fix: bump non-breaking dependencies to latest

[aversini]

Automated non-major dependency bump (deps-train).

package.json

• turbo 2.10.12 → 2.10.13

packages/timer/package.json

• moment 2.30.1 → 2.31.0

packages/static-server/package.json

• open 11.0.3 → 11.0.4

Transitive refresh (pnpm update) — 3 package(s) moved

Show transitive changes

• b4a 1.8.1 → 1.9.0
• brace-expansion 2.1.4, 5.0.9 → 2.1.7, 5.0.12
• fast-uri 3.1.7, 4.1.4 → 3.1.8, 4.1.5

---

What changed

turbo 2.10.12 → 2.10.13

Turborepo v2.10.13

What's Changed

Changelog

• chore: Release Turborepo 2.10.12 by @github-actions[bot] in chore: Release Turborepo 2.10.12 vercel/turborepo#13844
• fix: Remove unsupported remote cache environment variable by @anthonyshew in fix: Remove unsupported remote cache environment variable vercel/turborepo#13845
• fix: Copy TUI selections locally over SSH by @anthonyshew in fix: Copy TUI selections locally over SSH vercel/turborepo#13847
• feat: Use uv workspace metadata by @anthonyshew in feat: Use uv workspace metadata vercel/turborepo#13848
• feat: Support Python virtual environments by @anthonyshew in feat: Support Python virtual environments vercel/turborepo#13849
• fix: Scope uv lockfile affectedness by @anthonyshew in fix: Scope uv lockfile affectedness vercel/turborepo#13850
• test: Isolate uv prune configuration by @anthonyshew in test: Isolate uv prune configuration vercel/turborepo#13851
• fix: Explain disabled uv task caching by @anthonyshew in fix: Explain disabled uv task caching vercel/turborepo#13852
• fix: Explain uv identity probe failures by @anthonyshew in fix: Explain uv identity probe failures vercel/turborepo#13853
• fix: Explain uncached Cargo library builds by @anthonyshew in fix: Explain uncached Cargo library builds vercel/turborepo#13855
• fix: Explain disabled Cargo task caching by @anthonyshew in fix: Explain disabled Cargo task caching vercel/turborepo#13854
• fix: Keep Cargo tasks runnable without compiler identity by @anthonyshew in fix: Keep Cargo tasks runnable without compiler identity vercel/turborepo#13857
• chore: Release Turborepo 2.10.13-canary.1 by @github-actions[bot] in chore: Release Turborepo 2.10.13-canary.1 vercel/turborepo#13858

…notes truncated.

compare 2.10.12…2.10.13 · npm

moment 2.30.1 → 2.31.0

2.31.0

Released Sep 14, 2026

Security fixes

• Fix CVE-2026-17495 (GHSA-4p3w-j4w9-5jqw)

Bug fixes

• #6376 Prevent object prototype properties from being used as format tokens
• #6386 Normalize lazy-loaded locale names
• #6404 Fix parsing issue with eHHmm format
• #6433 Ignore non-Moment arguments in min and max
• #6434 Fix inherited lowercase long date formats
• #6436 Reset locale parsing caches after updates
• #6437 Fix weekday mismatch when the format only has part of a date
• #6442 Fix locale('__proto__') corrupting the global locale
• #6443 Avoid Object.assign in duration.humanize
• #6446 Validate range when parsing a time zone offset
• #6447 Include metadata in all-locales bundle
• #6448 Apply postformat to locale relative time methods
• #6450

…notes truncated.

compare 2.30.1…2.31.0 · npm

open 11.0.3 → 11.0.4

v11.0.4

• Fix browser/browserPrivate not detecting Safari or Brave as the default browser 6ae6196

---

sindresorhus/open@v11.0.3...v11.0.4

compare 11.0.3…11.0.4 · npm