Skip to content

build(deps): bump the npm-dependencies group across 1 directory with 19 updates#542

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-35ecfd1da9
Closed

build(deps): bump the npm-dependencies group across 1 directory with 19 updates#542
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-35ecfd1da9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-dependencies group with 19 updates in the / directory:

Package From To
@babel/core 7.29.0 7.29.7
@cyclonedx/cyclonedx-library 6.13.1 10.0.0
eslint-import-resolver-typescript 4.4.4 4.4.5
fast-xml-parser 5.7.0 5.8.0
https-proxy-agent 7.0.6 9.0.0
js-yaml 4.1.1 4.2.0
p-limit 4.0.0 7.3.0
packageurl-js 1.0.2 2.0.1
web-tree-sitter 0.26.8 0.26.9
@types/node 20.19.31 25.9.1
chai 4.5.0 6.2.2
eslint 8.57.1 10.4.1
esmock 2.7.3 2.7.6
mocha 10.8.2 11.7.6
msw 2.12.7 2.14.6
sinon 15.2.0 22.0.0
sinon-chai 3.7.0 4.0.1
typescript 5.9.3 6.0.3
which 5.0.0 7.0.0

Updates @babel/core from 7.29.0 to 7.29.7

Release notes

Sourced from @​babel/core's releases.

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

v7.29.6 (2026-05-25)

🐛 Bug Fix

Committers: 3

v7.29.5 (2026-05-05)

🏠 Internal

  • babel-preset-env
    • Update @babel/* dependencies

v7.29.4 (2026-05-05)

🐛 Bug Fix

  • babel-plugin-transform-modules-systemjs
    • #17974 [7.x backport]fix(systemjs): improve module string name support (@​JLHwung)

Committers: 1

v7.29.3 (2026-04-30)

👓 Spec Compliance

🐛 Bug Fix

  • babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
    • #17931 fix(decorators): replace super within all removed static elements (@​JLHwung)
  • babel-register
  • babel-compat-data, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-preset-env

💅 Polish

  • babel-parser

... (truncated)

Commits

Updates @cyclonedx/cyclonedx-library from 6.13.1 to 10.0.0

Release notes

Sourced from @​cyclonedx/cyclonedx-library's releases.

10.0.0

BREAKING changes

  • Removed deprecated symbols
  • Removed PackageUrl factories
  • No longer use external standards' implementations directly

Removed

  • Entrypoint Builders (via #1377)
  • Entrypoint Factories (via #1377)
  • Entrypoint Utils (via #1377)
  • Entrypoint Contrib/PackageUrl (via #1378)
  • Deprecated symbol Builders (#1346 via #1377)
  • Deprecated symbol Builders.FromNodePackageJson (#1346 via #1377)
  • Deprecated symbol Builders.FromNodePackageJson.ToolBuilder (#1346 via #1377)
    Use Contrib.FromNodePackageJson.Builders.ToolBuilder instead.
  • Deprecated symbol Builders.FromNodePackageJson.ComponentBuilder (#1346 via #1377)
    Use Contrib.FromNodePackageJson.Builders.ComponentBuilder instead.
  • Deprecated symbol Factories (#1346 via #1377)
  • Deprecated symbol Factories.FromNodePackageJson (#1346 via #1377)
  • Deprecated symbol Factories.FromNodePackageJson.ExternalReferenceFactory (#1346 via #1377)
    Use Contrib.FromNodePackageJson.Factories.ExternalReferenceFactory instead.
  • Deprecated symbol Factories.FromNodePackageJson.PackageUrlFactory (#1346 via #1377)
    Use packageurl-js downstream.
  • Deprecated symbol Factories.LicenseFactory (#1346, #1348 via #1377, #1378)
    Use Contrib.License.Factories.LicenseFactory instead.
  • Deprecated symbol Factories.PackageUrlFactory (#1346 via #1377)
    Use packageurl-js downstream.
  • Deprecated symbol Types.NodePackageJson (#1346, #1348 via #1377, #1378)
    Use Contrib.FromNodePackageJson.Types.NodePackageJson instead.
  • Deprecated symbol Types.assertNodePackageJson (#1346 via #1377)
    Use Contrib.FromNodePackageJson.Types.assertNodePackageJson instead.
  • Deprecated symbol Types.isNodePackageJson (#1346 via #1377)
    Use Contrib.FromNodePackageJson.Types.isNodePackageJson instead.
  • Deprecated symbol Utils (#1346 via #1377)
  • Deprecated symbol Utils.BomUtility (#1346 via #1377)
  • Deprecated symbol Utils.BomUtility.randomSerialNumber (#1346 via #1377)
    Use Contrib.Bom.Utils.randomSerialNumber instead.
  • Deprecated symbol Utils.LicenseUtility (#1346 via #1377)
  • Deprecated symbol Utils.LicenseUtility.FsUtils (#1346 via #1377)
    Use Contrib.License.Utils.FsUtils instead.
  • Deprecated symbol Utils.LicenseUtility.PathUtils (#1346 via #1377)
  • Use Contrib.License.Utils.PathUtils instead.
  • Deprecated symbol Utils.LicenseUtility.FileAttachment (#1346 via #1377)
    Use Contrib.License.Utils.FileAttachment instead.
  • Deprecated symbol Utils.LicenseUtility.ErrorReporter (#1346 via #1377)
    Use Contrib.License.Utils.ErrorReporter instead.
  • Deprecated symbol Utils.LicenseUtility.LicenseEvidenceGatherer (#1346 via #1377)
    Use Contrib.License.Utils.LicenseEvidenceGatherer instead.
  • Deprecated symbol Utils.NpmjsUtility (#1346 via #1377)
  • Deprecated symbol Utils.NpmjsUtility.parsePackageIntegrity (#1346 via #1377)
    Use Contrib.FromNodePackageJson.Utils.parsePackageIntegrity instead.

... (truncated)

Changelog

Sourced from @​cyclonedx/cyclonedx-library's changelog.

10.0.0 -- 2026-03-03

  • BREAKING changes
    • Removed deprecated symbols
    • Removed PackageUrl factories
    • No longer use external standards' implementations directly
  • Removed
    • Entrypoint Builders (via #1377)
    • Entrypoint Factories (via #1377)
    • Entrypoint Utils (via #1377)
    • Entrypoint Contrib/PackageUrl (via #1378)
    • Deprecated symbol Builders (#1346 via #1377)
    • Deprecated symbol Builders.FromNodePackageJson (#1346 via #1377)
    • Deprecated symbol Builders.FromNodePackageJson.ToolBuilder (#1346 via #1377)
      Use Contrib.FromNodePackageJson.Builders.ToolBuilder instead.
    • Deprecated symbol Builders.FromNodePackageJson.ComponentBuilder (#1346 via #1377)
      Use Contrib.FromNodePackageJson.Builders.ComponentBuilder instead.
    • Deprecated symbol Factories (#1346 via #1377)
    • Deprecated symbol Factories.FromNodePackageJson (#1346 via #1377)
    • Deprecated symbol Factories.FromNodePackageJson.ExternalReferenceFactory (#1346 via #1377)
      Use Contrib.FromNodePackageJson.Factories.ExternalReferenceFactory instead.
    • Deprecated symbol Factories.FromNodePackageJson.PackageUrlFactory (#1346 via #1377)
      Use packageurl-js downstream.
    • Deprecated symbol Factories.LicenseFactory (#1346, #1348 via #1377, #1378)
      Use Contrib.License.Factories.LicenseFactory instead.
    • Deprecated symbol Factories.PackageUrlFactory (#1346 via #1377)
      Use packageurl-js downstream.
    • Deprecated symbol Types.NodePackageJson (#1346, #1348 via #1377, #1378)
      Use Contrib.FromNodePackageJson.Types.NodePackageJson instead.
    • Deprecated symbol Types.assertNodePackageJson (#1346 via #1377)
      Use Contrib.FromNodePackageJson.Types.assertNodePackageJson instead.
    • Deprecated symbol Types.isNodePackageJson (#1346 via #1377)
      Use Contrib.FromNodePackageJson.Types.isNodePackageJson instead.
    • Deprecated symbol Utils (#1346 via #1377)
    • Deprecated symbol Utils.BomUtility (#1346 via #1377)
    • Deprecated symbol Utils.BomUtility.randomSerialNumber (#1346 via #1377)
      Use Contrib.Bom.Utils.randomSerialNumber instead.
    • Deprecated symbol Utils.LicenseUtility (#1346 via #1377)
    • Deprecated symbol Utils.LicenseUtility.FsUtils (#1346 via #1377)
      Use Contrib.License.Utils.FsUtils instead.
    • Deprecated symbol Utils.LicenseUtility.PathUtils (#1346 via #1377)
    • Use Contrib.License.Utils.PathUtils instead.
    • Deprecated symbol Utils.LicenseUtility.FileAttachment (#1346 via #1377)
      Use Contrib.License.Utils.FileAttachment instead.
    • Deprecated symbol Utils.LicenseUtility.ErrorReporter (#1346 via #1377)
      Use Contrib.License.Utils.ErrorReporter instead.
    • Deprecated symbol Utils.LicenseUtility.LicenseEvidenceGatherer (#1346 via #1377)
      Use Contrib.License.Utils.LicenseEvidenceGatherer instead.
    • Deprecated symbol Utils.NpmjsUtility (#1346 via #1377)
    • Deprecated symbol Utils.NpmjsUtility.parsePackageIntegrity (#1346 via #1377)

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​cyclonedx/cyclonedx-library since your current version.


Updates eslint-import-resolver-typescript from 4.4.4 to 4.4.5

Release notes

Sourced from eslint-import-resolver-typescript's releases.

v4.4.5

Patch Changes

Changelog

Sourced from eslint-import-resolver-typescript's changelog.

4.4.5

Patch Changes

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for eslint-import-resolver-typescript since your current version.


Updates fast-xml-parser from 5.7.0 to 5.8.0

Release notes

Sourced from fast-xml-parser's releases.

update strnum, FXB. Use xml-naming for DOCTYPE

  • integrate xml-naming to validate DOCTYPE entity name and notation name (using qname because of backward compatibility)
    • This will consider xml-version as well. '1.0' is default
  • update strnum to 2.3.0
    • You can set octal and binary parsing which is by deault off
  • update fast-xml-builder to 1.2.0
    • can sanitize tag names if found invalid
    • fix format output

fix minor old bugs and update builder

  • fix: alwaysCreateTextNode should create text node when attributes are present for self closing node
  • fix stop node expression when ns prefix is removed (found by iruizsalinas)
  • update XML Builder to 1.1.7
  • mark addEntity deprecated

backward compatibility for numerical external entity, fix #705, #817

  • allow numerical external entity for backward compatibility
  • fix #705: attributesGroupName working with preserveOrder
  • fix #817: stackoverflow when tag expression is very long

upgrade @​nodable/entities and FXB

  • Use @nodable/entities v2.1.0
    • breaking changes
      • single entity scan. You're not allowed to use entity value to form another entity name.
      • you cant add numeric external entity
      • entity error message when expantion limit is crossed might change
    • typings are updated for new options related to process entity
    • please follow documentation of @nodable/entities for more detail.
    • performance
      • if processEntities is false, then there should not be impact on performance.
      • if processEntities is true, but you dont pass entity decoder separately then performance may degrade by approx 8-10%
      • if processEntities is true, and you pass entity decoder separately
        • if no entity then performance should be same as before
        • if there are entities then performance should be increased from past versions
    • ignoreAttributes is not required to be set to set xml version for NCR entity value
  • update 'fast-xml-builder' to sanitize malicious CDATA and comment's content
Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

*5.8.0 / 2026-05-12

  • integrate xml-naming to validate DOCTYPE entity name and notation name (using qname becaue of backward compatibility)
    • This will consider xml-version as well. '1.0' is default
  • update strnum to 2.3.0
    • You can set octal and binary parsing which is bydeault off
  • update fast-xml-builder to 1.2.0
    • can sanitize tag names if found invalid
    • fix format output

5.7.3 / 2006-05-05

  • fix: alwaysCreateTextNode should create text node when attributes are present for self closing node
  • fix stop node expression when ns prefix is removed (found by iruizsalinas)
  • update XML Builder to 1.1.7
  • mark addEntity deprecated

5.7.2 / 2026-04-25

  • allow numerical external entity for backward compatibility
  • fix #705: attributesGroupName working with preserveOrder
  • fix #817: stackoverflow when tag expression is very long

5.7.1 / 2026-04-20

  • fix typo in CJS typing file

5.7.0 / 2026-04-17

  • Use @nodable/entities v2.1.0
    • breaking changes
      • single entity scan. You're not allowed to user entity value to form another entity name.
      • you cant add numeric external entity
      • entity error message when expantion limit is crossed might change
    • typings are updated for new options related to process entity
    • please follow documentation of @nodable/entities for more detail.
    • performance
      • if processEntities is false, then there should not be impact on performance.
      • if processEntities is true, but you dont pass entity decoder separately then performance may degrade by approx 8-10%
      • if processEntities is true, and you pass entity decoder separately
        • if no entity then performance should be same as before
        • if there are entities then performance should be increased from past versions
    • ignoreAttributes is not required to be set to set xml version for NCR entity value
  • update 'fast-xml-builder' to sanitize malicious CDATA and comment's content

5.6.0 / 2026-04-15

  • fix: entity replacement for numeric entities
  • use @​nodable/entities to replace entities
    • this may change some error messages related to entities expansion limit or inavlid use
    • post check would be exposed in future version

... (truncated)

Commits

Updates https-proxy-agent from 7.0.6 to 9.0.0

Release notes

Sourced from https-proxy-agent's releases.

https-proxy-agent@9.0.0

Major Changes

  • 7d12b51: Set minimum Node.js version to 20

Patch Changes

  • 7ca27d0: Simplify package.json exports to remove unnecessary imports restriction
  • Updated dependencies [ca12148]
  • Updated dependencies [7d12b51]
  • Updated dependencies [7ca27d0]
    • agent-base@9.0.0

https-proxy-agent@8.0.0

Major Changes

  • 9c92c09: Convert to ESM. All packages now use "type": "module" and compile to ESM output instead of CommonJS.

Patch Changes

  • Updated dependencies [9c92c09]
    • agent-base@8.0.0
Changelog

Sourced from https-proxy-agent's changelog.

9.0.0

Major Changes

  • 7d12b51: Set minimum Node.js version to 20

Patch Changes

  • 7ca27d0: Simplify package.json exports to remove unnecessary imports restriction
  • Updated dependencies [ca12148]
  • Updated dependencies [7d12b51]
  • Updated dependencies [7ca27d0]
    • agent-base@9.0.0

8.0.0

Major Changes

  • 9c92c09: Convert to ESM. All packages now use "type": "module" and compile to ESM output instead of CommonJS.

Patch Changes

  • Updated dependencies [9c92c09]
    • agent-base@8.0.0
Commits
  • af317e0 Version Packages (#397)
  • 7ca27d0 Simplify package.json exports to remove unnecessary imports restriction (#408)
  • 7d12b51 Set minimum Node.js version to 20 and add Node 24.x to CI matrix
  • 8dcdac8 Version Packages (#395)
  • 5d3f71a Use pnpm catalog: for shared dependencies
  • 77da068 Use workspace:* for inter-repo dependencies
  • f70a9dc Fix CI failures: update Node.js matrix and test configuration
  • 9c92c09 Convert all packages to ESM with type: module
  • 0b77ac7 Migrate from Jest to Vitest
  • ed00d30 Re-generate self-signed cert for tests
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for https-proxy-agent since your current version.


Updates js-yaml from 4.1.1 to 4.2.0

Changelog

Sourced from js-yaml's changelog.

[4.2.0] - 2026-06-01

Added

  • Added docs/safety.md with notes about processing untrusted YAML.
  • Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.
  • Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.
  • Added sourcemaps to dist/ builds.

Changed

  • Stop resolving numbers with underscores as numeric scalars, #627.
  • Switched dev toolchains to Vite / neostandard.
  • Updated demo.
  • Reorganized tests.
  • dist/ files are no longer kept in the repository.

Fixed

  • Fix parsing of properties on the first implicit block mapping key, #62.
  • Fix trailing whitespace handling when folding flow scalar lines, #307.
  • Reject top-level block scalars without content indentation, #280.
  • Ensure numbers survive round-trip, #737.
  • Fix test coverage for issue #221.
  • Fix flow scalar trailing whitespace folding, #307.
  • Fix digits in YAML named tag handles.

Security

  • Fix potential DoS via quadratic complexity in merge - deduplicate repeated elements (makes sense for malformed files > 10K).

[3.14.2] - 2025-11-15

Security

  • Backported v4.1.1 fix to v3
Commits

Updates p-limit from 4.0.0 to 7.3.0

Release notes

Sourced from p-limit's releases.

v7.3.0

  • Add rejectOnClear option 8907801
  • Support options object in pLimit() 870db0f

sindresorhus/p-limit@v7.2.0...v7.3.0

v7.2.0

  • Make .map() method accept an iterable, not just array (#98) d76231b

sindresorhus/p-limit@v7.1.1...v7.2.0

v7.1.1

  • Fix limitFunction type ccb80b2

sindresorhus/p-limit@v7.1.0...v7.1.1

v7.1.0

  • Add index parameter to map() method 2aeffd4

sindresorhus/p-limit@v7.0.0...v7.1.0

v7.0.0

Breaking

  • Require Node.js 20 78b81a5
  • activeCount now increments when tasks actually start running (more intuitive) rather than when queued. This means:
    • activeCount reflects truly active/running promises
    • pendingCount more accurately represents waiting

Improvements

  • Add .map convenience method 86a5d73
  • Improve performance (#93) be1965b

sindresorhus/p-limit@v6.2.0...v7.0.0

v6.2.0

sindresorhus/p-limit@v6.1.0...v6.2.0

... (truncated)

Commits
  • 886bda5 7.3.0
  • 8907801 Add rejectOnClear option
  • ce9d71c Add test for shared context provider pattern
  • 24503f9 Document recursive limiter deadlocks
  • 9bce97a Add recipes documentation
  • 870db0f Support options object in pLimit()
  • 1fb1407 Fix benchmarks
  • 7bdd25c 7.2.0
  • d76231b Make .map() method accept an iterable, not just array (#98)
  • 9da5934 Use native Node.js timers instead of delay package in tests
  • Additional commits viewable in compare view

Updates packageurl-js from 1.0.2 to 2.0.1

Changelog

Sourced from packageurl-js's changelog.

2.0.1

Bug Fix

  • Fix decoding problems around the % character #75 (fix contributed by @​jdalton)

2.0.0

  • Significant refactor based on code from @​jdalton
  • Numerous bug fixes and improvements the community was asking for
    • See closed issues and PRs for details (too many to list here)

1.2.1

Bug Fixes

1.2.0

Features

  • Add pub parsing for Dart and Flutter packages (contributed by @​topaztee)

1.1.1

Bug Fix

  • publish errors

1.1.0

Features

Commits
  • cd1eb4b chore: bump to v2.0.1 (#77)
  • f7dccd6 fix: error on decode with meaningful message
  • 07b818b fix: only decode in parseString
  • c2f576f bump to v2.0.0 (#74)
  • b5660a5 Merge pull request #73 from package-url/jdalton/sync
  • 400de0c Merge pull request #72 from package-url/dependabot/npm_and_yarn/braces-3.0.3
  • b6c8ce8 fix: correct package-url.d.ts readonly type casing
  • 96822af fix: correct param name typos
  • f81a6be fix: use encodeQualifierValue for qualifierKey and qualifierValue
  • ff590d2 feat: encode qualifiers with URLSearchParams
  • Additional commits viewable in compare view

Updates web-tree-sitter from 0.26.8 to 0.26.9

Release notes

Sourced from web-tree-sitter's releases.

v0.26.9

What's Changed

Full Changelog: tree-sitter/tree-sitter@v0.26.8...v0.26.9

Commits

Updates @types/node from 20.19.31 to 25.9.1

Commits

Updates chai from 4.5.0 to 6.2.2

Release notes

Sourced from chai's releases.

v6.2.2

What's Changed

New Contributors

Full Changelog: chaijs/chai@v6.2.1...v6.2.2

v6.2.1

What's Changed

@dependabot
build(deps): bump the npm-dependencies group across 1 directory with …
6c38bfa 
…19 updates

Bumps the npm-dependencies group with 19 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) | `7.29.0` | `7.29.7` |
| [@cyclonedx/cyclonedx-library](https://github.com/CycloneDX/cyclonedx-javascript-library) | `6.13.1` | `10.0.0` |
| [eslint-import-resolver-typescript](https://github.com/import-js/eslint-import-resolver-typescript) | `4.4.4` | `4.4.5` |
| [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | `5.7.0` | `5.8.0` |
| [https-proxy-agent](https://github.com/TooTallNate/proxy-agents/tree/HEAD/packages/https-proxy-agent) | `7.0.6` | `9.0.0` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.1` | `4.2.0` |
| [p-limit](https://github.com/sindresorhus/p-limit) | `4.0.0` | `7.3.0` |
| [packageurl-js](https://github.com/package-url/packageurl-js) | `1.0.2` | `2.0.1` |
| [web-tree-sitter](https://github.com/tree-sitter/tree-sitter/tree/HEAD/lib/binding_web) | `0.26.8` | `0.26.9` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `20.19.31` | `25.9.1` |
| [chai](https://github.com/chaijs/chai) | `4.5.0` | `6.2.2` |
| [eslint](https://github.com/eslint/eslint) | `8.57.1` | `10.4.1` |
| [esmock](https://github.com/iambumblehead/esmock) | `2.7.3` | `2.7.6` |
| [mocha](https://github.com/mochajs/mocha) | `10.8.2` | `11.7.6` |
| [msw](https://github.com/mswjs/msw) | `2.12.7` | `2.14.6` |
| [sinon](https://github.com/sinonjs/sinon) | `15.2.0` | `22.0.0` |
| [sinon-chai](https://github.com/chaijs/sinon-chai) | `3.7.0` | `4.0.1` |
| [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `6.0.3` |
| [which](https://github.com/npm/node-which) | `5.0.0` | `7.0.0` |



Updates `@babel/core` from 7.29.0 to 7.29.7
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.7/packages/babel-core)

Updates `@cyclonedx/cyclonedx-library` from 6.13.1 to 10.0.0
- [Release notes](https://github.com/CycloneDX/cyclonedx-javascript-library/releases)
- [Changelog](https://github.com/CycloneDX/cyclonedx-javascript-library/blob/main/HISTORY.md)
- [Commits](CycloneDX/cyclonedx-javascript-library@v6.13.1...v10.0.0)

Updates `eslint-import-resolver-typescript` from 4.4.4 to 4.4.5
- [Release notes](https://github.com/import-js/eslint-import-resolver-typescript/releases)
- [Changelog](https://github.com/import-js/eslint-import-resolver-typescript/blob/master/CHANGELOG.md)
- [Commits](import-js/eslint-import-resolver-typescript@v4.4.4...v4.4.5)

Updates `fast-xml-parser` from 5.7.0 to 5.8.0
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](NaturalIntelligence/fast-xml-parser@v5.7.0...v5.8.0)

Updates `https-proxy-agent` from 7.0.6 to 9.0.0
- [Release notes](https://github.com/TooTallNate/proxy-agents/releases)
- [Changelog](https://github.com/TooTallNate/proxy-agents/blob/main/packages/https-proxy-agent/CHANGELOG.md)
- [Commits](https://github.com/TooTallNate/proxy-agents/commits/https-proxy-agent@9.0.0/packages/https-proxy-agent)

Updates `js-yaml` from 4.1.1 to 4.2.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/commits)

Updates `p-limit` from 4.0.0 to 7.3.0
- [Release notes](https://github.com/sindresorhus/p-limit/releases)
- [Commits](sindresorhus/p-limit@v4.0.0...v7.3.0)

Updates `packageurl-js` from 1.0.2 to 2.0.1
- [Changelog](https://github.com/package-url/packageurl-js/blob/master/CHANGELOG.md)
- [Commits](package-url/packageurl-js@v1.0.2...v2.0.1)

Updates `web-tree-sitter` from 0.26.8 to 0.26.9
- [Release notes](https://github.com/tree-sitter/tree-sitter/releases)
- [Commits](https://github.com/tree-sitter/tree-sitter/commits/v0.26.9/lib/binding_web)

Updates `@types/node` from 20.19.31 to 25.9.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `chai` from 4.5.0 to 6.2.2
- [Release notes](https://github.com/chaijs/chai/releases)
- [Changelog](https://github.com/chaijs/chai/blob/main/History.md)
- [Commits](chaijs/chai@v4.5.0...v6.2.2)

Updates `eslint` from 8.57.1 to 10.4.1
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v8.57.1...v10.4.1)

Updates `esmock` from 2.7.3 to 2.7.6
- [Release notes](https://github.com/iambumblehead/esmock/releases)
- [Changelog](https://github.com/iambumblehead/esmock/blob/main/CHANGELOG.md)
- [Commits](iambumblehead/esmock@v2.7.3...v2.7.6)

Updates `mocha` from 10.8.2 to 11.7.6
- [Release notes](https://github.com/mochajs/mocha/releases)
- [Changelog](https://github.com/mochajs/mocha/blob/v11.7.6/CHANGELOG.md)
- [Commits](mochajs/mocha@v10.8.2...v11.7.6)

Updates `msw` from 2.12.7 to 2.14.6
- [Release notes](https://github.com/mswjs/msw/releases)
- [Changelog](https://github.com/mswjs/msw/blob/main/CHANGELOG.md)
- [Commits](mswjs/msw@v2.12.7...v2.14.6)

Updates `sinon` from 15.2.0 to 22.0.0
- [Release notes](https://github.com/sinonjs/sinon/releases)
- [Changelog](https://github.com/sinonjs/sinon/blob/main/docs/changelog.md)
- [Commits](sinonjs/sinon@v15.2.0...v22.0.0)

Updates `sinon-chai` from 3.7.0 to 4.0.1
- [Release notes](https://github.com/chaijs/sinon-chai/releases)
- [Changelog](https://github.com/chaijs/sinon-chai/blob/master/CHANGELOG.md)
- [Commits](chaijs/sinon-chai@3.7.0...4.0.1)

Updates `typescript` from 5.9.3 to 6.0.3
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](microsoft/TypeScript@v5.9.3...v6.0.3)

Updates `which` from 5.0.0 to 7.0.0
- [Release notes](https://github.com/npm/node-which/releases)
- [Changelog](https://github.com/npm/node-which/blob/main/CHANGELOG.md)
- [Commits](npm/node-which@v5.0.0...v7.0.0)

---
updated-dependencies:
- dependency-name: "@babel/core"
  dependency-version: 7.29.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: "@cyclonedx/cyclonedx-library"
  dependency-version: 10.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: eslint-import-resolver-typescript
  dependency-version: 4.4.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: fast-xml-parser
  dependency-version: 5.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: https-proxy-agent
  dependency-version: 9.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: js-yaml
  dependency-version: 4.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: p-limit
  dependency-version: 7.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: packageurl-js
  dependency-version: 2.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: web-tree-sitter
  dependency-version: 0.26.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: "@types/node"
  dependency-version: 25.9.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: chai
  dependency-version: 6.2.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: eslint
  dependency-version: 10.4.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: esmock
  dependency-version: 2.7.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: mocha
  dependency-version: 11.7.6
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: msw
  dependency-version: 2.14.6
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: sinon
  dependency-version: 22.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: sinon-chai
  dependency-version: 4.0.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: typescript
  dependency-version: 6.0.3
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: which
  dependency-version: 7.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 1, 2026
@ptomanRH
ptomanRH requested a review from Strum355 June 2, 2026 12:33
@Strum355

Strum355 commented Jun 2, 2026

Copy link
Copy Markdown
Member

Still cant merge as-is unfortunately, same/similar reason as mentioned here: #478 (comment)

We should probably add an ignore for packageurl-js for the time being, Ill investigate whether eslint can be bumped yet, and then we'll bump the rest too

@Strum355 Strum355 mentioned this pull request Jun 2, 2026
Merged
4 tasks
@Strum355

Strum355 commented Jun 2, 2026

Copy link
Copy Markdown
Member

Superseded by #544, which bumps the same dependencies plus migrates ESLint to v10 flat config and handles the Mocha 11 breaking changes. packageurl-js is excluded and added to the dependabot ignore list (blocked on upstream package-url/packageurl-js#90).

@Strum355 Strum355 closed this Jun 2, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jun 2, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm-dependencies-35ecfd1da9 branch June 2, 2026 13:44
Strum355 added a commit to Strum355/exhort-javascript-api that referenced this pull request Jun 2, 2026
@Strum355 @claude
build(deps): bump dependencies and migrate to ESLint 10 flat config
ffd0652 
Bump all safe dependencies to latest major versions:
- @cyclonedx/cyclonedx-library 6→10, https-proxy-agent 7→9, p-limit 4→7
- chai 4→6, mocha 10→11, sinon 15→22, sinon-chai 3→4
- eslint 8→10, typescript 5→6, which 5→7, @types/node 20→25

Migrate ESLint configuration:
- Convert .eslintrc.json to eslint.config.js (flat config, required by ESLint 10)
- Replace eslint-plugin-import with eslint-plugin-import-x (ESLint 10 support)
- Replace eslint-plugin-editorconfig with equivalent built-in ESLint rules
  (plugin uses removed context.getFilename API incompatible with ESLint 10)

Fix Mocha 11 breaking change:
- Convert all suite().beforeAll().afterAll() chains to use
  suiteSetup()/suiteTeardown() inside suite callbacks (chaining API removed)

Add dependabot ignore for packageurl-js (blocked on upstream purl spec
issue for '+' encoding in versions, see package-url/packageurl-js#90).

