Skip to content

deps(deps): bump the production-dependencies group across 1 directory with 7 updates - #14

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-5e555fcdd1
Open

deps(deps): bump the production-dependencies group across 1 directory with 7 updates#14
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-5e555fcdd1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 5, 2026

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 4 updates in the / directory: semver, @octokit/core, json-with-bigint and undici.

Updates semver from 7.8.4 to 7.8.5

Release notes

Sourced from semver's releases.

v7.8.5

7.8.5 (2026-06-19)

Bug Fixes

Changelog

Sourced from semver's changelog.

7.8.5 (2026-06-19)

Bug Fixes

Commits
  • 6e05b76 chore: release 7.8.5 (#879)
  • 9c8692a fix: include prereleases in tilde range lower bound with includePrerelease (#...
  • See full diff in compare view

Updates @octokit/core from 7.0.6 to 7.0.7

Release notes

Sourced from @​octokit/core's releases.

v7.0.7

7.0.7 (2026-08-01)

Bug Fixes

  • deps: update dependency @​octokit/types to v17 (#797) (087a093)
Commits
  • 087a093 fix(deps): update dependency @​octokit/types to v17 (#797)
  • e8c8789 ci(action): update actions/create-github-app-token action to v3 (#770)
  • a648383 chore(deps): bump postcss from 8.5.15 to 8.5.23 (#790)
  • 57516b7 chore(deps-dev): bump undici from 7.24.0 to 7.28.0 (#785)
  • c1d1bef chore(deps): bump picomatch from 4.0.3 to 4.0.4 (#772)
  • c60ac22 chore(deps): bump postcss from 8.5.3 to 8.5.15 (#778)
  • 8a9fb20 chore(deps): update dependency esbuild to ^0.28.0 [security] (#782)
  • 83550e2 chore(deps-dev): bump minimatch from 9.0.5 to 9.0.9 (#766)
  • dd8908c chore(deps): bump rollup from 4.41.0 to 4.59.0 (#765)
  • e265d99 chore(deps-dev): bump undici from 7.10.0 to 7.24.0 (#768)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​octokit/core since your current version.


Updates @octokit/graphql from 9.0.3 to 9.0.4

Release notes

Sourced from @​octokit/graphql's releases.

v9.0.4

9.0.4 (2026-08-01)

Bug Fixes

  • deps: update dependency @​octokit/types to v17 (#705) (245ee6e)
Commits
  • af94a01 chore(deps): update dependency prettier to v3.9.6 (#686)
  • 2b24525 build(deps): lock file maintenance (#704)
  • 245ee6e fix(deps): update dependency @​octokit/types to v17 (#705)
  • 9d55053 ci(action): update actions/add-to-project action to v2 (#695)
  • c92e5e3 ci(action): update actions/checkout action to v7 (#700)
  • 1d10b42 chore(deps): update dependency typescript to v7 (#701)
  • 25587cf ci(action): update actions/setup-node action to v7 (#702)
  • 9fef990 ci(action): update actions/create-github-app-token action to v3 (#688)
  • 5ef2ab4 build(deps): lock file maintenance (#699)
  • 7018c70 chore(deps): update dependency esbuild to ^0.28.0 [security] (#698)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​octokit/graphql since your current version.


Updates @octokit/request from 10.0.10 to 10.0.13

Release notes

Sourced from @​octokit/request's releases.

v10.0.13

10.0.13 (2026-08-01)

Bug Fixes

  • deps: update dependency @​octokit/types to v17 (#828) (e127cfe)

v10.0.12

10.0.12 (2026-08-01)

Bug Fixes

  • don't decode application/octet-stream as text when charset is utf-8 (#823) (facf3cb), closes #751

v10.0.11

10.0.11 (2026-06-29)

Bug Fixes

  • handle primitive JSON error bodies without throwing (#820) (554e102), closes #819
Commits
  • e127cfe fix(deps): update dependency @​octokit/types to v17 (#828)
  • deadf90 ci(action): update actions/setup-node action to v7 (#824)
  • facf3cb fix: don't decode application/octet-stream as text when charset is utf-8 (#823)
  • 554e102 fix: handle primitive JSON error bodies without throwing (#820)
  • 14cf144 build(deps-dev): bump undici from 7.24.0 to 7.28.0 (#813)
  • eccf620 chore(deps): update dependency esbuild to v0.28.1 [security] (#809)
  • See full diff in compare view

Updates @octokit/request-error from 7.1.0 to 7.1.1

Release notes

Sourced from @​octokit/request-error's releases.

v7.1.1

7.1.1 (2026-08-01)

Bug Fixes

  • deps: update dependency @​octokit/types to v17 (#569) (960f081)
Commits
  • 960f081 fix(deps): update dependency @​octokit/types to v17 (#569)
  • 2be455a chore(deps): update dependency esbuild to ^0.28.0 [security] (#562)
  • 4013f20 ci(action): update actions/checkout action to v7 (#564)
  • bf1a7eb build(deps): lock file maintenance (#563)
  • 81a8d78 build(deps): lock file maintenance (#549)
  • 78c94bb chore(deps): update dependency prettier to v3.7.4 (#547)
  • 1517a0d chore(deps): update dependency prettier to v3.7.1 (#546)
  • 786ec41 build(deps): lock file maintenance (#544)
  • 1f821c4 ci(action): update actions/checkout action to v6 (#543)
  • 297cd3e build(deps): lock file maintenance (#539)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​octokit/request-error since your current version.


Updates json-with-bigint from 3.5.8 to 3.5.10

Commits

Updates undici from 6.26.0 to 6.28.0

Release notes

Sourced from undici's releases.

v6.28.0

⚠️ Security fixes

  • GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 740a0b7c.
  • GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by cba3a52a, with corrected fixtures in 4fd5a0c6.
  • GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by af748404.

GHSA-4cwx-7wf7-3272 and GHSA-jr45-8vmc-qm54 affect the cache interceptor in Undici v7 and v8; Undici v6 is not in their affected version ranges.

Full Changelog: nodejs/undici@v6.27.0...v6.28.0

v6.27.0

⚠️ Security Release

This release line addresses 4 security advisories.

Action required: Upgrade to undici 6.27.0 or later.

npm install undici@^6.27.0

Note on patched version: the v6 fixes shipped in v6.27.0, not 6.26.0v6.26.0 contains only the chunked-EOF fix (#5308) and the version bump, none of the security fixes below.

The v6 line is not affected by the SOCKS5 advisories (GHSA-vmh5-mc38-953g, GHSA-hm92-r4w5-c3mj), the shared-cache disclosure (GHSA-pr7r-676h-xcf6), or the 8.x-only WebSocket regression (GHSA-38rv-x7px-6hhq).

Summary

Advisory CVE Severity (CVSS) Fixed in Fix commit
GHSA-vxpw-j846-p89q CVE-2026-12151 High (7.5) 6.27.0 b7f252e7
GHSA-p88m-4jfj-68fv CVE-2026-9679 Moderate (5.9) 6.27.0 25efa447
GHSA-g8m3-5g58-fq7m CVE-2026-11525 Low (3.7) 6.27.0 25efa447
GHSA-35p6-xmwp-9g52 CVE-2026-6733 Low (3.7) 6.27.0 f4c31d60

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770 Fix: b7f252e7 Backport WebSocket maxPayloadSize fixes (#5423, backported to v6 in #5428)

A malicious WebSocket server can stream a large number of small or empty continuation frames. Undici enforced a limit on cumulative payload size but did

... (truncated)

Commits
  • 01a912e Bumped v6.28.0 (#5591)
  • 481ecfc Use Node 22 and npm 11 to release
  • 740a0b7 fix: validate blob body content type
  • 2698e49 fix: validate coerced header values for CRLF (#5579)
  • 4fd5a0c test(retry): correct broken content-range fixtures in retry-handler.js
  • cba3a52 fix(retry): reject partial content length mismatch
  • af74840 fix: harden cookie domain, path, and unparsed attribute validation
  • 551138c Bumped v6.27.0 (#5431)
  • b7f252e Backport WebSocket maxPayloadSize fixes to v7.x (#5423) (#5428)
  • 25efa44 fix(cookies): preserve values and parse SameSite strictly
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

… with 7 updates

Bumps the production-dependencies group with 4 updates in the / directory: [semver](https://github.com/npm/node-semver), [@octokit/core](https://github.com/octokit/core.js), [json-with-bigint](https://github.com/Ivan-Korolenko/json-with-bigint) and [undici](https://github.com/nodejs/undici).


Updates `semver` from 7.8.4 to 7.8.5
- [Release notes](https://github.com/npm/node-semver/releases)
- [Changelog](https://github.com/npm/node-semver/blob/main/CHANGELOG.md)
- [Commits](npm/node-semver@v7.8.4...v7.8.5)

Updates `@octokit/core` from 7.0.6 to 7.0.7
- [Release notes](https://github.com/octokit/core.js/releases)
- [Commits](octokit/core.js@v7.0.6...v7.0.7)

Updates `@octokit/graphql` from 9.0.3 to 9.0.4
- [Release notes](https://github.com/octokit/graphql.js/releases)
- [Commits](octokit/graphql.js@v9.0.3...v9.0.4)

Updates `@octokit/request` from 10.0.10 to 10.0.13
- [Release notes](https://github.com/octokit/request.js/releases)
- [Commits](octokit/request.js@v10.0.10...v10.0.13)

Updates `@octokit/request-error` from 7.1.0 to 7.1.1
- [Release notes](https://github.com/octokit/request-error.js/releases)
- [Commits](octokit/request-error.js@v7.1.0...v7.1.1)

Updates `json-with-bigint` from 3.5.8 to 3.5.10
- [Commits](https://github.com/Ivan-Korolenko/json-with-bigint/commits)

Updates `undici` from 6.26.0 to 6.28.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.26.0...v6.28.0)

---
updated-dependencies:
- dependency-name: semver
  dependency-version: 7.8.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@octokit/core"
  dependency-version: 7.0.7
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@octokit/graphql"
  dependency-version: 9.0.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@octokit/request"
  dependency-version: 10.0.13
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@octokit/request-error"
  dependency-version: 7.1.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: json-with-bigint
  dependency-version: 3.5.10
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: undici
  dependency-version: 6.28.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Aug 5, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: npm. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@github-actions

github-actions Bot commented Aug 5, 2026

Copy link
Copy Markdown

🔮 Release Preview

What's Changed

🧹 Chores

Full Changelog: V1...preview

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants