Skip to content

build(deps): bump the npm-dependencies group across 1 directory with 16 updates#531

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-6ed7292111
Open

build(deps): bump the npm-dependencies group across 1 directory with 16 updates#531
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-6ed7292111

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 19, 2026 •
edited
Loading

Bumps the npm-dependencies group with 16 updates in the / directory:

Package From To
@cyclonedx/cyclonedx-library 6.13.1 10.0.0
fast-xml-parser 5.7.0 5.8.0
https-proxy-agent 7.0.6 9.0.0
p-limit 4.0.0 7.3.0
packageurl-js 1.0.2 2.0.1
web-tree-sitter 0.26.8 0.26.9
@types/node 20.19.31 25.9.1
chai 4.5.0 6.2.2
eslint 8.57.1 10.4.0
esmock 2.7.3 2.7.5
mocha 10.8.2 11.7.6
msw 2.12.7 2.14.6
sinon 15.2.0 22.0.0
sinon-chai 3.7.0 4.0.1
typescript 5.9.3 6.0.3
which 5.0.0 7.0.0

Updates @cyclonedx/cyclonedx-library from 6.13.1 to 10.0.0

Release notes

Sourced from @​cyclonedx/cyclonedx-library's releases.

10.0.0

BREAKING changes

  • Removed deprecated symbols
  • Removed PackageUrl factories
  • No longer use external standards' implementations directly

Removed

  • Entrypoint Builders (via #1377)
  • Entrypoint Factories (via #1377)
  • Entrypoint Utils (via #1377)
  • Entrypoint Contrib/PackageUrl (via #1378)
  • Deprecated symbol Builders (#1346 via #1377)
  • Deprecated symbol Builders.FromNodePackageJson (#1346 via #1377)
  • Deprecated symbol Builders.FromNodePackageJson.ToolBuilder (#1346 via #1377)
    Use Contrib.FromNodePackageJson.Builders.ToolBuilder instead.
  • Deprecated symbol Builders.FromNodePackageJson.ComponentBuilder (#1346 via #1377)
    Use Contrib.FromNodePackageJson.Builders.ComponentBuilder instead.
  • Deprecated symbol Factories (#1346 via #1377)
  • Deprecated symbol Factories.FromNodePackageJson (#1346 via #1377)
  • Deprecated symbol Factories.FromNodePackageJson.ExternalReferenceFactory (#1346 via #1377)
    Use Contrib.FromNodePackageJson.Factories.ExternalReferenceFactory instead.
  • Deprecated symbol Factories.FromNodePackageJson.PackageUrlFactory (#1346 via #1377)
    Use packageurl-js downstream.
  • Deprecated symbol Factories.LicenseFactory (#1346, #1348 via #1377, #1378)
    Use Contrib.License.Factories.LicenseFactory instead.
  • Deprecated symbol Factories.PackageUrlFactory (#1346 via #1377)
    Use packageurl-js downstream.
  • Deprecated symbol Types.NodePackageJson (#1346, #1348 via #1377, #1378)
    Use Contrib.FromNodePackageJson.Types.NodePackageJson instead.
  • Deprecated symbol Types.assertNodePackageJson (#1346 via #1377)
    Use Contrib.FromNodePackageJson.Types.assertNodePackageJson instead.
  • Deprecated symbol Types.isNodePackageJson (#1346 via #1377)
    Use Contrib.FromNodePackageJson.Types.isNodePackageJson instead.
  • Deprecated symbol Utils (#1346 via #1377)
  • Deprecated symbol Utils.BomUtility (#1346 via #1377)
  • Deprecated symbol Utils.BomUtility.randomSerialNumber (#1346 via #1377)
    Use Contrib.Bom.Utils.randomSerialNumber instead.
  • Deprecated symbol Utils.LicenseUtility (#1346 via #1377)
  • Deprecated symbol Utils.LicenseUtility.FsUtils (#1346 via #1377)
    Use Contrib.License.Utils.FsUtils instead.
  • Deprecated symbol Utils.LicenseUtility.PathUtils (#1346 via #1377)
  • Use Contrib.License.Utils.PathUtils instead.
  • Deprecated symbol Utils.LicenseUtility.FileAttachment (#1346 via #1377)
    Use Contrib.License.Utils.FileAttachment instead.
  • Deprecated symbol Utils.LicenseUtility.ErrorReporter (#1346 via #1377)
    Use Contrib.License.Utils.ErrorReporter instead.
  • Deprecated symbol Utils.LicenseUtility.LicenseEvidenceGatherer (#1346 via #1377)
    Use Contrib.License.Utils.LicenseEvidenceGatherer instead.
  • Deprecated symbol Utils.NpmjsUtility (#1346 via #1377)
  • Deprecated symbol Utils.NpmjsUtility.parsePackageIntegrity (#1346 via #1377)
    Use Contrib.FromNodePackageJson.Utils.parsePackageIntegrity instead.

