Repository navigation
build(deps-dev): bump the dev group with 6 updates - #307
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the dev group with 6 updates: | Package | From | To | | --- | --- | --- | | [lefthook](https://github.com/evilmartians/lefthook) | `2.2.1` | `2.2.2` | | [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.87.0` | `1.88.0` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.4` | `5.0.5` | | [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `0.133.0` | `0.135.0` | | [gpt-tokenizer](https://github.com/niieani/gpt-tokenizer) | `4.0.0` | `4.1.0` | | [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.149.0` | `4.151.1` | Updates `lefthook` from 2.2.1 to 2.2.2 - [Release notes](https://github.com/evilmartians/lefthook/releases) - [Changelog](https://github.com/evilmartians/lefthook/blob/master/CHANGELOG.md) - [Commits](evilmartians/lefthook@v2.2.1...v2.2.2) Updates `oxlint` from 1.87.0 to 1.88.0 - [Release notes](https://github.com/oxc-project/oxc/releases) - [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md) - [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.88.0/npm/oxlint) Updates `vitest` from 5.0.4 to 5.0.5 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/vitest) Updates `@anthropic-ai/sdk` from 0.133.0 to 0.135.0 - [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases) - [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md) - [Commits](anthropics/anthropic-sdk-typescript@sdk-v0.133.0...sdk-v0.135.0) Updates `gpt-tokenizer` from 4.0.0 to 4.1.0 - [Release notes](https://github.com/niieani/gpt-tokenizer/releases) - [Commits](niieani/gpt-tokenizer@4.0.0...4.1.0) Updates `wrangler` from 4.149.0 to 4.151.1 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.151.1/packages/wrangler) --- updated-dependencies: - dependency-name: lefthook dependency-version: 2.2.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev - dependency-name: oxlint dependency-version: 1.88.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev - dependency-name: vitest dependency-version: 5.0.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev - dependency-name: "@anthropic-ai/sdk" dependency-version: 0.135.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev - dependency-name: gpt-tokenizer dependency-version: 4.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev - dependency-name: wrangler dependency-version: 4.151.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
This was referenced Oct 24, 2026
solomonjames
added a commit
that referenced
this pull request
Oct 24, 2026
…telemetry-api (#309) (#310) Closes #309 ## Summary Clears the OSV-Scanner findings that fail `osv-scanner / osv-scan` on both open Dependabot PRs (#307, #308), and that would fail it on `main` at its next run. All the advisories were published 2026-10-20 to 2026-10-23. Lockfiles, one override pin, and a raised `fastmcp` floor for `yea-mcp`. No other range changes, and no scanner ignores. ```diff yea-site > vitepress (override vite ^6.4.3), vitest - vite 6.4.3 # 5 advisories (launch-editor command exec / fs.allow bypass), High + vite 6.4.5 # npm update vite yea-demo-worker > wrangler > miniflare (pins undici 7.29.1 exactly) - overrides.undici "7.29.1" # GHSA-xjj6-f33q-929c (High), GHSA-4qv8-2p9j-2685, GHSA-f72v-6w45-q472 + overrides.undici "7.30.1" python/mcp (fastmcp>=4.0.10,<5 extra) - fastmcp, fastmcp-slim 4.0.10 # GHSA-7xgj-8392-5q4r, GHSA-vqqp-x5qm-5qp4 + fastmcp, fastmcp-slim 4.1.3 - opentelemetry-api 1.45.0 # GHSA-xcq7-p3pf-p88h + opentelemetry-api 1.45.1 ``` - **vite**: npm resolves 6.4.5 (2026-10-21), one patch past the 6.4.4 fix. It was published from vite's GitHub Actions with provenance. - **undici**: miniflare still pins 7.29.1 exactly, so the override from #185 moves to 7.30.1 (2026-10-15, published with provenance). - **python/mcp/uv.lock**: `uv lock --upgrade-package fastmcp --upgrade-package fastmcp-slim --upgrade-package opentelemetry-api`. fastmcp 4.1.3 also pulls in `certifi` and `openapi-pydantic` 0.5.1 → 0.6.0, and on Python 3.15 only, `beartype` 0.23.1 (hence the new `>= '3.15'` resolution marker). - **fastmcp floor**: `yea-mcp[fastmcp]` (and the dev group) now require `fastmcp>=4.1.2,<5`, the first release with both fixes, so an install can't resolve a vulnerable version. `docs/framework/SPEC-mcp-py.md` states the new floor. Its line recording the versions the SDK facts were checked against (`fastmcp` 4.0.10) stays, because that records history. I wrote the npm lockfile with npm 11.21.1, so the diff holds only the vite and undici entries. ## Evidence - **Before** (`origin/main`, `osv-scanner scan source -r .`, v2.7.0): 13 vulnerabilities in 5 packages (vite ×5, undici ×3, fastmcp ×2, fastmcp-slim ×2, opentelemetry-api ×1). **After** (this branch, same command): ``` No issues found ``` - `npm ls vite` shows only vite@6.4.5. Checks run locally after a fresh `npm ci` from the new lockfile, which left the lockfile unchanged: `npm run lint`, `npm run lint:style`, `npm run lint:structure`, `npm run build`, `npm test` (all pass; 5 skipped by existing `skipIf` guards), `npm run site` (builds), `wrangler deploy --dry-run` for `deploy/demo` (bundles), `uv run pytest` in `python/` (883 passed) and `uv run --all-extras pytest` in `python/mcp` (165 passed, run again after the floor change). ## Merge danger **Door:** two-way Reverting restores the old lockfiles and pin. Nothing on the wire, in Lens output or in a published package's API changes. The one published-metadata change is `yea-mcp[fastmcp]`'s `fastmcp` floor (4.0.10 → 4.1.2). That's a tighter dependency range, not an API change, and yea-mcp has no users yet. **Blast radius:** dev tooling and CI only. That covers the site build and vitest (vite), `wrangler dev`/`deploy` for `deploy/demo` (undici under miniflare), and the `python/mcp` test environment (fastmcp). The TS SDK keeps zero runtime dependencies. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Collaborator
|
@dependabot rebase |
Contributor
Author
|
Looks like these dependencies are updatable in another way, so this is no longer needed. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the dev group with 6 updates:
2.2.12.2.21.87.01.88.05.0.45.0.50.133.00.135.04.0.04.1.04.149.04.151.1Updates
lefthookfrom 2.2.1 to 2.2.2Release notes
Sourced from lefthook's releases.
Changelog
Sourced from lefthook's changelog.
Commits
eb4e5042.2.2: keep backups for worktree flows and release android NPM package4aeffd7fix: cleanup only current stash hash (#1597)e3fa81brefactor(filter): simplify mimetype matching (#1596)db62412packaging: add support for android (#1591)Attestation changes
This version has no provenance attestation, while the previous version (2.2.1) was attested. Review the package versions before updating.
Updates
oxlintfrom 1.87.0 to 1.88.0Release notes
Sourced from oxlint's releases.
Changelog
Sourced from oxlint's changelog.
... (truncated)
Commits
6941b4erelease(apps): oxlint v1.88.0 && oxfmt v0.73.0 (#27643)3c361a7feat(linter/unicorn/prefer-query-selector): addallowWithVariablesoption (...Updates
vitestfrom 5.0.4 to 5.0.5Release notes
Sourced from vitest's releases.
Commits
7a825dbchore: release v5.0.5 (#11609)6621a72fix: abort all running tests on cancel (#11606)e9c3d72fix: release mocks of finished test files (#11607)8dd67c2fix(browser): run global setup once with instances (#11596)6c5a447fix: run hook cleanups when a later hook fails (#11605)9697b38fix: keep the import frame in native loader errors (#11599)6498b66fix(browser): wait 30s for the browser to close (#11601)f161e6dfix(browser): drop late connections of closed sessions (#11600)fe86a64fix: skip builtin loading in async leak detector (#11598)6ae8e89fix(reporter): end reason'failed'on worker crash (#11568)Updates
@anthropic-ai/sdkfrom 0.133.0 to 0.135.0Release notes
Sourced from @anthropic-ai/sdk's releases.
... (truncated)
Changelog
Sourced from @anthropic-ai/sdk's changelog.
... (truncated)
Commits
04a4c28release: 0.135.069dbe62Merge pull request #935 from anthropics/synced/publishedb61a531feat(helpers): retry a rate-limited fast fallback at standard speed (#943)38d0ab4feat(api): add between_tools to thinking types in model capabilities366b53bchore(docs): describe headers on Managed Agents and telemetry endpointsca50812docs(api): note that some models need a beta header to use speed03f6012fix(helpers): honor speed overrides from fallback entries when streaming (#942)88bf034docs(changelog): shorten the OpenTelemetry tracing note (#941)7c807a0fix(client): close streams dropped without being read to the end64758f6feat(api): add the speed parameter and usage.speed to MessagesUpdates
gpt-tokenizerfrom 4.0.0 to 4.1.0Release notes
Sourced from gpt-tokenizer's releases.
Commits
19b369dfeat: add a tokenizer-integrated incremental token counter78ab31adocs: restore scoped pure-JS speed and memory claims340cfc1docs: rank benchmark panels and clarify initialization winsc219fe8test: preserve single-read decode semantics and record rejected experiments6cf6be4bench: archive rejected Node-only Record experiment with anonymous metadata5b31c49bench: reject short string decoder with accessor evidence825a6d3bench: preserve rejected short array decoder experiment8dc68fcbench: archive rejected ASCII regex and unconditional record experimentsb631cfddocs: compare all benchmark contenders and emphasize package adoptionbb3b244chore: collapse generated measurement evidence in PR diffsUpdates
wranglerfrom 4.149.0 to 4.151.1Release notes
Sourced from wrangler's releases.
... (truncated)
Commits
e7f9e4eVersion Packages (#16287)4a5377f[wrangler] Hide unusable dev hotkeys under Turborepo (#13742)42c6912[wrangler] Don't report rollback success after declining changed secrets conf...e13d5cc[remote-bindings] Retry proactive preview token refresh after a transient fai...b81efbcVersion Packages (#16241)d6b1c82Generate source maps by default for Vite plugin Workers and Build Output (#16...fb3d9c8Version Packages (#16162)091e5ec[wrangler] Upload source maps by default (#16231)ea64ec4[wrangler] Preserve D1 migration paths during redirected provisioning (#15517)d232454[wrangler] Preserve public HTTPS response URLs behind TLS-terminating proxies...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions