Skip to content

chore(deps): bump the minor-production-deps group across 1 directory with 5 updates#1162

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-production-deps-0001d78b7f
Open

chore(deps): bump the minor-production-deps group across 1 directory with 5 updates#1162
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-production-deps-0001d78b7f

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Jun 1, 2026

Bumps the minor-production-deps group with 5 updates in the / directory:

Package From To
js-yaml 4.1.1 4.2.0
ora 9.1.0 9.4.0
semver 7.7.3 7.8.1
nock 14.0.10 14.0.15
vitest 4.1.6 4.1.8

Updates js-yaml from 4.1.1 to 4.2.0

Changelog

Sourced from js-yaml's changelog.

[4.2.0] - 2026-06-01

Added

  • Added docs/safety.md with notes about processing untrusted YAML.
  • Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.
  • Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.
  • Added sourcemaps to dist/ builds.

Changed

  • Stop resolving numbers with underscores as numeric scalars, #627.
  • Switched dev toolchains to Vite / neostandard.
  • Updated demo.
  • Reorganized tests.
  • dist/ files are no longer kept in the repository.

Fixed

  • Fix parsing of properties on the first implicit block mapping key, #62.
  • Fix trailing whitespace handling when folding flow scalar lines, #307.
  • Reject top-level block scalars without content indentation, #280.
  • Ensure numbers survive round-trip, #737.
  • Fix test coverage for issue #221.
  • Fix flow scalar trailing whitespace folding, #307.
  • Fix digits in YAML named tag handles.

Security

  • Fix potential DoS via quadratic complexity in merge - deduplicate repeated elements (makes sense for malformed files > 10K).

[3.14.2] - 2025-11-15

Security

  • Backported v4.1.1 fix to v3
Commits

Updates ora from 9.1.0 to 9.4.0

Release notes

Sourced from ora's releases.

v9.4.0

  • Add successSymbol and failSymbol options to oraPromise 3d2e0a9

sindresorhus/ora@v9.3.0...v9.4.0

v9.3.0

  • Reduce flicker in rendering 2ab4f76

sindresorhus/ora@v9.2.0...v9.3.0

v9.2.0

  • Update stdin-discarder dependency (#251) 020eaba

sindresorhus/ora@v9.1.0...v9.2.0

Commits

Updates semver from 7.7.3 to 7.8.1

Release notes

Sourced from semver's releases.

v7.8.1

7.8.1 (2026-05-21)

Bug Fixes

v7.8.0

7.8.0 (2026-05-08)

Features

Bug Fixes

Documentation

Chores

v7.7.4

7.7.4 (2026-01-16)

Bug Fixes

Documentation

Dependencies

Chores

Changelog

Sourced from semver's changelog.

7.8.1 (2026-05-21)

Bug Fixes

7.8.0 (2026-05-08)

Features

Bug Fixes

Documentation

Chores

7.7.4 (2026-01-16)

Bug Fixes

Documentation

Dependencies

Chores

Commits

Updates nock from 14.0.10 to 14.0.15

Release notes

Sourced from nock's releases.

v14.0.15

14.0.15 (2026-05-07)

Bug Fixes

  • Revert "fix(backport): apply body delay before the response end" (#2973) (de5450c), closes #2969

v14.0.14

14.0.14 (2026-04-30)

Bug Fixes

  • backport: apply body delay before the response end (#2969) (215cd2a)

v14.0.13

14.0.13 (2026-04-20)

Bug Fixes

  • types: align Definition with runtime; add rawHeaders, drop headers (#2955) (07fbfab)

v14.0.12

14.0.12 (2026-04-05)

Bug Fixes

  • prevent crash when query params have conflicting dot-notation keys (#2958) (7ea9933)

v14.0.11

14.0.11 (2026-02-09)

Bug Fixes

Commits
  • de5450c fix: Revert "fix(backport): apply body delay before the response end" (#2973)
  • 215cd2a fix(backport): apply body delay before the response end (#2969)
  • 07fbfab fix(types): align Definition with runtime; add rawHeaders, drop headers (#2955)
  • fe2c3ea chore(deps-dev): bump lodash-es from 4.17.23 to 4.18.1 (#2961)
  • ee49b4f chore(deps-dev): bump flatted from 3.2.5 to 3.4.2
  • 11bf183 chore(deps-dev): bump undici from 6.23.0 to 6.24.1 (#2954)
  • 6b80154 chore(deps-dev): bump handlebars from 4.7.8 to 4.7.9 (#2960)
  • 4cbf6cc chore(deps): bump tar and npm (#2952)
  • 7ea9933 fix: prevent crash when query params have conflicting dot-notation keys (#2958)
  • d00d371 chore(deps): bump picomatch
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nock since your current version.


Updates vitest from 4.1.6 to 4.1.8

Release notes

Sourced from vitest's releases.

v4.1.8

   🐞 Bug Fixes

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

    View changes on GitHub
Commits
  • e61f2dd chore: release v4.1.8
  • e4067b3 fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
  • a09d472 chore: release v4.1.7
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot dependabot Bot requested a review from erunion as a code owner June 1, 2026 15:03
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jun 1, 2026
@erunion erunion removed their request for review June 3, 2026 17:17
@gkoberger gkoberger force-pushed the dependabot/npm_and_yarn/minor-production-deps-0001d78b7f branch from 4a50447 to 5711609 Compare June 7, 2026 00:12
@gkoberger gkoberger requested a review from a team June 7, 2026 00:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants