Skip to content

Bump the npm_and_yarn group across 1 directory with 15 updates#334

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-8fa69cd9d9
Closed

Bump the npm_and_yarn group across 1 directory with 15 updates#334
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-8fa69cd9d9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 21, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 15 updates in the / directory:

Package From To
@azure/identity 3.4.2 4.13.1
axios 0.27.2 0.33.0
fast-xml-parser 4.5.3 5.7.0
lodash 4.17.21 4.18.1
uuid 8.3.2 14.0.1
glob 11.0.3 12.0.0
webpack 5.102.1 5.108.4
@nevware21/ts-utils 0.12.5 0.16.0
fast-uri 3.1.0 3.1.4
flatted 3.3.3 3.4.2
follow-redirects 1.15.11 1.16.0
form-data 4.0.4 4.0.6
handlebars 4.7.8 4.7.9
jws 3.2.2 3.2.3
picomatch 2.3.1 4.0.5

Updates @azure/identity from 3.4.2 to 4.13.1

Commits
  • 0604e47 Sync eng/common directory with azure-sdk-tools for PR 13235 (#36861)
  • 85a1361 Silence 1ESPT non-blocking error (#36342)
  • a6ce3c7 [Identity] Bump MSAL dependency to v5 (#37685)
  • 6d2d180 restore assets.json from @​azure/storage-blob_12.31.0
  • 980d126 [Identity] Prepare release Oct 25 (#36121)
  • 29a8eab Azure.Communication.Email 1.1.0 - 2025-09-01 (#36008)
  • 05a9860 [notification-hubs] fix TypeError when parsing AppleTemplateRegistrationDescr...
  • cdbd31b [EngSys] automatic pnpm update (#36119)
  • 953fcf9 Sync eng/common directory with azure-sdk-tools for PR 12337 (#36113)
  • 259da84 [Identity] Remove inappropriate @​internal tags from non-exported members (#36...
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for @​azure/identity since your current version.


Updates axios from 0.27.2 to 0.33.0

Release notes

Sourced from axios's releases.

v0.33.0 — June 13, 2026

This release hardens request config handling and form serialisation, adds Node.js 26 coverage for v0.x, and updates the v0.x release workflow.

🔒 Security Fixes

  • Request Config Hardening: Uses own-property reads for nested request options affecting auth, params, proxy, and data handling; adds bounded form serialisation depth checks; normalises nullish Basic Auth credentials; and treats 0.0.0.0 as local for proxy bypass. (#11001)

🚀 New Features

  • Node.js 26: Adds Node.js 26 to the v0.x CI and release/publish matrices. (#10937)

🔧 Maintenance & Chores

  • Release Publishing: Adopts npm staged publishing for v0.x releases and disables npm caching in CI to make installs and publish jobs more deterministic. (#10936, #10943)
  • Changelog: Backfills missing v0.x changelog entries for prior releases. (#10842)
  • Release Metadata: Bumps package and internal version metadata for v0.33.0. (#11002)

Full Changelog

v0.32.0 — May 4, 2026

This release backports a comprehensive set of security and hardening fixes from the v1.x branch into v0.x, covering prototype-pollution protections, default error redaction, stricter proxy/cookie/socket handling, and one breaking change to merged config and header object prototypes.

⚠️ Breaking Changes & Deprecations

  • Null-prototype merged objects: mergeConfig and header merging now return objects with a null prototype to block prototype-pollution gadgets. Consumers must use Object.prototype.hasOwnProperty.call(obj, key) and avoid implicit string coercion against merged config or header objects. (#10838)

🔒 Security Fixes

  • Default error redaction: AxiosError.toJSON() now redacts sensitive keys by default to prevent credential leaks in logs. The behavior is configurable via config.redact, with defaults exposed on defaults.redact. (#10838)
  • Cookie & XSRF handling: Cookie names are read literally rather than via regex, and only own properties are respected when evaluating withXSRFToken. (#10838)
  • Proxy bypass IPv6 parity: NO_PROXY matching now handles canonical IPv4-mapped IPv6 forms such as ::ffff:127.0.0.1 and ::ffff:7f00:1. (#10838)
  • Node http adapter hardening: Strips Proxy-Authorization when no proxy is in use and gates socketPath behind a new allowedSocketPaths allowlist (string or array, normalized) to reduce accidental Unix socket exposure. (#10838)
  • Browser xhr adapter: Stricter own-property checks when reading config and headers. (#10838)
  • URL parameters: AxiosURLSearchParams keeps %00 encoded and applies consistent encoding throughout. (#10838)
  • Public type surface: Adds formDataHeaderPolicy, redact, and allowedSocketPaths to the TypeScript declarations alongside their runtime defaults. (#10838)

🔧 Maintenance & Chores

  • Repo hygiene: Updates README.md and CHANGELOG.md, adds AGENTS.md, and refreshes the issue and PR templates. (#10838)

Full Changelog

v0.31.1

This release backports a broad set of security hardenings from the v1 line — covering prototype-pollution defences, stream size enforcement, XSRF handling, URL null-byte encoding, and bounded FormData recursion — and drops committed dist/ artefacts along with Bower support.

⚠️ Breaking Changes & Deprecations

  • Bower & Committed dist/ Removed: dist/ bundles are no longer committed to the repo, and bower.json plus the Grunt package2bower task have been removed. CI still builds bundles before publish, so npm/yarn/pnpm consumers are unaffected; installs via Bower or directly from the git tree must migrate to npm or a CDN. (#10747)

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for axios since your current version.


Updates fast-xml-parser from 4.5.3 to 5.7.0

Release notes

Sourced from fast-xml-parser's releases.

use @​nodable/entities to replace entities

  • No API change
  • No change in performance for basic usage
  • No typing change
  • No config change
  • new dependency
  • breaking: error messages for entities might have been changed.

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.12...v5.6.0

performance improvment, increase entity expansion default limit

  • increase default entity explansion limit as many projects demand for that
maxEntitySize: 10000,
maxExpansionDepth: 10000,
maxTotalExpansions: Infinity,
maxExpandedLength: 100000,
maxEntityCount: 1000,
  • performance improvement
    • reduce calls to toString
    • early return when entities are not present
    • prepare rawAttrsForMatcher only if user sets jPath: false

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.9...v5.5.10

fix typins and matcher instance in callbacks

combine typings file to avoid configuration changes pass readonly instance of matcher to the call backs to avoid accidental push/pop call

fix bugs of entity parsing and value parsing

fix: entity expansion limits update strnum package to 2.2.0

fix entity expansion and incorrect replacement and performance

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.5...v5.5.6

support onDangerousProperty

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.3...v5.5.5

update dependecies to fix typings

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.1...v5.5.2

integrate path-expression-matcher

  • support path-expression-matcher
  • fix: stopNode should not be parsed
  • performance improvement for stopNode checking

Separate Builder

XML Builder was the part of fast-xml-parser for years. But considering that any bug in builder may false-alarm the users who are only using parser and vice-versa, we have decided to split it into a separate package.

... (truncated)

Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

5.10.1 / 2026-07-17

  • fix: multiple DOCTYPE declarations.
  • deps: @nodable/entities for treeshaking

5.10.0 / 2026-07-11

  • upgrade:
    • xml-naming v0.3.0: cache support
    • PEM v1.6.2: sibling bug fix
    • is-unsafe v2.0.0: tree shaking

*5.9.3 / 2026-06-19

  • update strnum

*5.9.2 / 2026-06-17

  • dummy release to test changes in github action

*5.9.1 / 2026-06-17

  • dummy release to test release from github action

*5.9.0 / 2026-06-15

  • update strnum to 2.3.0
    • you can set hex, binary, enotation, infinity, unicode
  • validate unsafe HTML or XML data in doctype entities unsing 'is-unsafe' library. User can override rules by overriding EntityDecoder.

*5.8.0 / 2026-05-12

  • integrate xml-naming to validate DOCTYPE entity name and notation name (using qname becaue of backward compatibility)
    • This will consider xml-version as well. '1.0' is default
  • update strnum to 2.3.0
    • You can set octal and binary parsing which is bydeault off
  • update fast-xml-builder to 1.2.0
    • can sanitize tag names if found invalid
    • fix format output

5.7.3 / 2006-05-05

  • fix: alwaysCreateTextNode should create text node when attributes are present for self closing node
  • fix stop node expression when ns prefix is removed (found by iruizsalinas)
  • update XML Builder to 1.1.7
  • mark addEntity deprecated

5.7.2 / 2026-04-25

  • allow numerical external entity for backward compatibility

... (truncated)

Commits
  • f529642 update to release v5.7.0
  • 52a8583 Revert "improve performance of attributes reading"
  • 8d187f9 update builder
  • e174168 improve performance of attributes reading
  • 79a8dde update docs
  • f5cd5a5 set xml version to decoder even if attributes are ignored
  • f44b923 remove unwanted tests
  • 869ec8b Use @​nodable/entities v2.1.0
  • 7cb49e5 update release detail
  • 1b14fa7 include currency entities in default list
  • Additional commits viewable in compare view

Updates lodash from 4.17.21 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

  • Add security notice for _.template in threat model and API docs (#6099)
  • Document lower > upper behavior in _.random (#6115)
  • Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

Commits
  • cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
  • 75535f5 chore: prune stale advisory refs (#6170)
  • 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
  • 59be2de release(minor): bump to 4.18.0 (#6161)
  • af63457 fix: broken tests for _.template 879aaa9
  • 1073a76 fix: linting issues
  • 879aaa9 fix: validate imports keys in _.template
  • fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
  • 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
  • b819080 ci: add dist sync validation workflow (#6137)
  • Additional commits viewable in compare view

Updates uuid from 8.3.2 to 14.0.1

Release notes

Sourced from uuid's releases.

v14.0.1

14.0.1 (2026-06-20)

Bug Fixes

  • add types condition to node export for moduleResolution bundler (#961) (27ffae5)

v14.0.0

14.0.0 (2026-04-19)

⚠ BREAKING CHANGES

  • expect crypto to be global everywhere (requires node@20+) (#935)
  • drop node@18 support (#934)

Features

Bug Fixes

  • expect crypto to be global everywhere (requires node@20+) (#935) (f2c235f)
  • Use GITHUB_TOKEN for release-please and enable npm provenance (#925) (ffa3138)

v13.0.2

13.0.2 (2026-05-04)

Bug Fixes

  • rerelease to fix provenance. (49ccb35)

v13.0.1

13.0.1 (2026-04-27)

Bug Fixes

v13.0.0

13.0.0 (2025-09-08)

⚠ BREAKING CHANGES

  • make browser exports the default (#901)

... (truncated)

Changelog

Sourced from uuid's changelog.

14.0.1 (2026-06-20)

Bug Fixes

  • add types condition to node export for moduleResolution bundler (#961) (27ffae5)

14.0.0 (2026-04-19)

Security

  • Fixes GHSA-w5hq-g745-h8pq: v3(), v5(), and v6() did not validate that writes would remain within the bounds of a caller-supplied buffer, allowing out-of-bounds writes when an invalid offset was provided. A RangeError is now thrown if offset < 0 or offset + 16 > buf.length.

⚠ BREAKING CHANGES

  • crypto is now expected to be globally defined (requires node@20+) (#935)
  • drop node@18 support (#934)
  • upgrade minimum supported TypeScript version to 5.4.3, in keeping with the project's policy of supporting TypeScript versions released within the last two years

13.0.0 (2025-09-08)

⚠ BREAKING CHANGES

  • make browser exports the default (#901)

Bug Fixes

12.0.0 (2025-09-05)

⚠ BREAKING CHANGES

  • update to typescript@5.2 (#887)
  • remove CommonJS support (#886)
  • drop node@16 support (#883)

Features

Bug Fixes

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for uuid since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates glob from 11.0.3 to 12.0.0

Changelog

Sourced from glob's changelog.

changeglob

13

  • Move the CLI program out to a separate package, glob-bin. Install that if you'd like to continue using glob from the command line.

12

  • Remove the unsafe --shell option. The --shell option is now ONLY supported on known shells where the behavior can be implemented safely.

11.1

GHSA-5j98-mcp5-4vw2

  • Add the --shell option for the command line, with a warning that this is unsafe. (It will be removed in v12.)
  • Add the --cmd-arg/-g as a way to safely add positional arguments to the command provided to the CLI tool.
  • Detect commands with space or quote characters on known shells, and pass positional arguments to them safely, avoiding shell:true execution.

11.0

  • Drop support for node before v20

10.4

  • Add includeChildMatches: false option
  • Export the Ignore class

10.3

  • Add --default -p flag to provide a default pattern
  • exclude symbolic links to directories when follow and nodir are both set

10.2

  • Add glob cli

10.1

  • Return '.' instead of the empty string '' when the current working directory is returned as a match.
  • Add posix: true option to return / delimited paths, even on

... (truncated)

Commits
  • 2b03cca 12.0.0
  • d56203d prettier config
  • bb521e5 Remove --shell option where unsafe to use
  • 2551fb5 11.1.0
  • 47473c0 bin: Do not expose filenames to shell expansion
  • bc33fe1 skip tilde test on systems that lack tilde expansion
  • 59bf9ca fix notes
  • dde4fa6 docs(README): add #anchor and improve notes
  • 0559b0e docs: add better links to path-scurry docs
  • c9773c2 fix: correct typos in README.md
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by isaacs, a new releaser for glob since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates webpack from 5.102.1 to 5.108.4

Release notes

Sourced from webpack's releases.

v5.108.4

Patch Changes

v5.108.3

Patch Changes

v5.108.2

Patch Changes

v5.108.1

Patch Changes

  • Fix invalid property access for escaped namespace imports with multi-character mangled export names. (by @​xiaoxiaojx in #21280)

  • Add frames to ProfilingPlugin TracingStartedInBrowser event so the trace loads in Chrome DevTools. (by @​alexander-akait in #21269)

v5.108.0

Minor Changes

  • Treat top-level await and import.meta as ES module markers, matching Node.js syntax detection so no explicit module type is needed. (by @​alexander-akait in #21218)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.108.4

Patch Changes

5.108.3

Patch Changes

5.108.2

Patch Changes

5.108.1

Patch Changes

  • Fix invalid property access for escaped namespace imports with multi-character mangled export names. (by @​xiaoxiaojx in #21280)

  • Add frames to ProfilingPlugin TracingStartedInBrowser event so the trace loads in Chrome DevTools. (by @​alexander-akait in #21269)

... (truncated)

Commits
  • bb9ccfd chore(release): new release (#21319)
  • 7639066 fix: invalidate provided-exports cache with lazy barrel (#21326)
  • ae28c54 perf: reduce CPU and memory overhead of the HTML and CSS pipelines (#21332)
  • e6fb547 perf: re-encode the HTML AST as struct-of-arrays behind a path-based visitor ...
  • 5ce1c22 fix(html): resolve asset URLs against <base href> (#21329)
  • 0e43c4a test(html): cover generateError, ignored-source, and null-character parse pat...
  • cebd793 refactor: build export-presence guards from a lazy boolean formula (#21320)
  • c2628cf fix: don't resolve new URL() directory references as modules (#21312)
  • 00d8b2f perf: speed up non-CSS-Modules CSS parsing by skipping unused AST work (#21324)
  • f7a3f6d perf: reduce HTML parser memory and CPU with parser-level skip options (#21323)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for webpack since your current version.


Updates @nevware21/ts-utils from 0.12.5 to 0.16.0

Release notes

Sourced from @​nevware21/ts-utils's releases.

0.16.0

Changelog

Features

  • #587 feat(errors): expose isOwnInstance to createCustomError's constructCb and skip redundant stack captures
    • constructCb now receives a 3rd argument, isOwnInstance, which is true when the class is the leaf-most type actually being instantiated and false when its constructor is only running as a base-class step for a subclass further down an inheritance chain
    • The internal Error.captureStackTrace call is now gated by the same check, so it only fires once per instance (at the leaf-most class) instead of redundantly at every level of a chain
    • Lets custom error hierarchies with their own per-level stack-capture logic skip that work except at the leaf
  • #589 feat(errors): bind constructCb's this to the new instance via fnCall
    • constructCb is now invoked with this bound to the constructed instance (the same value also passed as the self argument), so non-arrow callbacks can use this.prop = ... instead of requiring the self argument
    • constructCb's type signature now declares an explicit this: any parameter; existing callbacks (arrow functions, or plain functions that don't declare this) remain unaffected

Bug Fixes

  • #588 npm run package failed with ERR_REQUIRE_ESM after magic-string moved to an ESM-only release (v1.0.0)
    • lib/rollup.config.js's PURE-annotation normalization plugin now loads magic-string via a dynamic import() inside renderChunk instead of a static import, since --bundleConfigAsCjs rewrites static imports to require(), which throws on Node versions without require(esm) support (eg. Node 18)
    • Added skipLibCheck to the main build and test tsconfigs (lib/tsconfig.base.json and lib/test/tsconfig.*.json) to stop external @types/node type errors (IteratorObject, BuiltinIteratorReturn, etc., introduced by the @types/node v26 bump) from leaking into the build and test compiles
  • #585 Add skipLibCheck to the TypeDoc compiler options to fix the same @types/node v26 type errors when generating docs

Repository Improvements

  • #582 CI: switch Puppeteer loading to ESM import() in Karma configs (Puppeteer is ESM-only), pin Size tests to run only on Node 22, and make Codecov upload non-blocking

Full Changelog

0.15.0

Changelog

Features

  • #570 Add microtask scheduling helpers with native queueMicrotask, Promise, and timer-backed fallbacks
    • New functions: scheduleMicrotask, hasQueueMicrotask, getQueueMicrotask, setMicroTaskFallbackOptions
    • New public types: ScheduleMicrotaskFn, MicroTaskOptions
    • Extends microtask support by providing cancellable microtasks via ITimerHandler, plus fallback ordering to run microtasks before queued timers when using the timer-backed implementation
    • Provides runtime parity across all supported environments by using native queueMicrotask when present, Promise-backed scheduling when available, and a timer-backed microtask queue otherwise
  • #573 Add nextTick scheduling support and new helper exports
    • New timer/runtime functions: scheduleNextTick, getProcessNextTick, hasProcessNextTick, setNextTickFallbackOptions
    • Uses native process.nextTick in Node runtimes when available, while providing equivalent nextTick behavior in browser and worker runtimes via Promise and timer-backed fallbacks
    • Adds shared queue logic and callback-argument support across microtask and nextTick scheduling
    • Adds arrConcat as a dedicated array helper and fnBindArgs as a dedicated function helper
    • Improves function binding typing with exported BoundFunction and updated signatures for fnBind / fnBindArgs
  • #574 feat(iterator,array): add iterator collection helpers, split helper modules, and align collection membership semantics
    • Added new iterator helpers: iterMap, iterFilter, iterTake, iterReduce, iterSome, iterEvery, iterToArray, iterUnion, iterIntersection, iterDifference
    • Added arrToMap helper in the array module and moved callback/type declarations into iterator/types
    • Refactored iterator helper implementation/tests into per-function files and updated root exports
    • Added NaN regression coverage and switched iterator set-operation membership checks to arrIncludes semantics for parity with array helpers
  • #576 Refactor timer microtask/nextTick shared types and environment helpers, with expanded fallback coverage
    • Moved MicrotaskFn and ScheduleMicrotaskFn to helpers/types and updated timer internals to consume shared type definitions

... (truncated)

Changelog

Sourced from @​nevware21/ts-utils's changelog.

v0.16.0 July 18th, 2026

Changelog

Features

  • #587 feat(errors): expose isOwnInstance to createCustomError's constructCb and skip redundant stack captures
    • constructCb now receives a 3rd argument, isOwnInstance, which is true when the class is the leaf-most type actually being instantiated and false when its constructor is only running as a base-class step for a subclass further down an inheritance chain
    • The internal Error.captureStackTrace call is now gated by the same check, so it only fires once per instance (at the leaf-most class) instead of redundantly at every level of a chain
    • Lets custom error hierarchies with their own per-level stack-capture logic skip that work except at the leaf
  • #589 feat(errors): bind constructCb's this to the new instance via fnCall
    • constructCb is now invoked with this bound to the constructed instance (the same value also passed as the self argument), so non-arrow callbacks can use this.prop = ... instead of requiring the self argument
    • constructCb's type signature now declares an explicit this: any parameter; existing callbacks (arrow functions, or plain functions that don't declare this) remain unaffected

Bug Fixes

  • #588 npm run package failed with ERR_REQUIRE_ESM after magic-string moved to an ESM-only release (v1.0.0)
    • lib/rollup.config.js's PURE-annotation normalization plugin now loads magic-string via a dynamic import() inside renderChunk instead of a static import, since --bundleConfigAsCjs rewrites static imports to require(), which throws on Node versions without require(esm) support (eg. Node 18)
    • Added skipLibCheck to the main build and test tsconfigs (lib/tsconfig.base.json and lib/test/tsconfig.*.json) to stop external @types/node type errors (IteratorObject, BuiltinIteratorReturn, etc., introduced by the @types/node v26 bump) from leaking into the build and test compiles
  • #585 Add skipLibCheck to the TypeDoc compiler options to fix the same @types/node v26 type errors when generating docs

Repository Improvements

  • #582 CI: switch Puppeteer loading to ESM import() in Karma configs (Puppeteer is ESM-only), pin Size tests to run only on Node 22, and make Codecov upload non-blocking

Full Changelog

v0.15.0 May 29th, 2026

Changelog

Features

  • #570 Add microtask scheduling helpers with native queueMicrotask, Promise, and timer-backed fallbacks
    • New functions: scheduleMicrotask, hasQueueMicrotask, getQueueMicrotask, setMicroTaskFallbac...

      Description has been truncated

@dependabot
Bump the npm_and_yarn group across 1 directory with 15 updates
6238b12 
Bumps the npm_and_yarn group with 15 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@azure/identity](https://github.com/Azure/azure-sdk-for-js) | `3.4.2` | `4.13.1` |
| [axios](https://github.com/axios/axios) | `0.27.2` | `0.33.0` |
| [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | `4.5.3` | `5.7.0` |
| [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.18.1` |
| [uuid](https://github.com/uuidjs/uuid) | `8.3.2` | `14.0.1` |
| [glob](https://github.com/isaacs/node-glob) | `11.0.3` | `12.0.0` |
| [webpack](https://github.com/webpack/webpack) | `5.102.1` | `5.108.4` |
| [@nevware21/ts-utils](https://github.com/nevware21/ts-utils) | `0.12.5` | `0.16.0` |
| [fast-uri](https://github.com/fastify/fast-uri) | `3.1.0` | `3.1.4` |
| [flatted](https://github.com/WebReflection/flatted) | `3.3.3` | `3.4.2` |
| [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.15.11` | `1.16.0` |
| [form-data](https://github.com/form-data/form-data) | `4.0.4` | `4.0.6` |
| [handlebars](https://github.com/handlebars-lang/handlebars.js) | `4.7.8` | `4.7.9` |
| [jws](https://github.com/brianloveswords/node-jws) | `3.2.2` | `3.2.3` |
| [picomatch](https://github.com/micromatch/picomatch) | `2.3.1` | `4.0.5` |



Updates `@azure/identity` from 3.4.2 to 4.13.1
- [Release notes](https://github.com/Azure/azure-sdk-for-js/releases)
- [Changelog](https://github.com/Azure/azure-sdk-for-js/blob/main/documentation/Changelog-for-next-generation.md)
- [Commits](https://github.com/Azure/azure-sdk-for-js/compare/@azure/identity_3.4.2...@azure/identity_4.13.1)

Updates `axios` from 0.27.2 to 0.33.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v0.27.2...v0.33.0)

Updates `fast-xml-parser` from 4.5.3 to 5.7.0
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](NaturalIntelligence/fast-xml-parser@v4.5.3...v5.7.0)

Updates `lodash` from 4.17.21 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.18.1)

Updates `uuid` from 8.3.2 to 14.0.1
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](uuidjs/uuid@v8.3.2...v14.0.1)

Updates `glob` from 11.0.3 to 12.0.0
- [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md)
- [Commits](isaacs/node-glob@v11.0.3...v12.0.0)

Updates `webpack` from 5.102.1 to 5.108.4
- [Release notes](https://github.com/webpack/webpack/releases)
- [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack@v5.102.1...v5.108.4)

Updates `@nevware21/ts-utils` from 0.12.5 to 0.16.0
- [Release notes](https://github.com/nevware21/ts-utils/releases)
- [Changelog](https://github.com/nevware21/ts-utils/blob/main/CHANGELOG.md)
- [Commits](nevware21/ts-utils@0.12.5...0.16.0)

Updates `fast-uri` from 3.1.0 to 3.1.4
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.0...v3.1.4)

Updates `flatted` from 3.3.3 to 3.4.2
- [Commits](WebReflection/flatted@v3.3.3...v3.4.2)

Updates `follow-redirects` from 1.15.11 to 1.16.0
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.15.11...v1.16.0)

Updates `form-data` from 4.0.4 to 4.0.6
- [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md)
- [Commits](form-data/form-data@v4.0.4...v4.0.6)

Updates `handlebars` from 4.7.8 to 4.7.9
- [Release notes](https://github.com/handlebars-lang/handlebars.js/releases)
- [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.9/release-notes.md)
- [Commits](handlebars-lang/handlebars.js@v4.7.8...v4.7.9)

Updates `jws` from 3.2.2 to 3.2.3
- [Release notes](https://github.com/brianloveswords/node-jws/releases)
- [Changelog](https://github.com/auth0/node-jws/blob/master/CHANGELOG.md)
- [Commits](auth0/node-jws@v3.2.2...v3.2.3)

Updates `picomatch` from 2.3.1 to 4.0.5
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@2.3.1...4.0.5)

---
updated-dependencies:
- dependency-name: "@azure/identity"
  dependency-version: 4.13.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 0.33.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: fast-xml-parser
  dependency-version: 5.7.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: uuid
  dependency-version: 14.0.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: glob
  dependency-version: 12.0.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: webpack
  dependency-version: 5.108.4
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: "@nevware21/ts-utils"
  dependency-version: 0.16.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-uri
  dependency-version: 3.1.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: flatted
  dependency-version: 3.4.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: follow-redirects
  dependency-version: 1.16.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: form-data
  dependency-version: 4.0.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: handlebars
  dependency-version: 4.7.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: jws
  dependency-version: 3.2.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: picomatch
  dependency-version: 4.0.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 21, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jul 22, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm_and_yarn-8fa69cd9d9 branch July 22, 2026 23:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Power-Maverick