Repository navigation
chore(deps): bump the npm_and_yarn group across 2 directories with 5 updates - #285
Conversation
…updates Bumps the npm_and_yarn group with 2 updates in the /pi directory: [@vitest/mocker](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker) and [zod](https://github.com/colinhacks/zod). Bumps the npm_and_yarn group with 4 updates in the /scripts/zod-check directory: [zod](https://github.com/colinhacks/zod), [body-parser](https://github.com/expressjs/body-parser), [fast-uri](https://github.com/fastify/fast-uri) and [ip-address](https://github.com/beaugunderson/ip-address). Updates `@vitest/mocker` from 5.0.0 to 5.0.5 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/mocker) Updates `zod` from 4.5.4 to 4.6.7 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.5.4...v4.6.7) Updates `zod` from 4.4.3 to 4.6.7 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.5.4...v4.6.7) Updates `body-parser` from 2.3.0 to 2.4.0 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@v2.3.0...v2.4.0) Updates `fast-uri` from 3.1.8 to 3.1.9 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.8...v3.1.9) Updates `ip-address` from 10.7.2 to 10.7.4 - [Release notes](https://github.com/beaugunderson/ip-address/releases) - [Commits](beaugunderson/ip-address@v10.7.2...v10.7.4) --- updated-dependencies: - dependency-name: "@vitest/mocker" dependency-version: 5.0.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: zod dependency-version: 4.6.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: zod dependency-version: 4.6.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: body-parser dependency-version: 2.4.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ip-address dependency-version: 10.7.4 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![revuto-review[bot]](https://avatars.githubusercontent.com/in/4488771?s=60&v=4){kind=small}
There was a problem hiding this comment.
This is an auto review done by revuto.
The Pi Zod update needs regenerated bundle artifacts before this PR can pass CI.
| "version": "4.5.4", | ||
| "resolved": "https://registry.npmjs.org/zod/-/zod-4.5.4.tgz", | ||
| "integrity": "sha512-sC95tT5iHHH9gtpj6A81kh+NEaRAUFN+qlUPDUbRfOMvNf5QCBqsb3WgvnpVtK5Y+4UfA6KqufotuTvMGiTlsA==", | ||
| "version": "4.6.7", |
There was a problem hiding this comment.
This is an auto review done by revuto.
[P2] Regenerate the Pi bundle and third-party notices
The checked-in pi/extension/THIRD_PARTY_NOTICES.txt:649 still records zod@4.5.4. pi/scripts/build.mjs generates that notice from the installed package version and compares generated artifacts byte-for-byte in --check mode. CI installs this lockfile and runs npm run build:check --prefix pi, so installing Zod 4.6.7 while leaving the artifacts unchanged fails that check. Run npm run build --prefix pi and commit the updated bundle and notices.
There was a problem hiding this comment.
This is an auto review done by revuto.
Revuto completed the review and found no evidence-backed concerns.
|
Reviewed the dependency updates and regenerated client bundle. No blockers found. The bundle check, TypeScript check, and local dependency audits pass. The separate security patch adds no missing fixes. Undici 8.12.2 keeps the existing Node requirement. The stale bundle reported by Revuto is regenerated here. Thanks for the dependency updates. |
Bumps the npm_and_yarn group with 2 updates in the /pi directory: @vitest/mocker and zod.
Bumps the npm_and_yarn group with 4 updates in the /scripts/zod-check directory: zod, body-parser, fast-uri and ip-address.
Updates
@vitest/mockerfrom 5.0.0 to 5.0.5Release notes
Sourced from @vitest/mocker's releases.
... (truncated)
Commits
7a825dbchore: release v5.0.5 (#11609)6a11cf6chore: release v5.0.4 (#11554)58c86edchore(deps): update all non-major dependencies (#11550)5c95521fix(browser): clean up unmocked and pending mocks (#11537)cd423bafix(mocker): fix native loader mocking edge cases (#11540)36d19cbfix: wrap module mocks during in-source testing (#11505)fe025b2chore(deps): update dependency msw to v3 (#11482)b0f2b3bfix: track project files and mocks with --changed (#11432)33cadeachore: release v5.0.3 (#11409)15cc006fix: don't print an interceptor warning in browser mode (#11377)Updates
zodfrom 4.5.4 to 4.6.7Release notes
Sourced from zod's releases.
... (truncated)
Commits
b500a2e4.6.79c21983ci: stage at verbose so a failed OIDC token exchange says why529f78d4.6.6a0ebf97fix(v4): check array, set and map size bounds before parsing elements (#6652)a2ba4a6fix(types): declare record output and input as members, not base type argumen...c42596brelease: hold the run on the release-approval environment until the staged ve...bacad51docs: square the Code for Japan logo to match the other bronze tiles8fb2fafdocs: crop the Code for Japan logo and list it first in bronzeb2ef983docs: add Code for Japan to bronze sponsors74304cerelease: stage npm versions instead of publishing them (#6622)Updates
zodfrom 4.4.3 to 4.6.7Release notes
Sourced from zod's releases.
... (truncated)
Commits
b500a2e4.6.79c21983ci: stage at verbose so a failed OIDC token exchange says why529f78d4.6.6a0ebf97fix(v4): check array, set and map size bounds before parsing elements (#6652)a2ba4a6fix(types): declare record output and input as members, not base type argumen...c42596brelease: hold the run on the release-approval environment until the staged ve...bacad51docs: square the Code for Japan logo to match the other bronze tiles8fb2fafdocs: crop the Code for Japan logo and list it first in bronzeb2ef983docs: add Code for Japan to bronze sponsors74304cerelease: stage npm versions instead of publishing them (#6622)Updates
body-parserfrom 2.3.0 to 2.4.0Release notes
Sourced from body-parser's releases.
Changelog
Sourced from body-parser's changelog.
Commits
b4744d72.4.0 (#777)f7075eafix: prevent process crash from trailing bytes after a compressed body185ff1dchore: update dependencies (#778)73713f7docs: fix depth error description (#776)2dcc826docs: improve readability (#756)402dbdcdocs: note that req.body may be undefined in v2 (#752)9883a1eperf: inline content stream setup (#750)02101dafix(test): pin supertest to 7.3.0 to avoid 7.3.1 regression (#773)822a0fdbuild(deps): bump the github-actions group with 3 updates (#771)aa9889bci: trigger npm publish on release published and set dist-tag (#768)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for body-parser since your current version.
Updates
fast-urifrom 3.1.8 to 3.1.9Release notes
Sourced from fast-uri's releases.
Commits
0def703Bumped v3.1.9a1d0da2test: generate only relative path references9eb8759fix: preserve relative paths in suffix and relative resolution54c30f7docs: note suffix-reference authority ambiguity39e6493fix: escape a first-segment colon in suffix references745183ctest: cover first-segment colon in suffix referencesddfc6a5fix(SEC-03): reject non reg-name characters in domain hostsd86a8d2fix: keep a colon-first segment behind "./" in relative normalizationeb483b5test: cover colon-first relative references in normalizationb110a35fix(SEC-02): preserve meaning of relative references during normalizationMaintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for fast-uri since your current version.
Updates
ip-addressfrom 10.7.2 to 10.7.4Release notes
Sourced from ip-address's releases.
Commits
651c1dd10.7.4ec80fcdFind an IPv6 zone by index so a rejected zone costs one passe22eb4aCheck generated docs without writing or hiding partial stagingc7f838e10.7.309b8072Reject an in-addr.arpa name longer than 32 characters before splitting it (#228)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.