2688 +196 -1100
Addednpm/​@​actions/​core@​1.9.19910010092100

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants