Skip to content

Bump the npm-minor-and-patch group across 1 directory with 15 updates - #3617

Merged
HughParry merged 5 commits into
mainfrom
dependabot/npm_and_yarn/npm-minor-and-patch-370add2672
Oct 26, 2026
Merged

Bump the npm-minor-and-patch group across 1 directory with 15 updates#3617
HughParry merged 5 commits into
mainfrom
dependabot/npm_and_yarn/npm-minor-and-patch-370add2672

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 26, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-minor-and-patch group with 15 updates in the / directory:

Package From To
@vitest/spy 5.0.4 5.0.5
turbo 2.11.8 2.11.9
rollup 4.64.6 4.64.10
webpack 5.111.1 5.112.0
webpack-dev-server 6.0.0 6.1.0
zod 3.23.8 3.25.76
dotenv 18.0.7 18.0.8
express 4.22.2 4.22.3
i18next 26.4.4 26.5.2
i18next-fs-backend 2.6.8 2.6.9
@vitest/browser-playwright 5.0.4 5.0.5
playwright 1.64.0 1.64.1
react 19.3.0 19.3.1
react-dom 19.3.0 19.3.1
cypress 16.1.1 16.2.0

Updates @vitest/spy from 5.0.4 to 5.0.5

Release notes

Sourced from @​vitest/spy's releases.

v5.0.5

   🐞 Bug Fixes

    View changes on GitHub
Commits

Updates turbo from 2.11.8 to 2.11.9

Release notes

Sourced from turbo's releases.

Turborepo v2.11.9

What's Changed

Changelog

... (truncated)

Commits
  • 64d5e48 publish 2.11.9 to registry
  • 78b039e fix(cache): Parallelize dry-run HEAD fallback (#14801)
  • 6834819 docs: Use .NET in the multi-language guide (#14793)
  • 679efb8 refactor: Remove setup lifecycle script controls (#14818)
  • 9c90852 fix: Allow native package manager configuration during setup (#14816)
  • a3bcc4a chore: Release Turborepo 2.11.9-canary.1 (#14817)
  • 9328416 fix: Stop installing the Unix shell hook automatically (#14813)
  • 74c9fbc fix: Attribute Cargo.lock changes to the crates whose dependencies changed (#...
  • a3ef52a chore: Update with-changesets example (#14638)
  • f05411f perf: Skip newline normalization copies for already-normalized TUI output (#1...
  • Additional commits viewable in compare view

Updates rollup from 4.64.6 to 4.64.10

Release notes

Sourced from rollup's releases.

v4.64.10

4.64.10

2026-10-18

Bug Fixes

  • Avoid breaking lazy loading when a dynamic import only contains reexports from a manual chunk (#6583)
  • Ensure HTML entities in JSX are properly decoded in the output (#6584)

Pull Requests

v4.64.9

4.64.9

2026-10-17

Bug Fixes

  • Ensure export live-bindings are properly maintained for aliased exports (#6576)
  • Retain typed array constructor calls if the argument has iteration side effects (#6582)

Pull Requests

v4.64.8

4.64.8

2026-10-17

Bug Fixes

  • Ensure chunk hashes change when sourcemap comments change (#6509)
  • Resolve some relative import resolution edge cases (#6522)

Pull Requests

... (truncated)

Changelog

Sourced from rollup's changelog.

4.64.10

2026-10-18

Bug Fixes

  • Avoid breaking lazy loading when a dynamic import only contains reexports from a manual chunk (#6583)
  • Ensure HTML entities in JSX are properly decoded in the output (#6584)

Pull Requests

4.64.9

2026-10-17

Bug Fixes

  • Ensure export live-bindings are properly maintained for aliased exports (#6576)
  • Retain typed array constructor calls if the argument has iteration side effects (#6582)

Pull Requests

4.64.8

2026-10-17

Bug Fixes

  • Ensure chunk hashes change when sourcemap comments change (#6509)
  • Resolve some relative import resolution edge cases (#6522)

Pull Requests

4.64.7

2026-10-15

... (truncated)

Commits

Updates webpack from 5.111.1 to 5.112.0

Release notes

Sourced from webpack's releases.

v5.112.0

Minor Changes

... (truncated)

Changelog

Sourced from webpack's changelog.

5.112.0

Minor Changes

... (truncated)

Commits
  • 755c49e chore(release): new release (#22170)
  • 35b066f feat(javascript): fold switches, PURE IIFEs, null tests, Babel helpers and pr...
  • edea0f5 refactor(css,html): give the ASCII helpers one Infra name in both parsers (#2...
  • 916cf37 fix(css): keep a rule nested under a selector opening on a combinator when lo...
  • 2ebe482 ci: pin Chrome and Firefox to the builds puppeteer-core names (#22703)
  • ed18fa1 fix(css): reach for no newer spelling where a target browser is one the data ...
  • 26d315a refactor: ask the dependency and module kind instead of flags and type string...
  • 3020447 refactor(cache): normalize build dependencies once (#22704)
  • 9b5fab7 fix(deps): bump the dependencies group with 4 updates (#22683)
  • b46763e feat: apply top-level plugins of a multi-configuration to the MultiCompiler (...
  • Additional commits viewable in compare view

Updates webpack-dev-server from 6.0.0 to 6.1.0

Release notes

Sourced from webpack-dev-server's releases.

v6.1.0

Minor Changes

  • Run as a plugin from the top-level plugins of a multi-configuration, serving every configuration from one server. (by @​alexander-akait in #5765)

  • Fix client progress modes, socket URL credentials, overlay and progress lifecycles, server startup error handling and local IP lookup; export BaseServer. (by @​alexander-akait in #5739)

  • The browser client, the error overlay and both transports now come from webpack-dev-middleware, so this package has no client code of its own. Every option keeps its name and meaning, allowedHosts and the origin checks still apply here, and this server's { type } messages are still sent next to the middleware's, so React Refresh keeps working. client/index.js, client/socket.js and client/clients/WebSocketClient.js still resolve while the client's internal files are gone, and the console wording, the overlay and the progress indicator are now the middleware's. client.webSocketTransport: "sse" adds Server-Sent Events, a universal build now runs in Node without the client throwing, and sendMessage(), getClientEntry() and getClientHotEntry() still work, a subclass's overrides included, but are deprecated. (by @​alexander-akait in #5750)

Patch Changes

  • Keep hot and live reload working after a cancelled "Leave site?" dialog. (by @​alexander-akait in #5744)

  • Keep the overlay for a runtime error thrown while the page is still loading. (by @​alexander-akait in #5745)

  • Validate the Host and Origin headers and enforce same-origin checks on WebSocket upgrade requests handled by proxies with ws: true. This prevents cross-origin pages from connecting to proxied WebSocket services through the development server. (by @​UlisesGascon in cb1534a)

  • Validate options with a precompiled schema to cut ~115ms from startup. (by @​alexander-akait in #5746)

  • Validate Host and HTTP/2 authority headers independently of Origin protocol exceptions, including when allowedHosts is "all". Handle malformed open-editor URLs with a controlled response and parse their query without relying on the Host header. (by @​bjohansebas in #5771)

Changelog

Sourced from webpack-dev-server's changelog.

6.1.0

Minor Changes

  • Run as a plugin from the top-level plugins of a multi-configuration, serving every configuration from one server. (by @​alexander-akait in #5765)

  • Fix client progress modes, socket URL credentials, overlay and progress lifecycles, server startup error handling and local IP lookup; export BaseServer. (by @​alexander-akait in #5739)

  • The browser client, the error overlay and both transports now come from webpack-dev-middleware, so this package has no client code of its own. Every option keeps its name and meaning, allowedHosts and the origin checks still apply here, and this server's { type } messages are still sent next to the middleware's, so React Refresh keeps working. client/index.js, client/socket.js and client/clients/WebSocketClient.js still resolve while the client's internal files are gone, and the console wording, the overlay and the progress indicator are now the middleware's. client.webSocketTransport: "sse" adds Server-Sent Events, a universal build now runs in Node without the client throwing, and sendMessage(), getClientEntry() and getClientHotEntry() still work, a subclass's overrides included, but are deprecated. (by @​alexander-akait in #5750)

Patch Changes

  • Keep hot and live reload working after a cancelled "Leave site?" dialog. (by @​alexander-akait in #5744)

  • Keep the overlay for a runtime error thrown while the page is still loading. (by @​alexander-akait in #5745)

  • Validate the Host and Origin headers and enforce same-origin checks on WebSocket upgrade requests handled by proxies with ws: true. This prevents cross-origin pages from connecting to proxied WebSocket services through the development server. (by @​UlisesGascon in cb1534a)

  • Validate options with a precompiled schema to cut ~115ms from startup. (by @​alexander-akait in #5746)

  • Validate Host and HTTP/2 authority headers independently of Origin protocol exceptions, including when allowedHosts is "all". Handle malformed open-editor URLs with a controlled response and parse their query without relying on the Host header. (by @​bjohansebas in #5771)

Commits
  • 50f2c43 chore(release): new release (#5740)
  • 807c441 fix: validate host headers and handle malformed editor URLs (#5771)
  • b4eb797 feat: run as a plugin from the top-level plugins of a multi-configuration (#5...
  • 9915359 fix: update generated websocket proxy types (#5767)
  • cb1534a Merge commit from fork
  • be1ca90 chore(deps): bump the dependencies group across 1 directory with 19 updates (...
  • dc9a72c feat: run on webpack-dev-middleware's client, with compatibility kept here (#...
  • d16ad96 chore(deps): bump the dependencies group with 3 updates (#5762)
  • 69077c9 chore(deps-dev): bump hono (#5756)
  • 6a11ab1 chore(deps): bump the dependencies group across 1 directory with 4 updates (#...
  • Additional commits viewable in compare view

Updates zod from 3.23.8 to 3.25.76

Release notes

Sourced from zod's releases.

v3.25.76

Commits:

  • 91c9ca6385bef38278605294498af06c89b9aa68 fix: cleanup _idmap of $ZodRegistry (#4837)
  • 9cce1c5779aea32d00226a931a7f67d3e2529d58 docs: fix typo in flattenError example on error-formatting page (#4819) (#4833)
  • a3560aeb6c3a8675a932601be79cfae897eec9d9 v3.25.76 (#4838)
  • 50606616c0d291caf3210a7521da51271b918333 Release 3.25.76
  • 7baee4e17f86f4017e09e12b0acdee36a5b1c087 Update index.mdx (#4831)

v3.25.75

Commits:

  • c5f349b6c4e76f879eba9fd350dd79950fcb02f9 Fix z.undefined() behavior in toJSONSchema

v3.25.74

Commits:

  • ae0dbe1f79b2421f6d91ec0796295763436b26e2 Partial record
  • 39c5f71c92b9c4c39fc0a59b9375204fa140eaf0 3.25.74

v3.25.73

Commits:

  • 1021d3c230d41d600698a6d98b9db86c19f56904 v3.25.73 (#4822)

v3.25.72

Commits:

  • 4a4dac7cfb787162eeb79165d39bbb4830d4a6de Warn about id uniqueness check on Metadata page (#4782)
  • 7a5838dc0da967e15a217bf5abdd81f725da46c4 feat(locale): Add Esperanto (eo) locale (#4743)
  • 36fe14e1472f2a7cd71415841be8832fc4e9acc5 Fix optionality of schemas (#4769)
  • 20c8c4b67b508d653012808f69c43c7cfe5b39e3 Fix re-export bug
  • 8b0df10c8757a5fbd75bd65128ae183d764b3304 3.25.72

v3.25.71

Commits:

  • 66a0f34bfc746acddbfb68426b8b1b3f1d3d1727 Move source to /src (#4808)
  • 2a15f44606fd66335c6ebc1f91d702bb6bc95693 3.25.71

v3.25.70

Commits:

  • bd81c7cfaa03f61365d1c708c7e0f1cac54ea9ca Add ecosystem listing to homepage
  • 1ddb9719564e644722852193930a09d54f720443 Add Mobb to sponsors
  • 30ba440859f5b9184817f578626ff85d484aec27 Clean up ecosystem.mdx
  • 0ef1b85b5923a1a06a2afab47dbad249d105a997 Add svelte-jsonschema-form to form integrations (#4784)
  • 14715f147363e88e73190bb6ddbdf008914f0b19 docs: fix Lambda spelling (#4804)
  • f6da030188ea30defc025bbc672e5a81fbe93078 Add back src (#4806)
  • 364200a67c9f74ef252dbfa65ea93aab8fb15c06 Revert "Add back src (#4806)"

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by colinhacks, a new releaser for zod since your current version.


Updates dotenv from 18.0.7 to 18.0.8

Change...

Description has been truncated

@dependabot
Bump the npm-minor-and-patch group across 1 directory with 15 updates
bb57f8c 
Bumps the npm-minor-and-patch group with 15 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@vitest/spy](https://github.com/vitest-dev/vitest/tree/HEAD/packages/spy) | `5.0.4` | `5.0.5` |
| [turbo](https://github.com/vercel/turborepo) | `2.11.8` | `2.11.9` |
| [rollup](https://github.com/rollup/rollup) | `4.64.6` | `4.64.10` |
| [webpack](https://github.com/webpack/webpack) | `5.111.1` | `5.112.0` |
| [webpack-dev-server](https://github.com/webpack/webpack-dev-server) | `6.0.0` | `6.1.0` |
| [zod](https://github.com/colinhacks/zod) | `3.23.8` | `3.25.76` |
| [dotenv](https://github.com/motdotla/dotenv) | `18.0.7` | `18.0.8` |
| [express](https://github.com/expressjs/express) | `4.22.2` | `4.22.3` |
| [i18next](https://github.com/i18next/i18next) | `26.4.4` | `26.5.2` |
| [i18next-fs-backend](https://github.com/i18next/i18next-fs-backend) | `2.6.8` | `2.6.9` |
| [@vitest/browser-playwright](https://github.com/vitest-dev/vitest/tree/HEAD/packages/browser-playwright) | `5.0.4` | `5.0.5` |
| [playwright](https://github.com/microsoft/playwright) | `1.64.0` | `1.64.1` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.3.0` | `19.3.1` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.3.0` | `19.3.1` |
| [cypress](https://github.com/cypress-io/cypress) | `16.1.1` | `16.2.0` |



Updates `@vitest/spy` from 5.0.4 to 5.0.5
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/spy)

Updates `turbo` from 2.11.8 to 2.11.9
- [Release notes](https://github.com/vercel/turborepo/releases)
- [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md)
- [Commits](vercel/turborepo@v2.11.8...v2.11.9)

Updates `rollup` from 4.64.6 to 4.64.10
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.64.6...v4.64.10)

Updates `webpack` from 5.111.1 to 5.112.0
- [Release notes](https://github.com/webpack/webpack/releases)
- [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack@v5.111.1...v5.112.0)

Updates `webpack-dev-server` from 6.0.0 to 6.1.0
- [Release notes](https://github.com/webpack/webpack-dev-server/releases)
- [Changelog](https://github.com/webpack/webpack-dev-server/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack-dev-server@v6.0.0...v6.1.0)

Updates `zod` from 3.23.8 to 3.25.76
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v3.23.8...v3.25.76)

Updates `dotenv` from 18.0.7 to 18.0.8
- [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md)
- [Commits](motdotla/dotenv@v18.0.7...v18.0.8)

Updates `express` from 4.22.2 to 4.22.3
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/v4.22.3/History.md)
- [Commits](expressjs/express@v4.22.2...v4.22.3)

Updates `i18next` from 26.4.4 to 26.5.2
- [Release notes](https://github.com/i18next/i18next/releases)
- [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/i18next@v26.4.4...v26.5.2)

Updates `i18next-fs-backend` from 2.6.8 to 2.6.9
- [Changelog](https://github.com/i18next/i18next-fs-backend/blob/master/CHANGELOG.md)
- [Commits](i18next/i18next-fs-backend@v2.6.8...v2.6.9)

Updates `@vitest/browser-playwright` from 5.0.4 to 5.0.5
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/browser-playwright)

Updates `playwright` from 1.64.0 to 1.64.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.64.0...v1.64.1)

Updates `react` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react)

Updates `react-dom` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom)

Updates `cypress` from 16.1.1 to 16.2.0
- [Release notes](https://github.com/cypress-io/cypress/releases)
- [Changelog](https://github.com/cypress-io/cypress/blob/develop/CHANGELOG.md)
- [Commits](cypress-io/cypress@v16.1.1...v16.2.0)

---
updated-dependencies:
- dependency-name: "@vitest/spy"
  dependency-version: 5.0.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: turbo
  dependency-version: 2.11.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: rollup
  dependency-version: 4.64.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: webpack
  dependency-version: 5.112.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: webpack-dev-server
  dependency-version: 6.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: zod
  dependency-version: 3.25.76
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: dotenv
  dependency-version: 18.0.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: express
  dependency-version: 4.22.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: i18next
  dependency-version: 26.5.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: i18next-fs-backend
  dependency-version: 2.6.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@vitest/browser-playwright"
  dependency-version: 5.0.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: playwright
  dependency-version: 1.64.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: react
  dependency-version: 19.3.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: react-dom
  dependency-version: 19.3.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: cypress
  dependency-version: 16.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from forgetso as a code owner October 26, 2026 12:37
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 26, 2026
@dependabot dependabot Bot added the javascript Pull requests that update Javascript code label Oct 26, 2026
@HughParry
HughParry enabled auto-merge (squash) October 26, 2026 13:37
@HughParry
HughParry merged commit 1966fc1 into main Oct 26, 2026
21 checks passed
@HughParry
HughParry deleted the dependabot/npm_and_yarn/npm-minor-and-patch-370add2672 branch October 26, 2026 15:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@forgetso forgetso Awaiting requested review from forgetso forgetso is a code owner
@goastler goastler Awaiting requested review from goastler goastler is a code owner
@HughParry HughParry Awaiting requested review from HughParry HughParry is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@HughParry @prosoponator