Skip to content

chore(deps): bump the npm_and_yarn group across 2 directories with 13 updates - #954

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-4f0b9e1037
Open

chore(deps): bump the npm_and_yarn group across 2 directories with 13 updates#954
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-4f0b9e1037

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 10, 2026 •
edited by pr-codex Bot
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 8 updates in the / directory:

Package From To
dd-trace 5.28.0 5.100.0
undici 6.20.1 6.28.0
vitest 2.1.8 3.2.6
body-parser 1.20.3 2.3.0
js-yaml 4.1.0 4.3.1
linkify-it 5.0.0 5.0.2
markdown-it 14.1.0 14.3.0
tmp 0.2.3 0.2.7

Bumps the npm_and_yarn group with 2 updates in the /sdk directory: brace-expansion and @babel/core.

Updates dd-trace from 5.28.0 to 5.100.0

Release notes

Sourced from dd-trace's releases.

5.100.0

  • [d46c3485c9] - (SEMVER-PATCH) perf(propagation): rewrite tracestate parser to be linear (Ruben Bridgewater) #8256
  • [ed087ea187] - (SEMVER-PATCH) chore(deps-dev): bump the dev-minor-and-patch-dependencies group across 1 directory with 2 updates (dependabot[bot]) #8258
  • [d0eba220a0] - (SEMVER-PATCH) chore(deps): bump the gh-actions-packages group across 2 directories with 1 update (dependabot[bot]) #8261
  • [33b0dc1e17] - (SEMVER-PATCH) fix(express): use the host's path-to-regexp dialect for route tagging (Ruben Bridgewater) #8224
  • [d064e062cf] - (SEMVER-PATCH) refactor(otel): extract bridge helpers into span-helpers.js (Ruben Bridgewater) #8220
  • [658450e18b] - (SEMVER-PATCH) fix(otel): return a non-recording span when the inner tracer is the noop (Ruben Bridgewater) #8218
  • [fe48fc0c5f] - (SEMVER-PATCH) fix(esm): expose 'tracer' as an ESM named export (Ruben Bridgewater) #8216
  • [90bb04871a] - (SEMVER-PATCH) fix: small correctness issues in mongodb-core and bullmq (Ruben Bridgewater) #8228
  • [20f9e76efe] - (SEMVER-PATCH) fix(config): align inferred service name with agent normalization (Ruben Bridgewater) #8217
  • [00a239a1e2] - (SEMVER-PATCH) fix(propagation): enforce baggageMax* caps on extract (Ruben Bridgewater) #8255
  • [15ce029c26] - (SEMVER-PATCH) ci: deprecate legacy macrobenchmarks in favor of parallel ones (Fayssal DEFAA) #8250
  • [9e6acd8951] - (SEMVER-MINOR) feat(test-optimization): create final_status tag on test event for playwright (Sebastián Kay) #8190
  • [77cc2e065d] - (SEMVER-PATCH) fix(hono): skip publishing when env.incoming is missing (Ruben Bridgewater) #8221
  • [c832bf7a10] - (SEMVER-PATCH) [test optimization] Update extraction of runner diagnostic dir using glob pattern matching (Sebastián Kay) #8115
  • [41789b4087] - (SEMVER-PATCH) refactor(config): drop more internalPropertyName aliases (Ruben Bridgewater) #8237
  • [c97a177432] - (SEMVER-PATCH) fix(encode): write truncated meta keys back to span.meta (Ruben Bridgewater) #8236
  • [e5e3e4d35b] - (SEMVER-PATCH) test: drop keep-alive on the ci-visibility web-app-server (Ruben Bridgewater) #8194
  • [6448470089] - (SEMVER-MINOR) [test-optimization] Honor attempt-to-fix failures (Juan Antonio Fernández de Alba) #8138
  • [925bd0aae7] - (SEMVER-PATCH) chore(deps): bump openai (dependabot[bot]) #8244
  • [b058d8b4af] - (SEMVER-PATCH) ci: remove old bundle-validate workflow (Roch Devost) #8214
  • [e199f82b3e] - (SEMVER-PATCH) ci: update all green script to fail when any retry failed (Roch Devost) #8222
  • [d109d5bf1b] - (SEMVER-PATCH) chore(codeowners): own remaining benchmark dirs and enforce in CI (Ruben Bridgewater) #8204

5.99.1

  • [030413c8b3] - (SEMVER-PATCH) refactor(config): drop low-use internalPropertyName aliases (Ruben Bridgewater) #8211
  • [538b5746da] - (SEMVER-PATCH) ci: update all green to fail when the rate limit is reached (Roch Devost) #8212
  • [e1461827cb] - (SEMVER-PATCH) fix(dogstatsd): stop re-emitting stale gauges (Ruben Bridgewater) #8153
  • [ddfe085c82] - (SEMVER-PATCH) add github workflow to mirror images from flaky registries (Roch Devost) #8165
  • [1709d32f57] - (SEMVER-PATCH) bench(spans): cover tags-and-otel construction shape (Ruben Bridgewater) #8199
  • [a72b441efe] - (SEMVER-PATCH) fix(propagation): improve baggage implementation (Ruben Bridgewater) #8193
  • [f1b085a703] - (SEMVER-PATCH) bench(llmobs): add writer flush benchmark (Ruben Bridgewater) #8200
  • [ce42131535] - (SEMVER-PATCH) bench(aws-sdk): add inject and response-body benchmarks (Ruben Bridgewater) #8201
  • [35425f7a4e] - (SEMVER-PATCH) bench(dsm): add Data Streams Monitoring pathway benchmark (Ruben Bridgewater) #8202
  • [b47fabe6d1] - (SEMVER-PATCH) bench(propagation): add extract and inject benchmarks (Ruben Bridgewater) #8203
  • [6e86edfcda] - (SEMVER-PATCH) bench(encoding): cover native and legacy span-events paths (Ruben Bridgewater) #8205
  • [f6faa2b85f] - (SEMVER-PATCH) ci: fix flakiness workflow falling back to default for empty branch (Roch Devost) #8207
  • [0421807fcf] - (SEMVER-PATCH) fix(llmobs): correlate otel gen_ai spans with sdk llmobs spans (Zachary Groves) #8127
  • [63adfd5ae1] - (SEMVER-PATCH) bench: add plugin-graphql-long sirun benchmark (Crystal Luc-Magloire) #8089
  • [26bee69994] - (SEMVER-PATCH) minimize requests for all green script and retry faster (Roch Devost) #8180
  • [7763af7037] - (SEMVER-PATCH) ci: add days/branch/occurrences option to flakiness report (Roch Devost) #8185
  • [974bbce729] - (SEMVER-PATCH) test: add integration coverage harness (Ruben Bridgewater) #8071
  • [40c512422d] - (SEMVER-PATCH) fix(test): use ALS run() instead of enterWith() in mock agent server.emit (William Conti) #8166
  • [8628c2716a] - (SEMVER-PATCH) fix(appsec): bound detectedSpecificEndpoints cache (Ruben Bridgewater) #8163
  • [fab96f8428] - (SEMVER-PATCH) test: fix mocha retries issue (Ilyas Shabi) #8189
  • [476b6d1269] - (SEMVER-PATCH) test: Improve profiling tests (Ilyas Shabi) #8169

5.99.0

  • [fe44ddbe67] - (SEMVER-PATCH) ci: refresh Node patch versions on cross-window cache restores (Ruben Bridgewater) #8179
  • [5f582369a6] - (SEMVER-PATCH) refactor: use the same symbol to instrument pino across versions (Roch Devost) #8181

... (truncated)

Commits
  • 581910d v5.100.0
  • b24e364 perf(propagation): rewrite tracestate parser to be linear (#8256)
  • 8e59ac7 chore(deps-dev): bump the dev-minor-and-patch-dependencies group across 1 dir...
  • e909c52 chore(deps): bump the gh-actions-packages group across 2 directories with 1 u...
  • 86e35a9 fix(express): use the host's path-to-regexp dialect for route tagging (#8224)
  • 9f302fe refactor(otel): extract bridge helpers into span-helpers.js (#8220)
  • 200d3bd fix(otel): return a non-recording span when the inner tracer is the noop (#8218)
  • b2df728 fix(esm): expose 'tracer' as an ESM named export (#8216)
  • 741482c fix: small correctness issues in mongodb-core and bullmq (#8228)
  • 280f96e fix(config): align inferred service name with agent normalization (#8217)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for dd-trace since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates undici from 6.20.1 to 6.28.0

Release notes

Sourced from undici's releases.

v6.28.0

⚠️ Security fixes

  • GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 740a0b7c.
  • GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by cba3a52a, with corrected fixtures in 4fd5a0c6.
  • GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by af748404.

GHSA-4cwx-7wf7-3272 and GHSA-jr45-8vmc-qm54 affect the cache interceptor in Undici v7 and v8; Undici v6 is not in their affected version ranges.

Full Changelog: nodejs/undici@v6.27.0...v6.28.0

v6.27.0

⚠️ Security Release

This release line addresses 4 security advisories.

Action required: Upgrade to undici 6.27.0 or later.

npm install undici@^6.27.0

Note on patched version: the v6 fixes shipped in v6.27.0, not 6.26.0 — v6.26.0 contains only the chunked-EOF fix (#5308) and the version bump, none of the security fixes below.

The v6 line is not affected by the SOCKS5 advisories (GHSA-vmh5-mc38-953g, GHSA-hm92-r4w5-c3mj), the shared-cache disclosure (GHSA-pr7r-676h-xcf6), or the 8.x-only WebSocket regression (GHSA-38rv-x7px-6hhq).

Summary

Advisory CVE Severity (CVSS) Fixed in Fix commit
GHSA-vxpw-j846-p89q CVE-2026-12151 High (7.5) 6.27.0 b7f252e7
GHSA-p88m-4jfj-68fv CVE-2026-9679 Moderate (5.9) 6.27.0 25efa447
GHSA-g8m3-5g58-fq7m CVE-2026-11525 Low (3.7) 6.27.0 25efa447
GHSA-35p6-xmwp-9g52 CVE-2026-6733 Low (3.7) 6.27.0 f4c31d60

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770 Fix: b7f252e7 Backport WebSocket maxPayloadSize fixes (#5423, backported to v6 in #5428)

A malicious WebSocket server can stream a large number of small or empty continuation frames. Undici enforced a limit on cumulative payload size but did

... (truncated)

Commits
  • 01a912e Bumped v6.28.0 (#5591)
  • 481ecfc Use Node 22 and npm 11 to release
  • 740a0b7 fix: validate blob body content type
  • 2698e49 fix: validate coerced header values for CRLF (#5579)
  • 4fd5a0c test(retry): correct broken content-range fixtures in retry-handler.js
  • cba3a52 fix(retry): reject partial content length mismatch
  • af74840 fix: harden cookie domain, path, and unparsed attribute validation
  • 551138c Bumped v6.27.0 (#5431)
  • b7f252e Backport WebSocket maxPayloadSize fixes to v7.x (#5423) (#5428)
  • 25efa44 fix(cookies): preserve values and parse SameSite strictly
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for undici since your current version.


Updates vitest from 2.1.8 to 3.2.6

Release notes

Sourced from vitest's releases.

v3.2.6

   🐞 Bug Fixes

    View changes on GitHub

v3.2.5

   🚀 Features

   🐞 Bug Fixes

    View changes on GitHub

v3.2.4

   🐞 Bug Fixes

    View changes on GitHub

v3.2.3

   🚀 Features

... (truncated)

Commits
  • b6d56f8 chore: release v3.2.6
  • 16f120d fix: pin last supported vite-node version
  • 2cbad0a chore: release v3.2.5
  • 385a1ae fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
  • af88b1f feat(api): add allowWrite and allowExec options to api [backport to v3]...
  • c666d14 chore: release v3.2.4
  • 8a18c8e fix(cli): throw error when --shard x/\<count> exceeds count of test files (#...
  • 8abd7cc chore(deps): update tinypool (#8174)
  • 93f3200 fix(deps): update all non-major dependencies (#8123)
  • 0c3be6f fix(coverage): ignore SCSS in browser mode (#8161)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vitest since your current version.


Updates body-parser from 1.20.3 to 2.3.0

Release notes

Sourced from body-parser's releases.

v2.3.0

Important: Security

What's Changed

New Contributors

Full Changelog: expressjs/body-parser@v2.2.2...v2.3.0

v2.2.2

What's Changed

... (truncated)

Changelog

Sourced from body-parser's changelog.

2.3.0 / 2026-06-15

  • Security fix for GHSA-v422-hmwv-36x6
  • fix: use static exports instead of lazy getters to improve ESM compatibility
  • feat: add subpath exports for individual parsers
  • fix: improve limit option validation (#698)
    • Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement
    • null and undefined fall back to the default 100kb limit
  • deps:
    • content-type@^2.0.0
    • http-errors@^2.0.1
    • iconv-lite^0.7.2
    • qs@^6.15.2
    • raw-body@^3.0.2
    • type-is@^2.1.0

2.2.2 / 2026-01-07

  • deps: qs@^6.14.1
  • refactor(json): simplify strict mode error string construction

2.2.1 / 2025-11-24

  • Security fix for GHSA-wqch-xfxh-vrr4
  • deps:
    • type-is@^2.0.1
    • iconv-lite@^0.7.0
      • Handle split surrogate pairs when encoding UTF-8
      • Avoid false positives in encodingExists by using prototype-less objects
    • raw-body@^3.0.1
    • debug@^4.4.3

2.2.0 / 2025-03-27

  • refactor: normalize common options for all parsers
  • deps:
    • iconv-lite@^0.6.3

2.1.0 / 2025-02-10

  • deps:
    • type-is@^2.0.0
    • debug@^4.4.0
    • Removed destroy
  • refactor: prefix built-in node module imports

... (truncated)

Commits
  • d0f2ace 2.3.0 (#735)
  • 7d03f2f chore: updated deps to latest (#733)
  • 8024ba7 build(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#732)
  • 32b4ed4 build(deps): bump github/codeql-action from 4.35.3 to 4.36.1 (#731)
  • ff0f6b9 docs: update outdated reference to MDN docs (#730)
  • 14d001a refactor: switch to const/let and enable eslint no-var rule (#729)
  • 37f36a2 deps: update content-type and type-is (#728)
  • e1c244b build(deps): bump github/codeql-action from 4.35.1 to 4.35.3 (#723)
  • e01087f build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#724)
  • a7698d3 build(deps): bump actions/setup-node from 6.3.0 to 6.4.0 (#725)
  • Additional commits viewable in compare view

Updates js-yaml from 4.1.0 to 4.3.1

Changelog

Sourced from js-yaml's changelog.

4.3.1 - 2026-07-31

Security

  • [backport] Remove quadratic complexity from !!omap duplicate key detection.

4.3.0 - 2026-06-27

Added

  • [backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

  • Restore umd builds back to es5.

Removed

  • [backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

[4.2.0] - 2026-06-01

Added

  • Added docs/safety.md with notes about processing untrusted YAML.
  • Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.
  • Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.
  • Added sourcemaps to dist/ builds.

Changed

  • Stop resolving numbers with underscores as numeric scalars, #627.
  • Switched dev toolchains to Vite / neostandard.
  • Updated demo.
  • Reorganized tests.
  • dist/ files are no longer kept in the repository.

Fixed

  • Fix parsing of properties on the first implicit block mapping key, #62.
  • Fix trailing whitespace handling when folding flow scalar lines, #307.
  • Reject top-level block scalars without content indentation, #280.
  • Ensure numbers survive round-trip, #737.
  • Fix test coverage for issue #221.
  • Fix flow scalar trailing whitespace folding, #307.
  • Fix digits in YAML named tag handles.

Security

  • Fix potential DoS via quadratic complexity in merge - deduplicate repeated elements (makes sense for malformed files > 10K).

[3.14.2] - 2025-11-15

Security

... (truncated)

Commits
  • 86e91b8 4.3.1 released
  • c3cc4b0 Backport quadratic complexity fix for !!omap
  • 33d05b5 4.3.0 released
  • 663bfab Drop demo publish, to not override new v5 one.
  • 1cb8c7b Add v4-legacy tag for publish
  • 02f27af Restore umd builds back to es5
  • 8be84ed Fix es5 compatibility
  • 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
  • 6842ef6 doc polish
  • 590dbab 4.2.0 released
  • Additional commits viewable in compare view

Updates linkify-it from 5.0.0 to 5.0.2

Changelog

Sourced from linkify-it's changelog.

5.0.2 / 2026-07-02

  • Fixed DoS in mailto: links (restrict user name to 64 chars).
  • Restricted user/pass part length in links.

5.0.1 / 2026-05-23

  • Fixed DoS in fuzzy links/emails search.
  • Reworked search logic - check each pattern separate, use g regexes instead of slice.
  • Removed internal cache - useless overcomplication.
Commits

Updates markdown-it from 14.1.0 to 14.3.0

Changelog

Sourced from markdown-it's changelog.

[14.3.0] - 2026-07-02

Changed

  • Reworked build pipeline & tools.
  • Added source maps.
  • Bumped linkify-it to 5.0.2.

Fixed

  • Preserve backslash-space hard line breaks, matching CommonMark 6.7, #1185.

[14.2.0] - 2026-05-24

Added

  • isPunctCharCode to utilities.

Fixed

  • Don't end HTML comment blocks on a blank line, #1155.
  • Properly recognize astral chars (surrogates) in delimiter scans for emphasis-like markers, #1072. Big thanks to @​tats-u for his global efforts with improving CJK support.
  • Preserve unicode whitespaces when trimm headings/paragraphs, #1074.
  • More strict entities decode to avoid false positives ;, #1096.
  • Restore block parser state on fail in lheading rule, #1131.

Security

  • Fixed poor smartquotes perfomance on > 70k quotes in single block
  • Bumped linkify-it to 5.0.1 with fixed potential perfomance issues.

[14.1.1] - 2026-01-11

Security

  • Fixed regression from v13 in linkify inline rule. Specific patterns could cause high CPU use. Thanks to @​ltduc147 for report.
Commits
  • ff0ee08 14.3.0 released
  • 52e2749 Bump linkify-it / vite deps
  • 56c2404 fix: keep backslash-space hard line break (CommonMark 6.7) (#1185)
  • 0fbb18b Bump vite from 8.0.14 to 8.0.16 (#1181)
  • 83450e2 Rework benchmark deps and bump versions
  • 57a6863 benchmark => tinybench
  • 7608db1 Update CI config
  • 9d8eb42 Added package-lock and updated versions to latest possible
  • 0aee70d lint: enable @​stylistic/no-multi-spaces rule
  • 8878985 lint => neostandard
  • Additional commits viewable in compare view

Updates postcss from 8.4.49 to 8.5.26

Release notes

Sourced from postcss's releases.

8.5.26

  • Fixed list.split() regression (by @​lazerg).
  • Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

  • Fixed Maximum call stack size exceeded error.
  • Fixed Prototype hijacking for postcss.fromJSON().
  • Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

8.5.15

  • Fixed declaration parsing performance (by @​homanp).

8.5.14

@dependabot
chore(deps): bump the npm_and_yarn group across 2 directories with 13…
349f956 
… updates

Bumps the npm_and_yarn group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [dd-trace](https://github.com/DataDog/dd-trace-js) | `5.28.0` | `5.100.0` |
| [undici](https://github.com/nodejs/undici) | `6.20.1` | `6.28.0` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `2.1.8` | `3.2.6` |
| [body-parser](https://github.com/expressjs/body-parser) | `1.20.3` | `2.3.0` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.0` | `4.3.1` |
| [linkify-it](https://github.com/markdown-it/linkify-it) | `5.0.0` | `5.0.2` |
| [markdown-it](https://github.com/markdown-it/markdown-it) | `14.1.0` | `14.3.0` |
| [tmp](https://github.com/raszi/node-tmp) | `0.2.3` | `0.2.7` |

Bumps the npm_and_yarn group with 2 updates in the /sdk directory: [brace-expansion](https://github.com/juliangruber/brace-expansion) and [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core).


Updates `dd-trace` from 5.28.0 to 5.100.0
- [Release notes](https://github.com/DataDog/dd-trace-js/releases)
- [Commits](DataDog/dd-trace-js@v5.28.0...v5.100.0)

Updates `undici` from 6.20.1 to 6.28.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.20.1...v6.28.0)

Updates `vitest` from 2.1.8 to 3.2.6
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v3.2.6/packages/vitest)

Updates `body-parser` from 1.20.3 to 2.3.0
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@1.20.3...v2.3.0)

Updates `js-yaml` from 4.1.0 to 4.3.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.3.1)

Updates `linkify-it` from 5.0.0 to 5.0.2
- [Changelog](https://github.com/markdown-it/linkify-it/blob/master/CHANGELOG.md)
- [Commits](markdown-it/linkify-it@5.0.0...5.0.2)

Updates `markdown-it` from 14.1.0 to 14.3.0
- [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md)
- [Commits](markdown-it/markdown-it@14.1.0...14.3.0)

Updates `postcss` from 8.4.49 to 8.5.26
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.4.49...8.5.26)

Updates `qs` from 6.13.0 to 6.13.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.13.1)

Updates `tmp` from 0.2.3 to 0.2.7
- [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md)
- [Commits](raszi/node-tmp@v0.2.3...v0.2.7)

Updates `vite` from 5.4.11 to 7.3.6
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v7.3.6/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v7.3.6/packages/vite)

Updates `brace-expansion` from 1.1.11 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@1.1.11...v1.1.18)

Updates `@babel/core` from 7.23.2 to 7.29.7
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.7/packages/babel-core)

---
updated-dependencies:
- dependency-name: dd-trace
  dependency-version: 5.100.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 6.28.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: vitest
  dependency-version: 3.2.6
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: body-parser
  dependency-version: 2.3.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.3.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: linkify-it
  dependency-version: 5.0.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: markdown-it
  dependency-version: 14.3.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: postcss
  dependency-version: 8.5.26
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.13.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: tmp
  dependency-version: 0.2.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 7.3.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 1.1.18
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@babel/core"
  dependency-version: 7.29.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 10, 2026
@socket-security

socket-security Bot commented Aug 10, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatednpm/​dd-trace@​5.28.0 ⏵ 5.100.066 -10100 +1695 -596 +2100
Updatednpm/​vitest@​2.1.8 ⏵ 3.2.698100 +757898100
Addednpm/​uuid@​14.0.110010010088100
Updatednpm/​undici@​6.20.1 ⏵ 6.28.093100 +40100 +198100

View full report

@socket-security

socket-security Bot commented Aug 10, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm dd-trace is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package.json → npm/dd-trace@5.100.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/dd-trace@5.100.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants