chore(deps-dev): bump the development-dependencies group across 1 directory with 7 updates by dependabot[bot] · Pull Request #790 · NodeSecure/cli

dependabot · 2026-07-27T05:54:27Z

Bumps the development-dependencies group with 7 updates in the / directory:

Package	From	To
@changesets/cli	`2.31.0`	`2.31.1`
c8	`11.0.0`	`12.0.0`
eslint-plugin-jsdoc	`63.0.12`	`63.2.0`
typescript	`6.0.3`	`7.0.2`
vite	`8.1.4`	`8.1.5`
stylelint	`17.14.0`	`17.14.1`
undici	`8.0.2`	`8.8.0`

Updates @changesets/cli from 2.31.0 to 2.31.1

Release notes

Sourced from @changesets/cli's releases.

@changesets/cli@2.31.1

Patch Changes

#2159 15cf592 Thanks @ingvaldlorentzen! - Fixed already-published version detection with npm 12, which always wraps successful npm info --json output in an array. The unwrapped output made changeset publish treat every package as unpublished and fail attempting to republish existing versions.

Commits

a897bb8 Use a different publish tag for maintenance/v2 branch (#2162)
e8650b9 Version Packages (#2161)
15cf592 Fixed handling of the npm 12 info output (#2159)
9f2cb2a Configure Changesets for maintenance/v2 line (#2076)
97247cb Change allowed publish pattern to maintenance/v* given rulesets behavior (#...
13286a8 Build(deps): Bump the github-actions group across 1 directory with 3 updates ...
8f6acd6 Update dependabot group to exclude major (#2067)
c70c675 Setup backport workflow and sync next setup (#2057)
9672019 Remove SECURITY.md to defer to .github (#2055)
18e1661 Use internal bot for versioning (#2039)
Additional commits viewable in compare view

Updates c8 from 11.0.0 to 12.0.0

Release notes

Sourced from c8's releases.

v12.0.0

12.0.0 (2026-07-14)

⚠ BREAKING CHANGES

yargs enforces a stricter range of Node versions ^20.19.0 || ^22.12.0 || >=23

Features

update yargs to 18.x.x (#599) (dc2d6c8)

Changelog

Sourced from c8's changelog.

12.0.0 (2026-07-14)

⚠ BREAKING CHANGES

yargs enforces a stricter range of Node versions ^20.19.0 || ^22.12.0 || >=23

Features

update yargs to 18.x.x (#599) (dc2d6c8)

Commits

ae5a0cf chore(main): release 12.0.0 (#600)
dc2d6c8 feat!: update yargs to 18.x.x (#599)
ee2f1cf chore(deps): update dependency @types/node to v24 (#579)
923c238 build: go back to publishing manually
See full diff in compare view

Updates eslint-plugin-jsdoc from 63.0.12 to 63.2.0

Release notes

Sourced from eslint-plugin-jsdoc's releases.

v63.2.0

63.2.0 (2026-07-19)

Features

normalize-see-links: add wrapBareUrls option (#1726) (77a7b1a)

v63.1.0

63.1.0 (2026-07-18)

Features

add normalize-see-links rule (#1725) (c03dd66)

v63.0.14

63.0.14 (2026-07-17)

Bug Fixes

escape-inline-tags: ignore Markdown code spans (786d12d)

v63.0.13

63.0.13 (2026-07-10)

Bug Fixes

failing pages build and deployment (3728347)

Commits

77a7b1a feat(normalize-see-links): add wrapBareUrls option (#1726)
c03dd66 feat: add normalize-see-links rule (#1725)
786d12d fix(escape-inline-tags): ignore Markdown code spans
3728347 fix: failing pages build and deployment
See full diff in compare view

Updates typescript from 6.0.3 to 7.0.2

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Updates vite from 8.1.4 to 8.1.5

Release notes

Sourced from vite's releases.

v8.1.5

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.1.5 (2026-07-16)

Bug Fixes

bundled-dev: avoid duplicated buildEnd (#22931) (8100320)

client: overlay error message format align rolldown (#22869) (5a72b87)

deps: update all non-major dependencies (#22921) (fef682d)

deps: update rolldown-related dependencies (#22922) (3c345e4)

module-runner: don't crash stack-trace source mapping when globalThis.Buffer is absent (#22945) (f8b38e3)

optimizer: respect importer module format for dynamic import interop with CJS deps (#22951) (6c08c39)

ssr: scope switch-case declarations to the switch, not the function (#22893) (b59a73f)

Documentation

build: fix incorrect @default for build.cssMinify (#22948) (c88c236)

build: fix incorrect @default for build.lib.formats (#22911) (369ed60)

Tests

avoid scanner scanning all files under __tests__ (#22912) (c961cae)

Commits

5e7fe12 release: v8.1.5
6c08c39 fix(optimizer): respect importer module format for dynamic import interop wit...
5a72b87 fix(client): overlay error message format align rolldown (#22869)
f8b38e3 fix(module-runner): don't crash stack-trace source mapping when globalThis.Bu...
8100320 fix(bundled-dev): avoid duplicated buildEnd (#22931)
c88c236 docs(build): fix incorrect @default for build.cssMinify (#22948)
b59a73f fix(ssr): scope switch-case declarations to the switch, not the function (#22...
fef682d fix(deps): update all non-major dependencies (#22921)
3c345e4 fix(deps): update rolldown-related dependencies (#22922)
369ed60 docs(build): fix incorrect @default for build.lib.formats (#22911)
Additional commits viewable in compare view

Updates stylelint from 17.14.0 to 17.14.1

Release notes

Sourced from stylelint's releases.

17.14.1

It fixes 4 bugs.

Fixed: quiet option suppresses report* warning reports (#9387) (@ychampion).

Fixed: reported range of unknown rules (#9385) (@ybiquitous).

Fixed: declaration-block-no-redundant-longhand-properties autofix producing invalid background shorthand when background-size is present (#9364) (@sarathfrancis90).

Fixed: rule-empty-line-before false positives for shared-line comments with except: ["after-single-line-comment"] (#9394) (@sarathfrancis90).

Changelog

Sourced from stylelint's changelog.

17.14.1 - 2026-07-20

It fixes 4 bugs.

Fixed: quiet option suppresses report* warning reports (#9387) (@ychampion).

Fixed: reported range of unknown rules (#9385) (@ybiquitous).

Fixed: declaration-block-no-redundant-longhand-properties autofix producing invalid background shorthand when background-size is present (#9364) (@sarathfrancis90).

Fixed: rule-empty-line-before false positives for shared-line comments with except: ["after-single-line-comment"] (#9394) (@sarathfrancis90).

Commits

cd66b03 Release 17.14.1 (#9397)
7c30fc5 Refactor to replace void with undefined in union types (#9395)
57c8d0e Fix rule-empty-line-before false positives for shared-line comments with `e...
226f10a Bump @vscode/windows-process-tree from 0.7.0 to 0.8.0 (#9392)
13c3c5c Bump globby from 16.2.0 to 16.2.1 (#9393)
6dafcf5 Document unknown-effort contributions (#9391)
54c2bc8 Fix test for Yarn PnP with npm v12 (#9390)
3e7eb56 Fix declaration-block-no-redundant-longhand-properties invalid background...
438196e Bump postcss from 8.5.15 to 8.5.16 in the postcss group across 1 directory (#...
c1e1489 Fix quiet option to suppress report* warning reports (#9387)
Additional commits viewable in compare view

Updates undici from 8.0.2 to 8.8.0

Release notes

Sourced from undici's releases.

v8.8.0

What's Changed

fetch: use ReadableStreamTee for cloning streams by @KhafraDev in nodejs/undici#5517

fix(benchmarks): adjust got after v15 upgrade by @slagiewka in nodejs/undici#5526

feat(mock): support asynchronous reply options callbacks by @Develop-KIM in nodejs/undici#5534

docs: clarify proxy threat model by @mcollina in nodejs/undici#5530

docs: clarify MockAgent pool usage by @vibhor-aggr in nodejs/undici#5542

docs: clarify parser timeout precision by @vibhor-aggr in nodejs/undici#5543

fix: handle flat alternating header arrays in cache normalizeHeaders by @mcollina in nodejs/undici#5536

chore(benchmarks): require(esm) on ESM-only packages by @slagiewka in nodejs/undici#5527

fix: run idle socket validation off setImmediate instead of setTimeout by @carlotestor in nodejs/undici#5499

docs: add custom interceptor example by @vibhor-aggr in nodejs/undici#5548

fix(h1): ignore type of service errors by @mcollina in nodejs/undici#5547

fix(fetch): convert null init in Response.json by @Ram-blip in nodejs/undici#5540

fix(redirect): remove body headers after POST-to-GET by @Ram-blip in nodejs/undici#5551

build(deps-dev): bump fast-check from 4.8.0 to 4.9.0 by @dependabot[bot] in nodejs/undici#5556

fix(h2): allow stream-bodied requests to multiplex on a busy session by @GiHoon1123 in nodejs/undici#5538

fix(h2): destroy aborted stream synchronously instead of via setImmediate by @staylor in nodejs/undici#5559

fix(decompress): skip HEAD responses by @Ram-blip in nodejs/undici#5564

ci: build undici with node.js v26 by @shivarm in nodejs/undici#5237

docs: clarify top-level request option url fields by @vibhor-aggr in nodejs/undici#5545

test: add unexpected disconnect guards to http2 tests by @Develop-KIM in nodejs/undici#5533

fix: track origins by client map key in Agent teardown by @emmayusufu in nodejs/undici#5537

fix: enforce must-revalidate and proxy-revalidate over max-stale and stale-if-error by @jeswr in nodejs/undici#5511

fix(retry): handle Retry-After zero delay by @Ram-blip in nodejs/undici#5519

fix: honor stale-if-error on connection errors during revalidation by @jeswr in nodejs/undici#5513

fix: store revalidation-only responses so etag revalidation can engage by @jeswr in nodejs/undici#5515

fix(h2): prevent uncaughtException from onHttp2SocketError accessing undefined kClient by @mcollina in nodejs/undici#5546

fix(h2): complete request stream on 'end' instead of waiting for 'close' by @staylor in nodejs/undici#5560

fix: invalidate Location and Content-Location URIs on unsafe methods by @jeswr in nodejs/undici#5514

test: deflake invalid websocket close status test by @mcollina in nodejs/undici#5550

refactor: replace tspl with node:test t.plan in connect-timeout tests by @mcollina in nodejs/undici#5518

fix(h2): release completed requests from queue by @staylor in nodejs/undici#5569

New Contributors

@Develop-KIM made their first contribution in nodejs/undici#5534

@carlotestor made their first contribution in nodejs/undici#5499

@GiHoon1123 made their first contribution in nodejs/undici#5538

@emmayusufu made their first contribution in nodejs/undici#5537

Full Changelog: nodejs/undici@v8.7.0...v8.8.0

v8.7.0

What's Changed

test: guard balanced-pool error port lookup by @mcollina in nodejs/undici#5463

perf: optimize http/2 request hot path by @mcollina in nodejs/undici#5483

fix: do not reject open-ended Range values in simpleRangeHeaderValue by @spokodev in nodejs/undici#5490

fix(eventsource): set use-URL-credentials flag by @Ram-blip in nodejs/undici#5489

test: deflake connect-timeout watchdog by @mcollina in nodejs/undici#5197

docs: correct npm script name and JSON syntax in examples by @lenoxfernando in nodejs/undici#5496

... (truncated)

Commits

1760faa Bumped v8.8.0 (#5575)
f87273e fix(h2): release completed requests from queue (#5569)
1383989 refactor: replace tspl with node:test t.plan in connect-timeout tests (#5518)
c6d37d2 test: deflake invalid websocket close status test (#5550)
1ca0912 fix: invalidate Location and Content-Location URIs on unsafe methods (#5514)
87270e4 fix(h2): complete request stream on 'end' instead of waiting for 'close' (#5560)
85b35e7 fix(h2): prevent uncaughtException from onHttp2SocketError accessing undefine...
de01bab fix: store revalidation-only responses so etag revalidation can engage (#5515)
e1cc0d4 fix: honor stale-if-error on connection errors during revalidation (#5513)
dc7c044 fix(retry): handle Retry-After zero delay (#5519)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…ectory with 7 updates Bumps the development-dependencies group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@changesets/cli](https://github.com/changesets/changesets) | `2.31.0` | `2.31.1` | | [c8](https://github.com/bcoe/c8) | `11.0.0` | `12.0.0` | | [eslint-plugin-jsdoc](https://github.com/gajus/eslint-plugin-jsdoc) | `63.0.12` | `63.2.0` | | [typescript](https://github.com/microsoft/TypeScript) | `6.0.3` | `7.0.2` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.1.4` | `8.1.5` | | [stylelint](https://github.com/stylelint/stylelint) | `17.14.0` | `17.14.1` | | [undici](https://github.com/nodejs/undici) | `8.0.2` | `8.8.0` | Updates `@changesets/cli` from 2.31.0 to 2.31.1 - [Release notes](https://github.com/changesets/changesets/releases) - [Commits](https://github.com/changesets/changesets/compare/@changesets/cli@2.31.0...@changesets/cli@2.31.1) Updates `c8` from 11.0.0 to 12.0.0 - [Release notes](https://github.com/bcoe/c8/releases) - [Changelog](https://github.com/bcoe/c8/blob/main/CHANGELOG.md) - [Commits](bcoe/c8@v11.0.0...v12.0.0) Updates `eslint-plugin-jsdoc` from 63.0.12 to 63.2.0 - [Release notes](https://github.com/gajus/eslint-plugin-jsdoc/releases) - [Commits](gajus/eslint-plugin-jsdoc@v63.0.12...v63.2.0) Updates `typescript` from 6.0.3 to 7.0.2 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](https://github.com/microsoft/TypeScript/commits) Updates `vite` from 8.1.4 to 8.1.5 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.1.5/packages/vite) Updates `stylelint` from 17.14.0 to 17.14.1 - [Release notes](https://github.com/stylelint/stylelint/releases) - [Changelog](https://github.com/stylelint/stylelint/blob/main/CHANGELOG.md) - [Commits](stylelint/stylelint@17.14.0...17.14.1) Updates `undici` from 8.0.2 to 8.8.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v8.0.2...v8.8.0) --- updated-dependencies: - dependency-name: "@changesets/cli" dependency-version: 2.31.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: c8 dependency-version: 12.0.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: development-dependencies - dependency-name: eslint-plugin-jsdoc dependency-version: 63.2.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: development-dependencies - dependency-name: vite dependency-version: 8.1.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: stylelint dependency-version: 17.14.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: undici dependency-version: 8.8.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

changeset-bot · 2026-07-27T05:54:31Z

⚠️ No Changeset found

Latest commit: b8c2fb7

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

socket-security · 2026-07-27T05:55:08Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance
npm/vite@8.1.4 ⏵ 8.1.5			⁺¹
npm/undici@8.0.2 ⏵ 8.8.0	^-10	⁺⁴⁰	⁺¹
npm/eslint-plugin-jsdoc@63.0.12 ⏵ 63.2.0				⁺¹
npm/typescript@7.0.2
npm/c8@11.0.0 ⏵ 12.0.0				⁺⁷
npm/@changesets/cli@2.31.0 ⏵ 2.31.1	⁺¹			⁺¹
npm/stylelint@17.14.0 ⏵ 17.14.1	⁺¹

View full report

socket-security · 2026-07-27T05:55:09Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `eslint-plugin-jsdoc` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package.json → `npm/eslint-plugin-jsdoc@63.2.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/eslint-plugin-jsdoc@63.2.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 27, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps-dev): bump the development-dependencies group across 1 directory with 7 updates - #790

chore(deps-dev): bump the development-dependencies group across 1 directory with 7 updates#790
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/development-dependencies-a4d162cb5d

dependabot Bot commented on behalf of github Jul 27, 2026

Uh oh!

changeset-bot Bot commented Jul 27, 2026

Uh oh!

socket-security Bot commented Jul 27, 2026

Uh oh!

socket-security Bot commented Jul 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 27, 2026

@​changesets/cli@​2.31.1

Patch Changes

v12.0.0

12.0.0 (2026-07-14)

⚠ BREAKING CHANGES

Features

12.0.0 (2026-07-14)

⚠ BREAKING CHANGES

Features

v63.2.0

63.2.0 (2026-07-19)

Features

v63.1.0

63.1.0 (2026-07-18)

Features

v63.0.14

63.0.14 (2026-07-17)

Bug Fixes

v63.0.13

63.0.13 (2026-07-10)

Bug Fixes

v8.1.5

8.1.5 (2026-07-16)

Bug Fixes

Documentation

Tests

17.14.1

17.14.1 - 2026-07-20

v8.8.0

What's Changed

New Contributors

v8.7.0

What's Changed

Uh oh!

changeset-bot Bot commented Jul 27, 2026

⚠️ No Changeset found

Uh oh!

socket-security Bot commented Jul 27, 2026

Uh oh!

socket-security Bot commented Jul 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`@changesets/cli@2`.31.1