Closes guacsec#542

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Strum355 added a commit to Strum355/exhort-javascript-api that referenced this pull request Jun 2, 2026
@Strum355 @claude
build(deps): bump dependencies and migrate to ESLint 10 flat config
5956544 
Bump all safe dependencies to latest major versions:
- @cyclonedx/cyclonedx-library 6→10, https-proxy-agent 7→9, p-limit 4→7
- chai 4→6, mocha 10→11, sinon 15→22, sinon-chai 3→4
- eslint 8→10, typescript 5→6, which 5→7, @types/node 20→25

Migrate ESLint configuration:
- Convert .eslintrc.json to eslint.config.js (flat config, required by ESLint 10)
- Replace eslint-plugin-import with eslint-plugin-import-x (ESLint 10 support)
- Replace eslint-plugin-editorconfig with equivalent built-in ESLint rules
  (plugin uses removed context.getFilename API incompatible with ESLint 10)

Fix Mocha 11 breaking change:
- Convert all suite().beforeAll().afterAll() chains to use
  suiteSetup()/suiteTeardown() inside suite callbacks (chaining API removed)

Add dependabot ignore for packageurl-js (blocked on upstream purl spec
issue for '+' encoding in versions, see package-url/packageurl-js#90).

Closes guacsec#542

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Strum355 added a commit to Strum355/exhort-javascript-api that referenced this pull request Jun 2, 2026
@Strum355 @claude
build(deps): bump dependencies and migrate to ESLint 10 flat config
3dbfd1c 
Bump all safe dependencies to latest major versions:
- @cyclonedx/cyclonedx-library 6→10, https-proxy-agent 7→9, p-limit 4→7
- chai 4→6, mocha 10→11, sinon 15→22, sinon-chai 3→4
- eslint 8→10, typescript 5→6, which 5→7, @types/node 20→25

Migrate ESLint configuration:
- Convert .eslintrc.json to eslint.config.js (flat config, required by ESLint 10)
- Replace eslint-plugin-import with eslint-plugin-import-x (ESLint 10 support)
- Replace eslint-plugin-editorconfig with equivalent built-in ESLint rules
  (plugin uses removed context.getFilename API incompatible with ESLint 10)

Fix Mocha 11 breaking change:
- Convert all suite().beforeAll().afterAll() chains to use
  suiteSetup()/suiteTeardown() inside suite callbacks (chaining API removed)

Add dependabot ignore for packageurl-js (blocked on upstream purl spec
issue for '+' encoding in versions, see package-url/packageurl-js#90).

Closes guacsec#542

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Strum355 added a commit that referenced this pull request Jun 2, 2026
@Strum355 @claude
build(deps): bump dependencies and migrate to ESLint 10 flat config (#…
d2edf6e 
…544)

Bump all safe dependencies to latest major versions:
- @cyclonedx/cyclonedx-library 6→10, https-proxy-agent 7→9, p-limit 4→7
- chai 4→6, mocha 10→11, sinon 15→22, sinon-chai 3→4
- eslint 8→10, typescript 5→6, which 5→7, @types/node 20→25

Migrate ESLint configuration:
- Convert .eslintrc.json to eslint.config.js (flat config, required by ESLint 10)
- Replace eslint-plugin-import with eslint-plugin-import-x (ESLint 10 support)
- Replace eslint-plugin-editorconfig with equivalent built-in ESLint rules
  (plugin uses removed context.getFilename API incompatible with ESLint 10)

Fix Mocha 11 breaking change:
- Convert all suite().beforeAll().afterAll() chains to use
  suiteSetup()/suiteTeardown() inside suite callbacks (chaining API removed)

Add dependabot ignore for packageurl-js (blocked on upstream purl spec
issue for '+' encoding in versions, see package-url/packageurl-js#90).

Closes #542

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Strum355 Strum355 Awaiting requested review from Strum355

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Strum355