chore(deps)(deps): bump the bun-minor-and-patch group across 1 directory with 34 updates

[dependabot]

Bumps the bun-minor-and-patch group with 34 updates in the / directory:

Package	From	To
eslint	10.2.0	10.10.0
eslint-plugin-react-refresh	0.5.3	0.5.6
typescript-eslint	8.62.0	8.70.0
@agendajs/mongo-backend	4.0.2	4.0.3
agenda	6.2.5	6.2.6
cron-parser	5.6.1	5.10.1
hono	4.12.27	4.13.7
jszip	3.10.1	3.10.2
mongodb	7.4.0	7.6.0
posthog-node	5.38.6	5.52.1
yaml	2.9.0	2.9.1
zod	4.4.3	4.6.5
bun-types	1.3.14	1.4.2
@hookform/resolvers	5.4.0	5.9.1
@tanstack/react-query	5.101.2	5.102.8
@xyflow/react	12.11.1	12.11.6
highlight.js	11.11.1	11.12.0
i18next	26.3.3	26.4.2
posthog-js	1.395.0	1.430.4
react	19.2.7	19.3.0
@types/react	19.2.17	19.3.0
react-dom	19.2.7	19.3.0
@types/react-dom	19.2.3	19.3.0
react-hook-form	7.80.0	7.88.0
react-i18next	17.0.8	17.0.14
react-router-dom	7.18.0	7.18.3
recharts	3.9.0	3.10.1
zustand	5.0.14	5.0.15
@tailwindcss/vite	4.3.1	4.3.3
@testing-library/react	16.3.2	16.3.3
@testing-library/user-event	14.6.1	14.6.7
@types/react	19.2.17	19.3.0
@types/react-dom	19.2.3	19.3.0
@vitejs/plugin-react	6.0.3	6.1.1
tailwindcss	4.3.1	4.3.3
vite	8.1.0	8.3.0

Updates eslint from 10.2.0 to 10.10.0

Release notes

Sourced from eslint's releases.

v10.10.0

Features

• 264b434 feat: add d and v flags to no-unexpected-multiline (#21305) (Gihyeon Jeong / 정기현)
• c6cc6c5 feat: check Object.prototype property names in new-cap (#21269) (crimsonjay0)
• 5661fa6 feat: no-extra-bind false negatives with class fields and static blocks (#21260) (synthex-byte)

Bug Fixes

• bb47dc6 fix: update dependency file-entry-cache to v11 (#20801) (Milos Djermanovic)
• 427ac0a fix: use format strings in debug calls (#21247) (Francesco Trotta)
• 9d81532 fix: support __proto__ in /* exported */ comments (#21261) (sethamus)
• 87e0a08 fix: prefer-object-has-own autofix breaks when Object is shadowed (#21282) (김채영)
• 8e2cb14 fix: new-cap false positive for UTC calls with properties: false (#21275) (Pixel)
• 9f4a364 fix: Ignore static imports in no-unreachable (#21276) (Taha Kotil)

Documentation

• 2417cad docs: Update README (GitHub Actions Bot)
• 9cecb8a docs: document \c control letter escapes in no-control-regex (#21286) (한국)
• 8724829 docs: update compat table links (#21263) (fnx)
• 5634542 docs: Clarify eqeqeq suggestion behavior (#21256) (Müslüm Yılmaz)

Chores

• b3d876b chore: disable npm audit in ecosystem tests (#21306) (Francesco Trotta)
• 1696682 ci: restore EMFILE test on Node.js 26 (#21297) (Marry (Subin Yang))
• 2c7f5d6 chore: update github/codeql-action action to v4.37.9 (#21296) (renovate[bot])
• 3c753f1 chore: update eslint (#21289) (renovate[bot])
• 1c73469 chore: update ecosystem plugins (#21280) (ESLint Bot)
• 08a02be test: add error locations to no-extra-boolean-cast (#21266) (lumir)
• 77bb1db chore: update github/codeql-action action to v4.37.8 (#21270) (renovate[bot])
• 007e81a ci: skip EMFILE test on Node.js 26 (#21265) (lumir)
• 0430280 chore: improve ecosystem tests compatibility on Windows (#21178) (crimsonjay0)

v10.9.1

Bug Fixes

• 1e641c9 fix: no-loss-of-precision false positive with trailing decimal point (#21251) (Aleksandr Shoronov)

Documentation

• ad74a8d docs: add deprecation steps for EOL package versions (#21248) (Francesco Trotta)

Chores

• 3c3ae53 chore: update ecosystem plugins (#21249) (ESLint Bot)

v10.9.0

Features

• 08de88e feat: handle underflow in no-loss-of-precision (#21218) (Rithish S)
• 55db479 feat: add checkConditionalExpressions to no-unmodified-loop-condition (#21175) (sethamus)

Bug Fixes

• 2ba3025 fix: prevent unsafe no-var autofix with hoisted functions (#21213) (sethamus)
• 8e69622 fix: Prevent no-var autofix when var is shadowed by catch parameter (#21204) (Yang Hyeonjong)
• 684b579 fix: prefer-template invalid autofix creates a tagged template call (#21207) (김채영)

... (truncated)

Commits

• 3f20a57 10.10.0
• f4e5284 Build: changelog update for 10.10.0
• bb47dc6 fix: update dependency file-entry-cache to v11 (#20801)
• 427ac0a fix: use format strings in debug calls (#21247)
• b3d876b chore: disable npm audit in ecosystem tests (#21306)
• 9d81532 fix: support __proto__ in /* exported */ comments (#21261)
• 264b434 feat: add d and v flags to no-unexpected-multiline (#21305)
• 1696682 ci: restore EMFILE test on Node.js 26 (#21297)
• 2c7f5d6 chore: update github/codeql-action action to v4.37.9 (#21296)
• 87e0a08 fix: prefer-object-has-own autofix breaks when Object is shadowed (#21282)
• Additional commits viewable in compare view

Updates eslint-plugin-react-refresh from 0.5.3 to 0.5.6

Release notes

Sourced from eslint-plugin-react-refresh's releases.

v0.5.6

• Support re-exporting namespace components (fixes #116)

v0.5.5

• Fix SCREAMING_SNAKE_CASE constant exported via export { Name } incorrectly treated as React component #114 (fixes #113)
• Add contentType and size to allowExportNames in Next config #115

v0.5.4

• Add instant to allowExportNames in Next config #112

Changelog

Sourced from eslint-plugin-react-refresh's changelog.

0.5.6

• Support re-exporting namespace components (fixes #116)

0.5.5

• Fix SCREAMING_SNAKE_CASE constant exported via export { Name } incorrectly treated as React component #114 (fixes #113)
• Add contentType and size to allowExportNames in Next config #115

0.5.4

• Add instant to allowExportNames in Next config #112

Commits

• 620568a Support re-exporting namespace components (fixes #116) [publish]
• 65c3172 [publish] v0.5.5
• 8411020 Bump deps
• c28fa15 Fix SCREAMING_SNAKE_CASE constant exported via export { Name } incorrectly ...
• 554c764 [publish] add contentType and size to allowExportNames in Next config (#115)
• e316617 [publish] Add instant to allowExportNames in Next config (#112)
• See full diff in compare view

Updates typescript-eslint from 8.62.0 to 8.70.0

Release notes

Sourced from typescript-eslint's releases.

v8.70.0

8.70.0 (2026-09-07)

🚀 Features

• eslint-plugin: [no-generated-empty-object-type] add rule (#12730)
• website: generate per-page social preview cards (#12734)

🩹 Fixes

• use stable release of pnpm 12 (#12808)
• update pnpm to 12.3.4 and dedupe Docusaurus packages (#12829)
• eslint-plugin: [member-ordering] don't report fields that read fields declared before them (#12729)
• eslint-plugin: [no-unnecessary-condition] no false positive on RHS of a nested logical expression (#12728)
• eslint-plugin: [no-deprecated] report deprecated imported values used in object shorthand properties (#12780)
• project-service: avoid discarded tsserver logs (#12748)
• typescript-estree: clarify the parserOptions.project error message (#12817)

❤️ Thank You

• Barry @​barry166
• Evyatar Daud @​StyleShit
• Josh Goldberg
• Josh Goldberg ✨ @​JoshuaKGoldberg
• Kirk Waiblinger @​kirkwaiblinger
• Ulrich Stark @​ulrichstark
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.69.0

8.69.0 (2026-08-31)

🚀 Features

• eslint-plugin: [no-misused-promises] add flagUnions option for checkConditionals (#12603)

🩹 Fixes

• eslint-plugin: [no-mixed-enums] use scope analysis instead of type checking for merged namespaces (#12731)
• eslint-plugin: [unified-signatures] compare type parameters by constraint instead of name (#12741)
• eslint-plugin: [no-meaningless-void-operator] report void on non-call expressions (#12727)
• website: respect allowJs playground config (#12744)

❤️ Thank You

• Abdu Alim Arlikhozhaev @​Arlikhozhaev
• Evyatar Daud @​StyleShit

... (truncated)

Changelog

Sourced from typescript-eslint's changelog.

8.70.0 (2026-09-07)

🩹 Fixes

• eslint-plugin: [no-deprecated] report deprecated imported values used in object shorthand properties (#12780)

❤️ Thank You

• Ulrich Stark @​ulrichstark

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.69.0 (2026-08-31)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.68.0 (2026-08-24)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.67.0 (2026-08-10)

🚀 Features

• typescript-eslint: export basic globs for using tseslint (#12105)

❤️ Thank You

• Claude Sonnet 5
• Evyatar Daud @​StyleShit
• Josh Goldberg
• Josh Goldberg ✨
• Kirk Waiblinger @​kirkwaiblinger

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.66.0 (2026-08-03)

... (truncated)

Commits

• 7ee7608 chore(release): publish 8.70.0
• 4586535 fix(eslint-plugin): [no-deprecated] report deprecated imported values used in...
• 9a6e546 chore(release): publish 8.69.0
• 8f4e00a chore(release): publish 8.68.0
• 55f6d5d chore: enable source maps (#12677)
• 20a261f chore(release): publish 8.67.0
• c245fbb feat(typescript-eslint): export basic globs for using tseslint (#12105)
• 3b155bb chore: use typescript 7 for typechecking (#12601)
• e51b11b chore(release): publish 8.66.0
• 63ba81b chore(release): publish 8.65.0
• Additional commits viewable in compare view

Updates @agendajs/mongo-backend from 4.0.2 to 4.0.3

Release notes

Sourced from @​agendajs/mongo-backend's releases.

@​agendajs/mongo-backend@​4.0.3

Patch Changes

• 4823fa7: Map startDate, endDate and skipDays from MongoDB documents to job objects so date constraints on repeating jobs survive a reload from the database (previously a repeating job with an endDate would keep running forever after its first execution)
• c419abe: Follow-up to #1783: restore defensive new Date() coercion for date fields in saveJobState so untyped callers passing ISO strings cannot persist strings in date fields, and remove the internal OptionalKeysToNullable helper type from the public exports
• cb27747: Push skip/limit to the database in queryJobs when no state filter is requested, instead of loading the entire matching collection into memory. Prevents out-of-memory on large collections (#1713, #1712).
• 1edf8bc: Conform to the MongoDB Stable API: replace the distinct command in getDistinctJobNames() with a $group aggregation, so the backend works with clients configured with apiStrict: true
• ea7c773: Reject server-side-evaluation operators ($where, $function, $expr, $accumulator) in unique() constraints. They have no use in a uniqueness key and could allow query injection when the key is built from untrusted input. Ordinary equality and comparison constraints are unchanged.
• 3708f9a: Extended the saved Job type to have explicit null values instead of undefined and stopped relying on the MongoDb driver "ignoreUndefined" flag to set them
• Updated dependencies [3369032]
• Updated dependencies [a072e7b]
• Updated dependencies [d90be16]
• Updated dependencies [42d17a3]
• Updated dependencies [2b6c926]
• Updated dependencies [08b1e22]
• Updated dependencies [24e7591]
• Updated dependencies [fd01a64]
  • agenda@6.2.6

Commits

• fd90c62 Version Packages (#1717)
• a930ab1 fix(test): send fork child error message over IPC instead of empty object (#1...
• ca44630 Update README.md (#1711)
• d90be16 fix(agenda): schedule @​Every jobs registered after agenda is ready (#1726)
• cb27747 fix(mongo-backend): paginate queryJobs at the database (#1755)
• 08b1e22 fix(agenda): treat numeric repeatInterval as milliseconds (#1754)
• 3369032 reset backoff failCount on success (#1727)
• 2b6c926 fix(agenda): correct processing queue insertion order (#1725)
• 42d17a3 fix(agenda): unlock future-dated job freed by the processor (#1750)
• a072e7b do not skip a cron occurrence when nextRunAt is ahead of the next tick (#1743)
• Additional commits viewable in compare view

Updates agenda from 6.2.5 to 6.2.6

Release notes

Sourced from agenda's releases.

agenda@6.2.6

Patch Changes

• 3369032: Reset a job's backoff retry counter after a successful run. A recurring job that exhausted its retries earlier in its lifetime kept the old failCount, so a later failure was treated as already out of retries and stopped retrying.
• a072e7b: Fix recurring cron jobs skipping a valid occurrence. computeFromInterval compared the next cron tick against the stored nextRunAt, so when nextRunAt was further in the future than the next tick after lastRunAt, it bumped past and skipped the legitimate occurrence. It now only re-rolls when the tick is not strictly after lastRunAt.
• d90be16: Fix @Every jobs registered after the agenda was already ready never being scheduled. The scheduler relied on a one-shot ready event that had already fired, so it now uses the ready promise, which stays resolved.
• 42d17a3: Release the database lock when the processor frees a job whose nextRunAt is too far in the future. Previously such a job, when picked up via the expired-lock recovery path (for example a recurring job left locked by a crashed worker), was removed from the local locked list but never unlocked in the database, so it was re-locked on every scan and never reached its run time.
• 2b6c926: Fix processing queue order. JobProcessingQueue.insert placed the highest-priority (or earliest nextRunAt) job in the slot that runs last, because the queue is read from the end. Jobs queued in the same tick now run in the correct priority order.
• 08b1e22: Treat a numeric (or purely-numeric string) repeatInterval as milliseconds in computeFromInterval, so recurring jobs scheduled with agenda.every(5000, 'job') keep running on backends that persist the interval as a string.
• 24e7591: Fix start() race where concurrent calls leaked a second JobProcessor and connected the notification channel twice
• fd01a64: stop() no longer unlocks jobs that are still running, preventing duplicate concurrent execution of the same job occurrence on another instance during rolling restarts. Only jobs that are locked locally but have not started running are unlocked; running jobs keep their database lock until they complete (or lockLifetime expires if the process dies).

Commits

• fd90c62 Version Packages (#1717)
• a930ab1 fix(test): send fork child error message over IPC instead of empty object (#1...
• ca44630 Update README.md (#1711)
• d90be16 fix(agenda): schedule @​Every jobs registered after agenda is ready (#1726)
• cb27747 fix(mongo-backend): paginate queryJobs at the database (#1755)
• 08b1e22 fix(agenda): treat numeric repeatInterval as milliseconds (#1754)
• 3369032 reset backoff failCount on success (#1727)
• 2b6c926 fix(agenda): correct processing queue insertion order (#1725)
• 42d17a3 fix(agenda): unlock future-dated job freed by the processor (#1750)
• a072e7b do not skip a cron occurrence when nextRunAt is ahead of the next tick (#1743)
• Additional commits viewable in compare view

Updates cron-parser from 5.6.1 to 5.10.1

Release notes

Sourced from cron-parser's releases.

v5.10.1

What's Changed

• fix: reject duplicate zero values in field validation by @​harrisiirak in harrisiirak/cron-parser#445
• fix: bound field value expansion at parse time by @​harrisiirak in harrisiirak/cron-parser#450

Full Changelog: harrisiirak/cron-parser@v5.10.0...v5.10.1

v5.10.0

What's Changed

• fix: pad short expressions from the leading field slot by @​harrisiirak in harrisiirak/cron-parser#443

Full Changelog: harrisiirak/cron-parser@v5.9.0...v5.10.0

v5.9.0

What's Changed

• fix: keep explicit range bounds when stringifying stepped fields (#279) by @​harrisiirak in harrisiirak/cron-parser#440
• fix: compensate DST transitions wider than one hour by @​aniket-3001 in harrisiirak/cron-parser#435
• fix: keep a hashed step wider than its range from emptying the field by @​Jaybhade in harrisiirak/cron-parser#437

New Contributors

• @​aniket-3001 made their first contribution in harrisiirak/cron-parser#435
• @​Jaybhade made their first contribution in harrisiirak/cron-parser#437

Full Changelog: harrisiirak/cron-parser@v5.8.1...v5.9.0

v5.8.1

What's Changed

• ci: automate releases by @​harrisiirak in harrisiirak/cron-parser#439

Full Changelog: harrisiirak/cron-parser@v5.8.0...v5.8.1

v5.8.0

What's Changed

• chore: report coverage and benchmark on every PR commit by @​harrisiirak in harrisiirak/cron-parser#430
• docs: document benchmark environment variables by @​harrisiirak in harrisiirak/cron-parser#431
• docs: add security policy and code of conduct by @​harrisiirak in harrisiirak/cron-parser#432
• fix: drop day of month values the month does not have by @​harrisiirak in harrisiirak/cron-parser#433
• fix: keep day fields that cover their whole range out of the wildcard form by @​harrisiirak in harrisiirak/cron-parser#434
• fix: round the current date to whole seconds so occurrences on the end date are returned by @​harrisiirak in harrisiirak/cron-parser#436
• fix: keep a day-of-week step from adding Sunday when it never reaches 7 by @​spokodev in harrisiirak/cron-parser#438

Full Changelog: harrisiirak/cron-parser@v5.7.0...v5.8.0

v5.7.0

What's Changed

• fix: enforce iteration loop limit so unsatisfiable expressions throw instead of returning a bogus date by @​spokodev in harrisiirak/cron-parser#415

... (truncated)

Changelog

Sourced from cron-parser's changelog.

v5.10.1 - 2026-09-12

What's Changed

• fix: reject duplicate zero values in field validation by @​harrisiirak in harrisiirak/cron-parser#445
• fix: bound field value expansion at parse time by @​harrisiirak in harrisiirak/cron-parser#450

Full Changelog: harrisiirak/cron-parser@v5.10.0...v5.10.1

v5.10.0 - 2026-08-14

What's Changed

• fix: pad short expressions from the leading field slot by @​harrisiirak in harrisiirak/cron-parser#443

Full Changelog: harrisiirak/cron-parser@v5.9.0...v5.10.0

v5.9.0 - 2026-08-13

What's Changed

• fix: keep explicit range bounds when stringifying stepped fields (#279) by @​harrisiirak in harrisiirak/cron-parser#440
• fix: compensate DST transitions wider than one hour by @​aniket-3001 in harrisiirak/cron-parser#435
• fix: keep a hashed step wider than its range from emptying the field by @​Jaybhade in harrisiirak/cron-parser#437

New Contributors

• @​aniket-3001 made their first contribution in harrisiirak/cron-parser#435
• @​Jaybhade made their first contribution in harrisiirak/cron-parser#437

Full Changelog: harrisiirak/cron-parser@v5.8.1...v5.9.0

v5.8.1 - 2026-08-09

What's Changed

• ci: automate releases by @​harrisiirak in harrisiirak/cron-parser#439

Full Changelog: harrisiirak/cron-parser@v5.8.0...v5.8.1

v5.8.0 - 2026-08-09

What's Changed

• chore: report coverage and benchmark on every PR commit by @​harrisiirak in harrisiirak/cron-parser#430
• docs: document benchmark environment variables by @​harrisiirak in harrisiirak/cron-parser#431
• docs: add security policy and code of conduct by @​harrisiirak in harrisiirak/cron-parser#432
• fix: drop day of month values the month does not have by @​harrisiirak in harrisiirak/cron-parser#433
• fix: keep day fields that cover their whole range out of the wildcard form by @​harrisiirak in harrisiirak/cron-parser#434
• fix: round the current date to whole seconds so occurrences on the end date are returned by @​harrisiirak in harrisiirak/cron-parser#436
• fix: keep a day-of-week step from adding Sunday when it never reaches 7 by @​spokodev in harrisiirak/cron-parser#438

... (truncated)

Commits

• 5b08cdf chore: bump version
• 1d5867c chore: update dev deps
• 95bac55 fix: bound field value expansion at parse time (#450)
• 7b3a0ad chore: add more funding sources to FUNDING.yml
• fc5ca7b chore: add Patreon username for funding support
• 03444a8 chore: update dev deps
• 4fd8809 fix: reject duplicate zero values in field validation (#445)
• 609feef chore: bump version
• 0bf36c8 fix: pad short expressions from the leading field slot (#443)
• 85f3644 fix: anchor the worktree ignore patterns to the project root
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for cron-parser since your current version.

Updates hono from 4.12.27 to 4.13.7

Release notes

Sourced from hono's releases.

v4.13.7

Security fixes

This release includes a fix for the following security issue:

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

---

Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

v4.13.6

What's Changed

• fix(client): keep a param value of "index" in $url() and $path() in honojs/hono#5297
• fix(client): normalize root WebSocket URLs in honojs/hono#5291
• fix(types): allow symbol keys in Context get and set fallbacks in honojs/hono#5300
• chore: bump editorconfig-checker in honojs/hono#5336
• refactor(on-handler): use forEach for consistent handler iteration in honojs/hono#5326

Full Changelog: honojs/hono@v4.13.5...v4.13.6

v4.13.5

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

---

Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

v4.13.4

What's Changed

• fix(request): handle params on unmatched requests in honojs/hono#5268
• fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in honojs/hono#5264
• fix(reg-exp-router): associate wildcard middleware with matching routes in honojs/hono#5266
• perf(router): share null object creation in honojs/hono#5267

... (truncated)

Commits

• eebdf7b 4.13.7
• 2b8ed40 Merge commit from fork
• cac0c4d 4.13.6
• dac5d57 refactor(on-handler): use forEach for consistent handler iteration (#5326)
• ec648d6 chore: bump editorconfig-checker (#5336)
• e2740d5 fix(types): allow symbol keys in Context<any> get and set fallbacks (#5300)
• 499c35e fix(client): normalize root WebSocket URLs (#5291)
• 50b8788 fix(client): keep a param value of "index" in $url() and $path() (#5297)
• 06880c4 4.13.5
• 531e9c5 Merge commit from fork
• Additional commits viewable in compare view

Updates jszip from 3.10.1 to 3.10.2

Changelog

Sourced from jszip's changelog.

v3.10.2 2026-09-09

• Fix cross-realm binary type detection in getTypeOf. Fixes #759 (see #578)
• Add missing types for JSZip.defaults. Fixes #690 (see #927)
• Fix Blob support in Node.js 18 and up. Fixes #941 (see #955)

Commits

• 020fa33 Release preparation for 3.10.2 (#974)
• d38fda5 Fix cross-realm binary type detection in getTypeOf (#578)
• e682f9a Fix grunt build rebundling existing dist via browser field (#971)
• 5adef36 Add missing types for JSZip.defaults (#927)
• 41a1342 Fix blob support in Node.js 18 and up (#955)
• 643714a Move all continuous integration to GitHub Actions (#942)
• 418c11f Upgrade Playwright to the latest version (#940)
• 2ceb998 Create FUNDING.yml
• See full diff in compare view

Maintainer changes

This version was pushed to npm by jkoops, a new releaser for jszip since your current version.

Updates mongodb from 7.4.0 to 7.6.0

Release notes

Sourced from mongodb's releases.

v7.6.0

7.6.0 (2026-08-21)

The MongoDB Node.js team is pleased to announce version 7.6.0 of the mongodb package!

Release Notes

Support for MongoDB 4.2 is removed

[!WARNING] When the driver connects to a MongoDB server of version 4.2 or less, it will now throw an error.

HTTP proxy support for KMS requests in CSFLE and Queryable Encryption

In-use encryption can now route KMS requests through an HTTP proxy. Set kmsConnectCallback on your ClientEncryption or auto-encryption options to control how the driver connects to a KMS host. The callback receives the target host and port and returns a connected socket (for example, a tunnel opened with HTTP CONNECT); the driver then performs the KMS TLS handshake over that socket using the provider's configured TLS options. This unblocks CSFLE and Queryable Encryption in environments that require an HTTP forward proxy for outbound KMS traffic, which the existing SOCKS5 proxyOptions does not cover.

const clientEncryption = new ClientEncryption(keyVaultClient, {
  keyVaultNamespace,
  kmsProviders,
  // Establish the KMS connection through your HTTP proxy; the driver adds TLS.
  kmsConnectCallback: ({ host, port }) => connectThroughHttpProxy(host, port)
});

Improved Intelligent Workload Management

Improved performance for MongoDB 9.0's Intelligent Workload Management (IWM) by only retrying overload errors when doing so is expected to not worsen server conditions

Bundling the driver into ESM no longer throws ReferenceError: require is not defined

v7.2.0 introduced the experimental runtimeAdapters option and, as part of it, replaced the driver’s static import of Node’s os module with a runtime require('os'). That works in a CommonJS build, but when the driver is bundled into ESM output (e.g. a Vite/esbuild/rollup server build with "type": "module"), there is no require in module scope, so constructing a client threw ReferenceError: require is not defined. The driver now load...

Description has been truncated

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.