deps(deps): bump the major group across 1 directory with 14 updates - #182
Merged
Conversation
Contributor
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
Contributor
|
@dependabot rebase |
Bumps the major group with 14 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@alpacahq/alpaca-trade-api](https://github.com/alpacahq/alpaca-trade-api-js) | `3.1.3` | `4.0.1` | | [framer-motion](https://github.com/motiondivision/motion) | `12.38.0` | `13.1.0` | | [ioredis](https://github.com/redis/ioredis) | `5.10.1` | `6.0.0` | | [openai](https://github.com/openai/openai-node) | `6.36.0` | `7.4.0` | | [puppeteer](https://github.com/puppeteer/puppeteer) | `24.42.0` | `25.7.0` | | [undici](https://github.com/nodejs/undici) | `7.25.0` | `8.10.0` | | [webtorrent](https://github.com/webtorrent/webtorrent) | `2.8.5` | `3.0.21` | | [@testing-library/jest-dom](https://github.com/testing-library/jest-dom) | `6.9.1` | `7.0.1` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.6.0` | `26.2.0` | | [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `5.1.4` | `6.0.5` | | [eslint](https://github.com/eslint/eslint) | `9.39.2` | `10.8.1` | | [jsdom](https://github.com/jsdom/jsdom) | `29.1.1` | `30.0.1` | | [@types/jsdom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/jsdom) | `28.0.0` | `30.0.0` | | [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `7.0.2` | Updates `@alpacahq/alpaca-trade-api` from 3.1.3 to 4.0.1 - [Release notes](https://github.com/alpacahq/alpaca-trade-api-js/releases) - [Changelog](https://github.com/alpacahq/alpaca-trade-api-js/blob/master/CHANGELOG.md) - [Commits](alpacahq/alpaca-trade-api-js@v3.1.3...v4.0.1) Updates `framer-motion` from 12.38.0 to 13.1.0 - [Changelog](https://github.com/motiondivision/motion/blob/main/CHANGELOG.md) - [Commits](motiondivision/motion@v12.38.0...v13.1.0) Updates `ioredis` from 5.10.1 to 6.0.0 - [Release notes](https://github.com/redis/ioredis/releases) - [Changelog](https://github.com/redis/ioredis/blob/main/CHANGELOG.md) - [Commits](redis/ioredis@v5.10.1...v6.0.0) Updates `openai` from 6.36.0 to 7.4.0 - [Release notes](https://github.com/openai/openai-node/releases) - [Changelog](https://github.com/openai/openai-node/blob/main/CHANGELOG.md) - [Commits](openai/openai-node@v6.36.0...v7.4.0) Updates `puppeteer` from 24.42.0 to 25.7.0 - [Release notes](https://github.com/puppeteer/puppeteer/releases) - [Changelog](https://github.com/puppeteer/puppeteer/blob/main/CHANGELOG.md) - [Commits](puppeteer/puppeteer@puppeteer-v24.42.0...puppeteer-v25.7.0) Updates `undici` from 7.25.0 to 8.10.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.25.0...v8.10.0) Updates `webtorrent` from 2.8.5 to 3.0.21 - [Release notes](https://github.com/webtorrent/webtorrent/releases) - [Changelog](https://github.com/webtorrent/webtorrent/blob/master/CHANGELOG.md) - [Commits](webtorrent/webtorrent@v2.8.5...v3.0.21) Updates `@testing-library/jest-dom` from 6.9.1 to 7.0.1 - [Release notes](https://github.com/testing-library/jest-dom/releases) - [Changelog](https://github.com/testing-library/jest-dom/blob/main/CHANGELOG.md) - [Commits](testing-library/jest-dom@v6.9.1...v7.0.1) Updates `@types/node` from 25.6.0 to 26.2.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@vitejs/plugin-react` from 5.1.4 to 6.0.5 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.0.5/packages/plugin-react) Updates `eslint` from 9.39.2 to 10.8.1 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v9.39.2...v10.8.1) Updates `jsdom` from 29.1.1 to 30.0.1 - [Release notes](https://github.com/jsdom/jsdom/releases) - [Commits](jsdom/jsdom@v29.1.1...v30.0.1) Updates `@types/jsdom` from 28.0.0 to 30.0.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/jsdom) Updates `typescript` from 5.9.3 to 7.0.2 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](https://github.com/microsoft/TypeScript/commits) --- updated-dependencies: - dependency-name: "@alpacahq/alpaca-trade-api" dependency-version: 4.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major - dependency-name: "@testing-library/jest-dom" dependency-version: 7.0.1 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major - dependency-name: "@types/jsdom" dependency-version: 30.0.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major - dependency-name: "@types/node" dependency-version: 26.2.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major - dependency-name: "@vitejs/plugin-react" dependency-version: 6.0.5 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major - dependency-name: eslint dependency-version: 10.8.1 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major - dependency-name: framer-motion dependency-version: 13.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major - dependency-name: ioredis dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major - dependency-name: jsdom dependency-version: 30.0.1 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major - dependency-name: openai dependency-version: 7.4.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major - dependency-name: puppeteer dependency-version: 25.7.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major - dependency-name: undici dependency-version: 8.10.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major - dependency-name: webtorrent dependency-version: 3.0.21 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/major-bc1a4a0a20
branch
from
August 18, 2026 09:03
e41140f to
8e7ee9a
Compare
Three of the 14 bumps in this group cannot be taken yet — each one fails a check on its own, which kept the whole group red: - typescript 7.0.2: no released typescript-eslint supports it (@typescript-eslint/typescript-estree peers on typescript <6.1.0), so `pnpm lint` dies in typescript-estree with "Cannot read properties of undefined (reading 'Cjs')". Held at ^5.9.3. - eslint 10.8.1: eslint-plugin-react/import/jsx-a11y — pulled in by eslint-config-next — still peer on eslint <=9, and ESLint 10 removed context.getFilename(), which eslint-plugin-react calls. Held at ^9.39.2. - @vitejs/plugin-react 6.0.5: requires vite ^8, but vitest 4 resolves vite 7, so vitest cannot even load its config. Held at ^5.1.4. Each is now an explicit `ignore` in dependabot.yml so the major group stops re-proposing them until the blocking package ships support. The other 11 majors are taken. Alpaca 4 needed the only code change: it moved from a default export to a named `Alpaca`, and renamed the client option `secretKey` to `secret`. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
ThreatCrush Security Scan106 finding(s) HIGH/CRITICAL: 13 | MEDIUM: 32 | LOW: 61
…and 56 more. Full results in the Security tab. Snippets are redacted; ThreatCrush never prints matched credential material. |
ralyodio
added a commit
that referenced
this pull request
Aug 19, 2026
Failed to start SiriusXM login: fetch failed
(cause: UND_ERR_INVALID_ARG: invalid onRequestStart method)
The radio client builds a ProxyAgent from the `undici` package and handed it to
the GLOBAL fetch, which Node backs with its own bundled copy of undici. The two
disagree on the dispatcher handler interface, so the request is rejected before it
is made. It worked while the package tracked undici 7, close to what Node bundles,
and broke on the major-group bump to 8 (#182).
That bump had been sitting on master undeployed for a while, because the droplet
deploy kept skipping behind a stalled apt mirror. Unblocking the pipeline shipped
it -- so the regression surfaced now even though the change is not mine.
Proxied radio calls now go through one helper that uses undici's own fetch. The
casts live there too: undici's Response and RequestInit are the same WHATWG shapes
as the globals but structurally distinct types from a second copy of the
declarations, and that is worth explaining once rather than at four call sites.
A test asserts no file in src pairs a dispatcher with the global fetch. The other
five places that use one -- the IPTV proxy, channels, playlists and the resale
stream -- were already correct.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the major group with 14 updates in the / directory:
3.1.34.0.112.38.013.1.05.10.16.0.06.36.07.4.024.42.025.7.07.25.08.10.02.8.53.0.216.9.17.0.125.6.026.2.05.1.46.0.59.39.210.8.129.1.130.0.128.0.030.0.05.9.37.0.2Updates
@alpacahq/alpaca-trade-apifrom 3.1.3 to 4.0.1Release notes
Sourced from @alpacahq/alpaca-trade-api's releases.
... (truncated)
Changelog
Sourced from @alpacahq/alpaca-trade-api's changelog.
... (truncated)
Commits
d704ceachore: version packages (#299)5344968fix: remove alpha from docs (#298)6ece844chore: version packages (#297)9301d5cTs alpha (#295)247c407Version bump (#280)Install script changes
This version adds
preparescript that runs during installation. Review the package contents before updating.Updates
framer-motionfrom 12.38.0 to 13.1.0Changelog
Sourced from framer-motion's changelog.
... (truncated)
Commits
adaf7a4v13.1.0e713759Updating changelogbc81c03Updating publish092b771Merge pull request #3785 from motiondivision/feature/1400-reorder-grid025b0f4Merge pull request #3789 from motiondivision/dependabot/npm_and_yarn/nanoid-3...2f05af8Bump nanoid from 3.3.11 to 3.3.18e0780bbMerge pull request #3788 from motiondivision/dependabot/npm_and_yarn/js-yaml-...29af841Fix wrapped Reorder insertion behavior0035e3cBump js-yaml from 3.15.0 to 3.15.1e4029cev13.0.0Updates
ioredisfrom 5.10.1 to 6.0.0Release notes
Sourced from ioredis's releases.
... (truncated)
Changelog
Sourced from ioredis's changelog.
... (truncated)
Commits
8ed2946chore(release): 6.0.0 [skip ci]3b410f8docs: clarify managed HIMPORT fieldset behavior (#2161)729f174feat: himport managed fieldsets (#2159)6d0716efeat: improve default connection resilience (#2160)cf3bf71fix(types): export ScanStreamOptions, RedisStatus and ClusterStatus (#2158)aac171bci: update Redis test image (#2156)807bb1cchore(release): update repository URL (#2154)6c889e7docs: add security policy (#2153)6455dbefix: clear stale socket timeout on reconnect (#2148)9618206fix(cluster): validate MOVED slot to prevent Array.prototype pollution (#2151)Updates
openaifrom 6.36.0 to 7.4.0Release notes
Sourced from openai's releases.
... (truncated)
Changelog
Sourced from openai's changelog.
... (truncated)
Commits
83c437frelease: 7.4.0 (#2055)a97cbffci: prepare checks for merge queue (#2066)481b325build(deps-dev): bump@smithy/hash-nodefrom 4.3.5 to 4.4.15 (#2064)3576574build(deps): bump dotenv from 16.6.1 to 17.4.2 (#2065)823d7dfbuild(deps-dev): bump publint from 0.2.12 to 0.3.22 (#2058)f61f267build(deps-dev): bump@types/webfrom 0.0.194 to 0.0.354 (#2061)85ea6b2[dependabot] Configure a seven-day npm cooldown (#2054)4d927debuild(deps): bump ip-address from 10.2.0 to 10.4.0 in /ecosystem-tests/vercel...590982fbuild(deps): bump fast-uri from 3.1.4 to 3.1.5 in /ecosystem-tests/vercel-edg...6d8fb53feat(api): Add gpt-5.5 model and tool metadata fields (#2049)Updates
puppeteerfrom 24.42.0 to 25.7.0Release notes
Sourced from puppeteer's releases.
... (truncated)
Changelog
Sourced from puppeteer's changelog.
... (truncated)
Commits
58e5798chore: release main (#15331)0c187dbfeat: roll to Chrome 152.0.7977.42 (#15330)eb874a5fix: logger calling causing crashes (#15338)df2d719refactor: use Desposable stacks to track listeners (#15332)c4d220cchore(deps-dev): bump the dev-dependencies group across 1 directory with 9 up...df5a524fix: roll to Firefox 153.0.4 (#15329)987f146feat(tracing): support bufferSize option in tracing.start (#15328)d484e21chore: release main (#15296)cd7308cchore: add linux arm64 to daily job (#15327)fc984bdfeat: allow downloading CfT linux-arm64 (#15325)Updates
undicifrom 7.25.0 to 8.10.0Release notes
Sourced from undici's releases.