Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 8 updates - #125

Closed
dependabot[bot] wants to merge 1 commit into
v4from
dependabot/npm_and_yarn/production-dependencies-5f4b85a9bf
Closed

chore(deps): bump the production-dependencies group across 1 directory with 8 updates#125
dependabot[bot] wants to merge 1 commit into
v4from
dependabot/npm_and_yarn/production-dependencies-5f4b85a9bf

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 8 updates in the / directory:

Package From To
chokidar 5.0.0 6.0.0
js-yaml 5.4.3 5.5.0
mdast-util-find-and-replace 3.0.3 3.0.4
preact 11.0.1 11.0.2
preact-render-to-string 6.8.0 6.8.1
satori 0.47.1 0.63.2
toml 5.0.0 5.0.1
unist-util-visit 5.1.0 5.2.0

Updates chokidar from 5.0.0 to 6.0.0

Release notes

Sourced from chokidar's releases.

6.0.0

High-level changes

  • Rewrote the watcher around a single observation pipeline. Backend callbacks are treated as invalidations and confirmed with lstat, stat, or readdir before any event is emitted, so the final state after a burst of changes matches the filesystem.
  • Added native recursive watching through fs.watch({ recursive: true }). The default auto backend uses it on macOS and Windows and per-directory watching elsewhere.
  • Shared native handles across watchers and opened them per directory only: files no longer own handles. This fixes EBADF errors when watching many files on macOS (#1385, #1452).
  • Replaced fs.watchFile with Chokidar-owned stat polling. Poll loops are shared across watchers at the fastest requested interval.
  • Required Node.js 22.22 or later.

API changes

  • Added the backend option: 'auto' (default), 'native', 'native-recursive', or 'polling'.
    • usePolling: true remains as a deprecated alias for backend: 'polling'.
  • Renamed interval and binaryInterval to pollingInterval and pollingBinaryInterval.
    • The old names remain as deprecated aliases; the new names win when both are given.
  • Changed the atomic default to false with polling. An explicit value is preserved.
  • Made close() terminal: add() now throws once closing has started. Construct a new watcher instead.
  • Validated options in the constructor: invalid backend, atomic, depth, awaitWriteFinish, and polling intervals throw TypeError.
  • Emitted errors from add() as error events instead of unhandled rejections (#1378).
  • Made getWatched() return a null-prototype object, so a watched directory named __proto__ is listed (#1493). Use Object.hasOwn() instead of hasOwnProperty() on the result.
  • Stopped applying ignored to directories above a path passed to watch() or add(), so a missing path is still watched through its parent (#1374). Other entries in those directories are still filtered.

Fixes

  • Fixed a 100% CPU loop when the process working directory containing a relatively watched file was deleted (#1474).
  • Fixed watching a filesystem root, which emitted unlink and unlinkDir for every entry (#1184, #452).
  • Fixed UNKNOWN errors from fs.watch on macOS sockets, which prevented watching /var/run (#1391).
  • Fixed a symlink whose target passes through a regular file (ENOTDIR) disabling watching of its directory and preventing ready (#1476).
  • Fixed files created in a newly added directory between its scan and watch registration being missed (#1471).
  • Fixed watching a missing nested path stopping its parent directory's subtree from being watched (#1470).
  • Fixed false change events on Windows when many sibling files are written (#1466).
  • Fixed duplicate add events for unchanged files under directory activity (#1465).
  • Fixed replacing a watched directory with a file of the same name hanging the process (#1464).
  • Fixed persistent watching stopping after a watched directory was removed (#1463).
  • Fixed a deleted watched path not being reported when recreated: previously only a deleted file that was the sole watched path was watched for its return. Any path passed to watch() or add() is now awaited from its nearest existing parent.
  • Fixed event throttling discarding updates; the newest differing change is now replayed when the window closes (#1455).
  • Fixed relative ignored paths; relative strings now resolve against cwd or the process working directory (#1436).
  • Fixed files not being detected when their directory did not exist before watching (#1422).
  • Fixed removed files being reported as unlinkDir instead of unlink (#1421).
  • Fixed ignored files and directories still being watched in WSL (#1418).
  • Fixed change being reported for every file when one file changed under Deno (#1417).
  • Fixed changes not being detected after the second save (#1399).
  • Fixed renaming a watched directory that contains subdirectories on Windows (#1380, #1398).
  • Fixed re-watching a path not honoring ignoreInitial (#1386).
  • Fixed EISDIR errors during the initial scan of network drives (#1376).
  • Fixed watching an array of absolute file paths (#1366).
  • Fixed unwatching a deleted watched directory on Windows, contributed by @​sapphi-red in [pull request #1467](paulmillr/chokidar#1467).
  • Documented that unwatched paths stay ignored until they are added again (#1439).

Misc

... (truncated)

Changelog

Sourced from chokidar's changelog.

6.0.0 (2026-10-19)

High-level changes

  • Rewrote the watcher around a single observation pipeline. Backend callbacks are treated as invalidations and confirmed with lstat, stat, or readdir before any event is emitted, so the final state after a burst of changes matches the filesystem.
  • Added native recursive watching through fs.watch({ recursive: true }). The default auto backend uses it on macOS and Windows and per-directory watching elsewhere.
  • Shared native handles across watchers and opened them per directory only: files no longer own handles. This fixes EBADF errors when watching many files on macOS (#1385, #1452).
  • Replaced fs.watchFile with Chokidar-owned stat polling. Poll loops are shared across watchers at the fastest requested interval.
  • Required Node.js 22.22 or later.

API changes

  • Added the backend option: 'auto' (default), 'native', 'native-recursive', or 'polling'.
    • usePolling: true remains as a deprecated alias for backend: 'polling'.
  • Renamed interval and binaryInterval to pollingInterval and pollingBinaryInterval.
    • The old names remain as deprecated aliases; the new names win when both are given.
  • Changed the atomic default to false with polling. An explicit value is preserved.
  • Made close() terminal: add() now throws once closing has started. Construct a new watcher instead.
  • Validated options in the constructor: invalid backend, atomic, depth, awaitWriteFinish, and polling intervals throw TypeError.
  • Emitted errors from add() as error events instead of unhandled rejections (#1378).
  • Made getWatched() return a null-prototype object, so a watched directory named __proto__ is listed (#1493). Use Object.hasOwn() instead of hasOwnProperty() on the result.
  • Stopped applying ignored to directories above a path passed to watch() or add(), so a missing path is still watched through its parent (#1374). Other entries in those directories are still filtered.

Fixes

  • Fixed a 100% CPU loop when the process working directory containing a relatively watched file was deleted (#1474).
  • Fixed watching a filesystem root, which emitted unlink and unlinkDir for every entry (#1184, #452).
  • Fixed UNKNOWN errors from fs.watch on macOS sockets, which prevented watching /var/run (#1391).
  • Fixed a symlink whose target passes through a regular file (ENOTDIR) disabling watching of its directory and preventing ready (#1476).
  • Fixed files created in a newly added directory between its scan and watch registration being missed (#1471).
  • Fixed watching a missing nested path stopping its parent directory's subtree from being watched (#1470).
  • Fixed false change events on Windows when many sibling files are written (#1466).
  • Fixed duplicate add events for unchanged files under directory activity (#1465).
  • Fixed replacing a watched directory with a file of the same name hanging the process (#1464).
  • Fixed persistent watching stopping after a watched directory was removed (#1463).
  • Fixed a deleted watched path not being reported when recreated: previously only a deleted file that was the sole watched path was watched for its return. Any path passed to watch() or add() is now awaited from its nearest existing parent.
  • Fixed event throttling discarding updates; the newest differing change is now replayed when the window closes (#1455).
  • Fixed relative ignored paths; relative strings now resolve against cwd or the process working directory (#1436).
  • Fixed files not being detected when their directory did not exist before watching (#1422).
  • Fixed removed files being reported as unlinkDir instead of unlink (#1421).
  • Fixed ignored files and directories still being watched in WSL (#1418).
  • Fixed change being reported for every file when one file changed under Deno (#1417).
  • Fixed changes not being detected after the second save (#1399).
  • Fixed renaming a watched directory that contains subdirectories on Windows (#1380, #1398).
  • Fixed re-watching a path not honoring ignoreInitial (#1386).
  • Fixed EISDIR errors during the initial scan of network drives (#1376).
  • Fixed watching an array of absolute file paths (#1366).
  • Fixed unwatching a deleted watched directory on Windows, contributed by @​sapphi-red in [pull request #1467](paulmillr/chokidar#1467).
  • Documented that unwatched paths stay ignored until they are added again (#1439).

... (truncated)

Commits

Updates js-yaml from 5.4.3 to 5.5.0

Changelog

Sourced from js-yaml's changelog.

[5.5.0] - 2026-10-16

Changed

  • Updated argparse to v3.
  • Updated development dependencies.

Fixed

  • Correct percent-encoding of shorthand and verbatim tags.
  • Reject ,, ], and } at the start of block plain scalars, #801.
  • Report the exact position of non-printable characters in errors, #801.
Commits
  • cb62b2d 5.5.0 released
  • 87aed90 Deps bump
  • 3aec511 Fix error positions for non-printable characters, #801
  • 11aa483 Reject flow indicators at the start of block plain scalars, #801
  • 339d8e0 Refactor tag encoder and decoder to match the YAML specification
  • See full diff in compare view

Updates mdast-util-find-and-replace from 3.0.3 to 3.0.4

Release notes

Sourced from mdast-util-find-and-replace's releases.

3.0.4

  • 2870b11 Refactor to improve performance

Full Changelog: syntax-tree/mdast-util-find-and-replace@3.0.3...3.0.4

Commits

Updates preact from 11.0.1 to 11.0.2

Release notes

Sourced from preact's releases.

11.0.2

Fixes

Types

Performance

Maintenance

Commits
  • 7c23627 Merge pull request #5329 from preactjs/release/11.0.2
  • b1fffe6 11.0.2
  • 1a07083 Merge pull request #5328 from brevin-aq/fix/render-error-duplicate-children
  • 8ab86ea fix: keep LIS candidacy separate from old vnode matching
  • 82d8c66 fix: don't leave MATCHED on new vnodes when a child throws
  • 1dde7a8 fix: correct type of createRef (#5326)
  • 74df25e Merge pull request #5319 from preactjs/JoviDeCroock/golf-preact-core
  • b8e0ad9 Or isHydrating into the suspended flags
  • 1324976 Test newProps !== oldProps first in the cWRP guard
  • ba2598a Let setStyle default removed style values
  • Additional commits viewable in compare view

Updates preact-render-to-string from 6.8.0 to 6.8.1

Release notes

Sourced from preact-render-to-string's releases.

v6.8.1

Patch Changes

  • #482 a4b9e49 Thanks @​JoviDeCroock! - Encode attribute values after string coercion so arrays and objects are serialized consistently with string attributes.
Changelog

Sourced from preact-render-to-string's changelog.

6.8.1

Patch Changes

  • #482 a4b9e49 Thanks @​JoviDeCroock! - Encode attribute values after string coercion so arrays and objects are serialized consistently with string attributes.
Commits

Updates satori from 0.47.1 to 0.63.2

Release notes

Sourced from satori's releases.

0.63.2

0.63.2 (2026-10-20)

Bug Fixes

  • Report invalid sizes, insets and margins like other invalid values (#950) (074f0b3)

0.63.1

0.63.1 (2026-10-20)

Bug Fixes

0.63.0

0.63.0 (2026-10-19)

Bug Fixes

  • Render variable fonts as their default instance (#946) (b9e5af5)

Features

  • Render selects and their options like Chrome (#947) (c66082d)

0.62.0

0.62.0 (2026-10-16)

Bug Fixes

  • Don't make lines of white space between blocks (#945) (7e8efab)
  • Hide closed dialogs, and draw open ones like browsers (#944) (5ae3a69)
  • Size SVGs without width and height like browsers (#942) (f725edd), closes #940 #939
  • Support -webkit-flex and -webkit-inline-flex (#941) (b7e86d9)

Features

0.61.0

0.61.0 (2026-10-16)

Bug Fixes

... (truncated)

Commits
  • 074f0b3 fix: Report invalid sizes, insets and margins like other invalid values (#950)
  • e1aa7be fix: Honor emoji and text presentation selectors (#948)
  • 5a9e32a docs(playground): Use the srcset sources browsers would use in screenshots (#...
  • c66082d feat: Render selects and their options like Chrome (#947)
  • b9e5af5 fix: Render variable fonts as their default instance (#946)
  • f725edd fix: Size SVGs without width and height like browsers (#942)
  • 7e8efab fix: Don't make lines of white space between blocks (#945)
  • 5ae3a69 fix: Hide closed dialogs, and draw open ones like browsers (#944)
  • b46e5ad feat: Render the labels of button inputs (#943)
  • b7e86d9 fix: Support -webkit-flex and -webkit-inline-flex (#941)
  • Additional commits viewable in compare view

Updates toml from 5.0.0 to 5.0.1

Changelog

Sourced from toml's changelog.

5.0.1 - October 12 2026

  • Address four security advisories, each reachable by parsing untrusted input:
    • CVE-2026-114142, in which a crafted document could still write to Object.prototype. Two distinct key paths could render to the same bookkeeping string, letting an array-of-tables header clear the guard on an unrelated key, after which a dotted key could descend through a date value into its prototype chain. The compiler now records how each table was defined on the table itself rather than in string-keyed sets, so paths cannot collide and key paths can only descend through tables the compiler created.
    • CVE-2026-114143, in which dotted keys, table headers, and inline-table keys with many segments took quadratic time to resolve.
    • CVE-2026-114141, in which every array-of-tables header rescanned all paths defined so far, so documents with many such headers took quadratic time.
    • CVE-2026-114144, in which integer literals were converted to BigInt before any size check, so a multi-megabyte literal consumed super-linear CPU time before being rejected. Literals with more digits than any 64-bit integer are now rejected before conversion.
Commits

Updates unist-util-visit from 5.1.0 to 5.2.0

Release notes

Sourced from unist-util-visit's releases.

5.2.0

Add

  • c1ed449 Add support for exit visitors

Performance

  • f57c39f Fix performance around indexOf

Full Changelog: syntax-tree/unist-util-visit@5.1.0...5.2.0

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the production-dependencies group across 1 director…
87e9031 
…y with 8 updates

Bumps the production-dependencies group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [chokidar](https://github.com/paulmillr/chokidar) | `5.0.0` | `6.0.0` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `5.4.3` | `5.5.0` |
| [mdast-util-find-and-replace](https://github.com/syntax-tree/mdast-util-find-and-replace) | `3.0.3` | `3.0.4` |
| [preact](https://github.com/preactjs/preact) | `11.0.1` | `11.0.2` |
| [preact-render-to-string](https://github.com/preactjs/preact-render-to-string) | `6.8.0` | `6.8.1` |
| [satori](https://github.com/vercel/satori) | `0.47.1` | `0.63.2` |
| [toml](https://github.com/BinaryMuse/toml-node) | `5.0.0` | `5.0.1` |
| [unist-util-visit](https://github.com/syntax-tree/unist-util-visit) | `5.1.0` | `5.2.0` |



Updates `chokidar` from 5.0.0 to 6.0.0
- [Release notes](https://github.com/paulmillr/chokidar/releases)
- [Changelog](https://github.com/paulmillr/chokidar/blob/main/CHANGELOG.md)
- [Commits](paulmillr/chokidar@5.0.0...6.0.0)

Updates `js-yaml` from 5.4.3 to 5.5.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@5.4.3...5.5.0)

Updates `mdast-util-find-and-replace` from 3.0.3 to 3.0.4
- [Release notes](https://github.com/syntax-tree/mdast-util-find-and-replace/releases)
- [Commits](syntax-tree/mdast-util-find-and-replace@3.0.3...3.0.4)

Updates `preact` from 11.0.1 to 11.0.2
- [Release notes](https://github.com/preactjs/preact/releases)
- [Commits](preactjs/preact@11.0.1...11.0.2)

Updates `preact-render-to-string` from 6.8.0 to 6.8.1
- [Release notes](https://github.com/preactjs/preact-render-to-string/releases)
- [Changelog](https://github.com/preactjs/preact-render-to-string/blob/main/CHANGELOG.md)
- [Commits](https://github.com/preactjs/preact-render-to-string/commits/v6.8.1)

Updates `satori` from 0.47.1 to 0.63.2
- [Release notes](https://github.com/vercel/satori/releases)
- [Commits](vercel/satori@0.47.1...0.63.2)

Updates `toml` from 5.0.0 to 5.0.1
- [Changelog](https://github.com/BinaryMuse/toml-node/blob/main/CHANGELOG.md)
- [Commits](BinaryMuse/toml-node@v5.0.0...v5.0.1)

Updates `unist-util-visit` from 5.1.0 to 5.2.0
- [Release notes](https://github.com/syntax-tree/unist-util-visit/releases)
- [Commits](syntax-tree/unist-util-visit@5.1.0...5.2.0)

---
updated-dependencies:
- dependency-name: chokidar
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: js-yaml
  dependency-version: 5.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: mdast-util-find-and-replace
  dependency-version: 3.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: preact
  dependency-version: 11.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: preact-render-to-string
  dependency-version: 6.8.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: satori
  dependency-version: 0.63.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: toml
  dependency-version: 5.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: unist-util-visit
  dependency-version: 5.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 29, 2026
@dependabot @github

dependabot Bot commented on behalf of github Nov 5, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Nov 5, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-5f4b85a9bf branch November 5, 2026 05:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants