ci(deps): bump the benchmark-npm group across 1 directory with 6 updates

[dependabot]

Bumps the benchmark-npm group with 6 updates in the /benchmark-tool/artillery-test directory:

Package	From	To
@eclipse-ditto/ditto-javascript-client-node	3.9.0-M1.1	3.9.1
artillery	2.0.30	2.0.34
defu	6.1.5	6.1.7
yaml	2.8.3	2.9.1
@types/node	20.19.33	26.5.1
typescript	5.9.3	7.0.2

Updates @eclipse-ditto/ditto-javascript-client-node from 3.9.0-M1.1 to 3.9.1

Release notes

Sourced from @​eclipse-ditto/ditto-javascript-client-node's releases.

3.9.1 (JS Client)

Security fix for CVE-2026-84197

Changelog: https://github.com/eclipse-ditto/ditto-clients/blob/release-js-3.9/javascript/CHANGELOG.md

Full Changelog: eclipse-ditto/ditto-clients@3.9.0...js_3.9.1

Commits

• See full diff in compare view

Updates artillery from 2.0.30 to 2.0.34

Release notes

Sourced from artillery's releases.

Artillery v2.0.34

New features

Core & CLI

• Add artillery ping command for quick testing of HTTP endpoints. Sends a request to a URL and shows a performance breakdown (DNS/TCP/TLS/TTFB/download timings) and response headers. Supports expectations via --expect, JMESPath and Cheerio queries on the response body, custom headers, basic auth, JSON/form request bodies, and HTTP/2 (default) or HTTP/1.1
• Full support for ESM: in processors, plugins, engines and custom reporters, including modules that use top-level await
• TypeScript type definitions shipped with the artillery package now model the full test script: all arrival phase kinds, scenarios for every built-in engine, capture/match, built-in plugin configs, and processor hook contracts.

AWS Lambda & Fargate

• Add --aws-tags flag to apply custom tags to AWS resources created for a test run (Fargate tasks, Lambda functions, SQS queues). Example: --aws-tags "team:perf,cost-center:1234"

Playwright

• Upgrade to Playwright v1.62.1

Fixes & improvements

Core & CLI

• Fix issue where tests using relative imports (e.g. import x from './helpers.js') in processor code could fail to run
• Fix issue where metric renaming via $rewriteMetricName was silently ignored when the processor file was an ES module

AWS Lambda & Fargate

• The fake-data plugin is now bundled with the worker image. Previously workers downloaded it from the npm registry at test startup

Docker

• Scripts mounted into the official Docker image can now import dependencies bundled with Artillery, such as Playwright

Other changes

• Various dependency upgrades to address security advisories
• npm releases are now published via npm trusted publishing (OIDC) with provenance attestations

Artillery v2.0.33

What's changed

• Upgrade to Playwright v1.61.0 (#3746)
• Replace Falso with Faker.js in fake-data plugin (#3745)

Artillery v2.0.32

What's Changed

New features

Playwright

... (truncated)

Commits

• 5bcfa94 ci: release v2.0.34 of artillery (#3771)
• 117f9bc chore: revert v2.0.34 version bump
• dd425ad fix(ci): release commits have to start with 'ci: release'
• e7c54c0 fix(ci): skip Playwright lib smoke test on arm64 images
• 8e4368d ci: release v2.0.34 of artillery (#3770)
• cc50474 Merge pull request #3769 from artilleryio/fix/stash-cloud-timeouts
• 8526626 fix: fetch stash details once in main process, not per worker
• 2bd1326 fix: gate stash client on cloud reporting being enabled
• 1d15f96 fix: bound connect-phase timeouts in cloud HTTP client
• d993877 dep: upgrade deps to fix npm audit CVEs (#3768)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for artillery since your current version.

Updates defu from 6.1.5 to 6.1.7

Release notes

Sourced from defu's releases.

v6.1.7

compare changes

📦 Build

• Correct the types export entry (#160)
• Export Defu types (#157)

❤️ Contributors

• Jakub Michálek (@​J-Michalek)
• Kricsleo (@​kricsleo)

v6.1.6

compare changes

📦 Build

• Fix mixed types (407b516)

Changelog

Sourced from defu's changelog.

v6.1.7

compare changes

🩹 Fixes

• defu.d.cts: Export Defu types (#157)

📦 Build

• Correct the types export entry (#160)

❤️ Contributors

• Jakub Michálek (@​J-Michalek)
• Kricsleo (@​kricsleo)

v6.1.6

compare changes

📦 Build

• Fix mixed types (407b516)

❤️ Contributors

• Pooya Parsa (@​pi0)

Commits

• 80c0146 chore(release): v6.1.7
• 40d7ef4 fix(defu.d.cts): export Defu types (#157)
• 3d3a7c8 build: correct the types export entry (#160)
• 001c290 chore(release): v6.1.6
• 407b516 build: fix mixed types
• See full diff in compare view

Updates yaml from 2.8.3 to 2.9.1

Release notes

Sourced from yaml's releases.

v2.9.1

• Limit recursive merge aliases (#685, #713)
• Simplify line unfolding during quoted string parsing (#714)

v2.9.0

The changes here are really only patches, but I'm releasing this as a minor version to note a small change to the documentation of parseDocument() and parseAllDocuments(): I've removed the claim that they'll "never throw".

It remains the case that practically all non-malicious inputs will be handled without emitting an error, but there is a decent chance that code paths remain where e.g. a RangeError due to call stack exhaustion can be triggered by malicious inputs. Up to now, I've considered these as security vulnerabilities, and in fact it's the only category of error for which yaml CVEs have been issued so far.

Starting from this release, I'll be considering such errors as bugs, but not vulnerabilities. I do welcome people and/or LLMs looking for them, but please report them as normal issues rather than suspected security vulnerabilities. This also applies to previously undiscovered bugs in earlier releases.

• fix: Avoid calling Array.prototype.push.apply() with large source array
• fix(lexer): Avoid recursive calls that may exhaust the call stack

v2.8.4

• Disable alias resolution with maxAliasCount:0 (#677)
• Handle invalid unicode escapes (e1a1a77)
• Apply minFractionDigits only to decimal strings (#676)

Commits

• 1440ecd 2.9.1
• c699bc5 fix: Simplify line unfolding during quoted string parsing (#714)
• d11ce77 fix: Limit recursive merge aliases (#713)
• c5f49f4 chore: Update docs-slate
• ddb21b0 2.9.0
• 167365b docs: Clarify that not all errors can be avoided
• 6eca2a7 fix: Avoid calling Array.prototype.push.apply() with large source array
• 0543cd5 fix(lexer): Avoid recursive calls that may exhaust the call stack
• ccdf743 2.8.4
• f625789 fix: Disable alias resolution with maxAliasCount:0 (#677)
• Additional commits viewable in compare view

Updates @types/node from 20.19.33 to 26.5.1

Commits

• See full diff in compare view

Updates typescript from 5.9.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

TypeScript 6.0.3

For release notes, check out the release announcement blog post.

• fixed issues query for TypeScript 6.0.0 (Beta).
• fixed issues query for TypeScript 6.0.1 (RC).
• fixed issues query for TypeScript 6.0.2 (Stable).
• fixed issues query for TypeScript 6.0.3 (Stable).

Downloads are available on:

• npm

TypeScript 6.0

For release notes, check out the release announcement blog post.

• fixed issues query for TypeScript 6.0.0 (Beta).
• fixed issues query for TypeScript 6.0.1 (RC).
• fixed issues query for TypeScript 6.0.2 (Stable).

Downloads are available on:

• npm

TypeScript 6.0.1 RC

For release notes, check out the release announcement blog post.

• fixed issues query for TypeScript 6.0.0 (Beta).
• fixed issues query for TypeScript 6.0.1 (RC).

Downloads are available on:

• npm

TypeScript 6.0 Beta

For release notes, check out the release announcement.

• fixed issues query for Typescript 6.0.0 (Beta).

Downloads are available on:

• npm

Commits

• 1e4744d Merge branch 'main' into ts7-release
• a5a219cmicrosoft/typescript-go#4558
• ecfe30d Update status localization
• 5de25b5 Hide executable name in TypeScript status
• d7ce74a Show bundled TypeScript version for packaged servers
• 29be66a Correct TS 7 release version to 7.0.2
• ed2bd1b Merge branch 'main' into ts7-release
• 8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
• 9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
• d4eaca5microsoft/typescript-go#4549
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.