Bump the npm_and_yarn group across 1 directory with 24 updates

[dependabot]

Bumps the npm_and_yarn group with 21 updates in the / directory:

Package	From	To
ai	3.4.33	5.0.52
diff	5.2.0	5.2.2
pnpm	9.15.0	10.28.2
vite	5.4.11	5.4.21
vitest	2.1.8	2.1.9
wrangler	3.91.0	3.114.17
@eslint/plugin-kit	0.2.3	0.2.8
@octokit/endpoint	10.1.1	10.1.4
@octokit/plugin-paginate-rest	11.3.6	11.6.0
@octokit/request-error	6.1.5	6.1.8
@octokit/request	9.1.3	9.2.4
ajv	6.12.6	6.14.0
bn.js	4.12.1	4.12.3
brace-expansion	1.1.11	1.1.12
glob	10.4.5	10.5.0
js-yaml	4.1.0	4.1.1
lodash	4.17.21	4.17.23
minimatch	3.1.2	3.1.5
pbkdf2	3.1.2	3.1.5
sha.js	2.4.11	2.4.12
tar-fs	2.1.1	2.1.4

Updates ai from 3.4.33 to 5.0.52

Commits

• 63d5f66 Version Packages (#8895)
• 930399b Backport: fix(ai): download files when intermediate file cannot be downloaded...
• 7ca78f1 Backport: feat(provider/gateway): Add new Qwen models to Gateway model string...
• 1cfc209 Backport: feat(provider/openai): OpenAILanguageModelOptions type (#8858)
• 347b7ec ci: rename v5.0 branch to release-v*
• 85909a9 Backport: chore(ai): update test message (#8875)
• c56822d Backport: fix(ai): update uiMessageChunkSchema to satisfy the `UIMessageChu...
• 1461adf Backport: chore(examples): remove redundant OpenAI reasoning examples (#8871)
• 6bd07df Version Packages (#8853)
• a45d61a ci(release): remove incorrect changeset bump for @ai-sdk/baseten
• Additional commits viewable in compare view

Updates diff from 5.2.0 to 5.2.2

Changelog

Sourced from diff's changelog.

v5.2.2 - January 2026

Only change from 5.2.0 is a backport of the fix to GHSA-73rr-hh4g-fpgx.

v5.2.1 (deprecated)

Accidental release - do not use.

Commits

• b7b6339 v5.2.2
• b5377ab Update package version to 5.2.1
• 7801789 Backport kpdecker/jsdiff#649
• 042a837 Backport kpdecker/jsdiff#647
• See full diff in compare view

Updates pnpm from 9.15.0 to 10.28.2

Release notes

Sourced from pnpm's releases.

pnpm 10.28.2

Patch Changes

• Security fix: prevent path traversal in directories.bin field.

• When pnpm installs a file: or git: dependency, it now validates that symlinks point within the package directory. Symlinks to paths outside the package root are skipped to prevent local data from being leaked into node_modules.

  This fixes a security issue where a malicious package could create symlinks to sensitive files (e.g., /etc/passwd, ~/.ssh/id_rsa) and have their contents copied when the package is installed.

  Note: This only affects file: and git: dependencies. Registry packages (npm) have symlinks stripped during publish and are not affected.

• Fixed optional dependencies to request full metadata from the registry to get the libc field, which is required for proper platform compatibility checks #9950.

Platinum Sponsors

Gold Sponsors

... (truncated)

Changelog

Sourced from pnpm's changelog.

10.28.2

Patch Changes

• Security fix: prevent path traversal in directories.bin field.

• When pnpm installs a file: or git: dependency, it now validates that symlinks point within the package directory. Symlinks to paths outside the package root are skipped to prevent local data from being leaked into node_modules.

  This fixes a security issue where a malicious package could create symlinks to sensitive files (e.g., /etc/passwd, ~/.ssh/id_rsa) and have their contents copied when the package is installed.

  Note: This only affects file: and git: dependencies. Registry packages (npm) have symlinks stripped during publish and are not affected.

• Fixed optional dependencies to request full metadata from the registry to get the libc field, which is required for proper platform compatibility checks #9950.

10.28.1

Patch Changes

• Fixed installation of config dependencies from private registries.

  Added support for object type in configDependencies when the tarball URL returned from package metadata differs from the computed URL #10431.

• Fix path traversal vulnerability in binary fetcher ZIP extraction

  • Validate ZIP entry paths before extraction to prevent writing files outside target directory
  • Validate BinaryResolution.prefix (basename) to prevent directory escape via crafted prefix
  • Both attack vectors now throw ERR_PNPM_PATH_TRAVERSAL error

• Support plain http:// and https:// URLs ending with .git as git repository dependencies.

  Previously, URLs like https://gitea.example.org/user/repo.git#commit were not recognized as git repositories because they lacked the git+ prefix (e.g., git+https://). This caused issues when installing dependencies from self-hosted git servers like Gitea or Forgejo that don't provide tarball downloads.

  Changes:

  • The git resolver now runs before the tarball resolver, ensuring git URLs are handled by the correct resolver
  • The git resolver now recognizes plain http:// and https:// URLs ending in .git as git repositories
  • Removed the isRepository check from the tarball resolver since it's no longer needed with the new resolver order

  Fixes #10468

• pnpm run -r and pnpm run --filter now fail with a non-zero exit code when no packages have the specified script. Previously, this only failed when all packages were selected. Use --if-present to suppress this error #6844.

• Fixed a path traversal vulnerability in tarball extraction on Windows. The path normalization was only checking for ./ but not .\. Since backslashes are directory separators on Windows, malicious packages could use paths like foo\..\..\.npmrc to write files outside the package directory.

• When running "pnpm exec" from a subdirectory of a project, don't change the current working directory to the root of the project #5759.

• Fixed a path traversal vulnerability in pnpm's bin linking. Bin names starting with @ bypassed validation, and after scope normalization, path traversal sequences like ../../ remained intact.

• Revert Try to avoid making network calls with preferOffline #10334.

• Fix --save-peer to write valid semver ranges to peerDependencies for protocol-based installs (e.g. jsr:) by deriving from resolved versions when available and falling back to * if none is available #10417.

• Do not exclude the root workspace project, when it is explicitly selected via a filter #10465.

10.28.0

Minor Changes

... (truncated)

Commits

• 89a2c4e chore(release): 10.28.2
• a484cea fix(npm-resolver): request full metadata for optional dependencies (#10455)
• c908370 test: fix
• 0b5a56a chore(release): 10.28.1
• 916b26b fix: prevent implicit root exclusion when user filters are provided (#10465)
• 9cbba28 fix(exec): preserve user execution cwd (#10445)
• 91a241e chore(release): 10.28.0
• a9784fb revert: "chore: upgrade qs to 6.14.1 (#10389)"
• 787ed46 chore: upgrade qs to 6.14.1 (#10389)
• 6bdba72 chore(release): 10.27.0
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for pnpm since your current version.

Updates vite from 5.4.11 to 5.4.21

Release notes

Sourced from vite's releases.

v5.4.21

Please refer to CHANGELOG.md for details.

v5.4.20

Please refer to CHANGELOG.md for details.

v5.4.19

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

5.4.21 (2025-10-20)

• fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20970) (cad1d31), closes #20968 #20970
• chore: update CHANGELOG (ca88ed7)

5.4.20 (2025-09-08)

• fix: apply fs.strict check to HTML files (#20736) (482000f), closes #20736
• fix: port sirv@3.0.2 changes to sirv@2.0.4 (#20737) (4f1c35b), closes #20737

5.4.19 (2025-04-30)

• fix: backport #19965, check static serve file inside sirv (#19966) (766947e), closes #19965 #19966

5.4.18 (2025-04-10)

• fix: backport #19830, reject requests with # in request-target (#19831) (823675b), closes #19830 #19831

5.4.17 (2025-04-03)

• fix: backport #19782, fs check with svg and relative paths (#19784) (84b2b46), closes #19782 #19784

5.4.16 (2025-03-31)

• fix: backport #19761, fs check in transform middleware (#19762) (b627c50), closes #19761 #19762

5.4.15 (2025-03-24)

• fix: backport #19702, fs raw query with query separators (#19703) (807d7f0), closes #19702 #19703

5.4.14 (2025-01-21)

• fix: preview.allowedHosts with specific values was not respected (#19246) (9df6e6b), closes #19246
• fix: allow CORS from loopback addresses by default (#19249) (7d1699c), closes #19249

... (truncated)

Commits

• adce3c2 release: v5.4.21
• cad1d31 fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20970)
• ca88ed7 chore: update CHANGELOG
• 997700f release: v5.4.20
• 482000f fix: apply fs.strict check to HTML files (#20736)
• 80a333a release: v5.4.19
• 766947e fix: backport #19965, check static serve file inside sirv (#19966)
• 731b77d release: v5.4.18
• 823675b fix: backport #19830, reject requests with # in request-target (#19831)
• 0a2518a release: v5.4.17
• Additional commits viewable in compare view

Updates vitest from 2.1.8 to 2.1.9

Release notes

Sourced from vitest's releases.

v2.1.9

This release includes security patches for:

• Browser mode serves arbitrary files | CVE-2025-24963
• Remote Code Execution when accessing a malicious website while Vitest API server is listening | CVE-2025-24964

   🐞 Bug Fixes

• backport vitest-dev/vitest#7317 to v2 - by @​hi-ogawa in vitest-dev/vitest#7318
• (backport #7340 to v2) restrict served files from /__screenshot-error - by @​hi-ogawa in vitest-dev/vitest#7343

    View changes on GitHub

Commits

• c9e59a0 chore: release v2.1.9
• e0fe1d8 fix: backport #7317 to v2 (#7318)
• See full diff in compare view

Updates wrangler from 3.91.0 to 3.114.17

Changelog

Sourced from wrangler's changelog.

3.114.17

Patch Changes

• #11891 6d5557b Thanks @​emily-shen! - Use argument array when executing git commands with wrangler pages deploy

  Pass user provided values from --commit-hash safely to underlying git command.

3.114.16

Patch Changes

• #11689 9bab0a0 Thanks @​ascorbic! - Display a warning when authentication errors occur and the account_id in your Wrangler configuration does not match any of your authenticated accounts. This helps identify configuration issues where you may have the wrong account ID set in your wrangler.toml or wrangler.jsonc file.

• #10737 c41a078 Thanks @​workers-devprod! - Allow WRANGLER_SEND_ERROR_REPORTS env var to override whether to report Wrangler crashes to Sentry

• #11134 bd39455 Thanks @​petebacondarwin! - Reduce the amount of arguments being passed in metrics capture.

  Now the argument values that are captured come from an allow list, and can be marked as ALLOW (capture the real value) or REDACT (capture as "").

• #11020 9cb702e Thanks @​dario-piotrowicz! - Fix observability.logs.persist being flagged as an unexpected field during the wrangler config file validation

• #11147 cf4993b Thanks @​FlorentCollin! - Improve the formatting of the D1 execute command to always show the duration in milliseconds with two decimal places.

• #11650 cc29ead Thanks @​ascorbic! - fix: respect TypeScript path aliases when resolving non-JS modules with module rules

  When importing non-JavaScript files (like .graphql, .txt, etc.) using TypeScript path aliases defined in tsconfig.json, Wrangler's module-collection plugin now correctly resolves these imports. Previously, path aliases were only respected for JavaScript/TypeScript files, causing imports like import schema from '~lib/schema.graphql' to fail when using module rules.

• #11179 7f779e9 Thanks @​ascorbic! - Log a more helpful error when attempting to "r2 object put" a non-existent file

• #11501 c78d942 Thanks @​edmundhung! - fix: prevent reporting SQLite error from wrangler d1 execute to Sentry

• #11262 b2683f7 Thanks @​workers-devprod! - Avoid using object lookup for OAuth Error classes

• #11107 d8037d3 Thanks @​workers-devprod! - Fixed conflict between --env and --expires flags in wrangler r2 object put.

  --e now aliases --env only, and NOT --expires.

• #10961 02d2ea9 Thanks @​devin-ai-integration! - Acquire Cloudflare Access tokens for additional requests made during a wrangler dev --remote session

• #11108 892ec4f Thanks @​emily-shen! - Fixed self-bindings (service bindings to the same worker) showing as [not connected] in wrangler dev. Self-bindings now correctly show as [connected] since a worker is always available to itself.

• #11138 3db872a Thanks @​devin-ai-integration! - Implement tail-based logging for wrangler dev remote mode, behind the --x-tail-tags flag. This will become the default in the future.

• #10889 204616c Thanks @​workers-devprod! - Clarify that wrangler check startup generates a local CPU profile

• #11491 ed8aaef Thanks @​edmundhung! - Explicitly close FileHandle in wrangler d1 execute to support Node 25

• #10962 203e599 Thanks @​devin-ai-integration! - Fixed duplicate warning messages appearing during wrangler dev when configuration changes or state transitions occur

... (truncated)

Commits

• f21ee75 Version Packages (#11895)
• 6d5557b fix: execute git commands in pages deploy safely (#11889) (#11891)
• 0e19ae9 Version Packages (#10906)
• 3db872a [v3 backport] Backport tail-based logging from #11135 and #11346 (#11138)
• 02d2ea9 Fix remote dev with Access (#10961)
• 9bab0a0 fix(wrangler): add warning when account_id mismatch detected on auth error (v...
• 4b18c6f Introduce internal isWorkerNotFoundError utility and avoid worker-not-found...
• ed8aaef fix(wrangler): close FileHandle in to support Node 25 (#11491)
• c78d942 V3 backport of #11467: prevent SQLite users error from being reported to Sent...
• cc29ead fix: respect TypeScript path aliases when resolving non-JS modules with modul...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for wrangler since your current version.

Updates @eslint/plugin-kit from 0.2.3 to 0.2.8

Release notes

Sourced from @​eslint/plugin-kit's releases.

plugin-kit: v0.2.8

0.2.8 (2025-04-01)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​eslint/core bumped from ^0.12.0 to ^0.13.0

plugin-kit: v0.2.7

0.2.7 (2025-02-21)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​eslint/core bumped from ^0.11.0 to ^0.12.0

plugin-kit: v0.2.6

0.2.6 (2025-01-31)

Bug Fixes

• CommonJS types in all packages (#148) (c91866c)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​eslint/core bumped from ^0.10.0 to ^0.11.0

plugin-kit: v0.2.5

0.2.5 (2025-01-09)

Bug Fixes

• make plugin-kit types usable in CommonJS (#143) (f77ba17)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​eslint/core bumped from ^0.9.1 to ^0.10.0

... (truncated)

Changelog

Sourced from @​eslint/plugin-kit's changelog.

0.2.8 (2025-04-01)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​eslint/core bumped from ^0.12.0 to ^0.13.0

0.2.7 (2025-02-21)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​eslint/core bumped from ^0.11.0 to ^0.12.0

0.2.6 (2025-01-31)

Bug Fixes

• CommonJS types in all packages (#148) (c91866c)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​eslint/core bumped from ^0.10.0 to ^0.11.0

0.2.5 (2025-01-09)

Bug Fixes

• make plugin-kit types usable in CommonJS (#143) (f77ba17)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​eslint/core bumped from ^0.9.1 to ^0.10.0

0.2.4 (2024-12-04)

Bug Fixes

... (truncated)

Commits

• 1615a01 chore: release main (#174)
• 6199b6e docs: Update README sponsors
• 1f9c609 docs: Update README sponsors
• 473c962 docs: Update README sponsors
• a48aa6a docs: Update README sponsors
• 49d1d20 docs: Update README sponsors
• 3e9b0eb chore: release main (#157)
• d4a04b9 docs: Update README sponsors
• 94eefd0 docs: Update README sponsors
• a57dd45 docs: Update README sponsors
• Additional commits viewable in compare view

Updates @octokit/endpoint from 10.1.1 to 10.1.4

Release notes

Sourced from @​octokit/endpoint's releases.

v10.1.4

10.1.4 (2025-04-10)

Bug Fixes

• deps: update dependency @​octokit/types to v14 (#523) (ca8c366)

v10.1.3

10.1.3 (2025-02-13)

Bug Fixes

• Fix a ReDos vulnerability, reported by @​DayShift (6c9c5be)

v10.1.2

10.1.2 (2024-12-31)

Bug Fixes

• deps: bump @octokit/types to improve Deno compat (#507) (15d700b)

Commits

• ca8c366 fix(deps): update dependency @​octokit/types to v14 (#523)
• 7b9a884 maint: cleanup package.json and use Node LTS instead of v16 (#519)
• bcc0f97 build(deps): bump vite from 6.1.0 to 6.2.5 (#522)
• 255c59d ci(action): update actions/create-github-app-token action to v2 (#521)
• adeee3e chore(deps): update dependency prettier to v3.5.3 (#518)
• ea60e07 chore(deps): update dependency semantic-release-plugin-update-version-in-file...
• 8f43346 chore(deps): update dependency prettier to v3.5.2 (#517)
• 2209b07 chore(deps): update dependency prettier to v3.5.1 (#513)
• d6cf1ad fix: linting issues breaking ci (#514)
• 6c9c5be Merge commit from fork
• Additional commits viewable in compare view

Updates @octokit/plugin-paginate-rest from 11.3.6 to 11.6.0

Release notes

Sourced from @​octokit/plugin-paginate-rest's releases.

v11.6.0

11.6.0 (2025-03-18)

Features

• new /orgs/{org}/issue-types, /orgs/{org}/issue-types/{issue_type_id} enpoints (#666) (1f44b54)

v11.5.0

11.5.0 (2025-03-18)

Features

• new GET /orgs/{org}/actions/hosted-runners, GET /orgs/{org}/actions/runner-groups/{runner_group_id}/hosted-runners, GET /orgs/{org}/rulesets/{ruleset_id}/history, GET /orgs/{org}/settings/network-configurations, GET /repos/{owner}/{repo}/rulesets/{ruleset_id}/history endpoints (#649) (ef30a05)

v11.4.4-cjs.2

11.4.4-cjs.2 (2025-02-26)

[!IMPORTANT] This is a special release to backport newer changes to CJS and address a ReDos vulnerability

Bug Fixes

• deps: update @octokit/plugin-rest-endpoint-methods (2c70eaf)

v11.4.4-cjs.1

11.4.4-cjs.1 (2025-02-26)

[!IMPORTANT] This is a special release to backport newer changes to CJS and address a ReDos vulnerability

Bug Fixes

• release: set prerelease flag for correct channel (ce534d9) See octokit/plugin-paginate-rest.js@v11.3.1...v11.4.4-cjs.1 for the full comparision

Reverts

• Revert "docs(README): update examples to use ESM (#611)" (1389b71)
• Revert "feat: package is now ESM (#596)" (64ba6f4)
• Revert "fix(pkg): add default fallback and types export (#612)" (27a8552)

v11.4.3

... (truncated)

Commits

• 1f44b54 feat: new /orgs/{org}/issue-types, `/orgs/{org}/issue-types/{issue_type_id}...
• ef30a05 feat: new GET /orgs/{org}/actions/hosted-runners, `GET /orgs/{org}/actions/...
• fbadb74 chore(deps): update dependency prettier to v3.5.3 (#665)
• 1c297ca chore(deps): update dependency semantic-release-plugin-update-version-in-file...
• 60d26d9 chore(deps): update dependency prettier to v3.5.2 (#664)
• 9a51aad fix(types): correct pagination return type for data which is an array (#662)
• 8b8c500 fix(types): add back the pagination keys (#653)
• 41876f4 chore(deps): update dependency prettier to v3.5.1 (#658)
• 7d1fade fix: mitigate ReDos issues & linting issues (#659)
• bb6c4f9 Merge commit from fork
• Additional commits viewable in compare view

Updates @octokit/request-error from 6.1.5 to 6.1.8

Release notes

Sourced from @​octokit/request-error's releases.

v6.1.8

6.1.8 (2025-04-10)

Bug Fixes

• deps: update dependency @​octokit/types to v14 (#505) (ab4ea7b)

v6.1.7

6.1.7 (2025-02-13)

Bug Fixes

• ReDos regex vulnerability, reported by @​DayShift (d558320874a4bc8d356babf1079e6f0056a59b9e)

v6.1.6

6.1.6 (2024-12-29)

Bug Fixes

• deps: bump @octokit/types to fix Deno compat (#483) (e01d470)

Commits

• ab4ea7b fix(deps): update dependency @​octokit/types to v14 (#505)
• 7eba3d2 chore(deps): update dependency tinybench to v4 (#501)
• 549624b build(deps): bump vite from 6.2.2 to 6.2.5 (#504)
• 11c1adc build(deps): lock file maintenance (#502)
• de5f24d chore(deps): update dependency prettier to v3.5.3 (#499)
• ef66347 build(deps): lock file maintenance (#500)
• 787201d build(deps): lock file maintenance (#498)
• 5ab6a76 chore(deps): update dependency prettier to v3.5.2 (#497)
• f8f8c4a build(deps): lock file maintenance (#496)
• eee2491 chore(deps): update dependency prettier to v3.5.1 (#493)
• Additional commits viewable in compare view

Updates @octokit/request from 9.1.3 to 9.2.4

Release notes

Sourced from @​octokit/request's releases.

v9.2.4

9.2.4 (2025-06-20)

Bug Fixes

• pkg: unreplaced version number in dist-bundle/ (#765) (afa9d09)

v9.2.3

9.2.3 (2025-04-10)

Bug Fixes

• deps: update dependency @​octokit/types to v14 (#753) (7d576b0)

v9.2.2

9.2.2 (2025-02-14)

Bug Fixes

• deps: update dependency @​octokit/request-error to v6.1.7 [security] (#740) (4b2f485)

v9.2.1

9.2.1 (2025-02-13)

Bug Fixes

• mitigate ReDos vulnerabilities & lint (#738) (6bb29ba)

v9.2.0

9.2.0 (2025-01-16)

Features

• correctly parse response bodies as JSON where the Content-Type is application/scim+json (#731) (00bf316)

v9.1.4

9.1.4 (2024-12-29)

Bug Fixes

• deps: bump @octokit/types to fix deno compat (#730) (324ffef)

Commits

• afa9d09 fix(pkg): unreplaced version number in dist-bundle/ (#765)
• 3773e64 ci: replace OCTOKITBOT_PROJECT_ACTION_TOKEN and OCTOKITBOT_PAT with a tok...
• 7d576b0 fix(deps): update dependency @​octokit/types to v14 (#753)
• c9bfc37 build(deps): bump vite from 6.1.0 to 6.2.5 (#750)
• f7b9616 ci(prettier): use Node LTS instead of Node 16 (#748)
• 1955847 chore(deps): update dependency prettier to v3.5.3 (#745)
• b71107b chore(deps): update dependency semantic-release-plugin-update-version-in-file...
• c855943 chore(deps): update dependency prettier to v3.5.2 (#743)
• 4b2f485 fix(deps): update dependency @​octokit/request-error to v6.1.7 [security] (#740)
• 0320a42 chore(deps): update dependency prettier to v3.5.1 (#737)
• Additional commits viewable in compare view

Updates ajv from 6.12.6 to 6.14.0

Commits

• e3af0a7 6.14.0
• b552ed6 add regExp option to address $data exploit via a regular expression (CVE-2025...
• 72f2286 docs: update v7 info
• 231e52b Merge pull request #1320 from philsturgeon/patch-1
• d3475fc Add spectral, an AJV util from a sponsor
• 413afe0 docs: v7.0.0-beta.3

[cloudflare-workers-and-pages]

Deploying zone-bolt with    Cloudflare Pages

Latest commit:	71af89e
Status:	🚫  Build failed.

View logs

[codesandbox]

Review or Edit in CodeSandbox

Open the branch in Web Editor • VS Code • Insiders

Open Preview

[github-actions]

This pull request has been marked as stale due to inactivity. If no further activity occurs, it will be closed in 7 days.