Skip to content

build(deps): bump the npm_and_yarn group across 1 directory with 12 updates#118

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-1bea177e98
Open

build(deps): bump the npm_and_yarn group across 1 directory with 12 updates#118
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-1bea177e98

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Mar 12, 2026

Bumps the npm_and_yarn group with 2 updates in the / directory: lodash and semantic-release.

Updates lodash from 4.17.21 to 4.17.23

Commits

Updates semantic-release from 17.4.7 to 25.0.3

Release notes

Sourced from semantic-release's releases.

v25.0.3

25.0.3 (2026-01-30)

Bug Fixes

v25.0.2

25.0.2 (2025-11-07)

Bug Fixes

  • deps: update dependency read-package-up to v12 (#3935) (1494cb9)

v25.0.1

25.0.1 (2025-10-19)

Bug Fixes

v25.0.1-beta.3

25.0.1-beta.3 (2025-10-19)

Bug Fixes

  • deps: update to latest npm plugin (a96aced)

v25.0.1-beta.2

25.0.1-beta.2 (2025-10-19)

Bug Fixes

v25.0.1-beta.1

25.0.1-beta.1 (2025-10-16)

Bug Fixes

... (truncated)

Commits
  • f404124 fix(deps): remove deprecated semver-diff (#3980)
  • fef7e34 docs: warn against using registry-url in setup-node (#4024)
  • 699d470 chore(deps): update dependency lockfile-lint to v5 (#4022)
  • c7c6f7a chore(deps): update dependency tempy to v3.1.2 (#4021)
  • 1ce5088 ci(action): update github/codeql-action action to v4.32.0 (#4019)
  • 9bb0d87 chore(deps): lock file maintenance (#4016)
  • 490171c chore(deps): update npm to v11.8.0 (#4015)
  • f6411e9 chore(deps): update dependency prettier to v3.8.1 (#4014)
  • c71c576 chore(deps): update dependency publint to v0.3.17 (#4013)
  • 989e18c chore(deps): update dependency tempy to v3.1.1 (#4012)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for semantic-release since your current version.


Updates @octokit/plugin-paginate-rest from 2.21.3 to 14.0.0

Release notes

Sourced from @​octokit/plugin-paginate-rest's releases.

v14.0.0

14.0.0 (2025-10-31)

Features

  • add immutable releases, enterprise team membership, enterprise team organization endpoints (413e899)

BREAKING CHANGES

  • Remove GET /projects/{project_id}/columns
  • Remove GET /enterprises/{enterprise}/secret-scanning/alerts

v13.2.1

13.2.1 (2025-10-20)

Bug Fixes

v13.2.0

13.2.0 (2025-09-29)

Features

  • new Projects v2 endpoints, new code scanning dismissal endpoints, many other endpoints (#690) (0e236cb)

v13.1.1

13.1.1 (2025-06-27)

Bug Fixes

  • handle url in response when using pagination with compareCommits (#686) (8e5da25)

v13.1.0

13.1.0 (2025-06-16)

Features

  • add paginatantion support for compareCommits and compareCommitsWithBasehead (#678) (6d8ea8a)

v13.0.1

13.0.1 (2025-05-25)

... (truncated)

Commits
  • 413e899 feat: add immutable releases, enterprise team membership, enterprise team org...
  • 3d311d6 chore(deps): update dependency @​types/node to v24 (#701)
  • ba56fbc fix(deps): update @octokit/types (#698)
  • 80745be ci(action): update actions/checkout action to v5 (#687)
  • 0e236cb feat: new Projects v2 endpoints, new code scanning dismissal endpoints, many ...
  • bf19e3e chore(deps): update dependency prettier to v3.6.2 (#685)
  • 4f9fc56 ci(action): update actions/setup-node action to v5 (#688)
  • 8e5da25 fix: handle url in response when using pagination with compareCommits (#686)
  • 6d8ea8a feat: add paginatantion support for compareCommits and `compareCommitsWith...
  • 8ec2713 fix(deps): update @octokit/types - no new paginated endpoints (#680)
  • Additional commits viewable in compare view

Updates @octokit/request from 5.6.3 to 10.0.8

Release notes

Sourced from @​octokit/request's releases.

v10.0.8

10.0.8 (2026-02-20)

Bug Fixes

  • use json-with-bigint instead of built-in JSON methods in order to properly support int64's (#798) (f13f5d9)

v10.0.7

10.0.7 (2025-11-13)

Bug Fixes

  • readme: properly structure the options for custom agent (#786) (f17c1c1), closes #785

v10.0.6

10.0.6 (2025-10-30)

Bug Fixes

  • deps: update dependency @​octokit/types to v16 (#783) (1aeac56)

v10.0.5

10.0.5 (2025-09-29)

Bug Fixes

v10.0.4

10.0.4 (2025-09-29)

Bug Fixes

  • deps: update dependency @​octokit/types to v15 (#775) (ad78b4c)

v10.0.3

10.0.3 (2025-06-20)

Bug Fixes

  • pkg: unreplaced version number in dist-bundle/ (#765) (5b181af)

v10.0.2

10.0.2 (2025-05-20)

... (truncated)

Commits
  • f13f5d9 fix: use json-with-bigint instead of built-in JSON methods in order to prop...
  • 9ba6ae0 Document that unsuccessful HTTP status code result in an exception (#795)
  • 7160b82 chore(deps): replace glob with tinyglobby (#791)
  • ab8018b ci(action): update peter-evans/create-or-update-comment action to v5 (#776)
  • fb916e4 build(deps): bump vite from 6.3.4 to 6.4.1 (#780)
  • e1eb769 chore(deps): update dependency esbuild to ^0.27.0 (#784)
  • f17c1c1 fix(readme): properly structure the options for custom agent (#786)
  • ea46fa9 ci(action): update github/codeql-action action to v4 (#778)
  • 8166d28 chore(deps): update vitest monorepo to v4 (major) (#781)
  • 1aeac56 fix(deps): update dependency @​octokit/types to v16 (#783)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​octokit/request since your current version.


Updates @octokit/request-error from 2.1.0 to 7.1.0

Release notes

Sourced from @​octokit/request-error's releases.

v7.1.0

7.1.0 (2025-11-13)

Features

  • inherit options from base Error class to add support for the cause property (#535/#536) (2ea2780)

v7.0.2

7.0.2 (2025-10-30)

Bug Fixes

  • deps: update dependency @​octokit/types to v16 (#533) (e5a75ef)

v7.0.1

7.0.1 (2025-09-29)

Bug Fixes

  • deps: update dependency @​octokit/types to v15 (#522) (4a453f2)

v7.0.0

7.0.0 (2025-05-20)

Continuous Integration

BREAKING CHANGES

  • Drop support for NodeJS v18

  • build: set minimal node version in build script to v20

  • ci: stop testing against NodeJS v18

v6.1.8

6.1.8 (2025-04-10)

Bug Fixes

  • deps: update dependency @​octokit/types to v14 (#505) (ab4ea7b)

v6.1.7

... (truncated)

Commits
  • 2ea2780 feat: inherit options from base Error class to add support for the cause ...
  • ac7b309 chore(deps): update vitest monorepo to v4 (major) (#531)
  • dadc76d ci(action): update peter-evans/create-or-update-comment action to v5 (#525)
  • f57f2e6 build(deps): lock file maintenance (#534)
  • e5a75ef fix(deps): update dependency @​octokit/types to v16 (#533)
  • e5d5de2 chore(deps): update dependency @​types/node to v24 (#532)
  • 8cc127b ci(action): update actions/setup-node action to v6 (#529)
  • b3a876b build(deps): lock file maintenance (#527)
  • cf1817b ci(action): update github/codeql-action action to v4 (#528)
  • 61f1e87 chore(deps): update dependency tinybench to v5 (#519)
  • Additional commits viewable in compare view

Updates brace-expansion from 1.1.11 to 1.1.12

Release notes

Sourced from brace-expansion's releases.

v1.1.12

  • pkg: publish on tag 1.x c460dbd
  • fmt ccb8ac6
  • Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

juliangruber/brace-expansion@v1.1.11...v1.1.12

Commits

Updates marked from 2.1.3 to 15.0.12

Release notes

Sourced from marked's releases.

v15.0.12

15.0.12 (2025-05-20)

Bug Fixes

v15.0.11

15.0.11 (2025-04-25)

Bug Fixes

  • fix image alt text rendered to match common mark (#3668) (2c0e47a)

v15.0.10

15.0.10 (2025-04-23)

Bug Fixes

v15.0.9

15.0.9 (2025-04-21)

Bug Fixes

  • fix link url with no closing parenthesis (#3664) (72b6373)

v15.0.8

15.0.8 (2025-04-07)

Bug Fixes

v15.0.7

15.0.7 (2025-02-10)

Bug Fixes

v15.0.6

15.0.6 (2025-01-06)

... (truncated)

Commits
  • b4eb83b chore(release): 15.0.12 [skip ci]
  • 7a6b2d7 fix: use esbuild for accurate sourcemaps (#3670)
  • 9b8b111 chore(deps-dev): Bump semantic-release from 24.2.3 to 24.2.4 (#3690)
  • d04a040 chore(deps-dev): Bump rollup from 4.40.2 to 4.41.0 (#3692)
  • 5672651 chore(deps-dev): Bump eslint from 9.26.0 to 9.27.0 (#3691)
  • 89818b2 chore(deps-dev): Bump undici from 6.21.1 to 6.21.3 (#3684)
  • 2516064 chore(deps-dev): Bump rollup from 4.40.1 to 4.40.2 (#3681)
  • ed78e7f chore(deps-dev): Bump @​arethetypeswrong/cli from 0.17.4 to 0.18.1 (#3682)
  • 9fcb8bb chore(deps-dev): Bump eslint from 9.25.1 to 9.26.0 (#3680)
  • f455d41 chore(deps-dev): Bump rollup from 4.40.0 to 4.40.1 (#3678)
  • Additional commits viewable in compare view

Updates minimatch from 3.0.4 to 3.1.5

Commits

Updates npm from 7.24.2 to 11.11.1

Release notes

Sourced from npm's releases.

v11.11.1

11.11.1 (2026-03-10)

Bug Fixes

Documentation

Dependencies

Chores

v11.11.0

11.11.0 (2026-02-25)

Features

Bug Fixes

Documentation

Dependencies

... (truncated)

Changelog

Sourced from npm's changelog.

11.11.1 (2026-03-10)

Bug Fixes

Documentation

Dependencies

Chores

11.11.0 (2026-02-25)

Features

Bug Fixes

Documentation

Dependencies

... (truncated)

Commits
  • 8afa3bd chore: release 11.11.1
  • a9d242b fix: include all subcommands on main command help (#9099)
  • 5b7c0cc fix(arborist): exclude store nodes from :root > * in linked strategy (#9096)
  • 3b70a9d fix(arborist): simplify rootDeclaredDeps initialization (#9097)
  • 29b8407 fix: unwrap comments and lines meant for output (#9087)
  • b56986a fix(ls): suppress false UNMET DEPENDENCYs in linked strategy (#9095)
  • c7702d0 fix(arborist): fix non-idempotent linked install with workspace projects (#9094)
  • 075ae23 deps: tar@7.5.11
  • 13fa40d deps: pacote@21.5.0
  • 76c76e5 fix(ci): don't error on optional deps in the lockfile (#9083)
  • Additional commits viewable in compare view

Updates diff from 5.0.0 to 8.0.3

Changelog

Sourced from diff's changelog.

8.0.3

  • #631 - fix support for using an Intl.Segmenter with diffWords. This has been almost completely broken since the feature was added in v6.0.0, since it would outright crash on any text that featured two consecutive newlines between a pair of words (a very common case).
  • #635 - small tweaks to tokenization behaviour of diffWords when used without an Intl.Segmenter. Specifically, the soft hyphen (U+00AD) is no longer considered to be a word break, and the multiplication and division signs (× and ÷) are now treated as punctuation instead of as letters / word characters.
  • #641 - the format of file headers in createPatch etc. patches can now be customised somewhat. It now takes a headerOptions option that can be used to disable the file headers entirely, or omit the Index: line and/or the underline. In particular, this was motivated by a request to make jsdiff patches compatible with react-diff-view, which they now are if produced with headerOptions: FILE_HEADERS_ONLY.
  • #647 and #649 - fix denial-of-service vulnerabilities in parsePatch whereby adversarial input could cause a memory-leaking infinite loop, typically crashing the calling process. Also fixed ReDOS vulnerabilities whereby adversarially-crafted patch headers could take cubic time to parse. Now, parsePatch should reliably take linear time. (Handling of headers that include the line break characters \r, \u2028, or \u2029 in non-trailing positions is also now more reasonable as side effect of the fix.)

8.0.2

  • #616 Restored compatibility of diffSentences with old Safari versions. This was broken in 8.0.0 by the introduction of a regex with a lookbehind assertion; these weren't supported in Safari prior to version 16.4.
  • #612 Improved tree shakeability by marking the built CJS and ESM packages with sideEffects: false.

8.0.1

  • #610 Fixes types for diffJson which were broken by 8.0.0. The new bundled types in 8.0.0 only allowed diffJson to be passed string arguments, but it should've been possible to pass either strings or objects (and now is). Thanks to Josh Kelley for the fix.

8.0.0

  • #580 Multiple tweaks to diffSentences:
    • tokenization no longer takes quadratic time on pathological inputs (reported as a ReDOS vulnerability by Snyk); is now linear instead
    • the final sentence in the string is now handled the same by the tokenizer regardless of whether it has a trailing punctuation mark or not. (Previously, "foo. bar." tokenized to ["foo.", " ", "bar."] but "foo. bar" tokenized to ["foo.", " bar"] - i.e. whether the space between sentences was treated as a separate token depended upon whether the final sentence had trailing punctuation or not. This was arbitrary and surprising; it is no longer the case.)
    • in a string that starts with a sentence end, like "! hello.", the "!" is now treated as a separate sentence
    • the README now correctly documents the tokenization behaviour (it was wrong before)
  • #581 - fixed some regex operations used for tokenization in diffWords taking O(n^2) time in pathological cases
  • #595 - fixed a crash in patch creation functions when handling a single hunk consisting of a very large number (e.g. >130k) of lines. (This was caused by spreading indefinitely-large arrays to .push() using .apply or the spread operator and hitting the JS-implementation-specific limit on the maximum number of arguments to a function, as shown at https://stackoverflow.com/a/56809779/1709587; thus the exact threshold to hit the error will depend on the environment in which you were running JsDiff.)
  • #596 - removed the merge function. Previously JsDiff included an undocumented function called merge that was meant to, in some sense, merge patches. It had at least a couple of serious bugs that could lead to it returning unambiguously wrong results, and it was difficult to simply "fix" because it was unclear precisely what it was meant to do. For now, the fix is to remove it entirely.

@dependabot
build(deps): bump the npm_and_yarn group across 1 directory with 12 u…
5addf1f 
…pdates

Bumps the npm_and_yarn group with 2 updates in the / directory: [lodash](https://github.com/lodash/lodash) and [semantic-release](https://github.com/semantic-release/semantic-release).


Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)

Updates `semantic-release` from 17.4.7 to 25.0.3
- [Release notes](https://github.com/semantic-release/semantic-release/releases)
- [Commits](semantic-release/semantic-release@v17.4.7...v25.0.3)

Updates `@octokit/plugin-paginate-rest` from 2.21.3 to 14.0.0
- [Release notes](https://github.com/octokit/plugin-paginate-rest.js/releases)
- [Commits](octokit/plugin-paginate-rest.js@v2.21.3...v14.0.0)

Updates `@octokit/request` from 5.6.3 to 10.0.8
- [Release notes](https://github.com/octokit/request.js/releases)
- [Commits](octokit/request.js@v5.6.3...v10.0.8)

Updates `@octokit/request-error` from 2.1.0 to 7.1.0
- [Release notes](https://github.com/octokit/request-error.js/releases)
- [Commits](octokit/request-error.js@v2.1.0...v7.1.0)

Updates `brace-expansion` from 1.1.11 to 1.1.12
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@1.1.11...v1.1.12)

Updates `marked` from 2.1.3 to 15.0.12
- [Release notes](https://github.com/markedjs/marked/releases)
- [Commits](markedjs/marked@v2.1.3...v15.0.12)

Updates `minimatch` from 3.0.4 to 3.1.5
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.0.4...v3.1.5)

Updates `npm` from 7.24.2 to 11.11.1
- [Release notes](https://github.com/npm/cli/releases)
- [Changelog](https://github.com/npm/cli/blob/latest/CHANGELOG.md)
- [Commits](npm/cli@v7.24.2...v11.11.1)

Updates `diff` from 5.0.0 to 8.0.3
- [Changelog](https://github.com/kpdecker/jsdiff/blob/master/release-notes.md)
- [Commits](kpdecker/jsdiff@v5.0.0...v8.0.3)

Updates `http-cache-semantics` from 4.1.0 to 4.2.0
- [Commits](https://github.com/kornelski/http-cache-semantics/commits)

Updates `tar` from 6.1.11 to 7.5.11
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-tar@v6.1.11...v7.5.11)

---
updated-dependencies:
- dependency-name: lodash
  dependency-version: 4.17.23
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: semantic-release
  dependency-version: 25.0.3
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@octokit/plugin-paginate-rest"
  dependency-version: 14.0.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@octokit/request"
  dependency-version: 10.0.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@octokit/request-error"
  dependency-version: 7.1.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 1.1.12
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: marked
  dependency-version: 15.0.12
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 3.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: npm
  dependency-version: 11.11.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: diff
  dependency-version: 8.0.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: http-cache-semantics
  dependency-version: 4.2.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: tar
  dependency-version: 7.5.11
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants