Skip to content

chore(deps): bump the dependencies group across 1 directory with 13 updates - #53

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-3a8e6b686c
Open

chore(deps): bump the dependencies group across 1 directory with 13 updates#53
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-3a8e6b686c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the dependencies group with 13 updates in the / directory:

Package From To
axios 1.12.2 1.18.1
qs 6.14.0 6.15.3
@types/qs 6.14.0 6.15.1
@types/node 24.9.0 26.1.2
@vitest/coverage-v8 3.2.4 4.1.10
prettier 3.6.2 3.9.6
typedoc 0.28.14 0.28.20
typedoc-plugin-markdown 4.9.0 4.12.0
typescript 5.9.3 7.0.2
vite 7.1.11 8.1.5
vite-plugin-dts 4.5.4 5.0.3
vite-tsconfig-paths 5.1.4 6.1.1
vitest 3.2.4 4.1.10

Updates axios from 1.12.2 to 1.18.1

Release notes

Sourced from axios's releases.

v1.18.1 — June 21, 2026

This release focuses on Node HTTP adapter fixes, safer AxiosError serialisation, runtime/type correctness fixes, documentation updates, and dependency maintenance.

🐛 Bug Fixes

  • AxiosError Serialisation: Made AxiosError#cause non-enumerable to prevent circular JSON serialisation failures when errors include nested causes. (#10913)
  • Node HTTP Adapter: Guarded socket.setKeepAlive for proxy agent streams, accepted path-only URLs when socketPath is configured, deferred environment proxy handling to Node, and explicitly passed maxBodyLength through to follow-redirects. (#10917, #10930, #10942, #10993)
  • Runtime and Type Correctness: Fixed several runtime crashes, type definition mismatches, and incorrect error handling paths. (#10959, #11021)
  • AxiosURLSearchParams: Switched the encoder callback to an arrow function so encoder.call(this) receives the AxiosURLSearchParams instance correctly. (#11019)

🔧 Maintenance & Chores

  • Documentation: Documented sensitive headers and status transition behaviour, prepared cleaned-up docs, added Deno install instructions, and clarified that request data is request-specific (#11007, #11010, #11023, #11025)

  • Dependencies: Bumped vite, rollup, form-data, js-yaml, and multer across the root project, docs, smoke tests, and module test workspaces. (#11011, #11012, #11013, #11014, #11015, #11016, #11017, #11026)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog

v1.18.0 — June 13, 2026

This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.

🔒 Security Fixes

  • Redirect Header Safety: Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (#10892)

  • URL And Request Hardening: Rejects malformed http: and https: URLs that omit // with ERR_INVALID_URL, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local NO_PROXY matching. (#11000)

🐛 Bug Fixes

  • Status Validation: Added transitional.validateStatusUndefinedResolves so applications can opt in to treating validateStatus: undefined like the option was omitted, while validateStatus: null remains the explicit way to accept every status. (#10899)

🔧 Maintenance & Chores

  • Documentation: Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the proxy request config as Node.js-only in the advanced docs. (#10984, #10988, #10992, #10995)

  • Dependencies: Bumped @babel/core, @babel/preset-env, @commitlint/cli, @commitlint/config-conventional, @rollup/plugin-babel, @rollup/plugin-commonjs, @vitest/browser, @vitest/browser-playwright, eslint, lint-staged, rollup, vitest, and actions/checkout. (#10989, #10996, #10997)

  • Release Metadata: Prepared the 1.18.0 release by updating package metadata and the runtime VERSION value. (#11003)

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

v1.19.0 — July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

  • Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

  • Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)
  • Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
  • HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

  • Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)

  • Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)

  • Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)

  • Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)

  • URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11008, #11038)

  • Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)

  • Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)

  • Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)

  • Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

  • Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)
  • Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)
  • Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)
  • Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)
  • Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)
  • Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

... (truncated)

Commits
  • a209bfb chore(release): prepare release 1.18.1 (#11027)
  • fa6a55e chore(deps-dev): bump multer from 2.1.1 to 2.2.0 (#11026)
  • 40e7be8 docs: clarifies that request data is request-specific in axios (#11025)
  • a446b39 fix(AxiosURLSearchParams): use arrow function so encoder.call(this) receives ...
  • cf1306a docs: add Deno to install instructions (#11023)
  • b32880a fix: incorrect use of error (#11021)
  • 1792eda fix: ensure maxBodyLength is explicitly passed to follow-redirects (#10993)
  • 30499d6 fix: various runtime crashes and type definition mismatches (#10959)
  • 20ce9c4 fix(http): defer env proxy handling to Node (#10942)
  • e64bcf9 chore(deps): merge branch 'v1.x' into tests/module/cjs (#11014)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for axios since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates qs from 6.14.0 to 6.15.3

Changelog

Sourced from qs's changelog.

6.15.3

  • [Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via combine/merge
  • [Fix] utils: respect encoding of surrogate pairs across chunks (#559)
  • [Robustness] parse: throw the arrayLimit error before splitting oversized comma values
  • [Robustness] utils.merge / utils.assign: avoid invoking __proto__ setter when copying own properties
  • [Robustness] utils: enforce arrayLimit consistently across merge's array paths
  • [Perf] utils: make compact O(n) via a side-channel visited-set instead of Array.indexOf
  • [Deps] update side-channel
  • [Dev Deps] update eslint, mock-property, tape
  • [Tests] parse: characterize current lenient handling of unbalanced bracket keys (#558)

6.15.2

  • [Fix] stringify: skip null/undefined entries in arrayFormat: 'comma' + encodeValuesOnly instead of crashing in encoder
  • [Fix] stringify: use configured delimiter after charsetSentinel (#555)
  • [Fix] stringify: apply formatter to encoded key under strictNullHandling (#554)
  • [Fix] stringify: skip null/undefined filter-array entries instead of crashing in encoder (#551)
  • [Fix] parse: handle nested bracket groups and add regression tests (#530)
  • [readme] fix grammar (#550)
  • [Dev Deps] update @ljharb/eslint-config
  • [Tests] add regression tests for keys containing percent-encoded bracket text

6.15.1

  • [Fix] parse: parameterLimit: Infinity with throwOnLimitExceeded: true silently drops all parameters
  • [Deps] update @ljharb/eslint-config
  • [Dev Deps] update @ljharb/eslint-config, iconv-lite
  • [Tests] increase coverage

6.15.0

  • [New] parse: add strictMerge option to wrap object/primitive conflicts in an array (#425, #122)
  • [Fix] duplicates option should not apply to bracket notation keys (#514)

6.14.2

  • [Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit (#546)
  • [Fix] arrayLimit means max count, not max index, in combine/merge/parseArrayValue
  • [Fix] parse: throw on arrayLimit exceeded with indexed notation when throwOnLimitExceeded is true (#529)
  • [Fix] parse: enforce arrayLimit on comma-parsed values
  • [Fix] parse: fix error message to reflect arrayLimit as max index; remove extraneous comments (#545)
  • [Robustness] avoid .push, use void
  • [readme] document that addQueryPrefix does not add ? to empty output (#418)
  • [readme] clarify parseArrays and arrayLimit documentation (#543)
  • [readme] replace runkit CI badge with shields.io check-runs badge
  • [meta] fix changelog typo (arrayLength → arrayLimit)
  • [actions] fix rebase workflow permissions

6.14.1

  • [Fix] ensure arrayLimit applies to [] notation as well
  • [Fix] parse: when a custom decoder returns null for a key, ignore that key
  • [Refactor] parse: extract key segment splitting helper
  • [meta] add threat model
  • [actions] add workflow permissions

... (truncated)

Commits
  • 18d085e v6.15.3
  • c38af42 [Deps] update side-channel
  • adce539 [Dev Deps] update eslint, mock-property, tape
  • 74a0f6a [Robustness] utils: enforce arrayLimit consistently across merge's arra...
  • f4938f5 [Tests] parse: characterize current lenient handling of unbalanced bracket ...
  • 5d5f723 [Perf] utils: make compact O(n) via a side-channel visited-set instead of...
  • 52afe00 [Robustness] parse: throw the arrayLimit error before splitting oversized...
  • 963e538 [Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via...
  • 59da434 [Fix] utils: respect encoding of surrogate pairs across chunks
  • 9532969 [Robustness] utils.merge / utils.assign: avoid invoking __proto__ sette...
  • Additional commits viewable in compare view

Updates @types/qs from 6.14.0 to 6.15.1

Commits

Updates @types/node from 24.9.0 to 26.1.2

Commits

Updates @types/qs from 6.14.0 to 6.15.1

Commits

Updates @vitest/coverage-v8 from 3.2.4 to 4.1.10

Release notes

Sourced from @​vitest/coverage-v8's releases.

v4.1.10

   🐞 Bug Fixes

    View changes on GitHub

v4.1.9

🐞 Bug Fixes

View changes on GitHub

v4.1.8

   🐞 Bug Fixes

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

    View changes on GitHub

v4.1.6

   🐞 Bug Fixes

   🏎 Performance

    View changes on GitHub

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​vitest/coverage-v8 since your current version.


Updates prettier from 3.6.2 to 3.9.6

Release notes

Sourced from prettier's releases.

3.9.6

What's Changed

🔗 Changelog

3.9.5

🔗 Changelog

3.9.4

  • Angular: Format @content(name) -> @content (name) to align with other block syntax (#19499 by @​fisker)

🔗 Changelog

3.9.3

🔗 Changelog

3.9.1

🔗 Changelog

3.9.0

diff

🔗 Prettier 3.9: Major parser upgrades and Formatting improvements

3.8.5

🔗 Changelog

3.8.4

🔗 Changelog

3.8.3

🔗 Changelog

... (truncated)

Changelog

Sourced from prettier's changelog.

3.9.6

diff

TypeScript: Preserve quotes for methods named new (#19621 by @​kovsu)

// Input
interface Container {
  "new"(id: string): number;
}
// Prettier 3.9.5
interface Container {
new(id: string): number;
}
// Prettier 3.9.6
interface Container {
"new"(id: string): number;
}

TypeScript: Support import defer (#19624, #19675 by @​fisker)

// Input
import defer * as foo from "foo";
// Prettier 3.9.5
import * as foo from "foo";
// Prettier 3.9.6
import defer * as foo from "foo";

JavaScript: Added a new official plugin @prettier/plugin-yuku (#19628, #19629 by @​fisker)

@prettier/plugin-yuku is powered by Yuku (A high-performance JavaScript/TypeScript compiler toolchain written in Zig).

This plugin includes two new parsers: yuku (JavaScript syntax) and yuku-ts (TypeScript syntax).

To use this plugin:

  1. Install the plugin:

    yarn add --dev prettier @prettier/plugin-yuku

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for prettier since your current version.


Updates typedoc from 0.28.14 to 0.28.20

Release notes

Sourced from typedoc's releases.

v0.28.20

Features

  • Group/category section headings (<h2>) in the default theme now include an id attribute so they can be linked to via fragment identifiers (e.g. modules.html#classes), #3029.
  • Added a @reexport modifier tag to have TypeDoc convert variable/type references as a re-export instead of a new symbol, #3096.
  • API: Introduced generateOutputsBegin and generateOutputsEnd events on Application for plugin use.

Bug Fixes

  • When --emit none is used, TypeDoc will now report warnings about missing relative paths previously reported when rendering, #3078.
  • Improved performance via asynchronously performing git and file write operations, more performant JSX rendering, and source code bundling, #3103.
  • A @hidden tag on a constructor parameter-property will now only hide the property, not both the property and the parameter, #3111.
  • Custom @group and @category titles with the same sort weight are now ordered consistently with the alphabetical reflection sort, #3120.

Thanks!

v0.28.19

Features

  • Added French translations for the TypeDoc interface and help descriptions.
  • Added support for triple-slash comment style, which requires exactly three slashes in the comment, #3089.

Bug Fixes

  • Corrected handling of icon caching for custom themes which use SVGs with a larger view box than TypeDoc's default theme.
  • Fixed short summary comment handling on module pages when the project source files use Windows line endings, #3093.

Thanks!

v0.28.18

Features

  • Support TypeScript 6.0, #3084.

v0.28.17

... (truncated)

Changelog

Sourced from typedoc's changelog.

v0.28.20 (2026-07-05)

Features

  • Group/category section headings (<h2>) in the default theme now include an id attribute so they can be linked to via fragment identifiers (e.g. modules.html#classes), #3029.
  • Added a @reexport modifier tag to have TypeDoc convert variable/type references as a re-export instead of a new symbol, #3096.
  • API: Introduced generateOutputsBegin and generateOutputsEnd events on Application for plugin use.

Bug Fixes

  • When --emit none is used, TypeDoc will now report warnings about missing relative paths previously reported when rendering, #3078.
  • Improved performance via asynchronously performing git and file write operations, more performant JSX rendering, and source code bundling, #3103.
  • A @hidden tag on a constructor parameter-property will now only hide the property, not both the property and the parameter, #3111.
  • Custom @group and @category titles with the same sort weight are now ordered consistently with the alphabetical reflection sort, #3120.

Thanks!

v0.28.19 (2026-04-12)

Features

  • Added French translations for the TypeDoc interface and help descriptions.
  • Added support for triple-slash comment style, which requires exactly three slashes in the comment, #3089.

Bug Fixes

  • Corrected handling of icon caching for custom themes which use SVGs with a larger view box than TypeDoc's default theme.
  • Fixed short summary comment handling on module pages when the project source files use Windows line endings, #3093.

Thanks!

v0.28.18 (2026-03-23)

Features

  • Support TypeScript 6.0, #3084.

v0.28.17 (2026-02-13)

... (truncated)

Commits
  • 34d843b Update changelog for release
  • fbd4a25 Bump version to 0.28.20
  • 93ba157 Update dependencies in example
  • e8c5df8 Remove unnecessary files from distribution
  • 392b0dd Update dependencies
  • 8510dd4 Add missing entries in changelog before release
  • 51dc052 Update change log for 0.28.20 release
  • 72f20cd Merge branch 'fix-locale-sort-group-category-titles' into dev
  • 623f2c0 Fix failing test, accept slightly slower build for now
  • c8bdf14 Minor config tweak to improve dev build time
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for typedoc since your current version.


Updates typedoc-plugin-markdown from 4.9.0 to 4.12.0

Release notes

Sourced from typedoc-plugin-markdown's releases.

typedoc-plugin-markdown@4.12.0

Minor Changes

  • Support JSDoc-style <caption> labels for @example tags (#861).
  • Add Markdown theme translations for the fr locale.

Patch Changes

  • Fixed duplicate sidebar groups when navigation.includeCategories=true and navigation.includeGroups=false (#866).

typedoc-plugin-markdown@4.11.0

Minor Changes

  • Improved rendering of union types when documented type details are present (#857).
  • Improved rendering of union types used in parameter declarations.
  • When a function returns another function, full documentation for the returned function is now only shown when meaningful comments are present, aligning with the default theme.
  • Index signature declarations are now rendered as blockquotes for improved consistency.

Patch Changes

  • Added locale translations for grouped @example headings (#858).
  • Function-typed properties are now rendered without parentheses in headings. This avoids implying that the member is a method and more accurately reflects that it is a property whose type is a function.
  • Optional properties are now indicated with ? in the property name, making the optionality explicit.
  • All pipe characters (|) in union type output are now escaped.

typedoc-plugin-markdown@4.10.0

Minor Changes

  • A JSON schema to be consumed by typedoc.json is now published to the package root.
  • Mark parameters with default values as optional, matching the default TypeDoc theme.

Patch Changes

  • Fixed markdownlint errors related to empty table cells and invalid link fragments.
  • Anchors inside table cells (when property formats equal "table") are now namespaced by reflection kind (for example property-foo) to prevent collisions with Markdown heading slugs and ensure stable in-page links (#856).
  • Resolve "does not have an anchor but one was requested" warnings in verbose log mode (#850).
  • Guard against undefined types causing errors in complex types in tables (thanks @​ilyabo).
Changelog

Sourced from typedoc-plugin-markdown's changelog.

4.12.0 (2026-06-02)

Minor Changes

  • Support JSDoc-style <caption> labels for @example tags (#861).
  • Add Markdown theme translations for the fr locale.

Patch Changes

  • Fixed duplicate sidebar groups when navigation.includeCategories=true and navigation.includeGroups=false (#866).

4.11.0 (2026-03-18)

Minor Changes

  • Improved rendering of union types when documented type details are present (#857).
  • Improved rendering of union types used in parameter declarations.
  • When a function returns another function, full documentation for the returned function is now only shown when meaningful comments are present, aligning with the default theme.
  • Index signature declarations are now rendered as blockquotes for improved consistency.

Patch Changes

  • Added locale translations for grouped @example headings (#858).
  • Function-typed properties are now rendered without parentheses in headings. This avoids implying that the member is a method and more accurately reflects that it is a property whose type is a function.
  • Optional properties are now indicated with ? in the property name, making the optionality explicit.
  • All pipe characters (|) in union type output are now escaped.

4.10.0 (2026-02-06)

Minor Changes

  • A JSON schema to be consumed by typedoc.json is now published to the package root.
  • Mark parameters with default values as optional, matching the default TypeDoc theme.

Patch Changes

  • Fixed markdownlint errors related to empty table cells and invalid link fragments.
  • Anchors inside table cells (when property formats equal "table") are now namespaced by reflection kind (for example property-foo) to prevent collisions with Markdown heading slugs and ensure stable in-page links (#856).
  • Resolve "does not have an anchor but one was requested" warnings in verbose log mode (#850).
  • Guard against undefined types causing errors in complex types in tables (thanks @​ilyabo).
Commits
  • 7d601e1 Version Packages
  • 1ab02e8 fix(core): fixed duplicate sidebar groups (#866)
  • 7696589 fix(core): support JSDoc-style \<caption> labels for @example tags (#861)
  • 94e7353 chore(core): refactor tweaks
  • 345eace chore(docs): updated docs
  • e7dc9cb chore(all): fixed specs
  • 37fa5e9 chore(all): add mocha to types
  • e0fe371 feat(core): add Markdown theme translations for the fr locale
  • 88f7efd chore(all): updated packages
  • 9bdc290 chore(docs): updated readmes
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for typedoc-plugin-markdown since your current version.

Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 4, 2026
@socket-security

socket-security Bot commented May 4, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updated@​types/​qs@​6.14.0 ⏵ 6.15.11001006981 -2100
Updated@​vitest/​coverage-v8@​3.2.4 ⏵ 4.1.1099 +110079 +799 +2100
Updatedvitest@​3.2.4 ⏵ 4.1.1098 +1100 +7579 +199 +2100
Updated@​types/​node@​24.9.0 ⏵ 26.1.289 -111008195 -1100
Updatedvite@​7.1.11 ⏵ 8.1.598 +1100 +318298100
Updatedtypedoc-plugin-markdown@​4.9.0 ⏵ 4.12.0100 +110084 +588100
Updatedvite-tsconfig-paths@​5.1.4 ⏵ 6.1.199100100 +185100
Updatedvite-plugin-dts@​4.5.4 ⏵ 5.0.3100 +110086 -1492 +3100
Updatedtypescript@​5.9.3 ⏵ 7.0.29910089 -1100100 +10
Updatedtypedoc@​0.28.14 ⏵ 0.28.201001009789100
Updatedqs@​6.14.0 ⏵ 6.15.3100100 +410091 -9100
Updatedaxios@​1.12.2 ⏵ 1.18.198 -1100 +7510091 -2100
Updatedprettier@​3.6.2 ⏵ 3.9.699 +210097 +199 +1100

View full report

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/dependencies-3a8e6b686c branch from 51598a5 to 118499c Compare June 29, 2026 18:25
@socket-security

socket-security Bot commented Jun 29, 2026 •
edited
Loading

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm @emnapi/runtime is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package-lock.json → npm/vite-plugin-dts@5.0.3 → npm/vite@8.1.5 → npm/@emnapi/runtime@1.11.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/runtime@1.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@dependabot
chore(deps): bump the dependencies group across 1 directory with 13 u…
5a5068c 
…pdates

Bumps the dependencies group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [axios](https://github.com/axios/axios) | `1.12.2` | `1.18.1` |
| [qs](https://github.com/ljharb/qs) | `6.14.0` | `6.15.3` |
| [@types/qs](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/qs) | `6.14.0` | `6.15.1` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `24.9.0` | `26.1.2` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `3.2.4` | `4.1.10` |
| [prettier](https://github.com/prettier/prettier) | `3.6.2` | `3.9.6` |
| [typedoc](https://github.com/TypeStrong/TypeDoc) | `0.28.14` | `0.28.20` |
| [typedoc-plugin-markdown](https://github.com/typedoc2md/typedoc-plugin-markdown/tree/HEAD/packages/typedoc-plugin-markdown) | `4.9.0` | `4.12.0` |
| [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `7.0.2` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `7.1.11` | `8.1.5` |
| [vite-plugin-dts](https://github.com/qmhc/unplugin-dts/tree/HEAD/packages/vite-plugin-dts) | `4.5.4` | `5.0.3` |
| [vite-tsconfig-paths](https://github.com/aleclarson/vite-tsconfig-paths) | `5.1.4` | `6.1.1` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `3.2.4` | `4.1.10` |



Updates `axios` from 1.12.2 to 1.18.1
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.12.2...v1.18.1)

Updates `qs` from 6.14.0 to 6.15.3
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.14.0...v6.15.3)

Updates `@types/qs` from 6.14.0 to 6.15.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/qs)

Updates `@types/node` from 24.9.0 to 26.1.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/qs` from 6.14.0 to 6.15.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/qs)

Updates `@vitest/coverage-v8` from 3.2.4 to 4.1.10
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/coverage-v8)

Updates `prettier` from 3.6.2 to 3.9.6
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.6.2...3.9.6)

Updates `typedoc` from 0.28.14 to 0.28.20
- [Release notes](https://github.com/TypeStrong/TypeDoc/releases)
- [Changelog](https://github.com/TypeStrong/typedoc/blob/master/CHANGELOG.md)
- [Commits](TypeStrong/typedoc@v0.28.14...v0.28.20)

Updates `typedoc-plugin-markdown` from 4.9.0 to 4.12.0
- [Release notes](https://github.com/typedoc2md/typedoc-plugin-markdown/releases)
- [Changelog](https://github.com/typedoc2md/typedoc-plugin-markdown/blob/main/packages/typedoc-plugin-markdown/CHANGELOG.md)
- [Commits](https://github.com/typedoc2md/typedoc-plugin-markdown/commits/typedoc-plugin-markdown@4.12.0/packages/typedoc-plugin-markdown)

Updates `typescript` from 5.9.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/commits)

Updates `vite` from 7.1.11 to 8.1.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.1.5/packages/vite)

Updates `vite-plugin-dts` from 4.5.4 to 5.0.3
- [Release notes](https://github.com/qmhc/unplugin-dts/releases)
- [Changelog](https://github.com/qmhc/unplugin-dts/blob/main/packages/vite-plugin-dts/CHANGELOG.md)
- [Commits](https://github.com/qmhc/unplugin-dts/commits/vite-plugin-dts@5.0.3/packages/vite-plugin-dts)

Updates `vite-tsconfig-paths` from 5.1.4 to 6.1.1
- [Release notes](https://github.com/aleclarson/vite-tsconfig-paths/releases)
- [Commits](aleclarson/vite-tsconfig-paths@v5.1.4...v6.1.1)

Updates `vitest` from 3.2.4 to 4.1.10
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 25.6.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: "@types/qs"
  dependency-version: 6.15.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: "@types/qs"
  dependency-version: 6.15.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 4.1.5
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: axios
  dependency-version: 1.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: prettier
  dependency-version: 3.8.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: qs
  dependency-version: 6.15.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: typedoc
  dependency-version: 0.28.19
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: typedoc-plugin-markdown
  dependency-version: 4.11.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: typescript
  dependency-version: 6.0.3
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: vite
  dependency-version: 8.0.10
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: vite-plugin-dts
  dependency-version: 5.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: vite-tsconfig-paths
  dependency-version: 6.1.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: vitest
  dependency-version: 4.1.5
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/dependencies-3a8e6b686c branch from 118499c to 5a5068c Compare July 27, 2026 18:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@ryohidaka ryohidaka

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ryohidaka