Bump the npm_and_yarn group across 1 directory with 20 updates by dependabot[bot] · Pull Request #23 · ZoneCog/zone.bolt

dependabot · 2026-02-14T06:26:57Z

Bumps the npm_and_yarn group with 18 updates in the / directory:

Package	From	To
ai	`3.4.33`	`5.0.52`
diff	`5.2.0`	`5.2.2`
pnpm	`9.15.0`	`10.28.2`
vite	`5.4.11`	`5.4.21`
vitest	`2.1.8`	`2.1.9`
wrangler	`3.91.0`	`3.114.17`
@eslint/plugin-kit	`0.2.3`	`0.2.8`
@octokit/endpoint	`10.1.1`	`10.1.4`
@octokit/plugin-paginate-rest	`11.3.6`	`11.6.0`
@octokit/request-error	`6.1.5`	`6.1.8`
@octokit/request	`9.1.3`	`9.2.4`
brace-expansion	`1.1.11`	`1.1.12`
glob	`10.4.5`	`10.5.0`
js-yaml	`4.1.0`	`4.1.1`
lodash	`4.17.21`	`4.17.23`
pbkdf2	`3.1.2`	`3.1.5`
sha.js	`2.4.11`	`2.4.12`
tar-fs	`2.1.1`	`2.1.4`

Updates ai from 3.4.33 to 5.0.52

Commits

63d5f66 Version Packages (#8895)
930399b Backport: fix(ai): download files when intermediate file cannot be downloaded...
7ca78f1 Backport: feat(provider/gateway): Add new Qwen models to Gateway model string...
1cfc209 Backport: feat(provider/openai): OpenAILanguageModelOptions type (#8858)
347b7ec ci: rename v5.0 branch to release-v*
85909a9 Backport: chore(ai): update test message (#8875)
c56822d Backport: fix(ai): update uiMessageChunkSchema to satisfy the `UIMessageChu...
1461adf Backport: chore(examples): remove redundant OpenAI reasoning examples (#8871)
6bd07df Version Packages (#8853)
a45d61a ci(release): remove incorrect changeset bump for @ai-sdk/baseten
Additional commits viewable in compare view

Updates diff from 5.2.0 to 5.2.2

Changelog

Sourced from diff's changelog.

v5.2.2 - January 2026

Only change from 5.2.0 is a backport of the fix to GHSA-73rr-hh4g-fpgx.

v5.2.1 (deprecated)

Accidental release - do not use.

Commits

b7b6339 v5.2.2
b5377ab Update package version to 5.2.1
7801789 Backport kpdecker/jsdiff#649
042a837 Backport kpdecker/jsdiff#647
See full diff in compare view

Updates pnpm from 9.15.0 to 10.28.2

Release notes

Sourced from pnpm's releases.

pnpm 10.28.2

Patch Changes

Security fix: prevent path traversal in directories.bin field.

When pnpm installs a file: or git: dependency, it now validates that symlinks point within the package directory. Symlinks to paths outside the package root are skipped to prevent local data from being leaked into node_modules.

This fixes a security issue where a malicious package could create symlinks to sensitive files (e.g., /etc/passwd, ~/.ssh/id_rsa) and have their contents copied when the package is installed.

Note: This only affects file: and git: dependencies. Registry packages (npm) have symlinks stripped during publish and are not affected.

Fixed optional dependencies to request full metadata from the registry to get the libc field, which is required for proper platform compatibility checks #9950.

Platinum Sponsors

Gold Sponsors

... (truncated)

Changelog

Sourced from pnpm's changelog.

10.28.2

Patch Changes

Security fix: prevent path traversal in directories.bin field.

When pnpm installs a file: or git: dependency, it now validates that symlinks point within the package directory. Symlinks to paths outside the package root are skipped to prevent local data from being leaked into node_modules.

This fixes a security issue where a malicious package could create symlinks to sensitive files (e.g., /etc/passwd, ~/.ssh/id_rsa) and have their contents copied when the package is installed.

Note: This only affects file: and git: dependencies. Registry packages (npm) have symlinks stripped during publish and are not affected.

Fixed optional dependencies to request full metadata from the registry to get the libc field, which is required for proper platform compatibility checks #9950.

10.28.1

Patch Changes

Fixed installation of config dependencies from private registries.

Added support for object type in configDependencies when the tarball URL returned from package metadata differs from the computed URL #10431.

Fix path traversal vulnerability in binary fetcher ZIP extraction

Validate ZIP entry paths before extraction to prevent writing files outside target directory

Validate BinaryResolution.prefix (basename) to prevent directory escape via crafted prefix

Both attack vectors now throw ERR_PNPM_PATH_TRAVERSAL error

Support plain http:// and https:// URLs ending with .git as git repository dependencies.

Previously, URLs like https://gitea.example.org/user/repo.git#commit were not recognized as git repositories because they lacked the git+ prefix (e.g., git+https://). This caused issues when installing dependencies from self-hosted git servers like Gitea or Forgejo that don't provide tarball downloads.

Changes:

The git resolver now runs before the tarball resolver, ensuring git URLs are handled by the correct resolver

The git resolver now recognizes plain http:// and https:// URLs ending in .git as git repositories

Removed the isRepository check from the tarball resolver since it's no longer needed with the new resolver order

Fixes #10468

pnpm run -r and pnpm run --filter now fail with a non-zero exit code when no packages have the specified script. Previously, this only failed when all packages were selected. Use --if-present to suppress this error #6844.

Fixed a path traversal vulnerability in tarball extraction on Windows. The path normalization was only checking for ./ but not .\. Since backslashes are directory separators on Windows, malicious packages could use paths like foo\..\..\.npmrc to write files outside the package directory.

When running "pnpm exec" from a subdirectory of a project, don't change the current working directory to the root of the project #5759.

Fixed a path traversal vulnerability in pnpm's bin linking. Bin names starting with @ bypassed validation, and after scope normalization, path traversal sequences like ../../ remained intact.

Revert Try to avoid making network calls with preferOffline #10334.

Fix --save-peer to write valid semver ranges to peerDependencies for protocol-based installs (e.g. jsr:) by deriving from resolved versions when available and falling back to * if none is available #10417.

Do not exclude the root workspace project, when it is explicitly selected via a filter #10465.

10.28.0

Minor Changes

... (truncated)

Commits

89a2c4e chore(release): 10.28.2
a484cea fix(npm-resolver): request full metadata for optional dependencies (#10455)
c908370 test: fix
0b5a56a chore(release): 10.28.1
916b26b fix: prevent implicit root exclusion when user filters are provided (#10465)
9cbba28 fix(exec): preserve user execution cwd (#10445)
91a241e chore(release): 10.28.0
a9784fb revert: "chore: upgrade qs to 6.14.1 (#10389)"
787ed46 chore: upgrade qs to 6.14.1 (#10389)
6bdba72 chore(release): 10.27.0
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for pnpm since your current version.

Updates vite from 5.4.11 to 5.4.21

Release notes

Sourced from vite's releases.

v5.4.21

Please refer to CHANGELOG.md for details.

v5.4.20

Please refer to CHANGELOG.md for details.

v5.4.19

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

5.4.21 (2025-10-20)

fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20970) (cad1d31), closes #20968 #20970

chore: update CHANGELOG (ca88ed7)

5.4.20 (2025-09-08)

fix: apply fs.strict check to HTML files (#20736) (482000f), closes #20736

fix: port sirv@3.0.2 changes to sirv@2.0.4 (#20737) (4f1c35b), closes #20737

5.4.19 (2025-04-30)

fix: backport #19965, check static serve file inside sirv (#19966) (766947e), closes #19965 #19966

5.4.18 (2025-04-10)

fix: backport #19830, reject requests with # in request-target (#19831) (823675b), closes #19830 #19831

5.4.17 (2025-04-03)

fix: backport #19782, fs check with svg and relative paths (#19784) (84b2b46), closes #19782 #19784

5.4.16 (2025-03-31)

fix: backport #19761, fs check in transform middleware (#19762) (b627c50), closes #19761 #19762

5.4.15 (2025-03-24)

fix: backport #19702, fs raw query with query separators (#19703) (807d7f0), closes #19702 #19703

5.4.14 (2025-01-21)

fix: preview.allowedHosts with specific values was not respected (#19246) (9df6e6b), closes #19246

fix: allow CORS from loopback addresses by default (#19249) (7d1699c), closes #19249

... (truncated)

Commits

adce3c2 release: v5.4.21
cad1d31 fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20970)
ca88ed7 chore: update CHANGELOG
997700f release: v5.4.20
482000f fix: apply fs.strict check to HTML files (#20736)
80a333a release: v5.4.19
766947e fix: backport #19965, check static serve file inside sirv (#19966)
731b77d release: v5.4.18
823675b fix: backport #19830, reject requests with # in request-target (#19831)
0a2518a release: v5.4.17
Additional commits viewable in compare view

Updates vitest from 2.1.8 to 2.1.9

Release notes

Sourced from vitest's releases.

v2.1.9

This release includes security patches for:

Browser mode serves arbitrary files | CVE-2025-24963

Remote Code Execution when accessing a malicious website while Vitest API server is listening | CVE-2025-24964

🐞 Bug Fixes

backport vitest-dev/vitest#7317 to v2 - by @hi-ogawa in vitest-dev/vitest#7318

(backport #7340 to v2) restrict served files from /__screenshot-error - by @hi-ogawa in vitest-dev/vitest#7343

View changes on GitHub

Commits

c9e59a0 chore: release v2.1.9
e0fe1d8 fix: backport #7317 to v2 (#7318)
See full diff in compare view

Updates wrangler from 3.91.0 to 3.114.17

Release notes

Sourced from wrangler's releases.

wrangler@3.114.17

Patch Changes

#11891 6d5557b Thanks @emily-shen! - Use argument array when executing git commands with wrangler pages deploy

Pass user provided values from --commit-hash safely to underlying git command.

Changelog

Sourced from wrangler's changelog.

3.114.17

Patch Changes

#11891 6d5557b Thanks @emily-shen! - Use argument array when executing git commands with wrangler pages deploy

Pass user provided values from --commit-hash safely to underlying git command.

3.114.16

Patch Changes

#11689 9bab0a0 Thanks @ascorbic! - Display a warning when authentication errors occur and the account_id in your Wrangler configuration does not match any of your authenticated accounts. This helps identify configuration issues where you may have the wrong account ID set in your wrangler.toml or wrangler.jsonc file.

#10737 c41a078 Thanks @workers-devprod! - Allow WRANGLER_SEND_ERROR_REPORTS env var to override whether to report Wrangler crashes to Sentry

#11134 bd39455 Thanks @petebacondarwin! - Reduce the amount of arguments being passed in metrics capture.

Now the argument values that are captured come from an allow list, and can be marked as ALLOW (capture the real value) or REDACT (capture as "").

#11020 9cb702e Thanks @dario-piotrowicz! - Fix observability.logs.persist being flagged as an unexpected field during the wrangler config file validation

#11147 cf4993b Thanks @FlorentCollin! - Improve the formatting of the D1 execute command to always show the duration in milliseconds with two decimal places.

#11650 cc29ead Thanks @ascorbic! - fix: respect TypeScript path aliases when resolving non-JS modules with module rules

When importing non-JavaScript files (like .graphql, .txt, etc.) using TypeScript path aliases defined in tsconfig.json, Wrangler's module-collection plugin now correctly resolves these imports. Previously, path aliases were only respected for JavaScript/TypeScript files, causing imports like import schema from '~lib/schema.graphql' to fail when using module rules.

#11179 7f779e9 Thanks @ascorbic! - Log a more helpful error when attempting to "r2 object put" a non-existent file

#11501 c78d942 Thanks @edmundhung! - fix: prevent reporting SQLite error from wrangler d1 execute to Sentry

#11262 b2683f7 Thanks @workers-devprod! - Avoid using object lookup for OAuth Error classes

#11107 d8037d3 Thanks @workers-devprod! - Fixed conflict between --env and --expires flags in wrangler r2 object put.

--e now aliases --env only, and NOT --expires.

#10961 02d2ea9 Thanks @devin-ai-integration! - Acquire Cloudflare Access tokens for additional requests made during a wrangler dev --remote session

#11108 892ec4f Thanks @emily-shen! - Fixed self-bindings (service bindings to the same worker) showing as [not connected] in wrangler dev. Self-bindings now correctly show as [connected] since a worker is always available to itself.

#11138 3db872a Thanks @devin-ai-integration! - Implement tail-based logging for wrangler dev remote mode, behind the --x-tail-tags flag. This will become the default in the future.

#10889 204616c Thanks @workers-devprod! - Clarify that wrangler check startup generates a local CPU profile

#11491 ed8aaef Thanks @edmundhung! - Explicitly close FileHandle in wrangler d1 execute to support Node 25

#10962 203e599 Thanks @devin-ai-integration! - Fixed duplicate warning messages appearing during wrangler dev when configuration changes or state transitions occur

... (truncated)

Commits

f21ee75 Version Packages (#11895)
6d5557b fix: execute git commands in pages deploy safely (#11889) (#11891)
0e19ae9 Version Packages (#10906)
3db872a [v3 backport] Backport tail-based logging from #11135 and #11346 (#11138)
02d2ea9 Fix remote dev with Access (#10961)
9bab0a0 fix(wrangler): add warning when account_id mismatch detected on auth error (v...
4b18c6f Introduce internal isWorkerNotFoundError utility and avoid worker-not-found...
ed8aaef fix(wrangler): close FileHandle in to support Node 25 (#11491)
c78d942 V3 backport of #11467: prevent SQLite users error from being reported to Sent...
cc29ead fix: respect TypeScript path aliases when resolving non-JS modules with modul...
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for wrangler since your current version.

Updates @eslint/plugin-kit from 0.2.3 to 0.2.8

Release notes

Sourced from @eslint/plugin-kit's releases.

plugin-kit: v0.2.8

0.2.8 (2025-04-01)

Dependencies

The following workspace dependencies were updated

dependencies

@eslint/core bumped from ^0.12.0 to ^0.13.0

plugin-kit: v0.2.7

0.2.7 (2025-02-21)

Dependencies

The following workspace dependencies were updated

dependencies

@eslint/core bumped from ^0.11.0 to ^0.12.0

plugin-kit: v0.2.6

0.2.6 (2025-01-31)

Bug Fixes

CommonJS types in all packages (#148) (c91866c)

Dependencies

The following workspace dependencies were updated

dependencies

@eslint/core bumped from ^0.10.0 to ^0.11.0

plugin-kit: v0.2.5

0.2.5 (2025-01-09)

Bug Fixes

make plugin-kit types usable in CommonJS (#143) (f77ba17)

Dependencies

The following workspace dependencies were updated

dependencies

@eslint/core bumped from ^0.9.1 to ^0.10.0

... (truncated)

Changelog

Sourced from @eslint/plugin-kit's changelog.

0.2.8 (2025-04-01)

Dependencies

The following workspace dependencies were updated

dependencies

@eslint/core bumped from ^0.12.0 to ^0.13.0

0.2.7 (2025-02-21)

Dependencies

The following workspace dependencies were updated

dependencies

@eslint/core bumped from ^0.11.0 to ^0.12.0

0.2.6 (2025-01-31)

Bug Fixes

CommonJS types in all packages (#148) (c91866c)

Dependencies

The following workspace dependencies were updated

dependencies

@eslint/core bumped from ^0.10.0 to ^0.11.0

0.2.5 (2025-01-09)

Bug Fixes

make plugin-kit types usable in CommonJS (#143) (f77ba17)

Dependencies

The following workspace dependencies were updated

dependencies

@eslint/core bumped from ^0.9.1 to ^0.10.0

0.2.4 (2024-12-04)

Bug Fixes

... (truncated)

Commits

1615a01 chore: release main (#174)
6199b6e docs: Update README sponsors
1f9c609 docs: Update README sponsors
473c962 docs: Update README sponsors
a48aa6a docs: Update README sponsors
49d1d20 docs: Update README sponsors
3e9b0eb chore: release main (#157)
d4a04b9 docs: Update README sponsors
94eefd0 docs: Update README sponsors
a57dd45 docs: Update README sponsors
Additional commits viewable in compare view

Updates @octokit/endpoint from 10.1.1 to 10.1.4

Release notes

Sourced from @octokit/endpoint's releases.

v10.1.4

10.1.4 (2025-04-10)

Bug Fixes

deps: update dependency @octokit/types to v14 (#523) (ca8c366)

v10.1.3

10.1.3 (2025-02-13)

Bug Fixes

Fix a ReDos vulnerability, reported by @DayShift (6c9c5be)

v10.1.2

10.1.2 (2024-12-31)

Bug Fixes

deps: bump @octokit/types to improve Deno compat (#507) (15d700b)

Commits

ca8c366 fix(deps): update dependency @octokit/types to v14 (#523)
7b9a884 maint: cleanup package.json and use Node LTS instead of v16 (#519)
bcc0f97 build(deps): bump vite from 6.1.0 to 6.2.5 (#522)
255c59d ci(action): update actions/create-github-app-token action to v2 (#521)
adeee3e chore(deps): update dependency prettier to v3.5.3 (#518)
ea60e07 chore(deps): update dependency semantic-release-plugin-update-version-in-file...
8f43346 chore(deps): update dependency prettier to v3.5.2 (#517)
2209b07 chore(deps): update dependency prettier to v3.5.1 (#513)
d6cf1ad fix: linting issues breaking ci (#514)
6c9c5be Merge commit from fork
Additional commits viewable in compare view

Updates @octokit/plugin-paginate-rest from 11.3.6 to 11.6.0

Release notes

Sourced from @octokit/plugin-paginate-rest's releases.

v11.6.0

11.6.0 (2025-03-18)

Features

new /orgs/{org}/issue-types, /orgs/{org}/issue-types/{issue_type_id} enpoints (#666) (1f44b54)

v11.5.0

11.5.0 (2025-03-18)

Features

new GET /orgs/{org}/actions/hosted-runners, GET /orgs/{org}/actions/runner-groups/{runner_group_id}/hosted-runners, GET /orgs/{org}/rulesets/{ruleset_id}/history, GET /orgs/{org}/settings/network-configurations, GET /repos/{owner}/{repo}/rulesets/{ruleset_id}/history endpoints (#649) (ef30a05)

v11.4.4-cjs.2

11.4.4-cjs.2 (2025-02-26)

[!IMPORTANT] This is a special release to backport newer changes to CJS and address a ReDos vulnerability

Bug Fixes

deps: update @octokit/plugin-rest-endpoint-methods (2c70eaf)

v11.4.4-cjs.1

11.4.4-cjs.1 (2025-02-26)

[!IMPORTANT] This is a special release to backport newer changes to CJS and address a ReDos vulnerability

Bug Fixes

release: set prerelease flag for correct channel (ce534d9) See octokit/plugin-paginate-rest.js@v11.3.1...v11.4.4-cjs.1 for the full comparision

Reverts

Revert "docs(README): update examples to use ESM (#611)" (1389b71)

Revert "feat: package is now ESM (#596)" (64ba6f4)

Revert "fix(pkg): add default fallback and types export (#612)" (27a8552)

v11.4.3

... (truncated)

Commits

1f44b54 feat: new /orgs/{org}/issue-types, `/orgs/{org}/issue-types/{issue_type_id}...
ef30a05 feat: new GET /orgs/{org}/actions/hosted-runners, `GET /orgs/{org}/actions/...
fbadb74 chore(deps): update dependency prettier to v3.5.3 (#665)
1c297ca chore(deps): update dependency semantic-release-plugin-update-version-in-file...
60d26d9 chore(deps): update dependency prettier to v3.5.2 (#664)
9a51aad fix(types): correct pagination return type for data which is an array (#662)
8b8c500 fix(types): add back the pagination keys (#653)
41876f4 chore(deps): update dependency prettier to v3.5.1 (#658)
7d1fade fix: mitigate ReDos issues & linting issues (#659)
bb6c4f9 Merge commit from fork
Additional commits viewable in compare view

Updates @octokit/request-error from 6.1.5 to 6.1.8

Release notes

Sourced from @octokit/request-error's releases.

v6.1.8

6.1.8 (2025-04-10)

Bug Fixes

deps: update dependency @octokit/types to v14 (#505) (ab4ea7b)

v6.1.7

6.1.7 (2025-02-13)

Bug Fixes

ReDos regex vulnerability, reported by @DayShift (d558320874a4bc8d356babf1079e6f0056a59b9e)

v6.1.6

6.1.6 (2024-12-29)

Bug Fixes

deps: bump @octokit/types to fix Deno compat (#483) (e01d470)

Commits

ab4ea7b fix(deps): update dependency @octokit/types to v14 (#505)
7eba3d2 chore(deps): update dependency tinybench to v4 (#501)
549624b build(deps): bump vite from 6.2.2 to 6.2.5 (#504)
11c1adc build(deps): lock file maintenance (#502)
de5f24d chore(deps): update dependency prettier to v3.5.3 (#499)
ef66347 build(deps): lock file maintenance (#500)
787201d build(deps): lock file maintenance (#498)
5ab6a76 chore(deps): update dependency prettier to v3.5.2 (#497)
f8f8c4a build(deps): lock file maintenance (#496)
eee2491 chore(deps): update dependency prettier to v3.5.1 (#493)
Additional commits viewable in compare view

Updates @octokit/request from 9.1.3 to 9.2.4

Release notes

Sourced from @octokit/request's releases.

v9.2.4

9.2.4 (2025-06-20)

Bug Fixes

pkg: unreplaced version number in dist-bundle/ (#765) (afa9d09)

v9.2.3

9.2.3 (2025-04-10)

Bug Fixes

deps: update dependency @octokit/types to v14 (#753) (7d576b0)

v9.2.2

9.2.2 (2025-02-14)

Bug Fixes

deps: update dependency @octokit/request-error to v6.1.7 [security] (#740) (4b2f485)

v9.2.1

9.2.1 (2025-02-13)

Bug Fixes

mitigate ReDos vulnerabilities & lint (#738) (6bb29ba)

v9.2.0

9.2.0 (2025-01-16)

Features

correctly parse response bodies as JSON where the Content-Type is application/scim+json (#731) (00bf316)

v9.1.4

9.1.4 (2024-12-29)

Bug Fixes

deps: bump @octokit/types to fix deno compat (#730) (324ffef)

Commits

afa9d09 fix(pkg): unreplaced version number in dist-bundle/ (#765)
3773e64 ci: replace OCTOKITBOT_PROJECT_ACTION_TOKEN and OCTOKITBOT_PAT with a tok...
7d576b0 fix(deps): update dependency @octokit/types to v14 (#753)
c9bfc37 build(deps): bump vite from 6.1.0 to 6.2.5 (#750)
f7b9616 ci(prettier): use Node LTS instead of Node 16 (#748)
1955847 chore(deps): update dependency prettier to v3.5.3 (#745)
b71107b chore(deps): update dependency semantic-release-plugin-update-version-in-file...
c855943 chore(deps): update dependency prettier to v3.5.2 (#743)
4b2f485 fix(deps): update dependency @octokit/request-error to v6.1.7 [security] (#740)
0320a42 chore(deps): update dependency prettier to v3.5.1 (#737)
Additional commits viewable in compare view

Updates brace-expansion from 1.1.11 to 1.1.12

Release notes

Sourced from brace-expansion's releases.

v1.1.12

pkg: publish on tag 1.x c460dbd

fmt ccb8ac6

Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

https://github.com/juliangruber/brac...
Description has been truncated

Bumps the npm_and_yarn group with 18 updates in the / directory: | Package | From | To | | --- | --- | --- | | [ai](https://github.com/vercel/ai) | `3.4.33` | `5.0.52` | | [diff](https://github.com/kpdecker/jsdiff) | `5.2.0` | `5.2.2` | | [pnpm](https://github.com/pnpm/pnpm/tree/HEAD/pnpm) | `9.15.0` | `10.28.2` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `5.4.11` | `5.4.21` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `2.1.8` | `2.1.9` | | [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `3.91.0` | `3.114.17` | | [@eslint/plugin-kit](https://github.com/eslint/rewrite/tree/HEAD/packages/plugin-kit) | `0.2.3` | `0.2.8` | | [@octokit/endpoint](https://github.com/octokit/endpoint.js) | `10.1.1` | `10.1.4` | | [@octokit/plugin-paginate-rest](https://github.com/octokit/plugin-paginate-rest.js) | `11.3.6` | `11.6.0` | | [@octokit/request-error](https://github.com/octokit/request-error.js) | `6.1.5` | `6.1.8` | | [@octokit/request](https://github.com/octokit/request.js) | `9.1.3` | `9.2.4` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.11` | `1.1.12` | | [glob](https://github.com/isaacs/node-glob) | `10.4.5` | `10.5.0` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.0` | `4.1.1` | | [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.17.23` | | [pbkdf2](https://github.com/browserify/pbkdf2) | `3.1.2` | `3.1.5` | | [sha.js](https://github.com/crypto-browserify/sha.js) | `2.4.11` | `2.4.12` | | [tar-fs](https://github.com/mafintosh/tar-fs) | `2.1.1` | `2.1.4` | Updates `ai` from 3.4.33 to 5.0.52 - [Release notes](https://github.com/vercel/ai/releases) - [Changelog](https://github.com/vercel/ai/blob/main/CHANGELOG.md) - [Commits](https://github.com/vercel/ai/compare/ai@3.4.33...ai@5.0.52) Updates `diff` from 5.2.0 to 5.2.2 - [Changelog](https://github.com/kpdecker/jsdiff/blob/master/release-notes.md) - [Commits](kpdecker/jsdiff@v5.2.0...v5.2.2) Updates `pnpm` from 9.15.0 to 10.28.2 - [Release notes](https://github.com/pnpm/pnpm/releases) - [Changelog](https://github.com/pnpm/pnpm/blob/v10.28.2/pnpm/CHANGELOG.md) - [Commits](https://github.com/pnpm/pnpm/commits/v10.28.2/pnpm) Updates `vite` from 5.4.11 to 5.4.21 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v5.4.21/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v5.4.21/packages/vite) Updates `vitest` from 2.1.8 to 2.1.9 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Commits](https://github.com/vitest-dev/vitest/commits/v2.1.9/packages/vitest) Updates `wrangler` from 3.91.0 to 3.114.17 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Changelog](https://github.com/cloudflare/workers-sdk/blob/wrangler@3.114.17/packages/wrangler/CHANGELOG.md) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@3.114.17/packages/wrangler) Updates `@eslint/plugin-kit` from 0.2.3 to 0.2.8 - [Release notes](https://github.com/eslint/rewrite/releases) - [Changelog](https://github.com/eslint/rewrite/blob/main/packages/plugin-kit/CHANGELOG.md) - [Commits](https://github.com/eslint/rewrite/commits/plugin-kit-v0.2.8/packages/plugin-kit) Updates `@octokit/endpoint` from 10.1.1 to 10.1.4 - [Release notes](https://github.com/octokit/endpoint.js/releases) - [Commits](octokit/endpoint.js@v10.1.1...v10.1.4) Updates `@octokit/plugin-paginate-rest` from 11.3.6 to 11.6.0 - [Release notes](https://github.com/octokit/plugin-paginate-rest.js/releases) - [Commits](octokit/plugin-paginate-rest.js@v11.3.6...v11.6.0) Updates `@octokit/request-error` from 6.1.5 to 6.1.8 - [Release notes](https://github.com/octokit/request-error.js/releases) - [Commits](octokit/request-error.js@v6.1.5...v6.1.8) Updates `@octokit/request` from 9.1.3 to 9.2.4 - [Release notes](https://github.com/octokit/request.js/releases) - [Commits](octokit/request.js@v9.1.3...v9.2.4) Updates `brace-expansion` from 1.1.11 to 1.1.12 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@1.1.11...v1.1.12) Updates `glob` from 10.4.5 to 10.5.0 - [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md) - [Commits](isaacs/node-glob@v10.4.5...v10.5.0) Updates `js-yaml` from 4.1.0 to 4.1.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.0...4.1.1) Updates `lodash` from 4.17.21 to 4.17.23 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.17.23) Updates `pbkdf2` from 3.1.2 to 3.1.5 - [Changelog](https://github.com/browserify/pbkdf2/blob/master/CHANGELOG.md) - [Commits](browserify/pbkdf2@v3.1.2...v3.1.5) Updates `react-router` from 6.28.0 to 6.30.3 - [Release notes](https://github.com/remix-run/react-router/releases) - [Changelog](https://github.com/remix-run/react-router/blob/react-router@6.30.3/packages/react-router/CHANGELOG.md) - [Commits](https://github.com/remix-run/react-router/commits/react-router@6.30.3/packages/react-router) Updates `sha.js` from 2.4.11 to 2.4.12 - [Changelog](https://github.com/browserify/sha.js/blob/master/CHANGELOG.md) - [Commits](browserify/sha.js@v2.4.11...v2.4.12) Updates `tar-fs` from 2.1.1 to 2.1.4 - [Commits](mafintosh/tar-fs@v2.1.1...v2.1.4) Updates `undici` from 5.28.4 to 5.29.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v5.28.4...v5.29.0) --- updated-dependencies: - dependency-name: ai dependency-version: 5.0.52 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: diff dependency-version: 5.2.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: pnpm dependency-version: 10.28.2 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 5.4.21 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vitest dependency-version: 2.1.9 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: wrangler dependency-version: 3.114.17 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@eslint/plugin-kit" dependency-version: 0.2.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@octokit/endpoint" dependency-version: 10.1.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@octokit/plugin-paginate-rest" dependency-version: 11.6.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@octokit/request-error" dependency-version: 6.1.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@octokit/request" dependency-version: 9.2.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: glob dependency-version: 10.5.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.1.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.17.23 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: pbkdf2 dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: react-router dependency-version: 6.30.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: sha.js dependency-version: 2.4.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar-fs dependency-version: 2.1.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 5.29.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

cloudflare-workers-and-pages · 2026-02-14T06:26:59Z

Deploying zone-bolt with Cloudflare Pages

Latest commit:	`d2dd741`
Status:	🚫 Build failed.

View logs

codesandbox · 2026-02-14T06:27:00Z

Review or Edit in CodeSandbox

Open the branch in Web Editor • VS Code • Insiders

Open Preview

github-actions · 2026-02-25T03:07:47Z

This pull request has been marked as stale due to inactivity. If no further activity occurs, it will be closed in 7 days.

dependabot · 2026-03-01T03:10:17Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Feb 14, 2026

github-actions bot added the stale label Feb 25, 2026

github-actions bot closed this Mar 1, 2026

dependabot bot deleted the dependabot/npm_and_yarn/npm_and_yarn-13b24784ca branch March 1, 2026 03:10

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the npm_and_yarn group across 1 directory with 20 updates#23

Bump the npm_and_yarn group across 1 directory with 20 updates#23
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-13b24784ca

dependabot bot commented on behalf of github Feb 14, 2026

Uh oh!

cloudflare-workers-and-pages bot commented Feb 14, 2026 •

edited

Loading

Uh oh!

codesandbox bot commented Feb 14, 2026

Uh oh!

github-actions bot commented Feb 25, 2026

Uh oh!

dependabot bot commented on behalf of github Mar 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Feb 14, 2026

v5.2.2 - January 2026

v5.2.1 (deprecated)

pnpm 10.28.2

Patch Changes

Platinum Sponsors

Gold Sponsors

10.28.2

Patch Changes

10.28.1

Patch Changes

10.28.0

Minor Changes

v5.4.21

v5.4.20

v5.4.19

5.4.21 (2025-10-20)

5.4.20 (2025-09-08)

5.4.19 (2025-04-30)

5.4.18 (2025-04-10)

5.4.17 (2025-04-03)

5.4.16 (2025-03-31)

5.4.15 (2025-03-24)

5.4.14 (2025-01-21)

v2.1.9

🐞 Bug Fixes

View changes on GitHub

wrangler@3.114.17

Patch Changes

3.114.17

Patch Changes

3.114.16

Patch Changes

plugin-kit: v0.2.8

0.2.8 (2025-04-01)

Dependencies

plugin-kit: v0.2.7

0.2.7 (2025-02-21)

Dependencies

plugin-kit: v0.2.6

0.2.6 (2025-01-31)

Bug Fixes

Dependencies

plugin-kit: v0.2.5

0.2.5 (2025-01-09)

Bug Fixes

Dependencies

0.2.8 (2025-04-01)

Dependencies

0.2.7 (2025-02-21)

Dependencies

0.2.6 (2025-01-31)

Bug Fixes

Dependencies

0.2.5 (2025-01-09)

Bug Fixes

Dependencies

0.2.4 (2024-12-04)

Bug Fixes

v10.1.4

10.1.4 (2025-04-10)

Bug Fixes

v10.1.3

10.1.3 (2025-02-13)

Bug Fixes

v10.1.2

10.1.2 (2024-12-31)

Bug Fixes

v11.6.0

11.6.0 (2025-03-18)

Features

v11.5.0

11.5.0 (2025-03-18)

Features

v11.4.4-cjs.2

11.4.4-cjs.2 (2025-02-26)

Bug Fixes

v11.4.4-cjs.1

11.4.4-cjs.1 (2025-02-26)

cloudflare-workers-and-pages bot commented Feb 14, 2026 •

edited

Loading