Skip to content

Build(deps): Bump the production-dependencies group across 1 directory with 11 updates - #2362

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-1d34bf6377
Open

Build(deps): Bump the production-dependencies group across 1 directory with 11 updates#2362
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-1d34bf6377

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 11 updates in the / directory:

Package From To
@types/node 26.4.1 26.6.5
vitest 5.0.0 5.0.5
@changesets/format 0.1.2 0.1.3
@clack/prompts 1.7.0 1.8.1
cac 7.0.0 7.1.0
launch-editor 2.14.1 2.14.2
package-manager-detector 1.8.0 1.9.0
human-id 4.2.1 4.2.2
yaml 2.9.0 2.9.1
modern-tar 0.8.5 0.8.6
vue 3.5.42 3.5.44

Updates @types/node from 26.4.1 to 26.6.5

Commits

Updates vitest from 5.0.0 to 5.0.5

Release notes

Sourced from vitest's releases.

v5.0.5

   🐞 Bug Fixes

    View changes on GitHub

v5.0.4

   🚀 Features

   🐞 Bug Fixes

... (truncated)

Commits

Updates @changesets/format from 0.1.2 to 0.1.3

Release notes

Sourced from @​changesets/format's releases.

@​changesets/format@​0.1.3

Patch Changes

Changelog

Sourced from @​changesets/format's changelog.

0.1.3

Patch Changes

Commits
  • dd337e5 Version Packages (#52)
  • e3a963c Accept readonly arrays in detect order option (#51)
  • 27fe395 Bump vitest from 4.1.11 to 5.0.1 (#50)
  • 922ca2e Bump tinyexec from 1.3.0 to 1.3.1 in the production-dependencies group across...
  • 1dabd50 Bump the github-actions group with 5 updates (#47)
  • 1c0744c Bump the development-dependencies group with 9 updates (#49)
  • c870b35 Remove unneeded deno config check (#46)
  • 6ed5a1a Bump the development-dependencies group with 6 updates (#44)
  • 4d065a5 Bump the github-actions group with 4 updates (#43)
  • 966f269 Bump actions/checkout from 7.0.0 to 7.0.1 in the github-actions group across ...
  • See full diff in compare view

Updates @clack/prompts from 1.7.0 to 1.8.1

Release notes

Sourced from @​clack/prompts's releases.

@​clack/prompts@​1.8.1

Patch Changes

  • 8bd9129 Thanks @​gameroman! - Return type for prompts now correctly specifies CANCEL_SYMBOL instead of symbol

  • Updated dependencies [8bd9129]:

    • @​clack/core@​1.5.1

@​clack/prompts@​1.8.0

Minor Changes

  • #592 caa32e8 Thanks @​gameroman! - Export CANCEL_SYMBOL constant from @clack/core and @clack/prompts

  • #594 37fca4e Thanks @​dreyfus92! - Add tab-completion to the path prompt: pressing Tab fills the input with the focused suggestion, so you can quickly descend into deep directories (type / and Tab again). Powered by a new opt-in completeOnTab option on autocomplete, which also shows a Tab: complete hint in the instructions footer. Default autocomplete behavior is unchanged.

  • #583 ae636dd Thanks @​43081j! - Add async validation support to prompts, and validation state rendering to text prompts.

Patch Changes

Changelog

Sourced from @​clack/prompts's changelog.

1.8.1

Patch Changes

  • 8bd9129 Thanks @​gameroman! - Return type for prompts now correctly specifies CANCEL_SYMBOL instead of symbol

  • Updated dependencies [8bd9129]:

    • @​clack/core@​1.5.1

1.8.0

Minor Changes

  • #592 caa32e8 Thanks @​gameroman! - Export CANCEL_SYMBOL constant from @clack/core and @clack/prompts

  • #594 37fca4e Thanks @​dreyfus92! - Add tab-completion to the path prompt: pressing Tab fills the input with the focused suggestion, so you can quickly descend into deep directories (type / and Tab again). Powered by a new opt-in completeOnTab option on autocomplete, which also shows a Tab: complete hint in the instructions footer. Default autocomplete behavior is unchanged.

  • #583 ae636dd Thanks @​43081j! - Add async validation support to prompts, and validation state rendering to text prompts.

Patch Changes

Commits

Updates cac from 7.0.0 to 7.1.0

Release notes

Sourced from cac's releases.

v7.1.0

   🐞 Bug Fixes

    View changes on GitHub

v7.0.1

   🐞 Bug Fixes

  • Prevent prototype pollution via dotted option names  -  by @​sxzz (604d4)
    View changes on GitHub
Commits
  • 12a5e82 chore: release v7.1.0
  • c0ccb94 fix: read process.argv lazily (#179)
  • 284577b chore: fix lint
  • e7c7f3a chore: remove Deno tests & docs
  • 0613c12 chore: upgrade deps
  • 26938a2 fix(parse): leave an omitted array option absent (#177)
  • 66bb550 chore: release v7.0.1
  • 604d408 fix: prevent prototype pollution via dotted option names
  • eb5fe08 chore: declare package side effects
  • 38268e6 chore: align pnpm workspace settings
  • Additional commits viewable in compare view

Updates launch-editor from 2.14.1 to 2.14.2

Commits
  • b533489 v2.14.2
  • f13cd83 fix: check file existence after path resolution (#157)
  • f6e6701 fix: ensure filenames passed to editors are not considered as flags (#156)
  • 3c2f9bf fix: reject paths containing % on windows (#155)
  • ecdfce1 refactor: extract constructWindowsLaunchCommand (#154)
  • 24d5d84 fix: correctly show error when the third parameter is not passed (#153)
  • 7bae9bc refactor: merge statements
  • 571fe00 chore(deps): update actions/setup-node action to v7 (#149)
  • d8ed423 chore(deps): update actions/checkout action to v7 (#148)
  • 75b3e6c fix(deps): update all non-major dependencies (#146)
  • Additional commits viewable in compare view

Updates package-manager-detector from 1.8.0 to 1.9.0

Release notes

Sourced from package-manager-detector's releases.

v1.9.0

   🚀 Features

    View changes on GitHub
Commits

Updates human-id from 4.2.1 to 4.2.2

Commits

Updates yaml from 2.9.0 to 2.9.1

Release notes

Sourced from yaml's releases.

v2.9.1

  • Limit recursive merge aliases (#685, #713)
  • Simplify line unfolding during quoted string parsing (#714)
Commits

Updates modern-tar from 0.8.5 to 0.8.6

Release notes

Sourced from modern-tar's releases.

v0.8.6

Overview

Various bug fixes and security improvements 📍

What's Changed

Full Changelog: ayuhito/modern-tar@v0.8.5...v0.8.6

Commits
  • 532ebb9 fix(tar): bound global pax attributes (#201)
  • 6d66e03 fix(tar): discard trailing data after eof (#199)
  • 035d5ec fix(tar): keep pax size consistent with entry bodies (#200)
  • 7e88d33 fix(web): reject invalid packer body chunks (#198)
  • 81cd392 fix(fs): enforce explicit base directory when dereferencing (#197)
  • c2ff3d0 ci: test node 26 and refresh workflow tooling (#196)
  • 181c8cb fix(tar): reject malformed octal fields (#195)
  • 2d47a45 perf(tar): decode entry types directly from bytes (#194)
  • 0e4aebd chore: bump version to 0.8.5
  • See full diff in compare view

Updates vue from 3.5.42 to 3.5.44

Release notes

Sourced from vue's releases.

v3.5.44

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.43

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Changelog

Sourced from vue's changelog.

3.5.44 (2026-10-13)

Bug Fixes

  • compat: expose _setupProxy for Vue 2.7 compiled script setup (fix #11164) (#15618) (f08059d)
  • compiler-core: parenthesise v-for key in v-memo cache guard (#15724) (d084b90), closes #15723
  • compiler-dom: correctly stringify 0 and false in v-html (#15571) (9f3b437)
  • compiler-dom: inject transition persisted for v-show in production (#15783) (89cb272)
  • compiler-sfc: error when defineModel prop options reference a destructured prop (#15604) (38012a5), closes #15602
  • custom-element: skip mounting an async custom element removed while its component loads (#15777) (0f8e7b4), closes #15775
  • hydration: observe children of a display: contents root in hydrateOnVisible (#15773) (7f688e8)
  • KeepAlive: unmount pruned current component when its vnode was cloned on mount (#15711) (92798ac), closes #15710
  • reactivity: avoid mutating native array iterators (#15703) (7f9d45d), closes #15643
  • reactivity: do not track deps in watcher callbacks run inside another effect (#15782) (db00fe9), closes #5009
  • reactivity: once watcher should stop when its callback throws (#15755) (ae4bd94)
  • reactivity: preserve shallow collection semantics (#15793) (b600466), closes #15792
  • runtime-core: detect new prop keys when comparing full props (#15634) (702fa61), closes #15632
  • runtime-core: keep async placeholder for block patching and pending component updates (#15554) (05ec25f), closes #15551
  • runtime-core: only flush jobs queued by the root render itself (#15757) (0bea14b), closes #6728
  • runtime-core: render nothing for an invalid v-for range in production (#15742) (ad19e7d)
  • runtime-dom: preserve v-show display for unchanged style strings (#15794) (c0a6d3f)
  • runtime-dom: treat playsinline as a boolean attribute (#15627) (a084e44)
  • server-renderer: propagate async setup errors (#15857) (6930374), closes #15716
  • ssr: honor falsy vnode content overrides (#15769) (c11c5c8)
  • suspense: mount resolved async component with its own namespace (#15640) (2a086a2), closes #15639
  • suspense: skip rendering async components unmounted while pending (4ab865a)
  • teleport: move targetStart and keep children before targetAnchor (#15818) (d3c6e02), closes #15817
  • transition-group: measure nested groups against their moving outer item (#15848) (1936c87), closes #5385 #1531
  • transition: handle comment-wrapped component roots (#15853) (ff35014), closes #6080 #5500

3.5.43 (2026-09-17)

Bug Fixes

  • compiler-sfc: ignore comment delimiters inside strings and url() when parsing css vars (#15548) (2fde323)
  • compiler-sfc: prepend semicolon for await in switch case (#15498) (9a1df69), closes #15495
  • compiler-sfc: restore await scope when leaving nested blocks (5409708), closes #15465
  • compiler-sfc: reuse parsed parent configs across tsconfig walks (fix #15478) (#15480) (d6febaa)
  • hydration: run leave hooks for hydration placeholders (#15431) (5dda192)
  • reactivity: preserve readonly wrappers in array copy methods (#15469) (599f35b)
  • runtime-core: unmount v-once children after parent rerenders (#15435) (d720338)
  • shared: handle circular references in looseEqual (#15499) (718f782), closes #15496
  • shared: preserve comment-like text in style values (#15471) (b9456cb)
  • suspense: don't drop nested suspense patches during hydration (#15429) (76d42dc)
  • suspense: keep the boundary pending while its branch is patched (#15411) (bfcfe9e), closes #7506
  • suspense: patch a hydrating boundary's pending branch in place (#15432) (2cde6f7)
  • suspense: unmount the DOM an interrupted async component claimed (#15430) (fb9b45c)
  • types: keep optional props when a runtime prop uses a generic PropType (#15523) (243aabc), closes #9546
Commits
  • bf5f0dd release: v3.5.44
  • 6930374 fix(server-renderer): propagate async setup errors (#15857)
  • 8e8c547 chore(deps): update all non-major dependencies (#15585)
  • 4cb0ca8 chore(deps): update playground (#15685)
  • e38478f chore(deps): update dawidd6/action-download-artifact action to v27 (

@dependabot
Build(deps): Bump the production-dependencies group across 1 director…
885b770 
…y with 11 updates

Bumps the production-dependencies group with 11 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.4.1` | `26.6.5` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.0` | `5.0.5` |
| [@changesets/format](https://github.com/changesets/format) | `0.1.2` | `0.1.3` |
| [@clack/prompts](https://github.com/bombshell-dev/clack/tree/HEAD/packages/prompts) | `1.7.0` | `1.8.1` |
| [cac](https://github.com/cacjs/cac) | `7.0.0` | `7.1.0` |
| [launch-editor](https://github.com/vitejs/launch-editor) | `2.14.1` | `2.14.2` |
| [package-manager-detector](https://github.com/antfu-collective/package-manager-detector) | `1.8.0` | `1.9.0` |
| [human-id](https://github.com/RienNeVaPlus/human-id) | `4.2.1` | `4.2.2` |
| [yaml](https://github.com/eemeli/yaml) | `2.9.0` | `2.9.1` |
| [modern-tar](https://github.com/ayuhito/modern-tar) | `0.8.5` | `0.8.6` |
| [vue](https://github.com/vuejs/core) | `3.5.42` | `3.5.44` |



Updates `@types/node` from 26.4.1 to 26.6.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `vitest` from 5.0.0 to 5.0.5
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/vitest)

Updates `@changesets/format` from 0.1.2 to 0.1.3
- [Release notes](https://github.com/changesets/format/releases)
- [Changelog](https://github.com/changesets/format/blob/main/CHANGELOG.md)
- [Commits](https://github.com/changesets/format/compare/@changesets/format@0.1.2...@changesets/format@0.1.3)

Updates `@clack/prompts` from 1.7.0 to 1.8.1
- [Release notes](https://github.com/bombshell-dev/clack/releases)
- [Changelog](https://github.com/bombshell-dev/clack/blob/main/packages/prompts/CHANGELOG.md)
- [Commits](https://github.com/bombshell-dev/clack/commits/@clack/prompts@1.8.1/packages/prompts)

Updates `cac` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/cacjs/cac/releases)
- [Commits](cacjs/cac@v7.0.0...v7.1.0)

Updates `launch-editor` from 2.14.1 to 2.14.2
- [Commits](vitejs/launch-editor@v2.14.1...v2.14.2)

Updates `package-manager-detector` from 1.8.0 to 1.9.0
- [Release notes](https://github.com/antfu-collective/package-manager-detector/releases)
- [Commits](antfu-collective/package-manager-detector@v1.8.0...v1.9.0)

Updates `human-id` from 4.2.1 to 4.2.2
- [Commits](https://github.com/RienNeVaPlus/human-id/commits)

Updates `yaml` from 2.9.0 to 2.9.1
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.9.0...v2.9.1)

Updates `modern-tar` from 0.8.5 to 0.8.6
- [Release notes](https://github.com/ayuhito/modern-tar/releases)
- [Commits](ayuhito/modern-tar@v0.8.5...v0.8.6)

Updates `vue` from 3.5.42 to 3.5.44
- [Release notes](https://github.com/vuejs/core/releases)
- [Changelog](https://github.com/vuejs/core/blob/main/CHANGELOG.md)
- [Commits](vuejs/core@v3.5.42...v3.5.44)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 26.6.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: vitest
  dependency-version: 5.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@changesets/format"
  dependency-version: 0.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@clack/prompts"
  dependency-version: 1.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: cac
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: launch-editor
  dependency-version: 2.14.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: package-manager-detector
  dependency-version: 1.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: human-id
  dependency-version: 4.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: yaml
  dependency-version: 2.9.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: modern-tar
  dependency-version: 0.8.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: vue
  dependency-version: 3.5.44
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 1, 2026
@netlify

netlify Bot commented Nov 1, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Deploy Preview for changesets ready!

Name Link
🔨 Latest commit 885b770
🔍 Latest deploy log https://app.netlify.com/projects/changesets/deploys/6ae7612806cae709c23fb071
😎 Deploy Preview https://deploy-preview-2362--changesets.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@changeset-bot

changeset-bot Bot commented Nov 1, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 885b770

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@socket-security

socket-security Bot commented Nov 1, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedlaunch-editor@​2.14.1 ⏵ 2.14.299 +1100 +1970 +190100
Updatedvitest@​5.0.0 ⏵ 5.0.59810079 +198100
Updated@​types/​node@​26.4.1 ⏵ 26.6.5100 +110081 +196 +2100
Updated@​changesets/​format@​0.1.2 ⏵ 0.1.31001008488 +3100
Updatedhuman-id@​4.2.1 ⏵ 4.2.2100 +1100100 +187 +1100
Addedpackage-manager-detector@​1.9.010010010089100
Addedcac@​7.1.010010010090100
Updatedmodern-tar@​0.8.5 ⏵ 0.8.6100 +1100100 +191100
Updatedvue@​3.5.42 ⏵ 3.5.449910091 +197100
Updated@​clack/​prompts@​1.7.0 ⏵ 1.8.1100 +110010094100

View full report

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants