chore(deps): bump the npm_and_yarn group across 6 directories with 18 updates by dependabot[bot] · Pull Request #3 · GrischaS/datatracker

dependabot · 2026-02-19T17:16:19Z

Bumps the npm_and_yarn group with 4 updates in the / directory: lodash, send, pug and vite.
Bumps the npm_and_yarn group with 1 update in the /dev/coverage-action directory: lodash.
Bumps the npm_and_yarn group with 1 update in the /dev/del-old-packages directory: @octokit/request.
Bumps the npm_and_yarn group with 5 updates in the /dev/deploy-to-container directory:

Package	From	To
brace-expansion	`2.0.1`	`2.0.2`
cross-spawn	`7.0.3`	`7.0.6`
glob	`10.3.12`	`10.5.0`
tar	`7.4.3`	`7.5.8`
tar-fs	`2.1.2`	`2.1.4`

Bumps the npm_and_yarn group with 5 updates in the /dev/diff directory:

Package	From	To
brace-expansion	`2.0.1`	`2.0.2`
cross-spawn	`7.0.3`	`7.0.6`
glob	`10.3.12`	`10.5.0`
tar	`7.4.3`	`7.5.8`
tar-fs	`2.1.2`	`2.1.4`

Bumps the npm_and_yarn group with 9 updates in the /playwright directory:

Package	From	To
lodash	`4.17.21`	`4.17.23`
brace-expansion	`1.1.11`	`1.1.12`
brace-expansion	`2.0.1`	`2.0.2`
braces	`3.0.2`	`3.0.3`
cross-spawn	`7.0.3`	`7.0.6`
ip	`2.0.0`	`removed`
js-yaml	`4.1.0`	`4.1.1`
semver	`6.3.0`	`6.3.1`
tar	`6.1.15`	`removed`
playwright	`1.42.1`	`1.58.2`

Updates lodash from 4.17.21 to 4.17.23

Commits

dec55b7 Bump main to v4.17.23 (#6088)
19c9251 fix: setCacheHas JSDoc return type should be boolean (#6071)
b5e6729 jsdoc: Add -0 and BigInt zeros to _.compact falsey values list (#6062)
edadd45 Prevent prototype pollution on baseUnset function
4879a7a doc: fix autoLink function, conversion of source links (#6056)
9648f69 chore: remove yarn.lock file (#6053)
dfa407d ci: remove legacy configuration files (#6052)
156e196 feat: add renovate setup (#6039)
933e106 ci: add pipeline for Bun (#6023)
072a807 docs: update links related to Open JS Foundation (#5968)
Additional commits viewable in compare view

Updates send from 0.18.0 to 0.19.0

Release notes

Sourced from send's releases.

0.19.0

What's Changed

Remove link renderization in html while redirecting (pillarjs/send#235)

New Contributors

@UlisesGascon made their first contribution in pillarjs/send#235

Full Changelog: pillarjs/send@0.18.0...0.19.0

Changelog

Sourced from send's changelog.

0.19.0 / 2024-09-10

Remove link renderization in html while redirecting

Commits

9d2db99 0.19.0
ae4f298 Merge commit from fork
See full diff in compare view

Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for send since your current version.

Updates pug from 3.0.2 to 3.0.3

Release notes

Sourced from pug's releases.

pug-code-gen@3.0.3

Bug Fixes

Validate templateName and globals are valid JavaScript identifiers to prevent possible remote code execution if un-trusted user input is passed to the compilation options (#3438)

pug@3.0.3

Bug Fixes

Update pug-code-gen with the following fix: (#3438)

Validate templateName and globals are valid JavaScript identifiers to prevent possible remote code execution if un-trusted user input is passed to the compilation options

Commits

32acfe8 fix: ensure template names are valid identifiers (#3438)
4767caf refactor: convert pug-error to TypeScript (#3355)
a724446 chore: update character-parser (#3354)
6cca8f7 docs: fix GitHub format in README (#3335)
See full diff in compare view

Updates vite from 4.5.3 to 5.4.21

Release notes

Sourced from vite's releases.

v5.4.21

Please refer to CHANGELOG.md for details.

v5.4.20

Please refer to CHANGELOG.md for details.

v5.4.19

Please refer to CHANGELOG.md for details.

v4.5.14

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

5.4.21 (2025-10-20)

fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20970) (cad1d31), closes #20968 #20970

chore: update CHANGELOG (ca88ed7)

5.4.20 (2025-09-08)

fix: apply fs.strict check to HTML files (#20736) (482000f), closes #20736

fix: port sirv@3.0.2 changes to sirv@2.0.4 (#20737) (4f1c35b), closes #20737

5.4.19 (2025-04-30)

fix: backport #19965, check static serve file inside sirv (#19966) (766947e), closes #19965 #19966

5.4.18 (2025-04-10)

fix: backport #19830, reject requests with # in request-target (#19831) (823675b), closes #19830 #19831

5.4.17 (2025-04-03)

fix: backport #19782, fs check with svg and relative paths (#19784) (84b2b46), closes #19782 #19784

5.4.16 (2025-03-31)

fix: backport #19761, fs check in transform middleware (#19762) (b627c50), closes #19761 #19762

5.4.15 (2025-03-24)

fix: backport #19702, fs raw query with query separators (#19703) (807d7f0), closes #19702 #19703

5.4.14 (2025-01-21)

fix: preview.allowedHosts with specific values was not respected (#19246) (9df6e6b), closes #19246

fix: allow CORS from loopback addresses by default (#19249) (7d1699c), closes #19249

... (truncated)

Commits

adce3c2 release: v5.4.21
cad1d31 fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20970)
ca88ed7 chore: update CHANGELOG
997700f release: v5.4.20
482000f fix: apply fs.strict check to HTML files (#20736)
80a333a release: v5.4.19
766947e fix: backport #19965, check static serve file inside sirv (#19966)
731b77d release: v5.4.18
823675b fix: backport #19830, reject requests with # in request-target (#19831)
0a2518a release: v5.4.17
Additional commits viewable in compare view

Updates esbuild from 0.18.20 to 0.21.5

Release notes

Sourced from esbuild's releases.

v0.21.5
Fix Symbol.metadata on classes without a class decorator (#3781)

This release fixes a bug with esbuild's support for the decorator metadata proposal. Previously esbuild only added the Symbol.metadata property to decorated classes if there was a decorator on the class element itself. However, the proposal says that the Symbol.metadata property should be present on all classes that have any decorators at all, not just those with a decorator on the class element itself.
Allow unknown import attributes to be used with the copy loader (#3792)

Import attributes (the with keyword on import statements) are allowed to alter how that path is loaded. For example, esbuild cannot assume that it knows how to load ./bagel.js as type bagel:
// This is an error with "--bundle" without also using "--external:./bagel.js"
import tasty from "./bagel.js" with { type: "bagel" }
Because of that, bundling this code with esbuild is an error unless the file ./bagel.js is external to the bundle (such as with --bundle --external:./bagel.js).

However, there is an additional case where it's ok for esbuild to allow this: if the file is loaded using the copy loader. That's because the copy loader behaves similarly to --external in that the file is left external to the bundle. The difference is that the copy loader copies the file into the output folder and rewrites the import path while --external doesn't. That means the following will now work with the copy loader (such as with --bundle --loader:.bagel=copy):
// This is no longer an error with "--bundle" and "--loader:.bagel=copy"
import tasty from "./tasty.bagel" with { type: "bagel" }
Support import attributes with glob-style imports (#3797)

This release adds support for import attributes (the with option) to glob-style imports (dynamic imports with certain string literal patterns as paths). These imports previously didn't support import attributes due to an oversight. So code like this will now work correctly:
async function loadLocale(locale: string): Locale {
  const data = await import(`./locales/${locale}.data`, { with: { type: 'json' } })
  return unpackLocale(locale, data)
}
Previously this didn't work even though esbuild normally supports forcing the JSON loader using an import attribute. Attempting to do this used to result in the following error:
✘ [ERROR] No loader is configured for ".data" files: locales/en-US.data
example.ts:2:28:
  2 │   const data = await import(`./locales/${locale}.data`, { with: { type: 'json' } })
    ╵                             ~~~~~~~~~~~~~~~~~~~~~~~~~~
In addition, this change means plugins can now access the contents of with for glob-style imports.
Support ${configDir} in tsconfig.json files (#3782)

This adds support for a new feature from the upcoming TypeScript 5.5 release. The character sequence ${configDir} is now respected at the start of baseUrl and paths values, which are used by esbuild during bundling to correctly map import paths to file system paths. This feature lets base tsconfig.json files specified via extends refer to the directory of the top-level tsconfig.json file. Here is an example:

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2023

This changelog documents all esbuild versions published in the year 2023 (versions 0.16.13 through 0.19.11).

0.19.11
Fix TypeScript-specific class transform edge case (#3559)

The previous release introduced an optimization that avoided transforming super() in the class constructor for TypeScript code compiled with useDefineForClassFields set to false if all class instance fields have no initializers. The rationale was that in this case, all class instance fields are omitted in the output so no changes to the constructor are needed. However, if all of this is the case and there are #private instance fields with initializers, those private instance field initializers were still being moved into the constructor. This was problematic because they were being inserted before the call to super() (since super() is now no longer transformed in that case). This release introduces an additional optimization that avoids moving the private instance field initializers into the constructor in this edge case, which generates smaller code, matches the TypeScript compiler's output more closely, and avoids this bug:
// Original code
class Foo extends Bar {
  #private = 1;
  public: any;
  constructor() {
    super();
  }
}
// Old output (with esbuild v0.19.9)
class Foo extends Bar {
constructor() {
super();
this.#private = 1;
}
#private;
}
// Old output (with esbuild v0.19.10)
class Foo extends Bar {
constructor() {
this.#private = 1;
super();
}
#private;
}
// New output
class Foo extends Bar {
#private = 1;
constructor() {
super();
}
}
Minifier: allow reording a primitive past a side-effect (#3568)

The minifier previously allowed reordering a side-effect past a primitive, but didn't handle the case of reordering a primitive past a side-effect. This additional case is now handled:

... (truncated)

Commits

fc37c2f publish 0.21.5 to npm
cb11924 fix Symbol.metadata errors in decorator tests
b93a2a9 fix #3781: add metadata to all decorated classes
953dae9 fix #3797: import attributes and glob-style import
98cb2ed fix #3782: support ${configDir} in tsconfig.json
8e6603b run make update-compat-table
db1b8ca fix #3792: import attributes and the copy loader
de572d0 fix non-deterministic import attribute plugin test
ae8d1b4 fix #3794: --supported:object-accessors=false
67cbf87 publish 0.21.4 to npm
Additional commits viewable in compare view

Updates rollup from 3.29.4 to 4.57.1

Release notes

Sourced from rollup's releases.

v4.57.1

4.57.1

2026-01-30

Bug Fixes

Fix heap corruption issue in Windows (#6251)

Ensure exports of a dynamic import are fully included when called from a try...catch (#6254)

Pull Requests

#6251: fix: Isolate and cache process.report.getReport() calls in a child process for robust environment detection (@alan-agius4, @lukastaegert)

#6252: chore(deps): update dependency lru-cache to v11 (@renovate[bot])

#6253: chore(deps): lock file maintenance minor/patch updates (@renovate[bot], @lukastaegert)

#6254: Fully include dynamic imports in a try-catch (@lukastaegert)

#6255: chore(deps): lock file maintenance (@renovate[bot])

v4.57.0

4.57.0

2026-01-27

Features

Add import attributes to all plugin hooks that did not provide them yet (#5700)

Deprecate returning import attributes from load or transform hooks as that will no longer be supported with rollup 5 (#5700)

Pull Requests

#5700: extend more hooks to include import attributes and add warnings (@TrickyPi, @lukastaegert)

#6243: fix(deps): update swc monorepo (major) (@renovate[bot], @lukastaegert)

#6244: fix(deps): lock file maintenance minor/patch updates (@renovate[bot], @lukastaegert)

#6245: chore(deps): lock file maintenance (@renovate[bot])

#6246: Refactor to reduce Rollup 5 upgrade diff (@lukastaegert)

v4.56.0

4.56.0

2026-01-22

Features

Track object property inclusions of dynamic namespace members (#6230)

Bug Fixes

Handle methods that access dynamically imported namespace members via this (#6230)

Pull Requests

... (truncated)

Changelog

Sourced from rollup's changelog.

rollup changelog

Commits

d37675f 4.57.1
eafac0b chore(deps): lock file maintenance (#6255)
47fa568 chore(deps): update dependency lru-cache to v11 (#6252)
416f476 Fully include dynamic imports in a try-catch (#6254)
5e393e3 fix: Isolate and cache process.report.getReport() calls in a child process ...
c931d23 chore(deps): lock file maintenance minor/patch updates (#6253)
c79e6c2 Mitigate vulnerability that would allow to steal credentials
743d054 4.57.0
74121c7 extend more hooks to include import attributes and add warnings (#5700)
c519d82 Refactor to reduce Rollup 5 upgrade diff (#6246)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for rollup since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates lodash from 4.17.21 to 4.17.23

Commits

dec55b7 Bump main to v4.17.23 (#6088)
19c9251 fix: setCacheHas JSDoc return type should be boolean (#6071)
b5e6729 jsdoc: Add -0 and BigInt zeros to _.compact falsey values list (#6062)
edadd45 Prevent prototype pollution on baseUnset function
4879a7a doc: fix autoLink function, conversion of source links (#6056)
9648f69 chore: remove yarn.lock file (#6053)
dfa407d ci: remove legacy configuration files (#6052)
156e196 feat: add renovate setup (#6039)
933e106 ci: add pipeline for Bun (#6023)
072a807 docs: update links related to Open JS Foundation (#5968)
Additional commits viewable in compare view

Updates @octokit/request from 6.2.2 to 10.0.7

Release notes

Sourced from @octokit/request's releases.

v10.0.7

10.0.7 (2025-11-13)

Bug Fixes

readme: properly structure the options for custom agent (#786) (f17c1c1), closes #785

v10.0.6

10.0.6 (2025-10-30)

Bug Fixes

deps: update dependency @octokit/types to v16 (#783) (1aeac56)

v10.0.5

10.0.5 (2025-09-29)

Bug Fixes

deps: update octokit deps (#772) (30f83b6)

v10.0.4

10.0.4 (2025-09-29)

Bug Fixes

deps: update dependency @octokit/types to v15 (#775) (ad78b4c)

v10.0.3

10.0.3 (2025-06-20)

Bug Fixes

pkg: unreplaced version number in dist-bundle/ (#765) (5b181af)

v10.0.2

10.0.2 (2025-05-20)

Bug Fixes

deps: update octokit monorepo (major) (#759) (fe8bb4b), closes #728 #760

v10.0.1

10.0.1 (2025-05-20)

... (truncated)

Commits

f17c1c1 fix(readme): properly structure the options for custom agent (#786)
ea46fa9 ci(action): update github/codeql-action action to v4 (#778)
8166d28 chore(deps): update vitest monorepo to v4 (major) (#781)
1aeac56 fix(deps): update dependency @octokit/types to v16 (#783)
b5b08a2 ci(action): update actions/setup-node action to v6 (#779)
9a78123 chore(deps): update dependency @types/node to v24 (#782)
30f83b6 fix(deps): update octokit deps (#772)
b07d593 ci(action): update actions/checkout action to v5 (#770)
928c3d7 chore(deps): update dependency prettier to v3.6.2 (#766)
a84613e ci(action): update actions/setup-node action to v5 (#771)
Additional commits viewable in compare view

Updates @octokit/request-error from 3.0.2 to 7.1.0

Release notes

Sourced from @octokit/request-error's releases.

v7.1.0

7.1.0 (2025-11-13)

Features

inherit options from base Error class to add support for the cause property (#535/#536) (2ea2780)

v7.0.2

7.0.2 (2025-10-30)

Bug Fixes

deps: update dependency @octokit/types to v16 (#533) (e5a75ef)

v7.0.1

7.0.1 (2025-09-29)

Bug Fixes

deps: update dependency @octokit/types to v15 (#522) (4a453f2)

v7.0.0

7.0.0 (2025-05-20)

Continuous Integration

stop testing against NodeJS v18 (#512) (8eee0c1)

BREAKING CHANGES

Drop support for NodeJS v18

build: set minimal node version in build script to v20

ci: stop testing against NodeJS v18

v6.1.8

6.1.8 (2025-04-10)

Bug Fixes

deps: update dependency @octokit/types to v14 (#505) (ab4ea7b)

v6.1.7

... (truncated)

Commits

2ea2780 feat: inherit options from base Error class to add support for the cause ...
ac7b309 chore(deps): update vitest monorepo to v4 (major) (#531)
dadc76d ci(action): update peter-evans/create-or-update-comment action to v5 (#525)
f57f2e6 build(deps): lock file maintenance (#534)
e5a75ef fix(deps): update dependency @octokit/types to v16 (#533)
e5d5de2 chore(deps): update dependency @types/node to v24 (#532)
8cc127b ci(action): update actions/setup-node action to v6 (#529)
b3a876b build(deps): lock file maintenance (#527)
cf1817b ci(action): update github/codeql-action action to v4 (#528)
61f1e87 chore(deps): update dependency tinybench to v5 (#519)
Additional commits viewable in compare view

Updates brace-expansion from 2.0.1 to 2.0.2

Release notes

Sourced from brace-expansion's releases.

v2.0.2

pkg: publish on tag 2.x 14f1d91

fmt ed7780a

Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 36603d5

juliangruber/brace-expansion@v2.0.1...v2.0.2

Commits

a3efcee 2.0.2
14f1d91 pkg: publish on tag 2.x
ed7780a fmt
36603d5 Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65)
See full diff in compare view

Updates cross-spawn from 7.0.3 to 7.0.6

Changelog

Sourced from cross-spawn's changelog.

7.0.6 (2024-11-18)

Bug Fixes

update cross-spawn version to 7.0.5 in package-lock.json (f700743)

7.0.5 (2024-11-07)

Bug Fixes

fix escaping bug introduced by backtracking (640d391)

7.0.4 (2024-11-07)

Bug Fixes

disable regexp backtracking (#160) (5ff3a07)

Commits

77cd97f chore(release): 7.0.6
6717de4 chore: upgrade standard-version
f700743 fix: update cross-spawn version to 7.0.5 in package-lock.json
9a7e3b2 chore: fix build status badge
0852683 chore(release): 7.0.5
640d391 fix: fix escaping bug introduced by backtracking
bff0c87 chore: remove codecov
a7c6abc chore: replace travis with github workflows
9b9246e chore(release): 7.0.4
5ff3a07 fix: disable regexp backtracking (#160)
Additional commits viewable in compare view

Updates glob from 10.3.12 to 10.5.0

Changelog

Sourced from glob's changelog.

changeglob

13

Move the CLI program out to a separate package, glob-bin. Install that if you'd like to continue using glob from the command line.

12

Remove the unsafe --shell option. The --shell option is now ONLY supported on known shells where the behavior can be implemented safely.

11.1

GHSA-5j98-mcp5-4vw2

Add the --shell option for the command line, with a warning that this is unsafe. (It will be removed in v12.)

Add the --cmd-arg/-g as a way to safely add positional arguments to the command provided to the CLI tool.

Detect commands with space or quote characters on known shells, and pass positional arguments to them safely, avoiding shell:true execution.

11.0

Drop support for node before v20

10.4

Add includeChildMatches: false option

Export the Ignore class

10.3

Add --default -p flag to provide a default pattern

exclude symbolic links to directories when follow and nodir are both set

10.2

Add glob cli

10.1

Return '.' instead of the empty string '' when the current working directory is returned as a match.

Add posix: true option to return / delimited paths, even on

... (truncated)

Commits

56774ef 10.5.0
1e4e297 bin: Do not expose filenames to shell expansion
1f0c1ca 10.4.5
eaf31dc whatever, just allow any engines
7827516 10.4.4
d06c8f8 restore support for node 14.latest and 16.latest
c14b787 10.4.3
8a69def node 14 no longer supported
eef7ea3 10.4.2
c76a7d2 use package-json-from-dist to look up package.json
Additional commits viewable in compare view

Updates tar from 7.4.3 to 7.5.8

Changelog

Sourced from tar's changelog.

Changelog

7.5

Added zstd compression support.

Consistent TOCTOU behavior in sync t.list

Only read from ustar block if not specified in Pax

Fix sync tar.list when file size reduces while reading

Sanitize absolute linkpaths properly

Prevent writing hardlink entries to the archive ahead of their file target

7.4

Deprecate onentry in favor of onReadEntry for clarity.

7.3

Add onWriteEntry option

7.2

DRY the command definitions into a single makeCommand method, and update the type signatures to more appropriately infer the return type from the options and arguments provided.

7.1

Update minipass to v7.1.0

Update the type definitions of write() and end() methods on Unpack and Parser classes to be compatible with the NodeJS.WritableStream type in the latest versions of @types/node.

7.0

Drop support for node <18

Rewrite in TypeScript, provide ESM and CommonJS hybrid interface

Add tree-shake friendly exports, like import('tar/create') and import('tar/read-entry') to get individual functions or classes.

Add chmod option that defaults to false, and deprecate noChmod. That is, reverse the default option regarding explicitly setting file system modes to match tar entry settings.

Add processUmask option to avoid having to call process.umask() when chmod: true (or noChmod: false) is set.

... (truncated)

Commits

6b8eba0 7.5.8
2cb1120 fix(unpack): improve UnpackSync symlink error "into" path accuracy
d18e4e1 fix: do not write linkpaths through symlinks
4a37eb9 7.5.7
f4a7aa9 fix: properly sanitize hard links containing ..
394ece6 7.5.6
7d4cc17 fix race puting a Link ahead of its target File
26ab904 7.5.5
e9a1ddb fix: do not prevent valid linkpaths within archive
911c886 7.5.4
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by isaacs, a new releaser for tar since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates tar-fs from 2.1.2 to 2.1.4

Commits

f421a23 2.1.4
c412fa1 refactor to same pattern as v3
4b7e868 2.1.3
266194b hardlink tweak from main
See full diff in compare view

Updates brace-expansion from 2.0.1 to 2.0.2

Release notes

Sourced from brace-expansion's releases.

v2.0.2

pkg: publish on tag 2.x 14f1d91

fmt ed7780a

Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 36603d5

juliangruber/brace-expansion@v2.0.1...v2.0.2

Commits

a3efcee 2.0.2
14f1d91 pkg: publish on tag 2.x
ed7780a fmt
36603d5 Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65)
See full diff in compare view

Updates cross-spawn from 7.0.3 to 7.0.6

Changelog

Sourced from cross-spawn's changelog.

7.0.6 (2024-11-18)

Bug Fixes

update cross-spawn version to 7.0.5 in package-lock.json (f700743)

7.0.5 (2024-11-07)

Bug Fixes

fix escaping bug introduced by backtracking (640d391)

7.0.4 (2024-11-07)

Bug Fixes

disable regexp backtracking (#160) (5ff3a07)

Commits

77cd97f chore(release): 7.0.6
6717de4 chore: upgrade standard-version
f700743 fix: update cross-spawn version to 7.0.5 in package-lock.json

… updates Bumps the npm_and_yarn group with 4 updates in the / directory: [lodash](https://github.com/lodash/lodash), [send](https://github.com/pillarjs/send), [pug](https://github.com/pugjs/pug) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Bumps the npm_and_yarn group with 1 update in the /dev/coverage-action directory: [lodash](https://github.com/lodash/lodash). Bumps the npm_and_yarn group with 1 update in the /dev/del-old-packages directory: [@octokit/request](https://github.com/octokit/request.js). Bumps the npm_and_yarn group with 5 updates in the /dev/deploy-to-container directory: | Package | From | To | | --- | --- | --- | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `2.0.1` | `2.0.2` | | [cross-spawn](https://github.com/moxystudio/node-cross-spawn) | `7.0.3` | `7.0.6` | | [glob](https://github.com/isaacs/node-glob) | `10.3.12` | `10.5.0` | | [tar](https://github.com/isaacs/node-tar) | `7.4.3` | `7.5.8` | | [tar-fs](https://github.com/mafintosh/tar-fs) | `2.1.2` | `2.1.4` | Bumps the npm_and_yarn group with 5 updates in the /dev/diff directory: | Package | From | To | | --- | --- | --- | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `2.0.1` | `2.0.2` | | [cross-spawn](https://github.com/moxystudio/node-cross-spawn) | `7.0.3` | `7.0.6` | | [glob](https://github.com/isaacs/node-glob) | `10.3.12` | `10.5.0` | | [tar](https://github.com/isaacs/node-tar) | `7.4.3` | `7.5.8` | | [tar-fs](https://github.com/mafintosh/tar-fs) | `2.1.2` | `2.1.4` | Bumps the npm_and_yarn group with 9 updates in the /playwright directory: | Package | From | To | | --- | --- | --- | | [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.17.23` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.11` | `1.1.12` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `2.0.1` | `2.0.2` | | [braces](https://github.com/micromatch/braces) | `3.0.2` | `3.0.3` | | [cross-spawn](https://github.com/moxystudio/node-cross-spawn) | `7.0.3` | `7.0.6` | | [ip](https://github.com/indutny/node-ip) | `2.0.0` | `removed` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.0` | `4.1.1` | | [semver](https://github.com/npm/node-semver) | `6.3.0` | `6.3.1` | | [tar](https://github.com/isaacs/node-tar) | `6.1.15` | `removed` | | [playwright](https://github.com/microsoft/playwright) | `1.42.1` | `1.58.2` | Updates `lodash` from 4.17.21 to 4.17.23 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.17.23) Updates `send` from 0.18.0 to 0.19.0 - [Release notes](https://github.com/pillarjs/send/releases) - [Changelog](https://github.com/pillarjs/send/blob/master/HISTORY.md) - [Commits](pillarjs/send@0.18.0...0.19.0) Updates `pug` from 3.0.2 to 3.0.3 - [Release notes](https://github.com/pugjs/pug/releases) - [Commits](https://github.com/pugjs/pug/compare/pug@3.0.2...pug@3.0.3) Updates `vite` from 4.5.3 to 5.4.21 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v5.4.21/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v5.4.21/packages/vite) Updates `esbuild` from 0.18.20 to 0.21.5 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2023.md) - [Commits](evanw/esbuild@v0.18.20...v0.21.5) Updates `rollup` from 3.29.4 to 4.57.1 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG-3.md) - [Commits](rollup/rollup@v3.29.4...v4.57.1) Updates `lodash` from 4.17.21 to 4.17.23 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.17.23) Updates `@octokit/request` from 6.2.2 to 10.0.7 - [Release notes](https://github.com/octokit/request.js/releases) - [Commits](octokit/request.js@v6.2.2...v10.0.7) Updates `@octokit/request-error` from 3.0.2 to 7.1.0 - [Release notes](https://github.com/octokit/request-error.js/releases) - [Commits](octokit/request-error.js@v3.0.2...v7.1.0) Updates `brace-expansion` from 2.0.1 to 2.0.2 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.0.1...v2.0.2) Updates `cross-spawn` from 7.0.3 to 7.0.6 - [Changelog](https://github.com/moxystudio/node-cross-spawn/blob/master/CHANGELOG.md) - [Commits](moxystudio/node-cross-spawn@v7.0.3...v7.0.6) Updates `glob` from 10.3.12 to 10.5.0 - [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md) - [Commits](isaacs/node-glob@v10.3.12...v10.5.0) Updates `tar` from 7.4.3 to 7.5.8 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v7.4.3...v7.5.8) Updates `tar-fs` from 2.1.2 to 2.1.4 - [Commits](mafintosh/tar-fs@v2.1.2...v2.1.4) Updates `brace-expansion` from 2.0.1 to 2.0.2 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.0.1...v2.0.2) Updates `cross-spawn` from 7.0.3 to 7.0.6 - [Changelog](https://github.com/moxystudio/node-cross-spawn/blob/master/CHANGELOG.md) - [Commits](moxystudio/node-cross-spawn@v7.0.3...v7.0.6) Updates `glob` from 10.3.12 to 10.5.0 - [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md) - [Commits](isaacs/node-glob@v10.3.12...v10.5.0) Updates `tar` from 7.4.3 to 7.5.8 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v7.4.3...v7.5.8) Updates `tar-fs` from 2.1.2 to 2.1.4 - [Commits](mafintosh/tar-fs@v2.1.2...v2.1.4) Updates `lodash` from 4.17.21 to 4.17.23 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.17.23) Updates `brace-expansion` from 1.1.11 to 1.1.12 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.0.1...v2.0.2) Updates `brace-expansion` from 2.0.1 to 2.0.2 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.0.1...v2.0.2) Updates `braces` from 3.0.2 to 3.0.3 - [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md) - [Commits](micromatch/braces@3.0.2...3.0.3) Updates `cross-spawn` from 7.0.3 to 7.0.6 - [Changelog](https://github.com/moxystudio/node-cross-spawn/blob/master/CHANGELOG.md) - [Commits](moxystudio/node-cross-spawn@v7.0.3...v7.0.6) Removes `ip` Updates `js-yaml` from 4.1.0 to 4.1.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.0...4.1.1) Updates `semver` from 6.3.0 to 6.3.1 - [Release notes](https://github.com/npm/node-semver/releases) - [Changelog](https://github.com/npm/node-semver/blob/v6.3.1/CHANGELOG.md) - [Commits](npm/node-semver@v6.3.0...v6.3.1) Removes `tar` Updates `playwright` from 1.42.1 to 1.58.2 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.42.1...v1.58.2) --- updated-dependencies: - dependency-name: lodash dependency-version: 4.17.23 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: send dependency-version: 0.19.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: pug dependency-version: 3.0.3 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 5.4.21 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: esbuild dependency-version: 0.21.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: rollup dependency-version: 4.57.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.17.23 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@octokit/request" dependency-version: 10.0.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@octokit/request-error" dependency-version: 7.1.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 2.0.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: cross-spawn dependency-version: 7.0.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: glob dependency-version: 10.5.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar dependency-version: 7.5.8 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: tar-fs dependency-version: 2.1.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 2.0.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: cross-spawn dependency-version: 7.0.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: glob dependency-version: 10.5.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar dependency-version: 7.5.8 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: tar-fs dependency-version: 2.1.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.17.23 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 2.0.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: braces dependency-version: 3.0.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: cross-spawn dependency-version: 7.0.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ip dependency-version: dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.1.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: semver dependency-version: 6.3.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar dependency-version: dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: playwright dependency-version: 1.58.2 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

cubic-dev-ai

3 issues found across 54 files

Prompt for AI agents (all issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="dev/deploy-to-container/package.json">

<violation number="1" location="dev/deploy-to-container/package.json:10">
P2: The new tar 7.5.8 dependency requires Node >=18, but this package still advertises support for Node >=16. That mismatch will break installs or runtime on Node 16. Align the engines requirement or pin tar to a Node 16-compatible version.</violation>
</file>

<file name="dev/del-old-packages/package.json">

<violation number="1" location="dev/del-old-packages/package.json:13">
P2: @octokit/core v7 drops Node 18 support (requires Node 20+), but this tool’s README still targets Node 18.x. Updating to ^7.0.6 will break installs/runs on Node 18. Either keep @octokit/core on the latest 6.x release or update the tool’s Node requirement/runtime to 20+.</violation>
</file>

<file name="package.json">

<violation number="1" location="package.json:76">
P2: Vite 5 requires Node.js 18+ while the project documents Node 16.x as the supported baseline. Upgrading to Vite 5 will break local installs and CI running on Node 16 unless the Node requirement is bumped or Vite stays on 4.x.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

cubic-dev-ai · 2026-02-19T17:23:31Z

    "nanoid-dictionary": "5.0.0",
    "slugify": "1.6.6",
-    "tar": "^7.4.3",
+    "tar": "^7.5.8",


P2: The new tar 7.5.8 dependency requires Node >=18, but this package still advertises support for Node >=16. That mismatch will break installs or runtime on Node 16. Align the engines requirement or pin tar to a Node 16-compatible version.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At dev/deploy-to-container/package.json, line 10: <comment>The new tar 7.5.8 dependency requires Node >=18, but this package still advertises support for Node >=16. That mismatch will break installs or runtime on Node 16. Align the engines requirement or pin tar to a Node 16-compatible version.</comment> <file context> @@ -4,10 +4,10 @@ "nanoid-dictionary": "5.0.0", "slugify": "1.6.6", - "tar": "^7.4.3", + "tar": "^7.5.8", "yargs": "^17.7.2" }, </file context>

cubic-dev-ai · 2026-02-19T17:23:31Z

  "license": "ISC",
  "dependencies": {
-    "@octokit/core": "^4.2.4",
+    "@octokit/core": "^7.0.6",


P2: @octokit/core v7 drops Node 18 support (requires Node 20+), but this tool’s README still targets Node 18.x. Updating to ^7.0.6 will break installs/runs on Node 18. Either keep @octokit/core on the latest 6.x release or update the tool’s Node requirement/runtime to 20+.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At dev/del-old-packages/package.json, line 13: <comment>@octokit/core v7 drops Node 18 support (requires Node 20+), but this tool’s README still targets Node 18.x. Updating to ^7.0.6 will break installs/runs on Node 18. Either keep @octokit/core on the latest 6.x release or update the tool’s Node requirement/runtime to 20+.</comment> <file context> @@ -10,7 +10,7 @@ "license": "ISC", "dependencies": { - "@octokit/core": "^4.2.4", + "@octokit/core": "^7.0.6", "luxon": "^3.4.4" } </file context>

Suggested change

"@octokit/core": "^7.0.6",

"@octokit/core": "^6.1.6",

cubic-dev-ai · 2026-02-19T17:23:32Z

    "sass": "1.72.0",
    "seedrandom": "3.0.5",
-    "vite": "4.5.3"
+    "vite": "5.4.21"


P2: Vite 5 requires Node.js 18+ while the project documents Node 16.x as the supported baseline. Upgrading to Vite 5 will break local installs and CI running on Node 16 unless the Node requirement is bumped or Vite stays on 4.x.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At package.json, line 76: <comment>Vite 5 requires Node.js 18+ while the project documents Node 16.x as the supported baseline. Upgrading to Vite 5 will break local installs and CI running on Node 16 unless the Node requirement is bumped or Vite stays on 4.x.</comment> <file context> @@ -70,10 +70,10 @@ "sass": "1.72.0", "seedrandom": "3.0.5", - "vite": "4.5.3" + "vite": "5.4.21" }, "targets": { </file context>

Suggested change

"vite": "5.4.21"

"vite": "4.5.3"

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Feb 19, 2026

dependabot Bot mentioned this pull request Feb 19, 2026

chore(deps): bump the npm_and_yarn group across 5 directories with 17 updates #1

Closed

cubic-dev-ai Bot reviewed Feb 19, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the npm_and_yarn group across 6 directories with 18 updates#3

chore(deps): bump the npm_and_yarn group across 6 directories with 18 updates#3
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-c8193efc3c

dependabot Bot commented on behalf of github Feb 19, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

cubic-dev-ai Bot Feb 19, 2026 •

edited

Loading

Uh oh!

cubic-dev-ai Bot Feb 19, 2026 •

edited

Loading

Uh oh!

cubic-dev-ai Bot Feb 19, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Feb 19, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

0.19.0

What's Changed

New Contributors

0.19.0 / 2024-09-10

pug-code-gen@3.0.3

Bug Fixes

pug@3.0.3

Bug Fixes

v5.4.21

v5.4.20

v5.4.19

v4.5.14

5.4.21 (2025-10-20)

5.4.20 (2025-09-08)

5.4.19 (2025-04-30)

5.4.18 (2025-04-10)

5.4.17 (2025-04-03)

5.4.16 (2025-03-31)

5.4.15 (2025-03-24)

5.4.14 (2025-01-21)

v0.21.5

Changelog: 2023

0.19.11

v4.57.1

4.57.1

Bug Fixes

Pull Requests

v4.57.0

4.57.0

Features

Pull Requests

v4.56.0

4.56.0

Features

Bug Fixes

Pull Requests

rollup changelog

v10.0.7

10.0.7 (2025-11-13)

Bug Fixes

v10.0.6

10.0.6 (2025-10-30)

Bug Fixes

v10.0.5

10.0.5 (2025-09-29)

Bug Fixes

v10.0.4

10.0.4 (2025-09-29)

Bug Fixes

v10.0.3

10.0.3 (2025-06-20)

Bug Fixes

v10.0.2

10.0.2 (2025-05-20)

Bug Fixes

v10.0.1

10.0.1 (2025-05-20)

v7.1.0

7.1.0 (2025-11-13)

Features

v7.0.2

7.0.2 (2025-10-30)

Bug Fixes

v7.0.1

7.0.1 (2025-09-29)

Bug Fixes

v7.0.0

7.0.0 (2025-05-20)

Continuous Integration

BREAKING CHANGES

v6.1.8

6.1.8 (2025-04-10)

Bug Fixes

v6.1.7

v2.0.2

7.0.6 (2024-11-18)

Bug Fixes

dependabot Bot commented on behalf of github Feb 19, 2026 •

edited by cubic-dev-ai Bot

Loading

cubic-dev-ai Bot Feb 19, 2026 •

edited

Loading

cubic-dev-ai Bot Feb 19, 2026 •

edited

Loading

cubic-dev-ai Bot Feb 19, 2026 •

edited

Loading