... (truncated)

Changelog

Sourced from @​cyclonedx/cyclonedx-library's changelog.

10.0.0 -- 2026-03-03

  • BREAKING changes
    • Removed deprecated symbols
    • Removed PackageUrl factories
    • No longer use external standards' implementations directly
  • Removed
    • Entrypoint Builders (via #1377)
    • Entrypoint Factories (via #1377)
    • Entrypoint Utils (via #1377)
    • Entrypoint Contrib/PackageUrl (via #1378)
    • Deprecated symbol Builders (#1346 via #1377)
    • Deprecated symbol Builders.FromNodePackageJson (#1346 via #1377)
    • Deprecated symbol Builders.FromNodePackageJson.ToolBuilder (#1346 via #1377)
      Use Contrib.FromNodePackageJson.Builders.ToolBuilder instead.
    • Deprecated symbol Builders.FromNodePackageJson.ComponentBuilder (#1346 via #1377)
      Use Contrib.FromNodePackageJson.Builders.ComponentBuilder instead.
    • Deprecated symbol Factories (#1346 via #1377)
    • Deprecated symbol Factories.FromNodePackageJson (#1346 via #1377)
    • Deprecated symbol Factories.FromNodePackageJson.ExternalReferenceFactory (#1346 via #1377)
      Use Contrib.FromNodePackageJson.Factories.ExternalReferenceFactory instead.
    • Deprecated symbol Factories.FromNodePackageJson.PackageUrlFactory (#1346 via #1377)
      Use packageurl-js downstream.
    • Deprecated symbol Factories.LicenseFactory (#1346, #1348 via #1377, #1378)
      Use Contrib.License.Factories.LicenseFactory instead.
    • Deprecated symbol Factories.PackageUrlFactory (#1346 via #1377)
      Use packageurl-js downstream.
    • Deprecated symbol Types.NodePackageJson (#1346, #1348 via #1377, #1378)
      Use Contrib.FromNodePackageJson.Types.NodePackageJson instead.
    • Deprecated symbol Types.assertNodePackageJson (#1346 via #1377)
      Use Contrib.FromNodePackageJson.Types.assertNodePackageJson instead.
    • Deprecated symbol Types.isNodePackageJson (#1346 via #1377)
      Use Contrib.FromNodePackageJson.Types.isNodePackageJson instead.
    • Deprecated symbol Utils (#1346 via #1377)
    • Deprecated symbol Utils.BomUtility (#1346 via #1377)
    • Deprecated symbol Utils.BomUtility.randomSerialNumber (#1346 via #1377)
      Use Contrib.Bom.Utils.randomSerialNumber instead.
    • Deprecated symbol Utils.LicenseUtility (#1346 via #1377)
    • Deprecated symbol Utils.LicenseUtility.FsUtils (#1346 via #1377)
      Use Contrib.License.Utils.FsUtils instead.
    • Deprecated symbol Utils.LicenseUtility.PathUtils (#1346 via #1377)
    • Use Contrib.License.Utils.PathUtils instead.
    • Deprecated symbol Utils.LicenseUtility.FileAttachment (#1346 via #1377)
      Use Contrib.License.Utils.FileAttachment instead.
    • Deprecated symbol Utils.LicenseUtility.ErrorReporter (#1346 via #1377)
      Use Contrib.License.Utils.ErrorReporter instead.
    • Deprecated symbol Utils.LicenseUtility.LicenseEvidenceGatherer (#1346 via #1377)
      Use Contrib.License.Utils.LicenseEvidenceGatherer instead.
    • Deprecated symbol Utils.NpmjsUtility (#1346 via #1377)
    • Deprecated symbol Utils.NpmjsUtility.parsePackageIntegrity (#1346 via #1377)

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​cyclonedx/cyclonedx-library since your current version.


Updates fast-xml-parser from 5.7.0 to 5.8.0

Release notes

Sourced from fast-xml-parser's releases.

update strnum, FXB. Use xml-naming for DOCTYPE

  • integrate xml-naming to validate DOCTYPE entity name and notation name (using qname because of backward compatibility)
    • This will consider xml-version as well. '1.0' is default
  • update strnum to 2.3.0
    • You can set octal and binary parsing which is by deault off
  • update fast-xml-builder to 1.2.0
    • can sanitize tag names if found invalid
    • fix format output

fix minor old bugs and update builder

  • fix: alwaysCreateTextNode should create text node when attributes are present for self closing node
  • fix stop node expression when ns prefix is removed (found by iruizsalinas)
  • update XML Builder to 1.1.7
  • mark addEntity deprecated

backward compatibility for numerical external entity, fix #705, #817

  • allow numerical external entity for backward compatibility
  • fix #705: attributesGroupName working with preserveOrder
  • fix #817: stackoverflow when tag expression is very long

upgrade @​nodable/entities and FXB

  • Use @nodable/entities v2.1.0
    • breaking changes
      • single entity scan. You're not allowed to use entity value to form another entity name.
      • you cant add numeric external entity
      • entity error message when expantion limit is crossed might change
    • typings are updated for new options related to process entity
    • please follow documentation of @nodable/entities for more detail.
    • performance
      • if processEntities is false, then there should not be impact on performance.
      • if processEntities is true, but you dont pass entity decoder separately then performance may degrade by approx 8-10%
      • if processEntities is true, and you pass entity decoder separately
        • if no entity then performance should be same as before
        • if there are entities then performance should be increased from past versions
    • ignoreAttributes is not required to be set to set xml version for NCR entity value
  • update 'fast-xml-builder' to sanitize malicious CDATA and comment's content
Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

*5.8.0 / 2026-05-12

  • integrate xml-naming to validate DOCTYPE entity name and notation name (using qname becaue of backward compatibility)
    • This will consider xml-version as well. '1.0' is default
  • update strnum to 2.3.0
    • You can set octal and binary parsing which is bydeault off
  • update fast-xml-builder to 1.2.0
    • can sanitize tag names if found invalid
    • fix format output

5.7.3 / 2006-05-05

  • fix: alwaysCreateTextNode should create text node when attributes are present for self closing node
  • fix stop node expression when ns prefix is removed (found by iruizsalinas)
  • update XML Builder to 1.1.7
  • mark addEntity deprecated

5.7.2 / 2026-04-25

  • allow numerical external entity for backward compatibility
  • fix #705: attributesGroupName working with preserveOrder
  • fix #817: stackoverflow when tag expression is very long

5.7.1 / 2026-04-20

  • fix typo in CJS typing file

5.7.0 / 2026-04-17

  • Use @nodable/entities v2.1.0
    • breaking changes
      • single entity scan. You're not allowed to user entity value to form another entity name.
      • you cant add numeric external entity
      • entity error message when expantion limit is crossed might change
    • typings are updated for new options related to process entity
    • please follow documentation of @nodable/entities for more detail.
    • performance
      • if processEntities is false, then there should not be impact on performance.
      • if processEntities is true, but you dont pass entity decoder separately then performance may degrade by approx 8-10%
      • if processEntities is true, and you pass entity decoder separately
        • if no entity then performance should be same as before
        • if there are entities then performance should be increased from past versions
    • ignoreAttributes is not required to be set to set xml version for NCR entity value
  • update 'fast-xml-builder' to sanitize malicious CDATA and comment's content

5.6.0 / 2026-04-15

  • fix: entity replacement for numeric entities
  • use @​nodable/entities to replace entities
    • this may change some error messages related to entities expansion limit or inavlid use
    • post check would be exposed in future version

... (truncated)

Commits

Updates https-proxy-agent from 7.0.6 to 9.0.0

Release notes

Sourced from https-proxy-agent's releases.

https-proxy-agent@9.0.0

Major Changes

  • 7d12b51: Set minimum Node.js version to 20

Patch Changes

  • 7ca27d0: Simplify package.json exports to remove unnecessary imports restriction
  • Updated dependencies [ca12148]
  • Updated dependencies [7d12b51]
  • Updated dependencies [7ca27d0]
    • agent-base@9.0.0

https-proxy-agent@8.0.0

Major Changes

  • 9c92c09: Convert to ESM. All packages now use "type": "module" and compile to ESM output instead of CommonJS.

Patch Changes

  • Updated dependencies [9c92c09]
    • agent-base@8.0.0
Changelog

Sourced from https-proxy-agent's changelog.

9.0.0

Major Changes

  • 7d12b51: Set minimum Node.js version to 20

Patch Changes

  • 7ca27d0: Simplify package.json exports to remove unnecessary imports restriction
  • Updated dependencies [ca12148]
  • Updated dependencies [7d12b51]
  • Updated dependencies [7ca27d0]
    • agent-base@9.0.0

8.0.0

Major Changes

  • 9c92c09: Convert to ESM. All packages now use "type": "module" and compile to ESM output instead of CommonJS.

Patch Changes

  • Updated dependencies [9c92c09]
    • agent-base@8.0.0
Commits
  • af317e0 Version Packages (#397)
  • 7ca27d0 Simplify package.json exports to remove unnecessary imports restriction (#408)
  • 7d12b51 Set minimum Node.js version to 20 and add Node 24.x to CI matrix
  • 8dcdac8 Version Packages (#395)
  • 5d3f71a Use pnpm catalog: for shared dependencies
  • 77da068 Use workspace:* for inter-repo dependencies
  • f70a9dc Fix CI failures: update Node.js matrix and test configuration
  • 9c92c09 Convert all packages to ESM with type: module
  • 0b77ac7 Migrate from Jest to Vitest
  • ed00d30 Re-generate self-signed cert for tests
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for https-proxy-agent since your current version.


Updates p-limit from 4.0.0 to 7.3.0

Release notes

Sourced from p-limit's releases.

v7.3.0

  • Add rejectOnClear option 8907801
  • Support options object in pLimit() 870db0f

sindresorhus/p-limit@v7.2.0...v7.3.0

v7.2.0

  • Make .map() method accept an iterable, not just array (#98) d76231b

sindresorhus/p-limit@v7.1.1...v7.2.0

v7.1.1

  • Fix limitFunction type ccb80b2

sindresorhus/p-limit@v7.1.0...v7.1.1

v7.1.0

  • Add index parameter to map() method 2aeffd4

sindresorhus/p-limit@v7.0.0...v7.1.0

v7.0.0

Breaking

  • Require Node.js 20 78b81a5
  • activeCount now increments when tasks actually start running (more intuitive) rather than when queued. This means:
    • activeCount reflects truly active/running promises
    • pendingCount more accurately represents waiting

Improvements

  • Add .map convenience method 86a5d73
  • Improve performance (#93) be1965b

sindresorhus/p-limit@v6.2.0...v7.0.0

v6.2.0

sindresorhus/p-limit@v6.1.0...v6.2.0

... (truncated)

Commits
  • 886bda5 7.3.0
  • 8907801 Add rejectOnClear option
  • ce9d71c Add test for shared context provider pattern
  • 24503f9 Document recursive limiter deadlocks
  • 9bce97a Add recipes documentation
  • 870db0f Support options object in pLimit()
  • 1fb1407 Fix benchmarks
  • 7bdd25c 7.2.0
  • d76231b Make .map() method accept an iterable, not just array (#98)
  • 9da5934 Use native Node.js timers instead of delay package in tests
  • Additional commits viewable in compare view

Updates packageurl-js from 1.0.2 to 2.0.1

Changelog

Sourced from packageurl-js's changelog.

2.0.1

Bug Fix

  • Fix decoding problems around the % character #75 (fix contributed by @​jdalton)

2.0.0

  • Significant refactor based on code from @​jdalton
  • Numerous bug fixes and improvements the community was asking for
    • See closed issues and PRs for details (too many to list here)

1.2.1

Bug Fixes

1.2.0

Features

  • Add pub parsing for Dart and Flutter packages (contributed by @​topaztee)

1.1.1

Bug Fix

  • publish errors

1.1.0

Features

Commits
  • cd1eb4b chore: bump to v2.0.1 (#77)
  • f7dccd6 fix: error on decode with meaningful message
  • 07b818b fix: only decode in parseString
  • c2f576f bump to v2.0.0 (#74)
  • b5660a5 Merge pull request #73 from package-url/jdalton/sync
  • 400de0c Merge pull request #72 from package-url/dependabot/npm_and_yarn/braces-3.0.3
  • b6c8ce8 fix: correct package-url.d.ts readonly type casing
  • 96822af fix: correct param name typos
  • f81a6be fix: use encodeQualifierValue for qualifierKey and qualifierValue
  • ff590d2 feat: encode qualifiers with URLSearchParams
  • Additional commits viewable in compare view

Updates web-tree-sitter from 0.26.8 to 0.26.9

Release notes

Sourced from web-tree-sitter's releases.

v0.26.9

What's Changed

Full Changelog: tree-sitter/tree-sitter@v0.26.8...v0.26.9

Commits

Updates @types/node from 20.19.31 to 25.9.1

Commits

Updates chai from 4.5.0 to 6.2.2

Release notes

Sourced from chai's releases.

v6.2.2

What's Changed

New Contributors

Full Changelog: chaijs/chai@v6.2.1...v6.2.2

v6.2.1

What's Changed

New Contributors

Full Changelog: chaijs/chai@v6.2.0...v6.2.1

... (truncated)

Commits
  • 814172d chore(deps): update dependency esbuild to v0.27.2 (#1759)
  • b38c22b chore: add legal-comments=none option (#1756)
  • 180d4cc chore(deps): update dependencies to v9.39.2 (#1757)
  • 678cd00 chore(deps): update dependencies (#1755)
  • c8fb100 chore(deps): update dependency prettier to v3.7.3 (#1754)
  • d63c74e chore(deps): update dependency eslint-plugin-jsdoc to v61.4.1 (#1751)
  • 243bf86 fix: avoid BigInt literal in closeTo for runtime compat (#1748)
  • d8b0395 chore(deps): update actions/checkout action to v6 (#1749)
  • 7e1e247 build(deps): bump glob from 10.4.5 to 10.5.0 (#1747)
  • b25e5d8 chore(deps): update dependency eslint-plugin-jsdoc to v61.2.1 (#1746)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for chai since your current version.


Updates eslint from 8.57.1 to 10.4.0

Release notes

Sourced from eslint's releases.

v10.4.0

Features

  • 1a45ec5 feat: check sequence expressions in for-direction (#20701) (kuldeep kumar)
  • 450040b feat: add includeIgnoreFile() to eslint/config (#20735) (Kirk Waiblinger)

Bug Fixes

  • 544c0c3 fix: escape code path DOT labels in debug output (#20866) (Pixel998)
  • 6799431 fix: update dependency @​eslint/config-helpers to ^0.6.0 (#20850) (renovate[bot])
  • f078fef fix: handle non-array deprecated rule replacements (#20825) (xbinaryx)

Documentation

  • 7e52a71 docs: add mention of @eslint-react/eslint-plugin (#20869) (Pavel)
  • db3468b docs: tweak wording around ambiguous CJS-vs-ESM config (#20865) (Kirk Waiblinger)
  • 9084664 docs: Update README (GitHub Actions Bot)
  • 9cc7387 docs: Update README (GitHub Actions Bot)
  • 3d7b548 docs: Update README (GitHub Actions Bot)
  • 191ec3c docs: Update README (GitHub Actions Bot)

Chores

  • 6616856 chore: upgrade knip to v6 (#20875) (Pixel998)
  • d13b084 ci: ensure auto-created PRs run CI (#20860) (lumir)
  • e71c7af ci: bump pnpm/action-setup from 6.0.5 to 6.0.7 (#20862) (dependabot[bot])

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 19, 2026
@dependabot
build(deps): bump the npm-dependencies group across 1 directory with …
18ed6ce 
…16 updates

Bumps the npm-dependencies group with 16 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@cyclonedx/cyclonedx-library](https://github.com/CycloneDX/cyclonedx-javascript-library) | `6.13.1` | `10.0.0` |
| [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | `5.7.0` | `5.8.0` |
| [https-proxy-agent](https://github.com/TooTallNate/proxy-agents/tree/HEAD/packages/https-proxy-agent) | `7.0.6` | `9.0.0` |
| [p-limit](https://github.com/sindresorhus/p-limit) | `4.0.0` | `7.3.0` |
| [packageurl-js](https://github.com/package-url/packageurl-js) | `1.0.2` | `2.0.1` |
| [web-tree-sitter](https://github.com/tree-sitter/tree-sitter/tree/HEAD/lib/binding_web) | `0.26.8` | `0.26.9` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `20.19.31` | `25.9.1` |
| [chai](https://github.com/chaijs/chai) | `4.5.0` | `6.2.2` |
| [eslint](https://github.com/eslint/eslint) | `8.57.1` | `10.4.0` |
| [esmock](https://github.com/iambumblehead/esmock) | `2.7.3` | `2.7.5` |
| [mocha](https://github.com/mochajs/mocha) | `10.8.2` | `11.7.6` |
| [msw](https://github.com/mswjs/msw) | `2.12.7` | `2.14.6` |
| [sinon](https://github.com/sinonjs/sinon) | `15.2.0` | `22.0.0` |
| [sinon-chai](https://github.com/chaijs/sinon-chai) | `3.7.0` | `4.0.1` |
| [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `6.0.3` |
| [which](https://github.com/npm/node-which) | `5.0.0` | `7.0.0` |



Updates `@cyclonedx/cyclonedx-library` from 6.13.1 to 10.0.0
- [Release notes](https://github.com/CycloneDX/cyclonedx-javascript-library/releases)
- [Changelog](https://github.com/CycloneDX/cyclonedx-javascript-library/blob/main/HISTORY.md)
- [Commits](CycloneDX/cyclonedx-javascript-library@v6.13.1...v10.0.0)

Updates `fast-xml-parser` from 5.7.0 to 5.8.0
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](NaturalIntelligence/fast-xml-parser@v5.7.0...v5.8.0)

Updates `https-proxy-agent` from 7.0.6 to 9.0.0
- [Release notes](https://github.com/TooTallNate/proxy-agents/releases)
- [Changelog](https://github.com/TooTallNate/proxy-agents/blob/main/packages/https-proxy-agent/CHANGELOG.md)
- [Commits](https://github.com/TooTallNate/proxy-agents/commits/https-proxy-agent@9.0.0/packages/https-proxy-agent)

Updates `p-limit` from 4.0.0 to 7.3.0
- [Release notes](https://github.com/sindresorhus/p-limit/releases)
- [Commits](sindresorhus/p-limit@v4.0.0...v7.3.0)

Updates `packageurl-js` from 1.0.2 to 2.0.1
- [Changelog](https://github.com/package-url/packageurl-js/blob/master/CHANGELOG.md)
- [Commits](package-url/packageurl-js@v1.0.2...v2.0.1)

Updates `web-tree-sitter` from 0.26.8 to 0.26.9
- [Release notes](https://github.com/tree-sitter/tree-sitter/releases)
- [Commits](https://github.com/tree-sitter/tree-sitter/commits/v0.26.9/lib/binding_web)

Updates `@types/node` from 20.19.31 to 25.9.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `chai` from 4.5.0 to 6.2.2
- [Release notes](https://github.com/chaijs/chai/releases)
- [Changelog](https://github.com/chaijs/chai/blob/main/History.md)
- [Commits](chaijs/chai@v4.5.0...v6.2.2)

Updates `eslint` from 8.57.1 to 10.4.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v8.57.1...v10.4.0)

Updates `esmock` from 2.7.3 to 2.7.5
- [Release notes](https://github.com/iambumblehead/esmock/releases)
- [Changelog](https://github.com/iambumblehead/esmock/blob/main/CHANGELOG.md)
- [Commits](iambumblehead/esmock@v2.7.3...v2.7.5)

Updates `mocha` from 10.8.2 to 11.7.6
- [Release notes](https://github.com/mochajs/mocha/releases)
- [Changelog](https://github.com/mochajs/mocha/blob/v11.7.6/CHANGELOG.md)
- [Commits](mochajs/mocha@v10.8.2...v11.7.6)

Updates `msw` from 2.12.7 to 2.14.6
- [Release notes](https://github.com/mswjs/msw/releases)
- [Changelog](https://github.com/mswjs/msw/blob/main/CHANGELOG.md)
- [Commits](mswjs/msw@v2.12.7...v2.14.6)

Updates `sinon` from 15.2.0 to 22.0.0
- [Release notes](https://github.com/sinonjs/sinon/releases)
- [Changelog](https://github.com/sinonjs/sinon/blob/main/docs/changelog.md)
- [Commits](sinonjs/sinon@v15.2.0...v22.0.0)

Updates `sinon-chai` from 3.7.0 to 4.0.1
- [Release notes](https://github.com/chaijs/sinon-chai/releases)
- [Changelog](https://github.com/chaijs/sinon-chai/blob/master/CHANGELOG.md)
- [Commits](chaijs/sinon-chai@3.7.0...4.0.1)

Updates `typescript` from 5.9.3 to 6.0.3
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](microsoft/TypeScript@v5.9.3...v6.0.3)

Updates `which` from 5.0.0 to 7.0.0
- [Release notes](https://github.com/npm/node-which/releases)
- [Changelog](https://github.com/npm/node-which/blob/main/CHANGELOG.md)
- [Commits](npm/node-which@v5.0.0...v7.0.0)

---
updated-dependencies:
- dependency-name: "@cyclonedx/cyclonedx-library"
  dependency-version: 10.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: "@types/node"
  dependency-version: 25.9.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: chai
  dependency-version: 6.2.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: eslint
  dependency-version: 10.4.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: esmock
  dependency-version: 2.7.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: fast-xml-parser
  dependency-version: 5.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: https-proxy-agent
  dependency-version: 9.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: mocha
  dependency-version: 11.7.5
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: msw
  dependency-version: 2.14.6
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: p-limit
  dependency-version: 7.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: packageurl-js
  dependency-version: 2.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: sinon
  dependency-version: 22.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: sinon-chai
  dependency-version: 4.0.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: typescript
  dependency-version: 6.0.3
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: web-tree-sitter
  dependency-version: 0.26.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: which
  dependency-version: 7.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-dependencies-6ed7292111 branch from c9b4c35 to 18ed6ce Compare May 21, 2026 14:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants