Skip to content

chore(deps): bump the dependencies group across 1 directory with 15 updates - #827

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/dependencies-cdf7b3c627
Open

chore(deps): bump the dependencies group across 1 directory with 15 updates#827
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/dependencies-cdf7b3c627

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown
Contributor

Bumps the dependencies group with 15 updates in the / directory:

Package From To
highlight.js 11.11.1 11.12.0
markdown-it 15.0.0 15.0.3
pretty-bytes 7.1.1 7.2.0
vis-data 8.0.5 8.0.6
vis-network 10.1.1 10.1.4
filenamify 7.0.2 7.0.3
@openally/httpie 1.1.3 2.0.1
chokidar 5.0.0 6.0.0
find-my-way 9.8.0 9.10.0
glob 13.0.6 14.0.3
pino 10.3.1 10.4.0
pino-pretty 13.1.3 13.2.0
ts-pattern 5.9.0 5.9.2
ws 8.21.3 8.22.0
open 11.0.1 11.0.4

Updates highlight.js from 11.11.1 to 11.12.0

Release notes

Sourced from highlight.js's releases.

v11.12.0 - Summer, hot and rainy.

Parser Engine:

  • fix(parser) count named capture groups when rewriting backreferences [spokodev][]

New Grammars:

  • add FreeDesktop config file (.desktop / systemd) grammar [gg582][]
  • added 3rd party Cedar grammar to SUPPORTED_LANGUAGES [Dhruv Maniya][]
  • added 3rd party DAX and M (Power Query) grammars to SUPPORTED_LANGUAGES [jiaopengzi][]
  • added 3rd party Djot grammar to SUPPORTED_LANGUAGES [Mark Scherer][]
  • added 3rd party Igor Pro grammar to SUPPORTED_LANGUAGES [Ryne Andal][]
  • added 3rd party Jaiva grammar to SUPPORTED_LANGUAGES [Lehlogonolo Poole][]
  • added 3rd party Liquidsoap grammar to SUPPORTED_LANGUAGES [Romain Beauxis][]
  • added 3rd party MoonBit grammar to SUPPORTED_LANGUAGES [Kaida-Amethyst][]
  • added 3rd party Pkl grammar to SUPPORTED_LANGUAGES [Dan Chao][]
  • added 3rd party RAScript grammar to SUPPORTED_LANGUAGES [Joshua Raphael][]
  • added 3rd party Veryl grammar to SUPPORTED_LANGUAGES [Naoya Hatta][]
  • added 3rd party Why3 grammar to SUPPORTED_LANGUAGES [JGalego][]
  • added 3rd party Xojo grammar to SUPPORTED_LANGUAGES [patricksalo][]
  • referenced existing 3rd party ES|QL grammar in SUPPORTED_LANGUAGES [Styx0x6][]

Core Grammars:

  • fix(c) only match real atomic_* type names, not C11 atomic functions, issue #3837 [Mark Xian][]
  • fix(c, cpp) bound the run of type tokens in front of a function name (ReDoS), issue #4362 [Jayesh Bhade][]
  • fix(c, cpp) scope angle-bracket header string to #include, issue #3505 [Pablo][]
  • fix(c, cpp) stop a raw string's closing delimiter from swallowing quotes, issue #3585 [David Pavlovschii][]
  • enh(cmake) add block and endblock keywords [Anonymous Maarten][]
  • fix(cmake) only highlight standalone numbers, not digits that begin an identifier (e.g. 3rdparty), issue #4170 [Mark Xian][]
  • fix(cpp) require a word boundary before numeric literals so digits inside identifiers aren't highlighted as numbers, issue #4231 [Mark Xian][]
  • fix(crystal) stop treating integer division // as a regex literal [Zain Asif][]
  • enh(csharp) support digit separators in binary literals and numeric type suffixes, and stop highlighting the leading _ of an identifier, issue #4258 [Sarath Francis][]
  • enh(css) add corner-shape properties [Hama Tanveer][]
  • enh(css) support six-digit unicode-range values [Konstantin Baltsat][]
  • enh(dart) add highlighting for class and function names [guuido][]
  • enh(dns) highlight registered CAA property tags, issue #4475 [Joey Huang][]
  • enh(dns) improve grammar: character strings, TXT, classes, escapes, addresses [Checconio][]
  • enh(dos) add batch as an alias, issue #4395 [Hashim Khan][]
  • enh(gherkin) update keyword list [Hirse][]
  • enh(gherkin) variables can't contain whitespace [Hirse][]
  • enh(gherkin) docstrings can use backticks [Hirse][]
  • enh(go) recognize binary integer literals [spokodev][]
  • enh(groovy) support underscores in numeric literals [greymoth][]
  • fix(haskell) highlight where in GADT and closed type-family declarations, issue #3753 [Konstantin Baltsat][]
  • enh(java) improve detection of types, including generic and array types [Hannes Wallnoefer][]
  • enh(javascript) add self to built-in variables [Dsaquel][]
  • enh(kotlin) add ktm and ktx aliases [DarkMatter-999][]
  • fix(leaf) fix bug in Leaf keyword highlighting [Francesco Paolo Severino][]
  • fix(lisp) preserve highlighting after quoted multiplication expressions [arturict][]

... (truncated)

Changelog

Sourced from highlight.js's changelog.

Version 11.12.0

Parser Engine:

  • fix(parser) count named capture groups when rewriting backreferences [spokodev][]

New Grammars:

  • add FreeDesktop config file (.desktop / systemd) grammar [gg582][]
  • added 3rd party Cedar grammar to SUPPORTED_LANGUAGES [Dhruv Maniya][]
  • added 3rd party DAX and M (Power Query) grammars to SUPPORTED_LANGUAGES [jiaopengzi][]
  • added 3rd party Djot grammar to SUPPORTED_LANGUAGES [Mark Scherer][]
  • added 3rd party Igor Pro grammar to SUPPORTED_LANGUAGES [Ryne Andal][]
  • added 3rd party Jaiva grammar to SUPPORTED_LANGUAGES [Lehlogonolo Poole][]
  • added 3rd party Liquidsoap grammar to SUPPORTED_LANGUAGES [Romain Beauxis][]
  • added 3rd party MoonBit grammar to SUPPORTED_LANGUAGES [Kaida-Amethyst][]
  • added 3rd party Pkl grammar to SUPPORTED_LANGUAGES [Dan Chao][]
  • added 3rd party RAScript grammar to SUPPORTED_LANGUAGES [Joshua Raphael][]
  • added 3rd party Veryl grammar to SUPPORTED_LANGUAGES [Naoya Hatta][]
  • added 3rd party Why3 grammar to SUPPORTED_LANGUAGES [JGalego][]
  • added 3rd party Xojo grammar to SUPPORTED_LANGUAGES [patricksalo][]
  • referenced existing 3rd party ES|QL grammar in SUPPORTED_LANGUAGES [Styx0x6][]

Core Grammars:

  • fix(c) only match real atomic_* type names, not C11 atomic functions, issue #3837 [Mark Xian][]
  • fix(c) do not highlight C++ std types as built-ins, issue #4103 [Arron Zou][]
  • fix(c, cpp) bound the run of type tokens in front of a function name (ReDoS), issue #4362 [Jayesh Bhade][]
  • fix(c, cpp) scope angle-bracket header string to #include, issue #3505 [Pablo][]
  • fix(c, cpp) stop a raw string's closing delimiter from swallowing quotes, issue #3585 [David Pavlovschii][]
  • enh(cmake) add block and endblock keywords [Anonymous Maarten][]
  • fix(cmake) only highlight standalone numbers, not digits that begin an identifier (e.g. 3rdparty), issue #4170 [Mark Xian][]
  • fix(cpp) require a word boundary before numeric literals so digits inside identifiers aren't highlighted as numbers, issue #4231 [Mark Xian][]
  • fix(crystal) stop treating integer division // as a regex literal [Zain Asif][]
  • enh(csharp) support digit separators in binary literals and numeric type suffixes, and stop highlighting the leading _ of an identifier, issue #4258 [Sarath Francis][]
  • enh(css) add corner-shape properties [Hama Tanveer][]
  • enh(css) support six-digit unicode-range values [Konstantin Baltsat][]
  • enh(dart) add highlighting for class and function names [guuido][]
  • enh(dns) highlight registered CAA property tags, issue #4475 [Joey Huang][]
  • enh(dns) improve grammar: character strings, TXT, classes, escapes, addresses [Checconio][]
  • enh(dos) add batch as an alias, issue #4395 [Hashim Khan][]
  • enh(gherkin) update keyword list [Hirse][]
  • enh(gherkin) variables can't contain whitespace [Hirse][]
  • enh(gherkin) docstrings can use backticks [Hirse][]
  • enh(go) recognize binary integer literals [spokodev][]
  • enh(groovy) support underscores in numeric literals [greymoth][]
  • fix(haml) recognize implicit div tag lines starting with .class or #id, issue #3783 [pikammmmm][]
  • fix(haskell) highlight where in GADT and closed type-family declarations, issue #3753 [Konstantin Baltsat][]
  • enh(java) improve detection of types, including generic and array types [Hannes Wallnoefer][]
  • enh(javascript) add self to built-in variables [Dsaquel][]

... (truncated)

Commits
  • f7f7d38 (release) release v11.12.0
  • c4c4728 (docs) FreeDesktop + Kotlin aliases; note extra language override
  • 9142292 bump version to 11.12.0
  • 03d1e7e (chore) rebuild CHANGES.md for 11.12.0
  • ca6bb8e enh(sqf) update to A3 v2.22 (#4460)
  • 1414c96 fix: use Trusted Publishers in publishing pipeline (#4427)
  • 2a9ad7d fix(markdown) don't treat a thematic break as the start of bold text (#4485)
  • 375f3f4 build(deps-dev): bump @​rollup/plugin-commonjs from 28.0.1 to 29.0.3 (#4481)
  • 2ce1706 build(deps-dev): bump del from 8.0.0 to 8.0.1 (#4484)
  • 72084b5 fix(ruby): don't treat scope resolution :: as symbols (#4463)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for highlight.js since your current version.


Updates markdown-it from 15.0.0 to 15.0.3

Changelog

Sourced from markdown-it's changelog.

[15.0.3] - 2026-10-16

Changed

  • Updated dependencies.

Fixed

  • Enforce the 999 Unicode code point limit for reference definition labels, partially addressing #1213.
  • Require whitespace before multiline reference titles.

Security

  • Fixed quadratic complexity when parsing multiline reference definitions.
  • Fixed quadratic complexity when parsing unclosed inline HTML comments, processing instructions, declarations and CDATA sections.

[15.0.2] - 2026-09-11

Security

  • Fixed quadratic complexity in smartquotes when quote types don't match, #1209. Also limited the smartquotes stack to 1000 unmatched openers.

[15.0.1] - 2026-08-27

Changed

  • doc: replace oxide theme with custom one.

Fixed

  • Fixed code span parsing after lookaheads for unclosed link and image labels, #1201.
  • Preserve spaces in code spans whose content consists only of spaces, #1180.
  • Preserve brackets around IPv6 address literals when normalizing links, #1204.

Security

  • Fixed quadratic complexity when replacing fuzzy links.
  • Fixed quadratic complexity in scheme backscan (inline linkify rule).
Commits
  • a8c00d4 15.0.3 released
  • e9504a4 Skip pathological speed tests during coverage collection
  • 46d8b52 Deps bump
  • 928bc8c Fix quadratic inline HTML parsing
  • 48fbc46 Fix quadratic reference parsing and partially address #1213
  • 3c51991 15.0.2 released
  • cf27366 Polish #1209 and limit smartquotes stack to 1000 openers
  • 1b379c1 Fix quadratic complexity in smartquotes rule when quote types don't match (#1...
  • 924b203 15.0.1 released
  • 25c3895 Changelog update
  • Additional commits viewable in compare view

Updates pretty-bytes from 7.1.1 to 7.2.0

Release notes

Sourced from pretty-bytes's releases.

v7.2.0

  • Fix formatting edge cases and validate options 4e800a3

sindresorhus/pretty-bytes@v7.1.3...v7.2.0

v7.1.3

  • Fix fractional digit formatting when localization is disabled (#92) 5cb9c95

sindresorhus/pretty-bytes@v7.1.2...v7.1.3

v7.1.2

  • Fix rounding across unit boundaries 059c979

sindresorhus/pretty-bytes@v7.1.1...v7.1.2

Commits

Updates vis-data from 8.0.5 to 8.0.6

Release notes

Sourced from vis-data's releases.

v8.0.6

8.0.6 (2026-10-25)

Bug Fixes

  • release: switch to trusted publishing (b0b0338)
Commits
  • 63100c3 ci(release): add workaround for Git auth issues
  • b0b0338 fix(release): switch to trusted publishing
  • 58c67d6 chore(deps): update Semantic Release npm to support trusted publishing
  • 5c0abe0 chore(deps): update dependency oxfmt to v0.74.0 (#1445)
  • 397544a chore(deps): update dependency npm to v12.2.1 (#1444)
  • abed3a0 chore(deps): update node.js to v24.22.1 (#1443)
  • d24cf80 chore(deps): update node.js to v24.22.1 (#1442)
  • 121daeb chore(deps): lock file maintenance (#1441)
  • 2f724a9 chore(deps): update dependency oxfmt to v0.73.0 (#1440)
  • ccc2ef8 chore(deps): update node.js to v24.22.0 (#1439)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by CircleCI, a new releaser for vis-data since your current version.


Updates vis-network from 10.1.1 to 10.1.4

Release notes

Sourced from vis-network's releases.

v10.1.4

10.1.4 (2026-10-27)

Bug Fixes

  • network: finish pending view animation before starting a new one (#2546) (3a757c6)

v10.1.3

10.1.3 (2026-10-25)

Bug Fixes

  • release: switch to trusted publishing (65a579f)

v10.1.2

10.1.2 (2026-08-19)

Bug Fixes

Commits
  • 0bcfb18 docs(examples): fix click listeners in animation showcase
  • 3a757c6 fix(network): finish pending view animation before starting a new one (#2546)
  • c262eb0 chore(deps): update dependency mocha to v12.0.3 (#2550)
  • e482b74 chore(deps): update dependency @​types/sinon to v22.0.1 (#2549)
  • 538248d chore(deps): update dependency @​semantic-release/github to v12.0.10 (#2548)
  • 4ab0b4a chore(deps): update actions/setup-node digest to 949feb2 (#2547)
  • 256ee79 chore(deps): update dependency oxfmt to v0.74.0
  • 54615c6 chore(deps): update dependency oxlint to v1.89.0, oxlint-tsgolint to 7.0.2005
  • 2fda874 test(selection): use unique test suite name
  • f2f89cf ci(release): add workaround for Git auth issues
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by CircleCI, a new releaser for vis-network since your current version.


Updates filenamify from 7.0.2 to 7.0.3

Release notes

Sourced from filenamify's releases.

v7.0.3

  • Fix Windows reserved device name handling 4eb7d0c

sindresorhus/filenamify@v7.0.2...v7.0.3

Commits

Updates @openally/httpie from 1.1.3 to 2.0.1

Release notes

Sourced from @​openally/httpie's releases.

v2.0.1

What's Changed

Full Changelog: OpenAlly/httpie@v2.0.0...v2.0.1

v2.0.0

What's Changed

Full Changelog: OpenAlly/httpie@v1.1.4...v2.0.0

v1.1.4

What's Changed

Full Changelog: OpenAlly/httpie@v1.1.3...v1.1.4

Commits
  • ccfb6a1 2.0.1
  • b260c24 chore: fix vulnerabilities (#14)
  • 49bb862 Merge pull request #13 from OpenAlly/update-documentation
  • 328ca48 2.0.0
  • 969ebac Merge pull request #12 from OpenAlly/improve-implementation
  • cf9de75 refactor(response): replace HttpieResponseHandler with internal functions
  • 14dcf3c chore: update dependencies
  • f4db16a refactor: use custom and minimal LRU-cache implementation
  • b054d2b refactor(typescript): migrate to esm-ts-next
  • 5bf5edf refactor: revamp folders and tests architecture
  • Additional commits viewable in compare view

Updates chokidar from 5.0.0 to 6.0.0

Release notes

Sourced from chokidar's releases.

6.0.0

High-level changes

  • Rewrote the watcher around a single observation pipeline. Backend callbacks are treated as invalidations and confirmed with lstat, stat, or readdir before any event is emitted, so the final state after a burst of changes matches the filesystem.
  • Added native recursive watching through fs.watch({ recursive: true }). The default auto backend uses it on macOS and Windows and per-directory watching elsewhere.
  • Shared native handles across watchers and opened them per directory only: files no longer own handles. This fixes EBADF errors when watching many files on macOS (#1385, #1452).
  • Replaced fs.watchFile with Chokidar-owned stat polling. Poll loops are shared across watchers at the fastest requested interval.
  • Required Node.js 22.22 or later.

API changes

  • Added the backend option: 'auto' (default), 'native', 'native-recursive', or 'polling'.
    • usePolling: true remains as a deprecated alias for backend: 'polling'.
  • Renamed interval and binaryInterval to pollingInterval and pollingBinaryInterval.
    • The old names remain as deprecated aliases; the new names win when both are given.
  • Changed the atomic default to false with polling. An explicit value is preserved.
  • Made close() terminal: add() now throws once closing has started. Construct a new watcher instead.
  • Validated options in the constructor: invalid backend, atomic, depth, awaitWriteFinish, and polling intervals throw TypeError.
  • Emitted errors from add() as error events instead of unhandled rejections (#1378).
  • Made getWatched() return a null-prototype object, so a watched directory named __proto__ is listed (#1493). Use Object.hasOwn() instead of hasOwnProperty() on the result.
  • Stopped applying ignored to directories above a path passed to watch() or add(), so a missing path is still watched through its parent (#1374). Other entries in those directories are still filtered.

Fixes

  • Fixed a 100% CPU loop when the process working directory containing a relatively watched file was deleted (#1474).
  • Fixed watching a filesystem root, which emitted unlink and unlinkDir for every entry (#1184, #452).
  • Fixed UNKNOWN errors from fs.watch on macOS sockets, which prevented watching /var/run (#1391).
  • Fixed a symlink whose target passes through a regular file (ENOTDIR) disabling watching of its directory and preventing ready (#1476).
  • Fixed files created in a newly added directory between its scan and watch registration being missed (#1471).
  • Fixed watching a missing nested path stopping its parent directory's subtree from being watched (#1470).
  • Fixed false change events on Windows when many sibling files are written (#1466).
  • Fixed duplicate add events for unchanged files under directory activity (#1465).
  • Fixed replacing a watched directory with a file of the same name hanging the process (#1464).
  • Fixed persistent watching stopping after a watched directory was removed (#1463).
  • Fixed a deleted watched path not being reported when recreated: previously only a deleted file that was the sole watched path was watched for its return. Any path passed to watch() or add() is now awaited from its nearest existing parent.
  • Fixed event throttling discarding updates; the newest differing change is now replayed when the window closes (#1455).
  • Fixed relative ignored paths; relative strings now resolve against cwd or the process working directory (#1436).
  • Fixed files not being detected when their directory did not exist before watching (#1422).
  • Fixed removed files being reported as unlinkDir instead of unlink (#1421).
  • Fixed ignored files and directories still being watched in WSL (#1418).
  • Fixed change being reported for every file when one file changed under Deno (#1417).
  • Fixed changes not being detected after the second save (#1399).
  • Fixed renaming a watched directory that contains subdirectories on Windows (#1380, #1398).
  • Fixed re-watching a path not honoring ignoreInitial (#1386).
  • Fixed EISDIR errors during the initial scan of network drives (#1376).
  • Fixed watching an array of absolute file paths (#1366).
  • Fixed unwatching a deleted watched directory on Windows, contributed by @​sapphi-red in [pull request #1467](paulmillr/chokidar#1467).
  • Documented that unwatched paths stay ignored until they are added again (#1439).

Misc

... (truncated)

Changelog

Sourced from chokidar's changelog.

6.0.0 (2026-10-19)

High-level changes

  • Rewrote the watcher around a single observation pipeline. Backend callbacks are treated as invalidations and confirmed with lstat, stat, or readdir before any event is emitted, so the final state after a burst of changes matches the filesystem.
  • Added native recursive watching through fs.watch({ recursive: true }). The default auto backend uses it on macOS and Windows and per-directory watching elsewhere.
  • Shared native handles across watchers and opened them per directory only: files no longer own handles. This fixes EBADF errors when watching many files on macOS (#1385, #1452).
  • Replaced fs.watchFile with Chokidar-owned stat polling. Poll loops are shared across watchers at the fastest requested interval.
  • Required Node.js 22.22 or later.

API changes

  • Added the backend option: 'auto' (default), 'native', 'native-recursive', or 'polling'.
    • usePolling: true remains as a deprecated alias for backend: 'polling'.
  • Renamed interval and binaryInterval to pollingInterval and pollingBinaryInterval.
    • The old names remain as deprecated aliases; the new names win when both are given.
  • Changed the atomic default to false with polling. An explicit value is preserved.
  • Made close() terminal: add() now throws once closing has started. Construct a new watcher instead.
  • Validated options in the constructor: invalid backend, atomic, depth, awaitWriteFinish, and polling intervals throw TypeError.
  • Emitted errors from add() as error events instead of unhandled rejections (#1378).
  • Made getWatched() return a null-prototype object, so a watched directory named __proto__ is listed (#1493). Use Object.hasOwn() instead of hasOwnProperty() on the result.
  • Stopped applying ignored to directories above a path passed to watch() or add(), so a missing path is still watched through its parent (#1374). Other entries in those directories are still filtered.

Fixes

  • Fixed a 100% CPU loop when the process working directory containing a relatively watched file was deleted (#1474).
  • Fixed watching a filesystem root, which emitted unlink and unlinkDir for every entry (#1184, #452).
  • Fixed UNKNOWN errors from fs.watch on macOS sockets, which prevented watching /var/run (#1391).
  • Fixed a symlink whose target passes through a regular file (ENOTDIR) disabling watching of its directory and preventing ready (#1476).
  • Fixed files created in a newly added directory between its scan and watch registration being missed (#1471).
  • Fixed watching a missing nested path stopping its parent directory's subtree from being watched (#1470).
  • Fixed false change events on Windows when many sibling files are written (#1466).
  • Fixed duplicate add events for unchanged files under directory activity (#1465).
  • Fixed replacing a watched directory with a file of the same name hanging the process (#1464).
  • Fixed persistent watching stopping after a watched directory was removed (#1463).
  • Fixed a deleted watched path not being reported when recreated: previously only a deleted file that was the sole watched path was watched for its return. Any path passed to watch() or add() is now awaited from its nearest existing parent.
  • Fixed event throttling discarding updates; the newest differing change is now replayed when the window closes (#1455).
  • Fixed relative ignored paths; relative strings now resolve against cwd or the process working directory (#1436).
  • Fixed files not being detected when their directory did not exist before watching (#1422).
  • Fixed removed files being reported as unlinkDir instead of unlink (#1421).
  • Fixed ignored files and directories still being watched in WSL (#1418).
  • Fixed change being reported for every file when one file changed under Deno (#1417).
  • Fixed changes not being detected after the second save (#1399).
  • Fixed renaming a watched directory that contains subdirectories on Windows (#1380, #1398).
  • Fixed re-watching a path not honoring ignoreInitial (#1386).
  • Fixed EISDIR errors during the initial scan of network drives (#1376).
  • Fixed watching an array of absolute file paths (#1366).
  • Fixed unwatching a deleted watched directory on Windows, contributed by @​sapphi-red in [pull request #1467](paulmillr/chokidar#1467).
  • Documented that unwatched paths stay ignored until they are added again (#1439).

... (truncated)

Commits

Updates find-my-way from 9.8.0 to 9.10.0

Release notes

Sourced from find-my-way's releases.

v9.10.0

What's Changed

New Contributors

Full Changelog: delvedor/find-my-way@v9.9.0...v9.10.0

v9.9.0

What's Changed

Full Changelog: delvedor/find-my-way@v9.8.0...v9.9.0

Commits
  • c47c38d Bumped v9.10.0
  • 7115731 perf: make route registration linear instead of quadratic (#457)
  • 91cb96b Merge pull request #465 from delvedor/fix/compiled-duplicate-slashes-querystring
  • b2cdb40 perf: validate absolute URLs without throwing (#460)
  • ab85d67 fix: do not remove duplicate slashes from the querystring (#463)
  • 7633b66 fix: use strict mode in all generated functions (#464)
  • cf0c300 feat: compiler mode for route lookup (#462)
  • ea13c2b fix(constrainer): guard strategy lookups against inherited Object prototype p...
  • 491be74 fix: do not leak a global from the compiled constraint matcher (#458)
  • 0eb2159 fix: bound regex host lookup cache (#454)
  • Additional commits viewable in compare view

Updates glob from 13.0.6 to 14.0.3

Changelog

Sourced from glob's changelog.

changeglob

14

  • Use minimatch 11. Each portion of a pattern with magic is now matched with a Matcher from @isaacs/nonrecursive-glob-match in place of a RegExp, so patterns can no longer cause ReDoS. Matching follows the minimatch 11 changes, which are closer to Bash in some edge cases.
  • Pattern#pattern() returns a Matcher for a portion with magic. The MMPattern type is now minimatch's ParseReturnFiltered, and the new MMMatcher type is the Matcher part of it.
  • Rename Pattern#isRegExp() to isMatcher(), and Processor#testRegExp() to testMatcher().
  • Remove the debug option, which minimatch no longer has.
  • Add the normalize option, to normalize unicode in the pattern and in the file names that it is matched against.
  • GlobWalker#walk() and walkSync() return arrays in place of sets, and MatchRecord#entries() is removed.
  • ignore patterns that start with / now start at the same place as other patterns that start with /: the root option if set, or else the root of the cwd, such as C:\ on Windows.
  • ignore patterns follow the windowsPathsNoEscape option, the same as other patterns.
  • On Windows, patterns that start with a long UNC root like //?/UNC/host/share/ walk that share, the same as //host/share/.
  • Faster ignore patterns (about 1.2 to 3 times faster), and less work for each entry in a walk (about 10% faster sync, and 15% to 30% faster async, for large trees).
  • Allow const string[] or readonly string[] as ignore option or pattern argument.
  • When the signal aborts an async walk, the walk stops. Before, it rejected, but continued to read directories.

13

  • Move the CLI program out to a separate package, glob-bin. Install that if you'd like to continue using glob from the command line.

12

  • Remove the unsafe --shell option. The --shell option is now ONLY supported on known shells where the behavior can be implemented safely.

11.1

... (truncated)

Commits

Updates pino from 10.3.1 to 10.4.0

Release notes

Sourced from pino's releases.

v10.4.0

What's Changed

@dependabot
chore(deps): bump the dependencies group across 1 directory with 15 u…
98b7a16 
…pdates

Bumps the dependencies group with 15 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [highlight.js](https://github.com/highlightjs/highlight.js) | `11.11.1` | `11.12.0` |
| [markdown-it](https://github.com/markdown-it/markdown-it) | `15.0.0` | `15.0.3` |
| [pretty-bytes](https://github.com/sindresorhus/pretty-bytes) | `7.1.1` | `7.2.0` |
| [vis-data](https://github.com/visjs/vis-data) | `8.0.5` | `8.0.6` |
| [vis-network](https://github.com/visjs/vis-network) | `10.1.1` | `10.1.4` |
| [filenamify](https://github.com/sindresorhus/filenamify) | `7.0.2` | `7.0.3` |
| [@openally/httpie](https://github.com/OpenAlly/httpie) | `1.1.3` | `2.0.1` |
| [chokidar](https://github.com/paulmillr/chokidar) | `5.0.0` | `6.0.0` |
| [find-my-way](https://github.com/delvedor/find-my-way) | `9.8.0` | `9.10.0` |
| [glob](https://github.com/isaacs/node-glob) | `13.0.6` | `14.0.3` |
| [pino](https://github.com/pinojs/pino) | `10.3.1` | `10.4.0` |
| [pino-pretty](https://github.com/pinojs/pino-pretty) | `13.1.3` | `13.2.0` |
| [ts-pattern](https://github.com/gvergnaud/ts-pattern) | `5.9.0` | `5.9.2` |
| [ws](https://github.com/websockets/ws) | `8.21.3` | `8.22.0` |
| [open](https://github.com/sindresorhus/open) | `11.0.1` | `11.0.4` |



Updates `highlight.js` from 11.11.1 to 11.12.0
- [Release notes](https://github.com/highlightjs/highlight.js/releases)
- [Changelog](https://github.com/highlightjs/highlight.js/blob/main/CHANGES.md)
- [Commits](highlightjs/highlight.js@11.11.1...11.12.0)

Updates `markdown-it` from 15.0.0 to 15.0.3
- [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md)
- [Commits](markdown-it/markdown-it@15.0.0...15.0.3)

Updates `pretty-bytes` from 7.1.1 to 7.2.0
- [Release notes](https://github.com/sindresorhus/pretty-bytes/releases)
- [Commits](sindresorhus/pretty-bytes@v7.1.1...v7.2.0)

Updates `vis-data` from 8.0.5 to 8.0.6
- [Release notes](https://github.com/visjs/vis-data/releases)
- [Commits](visjs/vis-data@v8.0.5...v8.0.6)

Updates `vis-network` from 10.1.1 to 10.1.4
- [Release notes](https://github.com/visjs/vis-network/releases)
- [Changelog](https://github.com/visjs/vis-network/blob/master/HISTORY.md)
- [Commits](visjs/vis-network@v10.1.1...v10.1.4)

Updates `filenamify` from 7.0.2 to 7.0.3
- [Release notes](https://github.com/sindresorhus/filenamify/releases)
- [Commits](sindresorhus/filenamify@v7.0.2...v7.0.3)

Updates `@openally/httpie` from 1.1.3 to 2.0.1
- [Release notes](https://github.com/OpenAlly/httpie/releases)
- [Commits](OpenAlly/httpie@v1.1.3...v2.0.1)

Updates `chokidar` from 5.0.0 to 6.0.0
- [Release notes](https://github.com/paulmillr/chokidar/releases)
- [Changelog](https://github.com/paulmillr/chokidar/blob/main/CHANGELOG.md)
- [Commits](paulmillr/chokidar@5.0.0...6.0.0)

Updates `find-my-way` from 9.8.0 to 9.10.0
- [Release notes](https://github.com/delvedor/find-my-way/releases)
- [Commits](delvedor/find-my-way@v9.8.0...v9.10.0)

Updates `glob` from 13.0.6 to 14.0.3
- [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md)
- [Commits](isaacs/node-glob@v13.0.6...v14.0.3)

Updates `pino` from 10.3.1 to 10.4.0
- [Release notes](https://github.com/pinojs/pino/releases)
- [Commits](pinojs/pino@v10.3.1...v10.4.0)

Updates `pino-pretty` from 13.1.3 to 13.2.0
- [Release notes](https://github.com/pinojs/pino-pretty/releases)
- [Commits](pinojs/pino-pretty@v13.1.3...v13.2.0)

Updates `ts-pattern` from 5.9.0 to 5.9.2
- [Release notes](https://github.com/gvergnaud/ts-pattern/releases)
- [Commits](gvergnaud/ts-pattern@v5.9.0...v5.9.2)

Updates `ws` from 8.21.3 to 8.22.0
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.21.3...8.22.0)

Updates `open` from 11.0.1 to 11.0.4
- [Release notes](https://github.com/sindresorhus/open/releases)
- [Commits](sindresorhus/open@v11.0.1...v11.0.4)

---
updated-dependencies:
- dependency-name: highlight.js
  dependency-version: 11.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: markdown-it
  dependency-version: 15.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: pretty-bytes
  dependency-version: 7.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: vis-data
  dependency-version: 8.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: vis-network
  dependency-version: 10.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: filenamify
  dependency-version: 7.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@openally/httpie"
  dependency-version: 2.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: chokidar
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: find-my-way
  dependency-version: 9.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: glob
  dependency-version: 14.0.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: pino
  dependency-version: 10.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: pino-pretty
  dependency-version: 13.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: ts-pattern
  dependency-version: 5.9.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: ws
  dependency-version: 8.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: open
  dependency-version: 11.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Nov 2, 2026
@changeset-bot

changeset-bot Bot commented Nov 2, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 98b7a16

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@socket-security

socket-security Bot commented Nov 2, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatednpm/​@​openally/​httpie@​1.1.3 ⏵ 2.0.177 +2100100 +192 +3100
Updatednpm/​vis-data@​8.0.5 ⏵ 8.0.694 -51008591100
Updatednpm/​highlight.js@​11.11.1 ⏵ 11.12.099 +110010085100
Updatednpm/​open@​11.0.1 ⏵ 11.0.4100 +1100100 +186 -5100
Updatednpm/​markdown-it@​15.0.0 ⏵ 15.0.3100 +1100 +2487 +192 +1100
Addednpm/​chokidar@​6.0.010010010087100
Addednpm/​pino-pretty@​13.2.09910010087100
Updatednpm/​vis-network@​10.1.1 ⏵ 10.1.488 -1110010094 +3100
Updatednpm/​find-my-way@​9.8.0 ⏵ 9.10.09910010089100
Addednpm/​pino@​10.4.09810010091100
Updatednpm/​ws@​8.21.3 ⏵ 8.22.09910010093100
Addednpm/​glob@​14.0.3981009993100

View full report

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants