Skip to content

build(deps): bump the npm-minor-and-patch group across 2 directories with 38 updates - #9749

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-and-patch-c2b5432ee9
Open

build(deps): bump the npm-minor-and-patch group across 2 directories with 38 updates#9749
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-and-patch-c2b5432ee9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 10, 2026

Copy link
Copy Markdown

Bumps the npm-minor-and-patch group with 37 updates in the / directory:

Package From To
@babel/parser 8.0.4 8.1.0
@babel/types 8.0.4 8.1.0
@clack/prompts 1.7.0 1.8.1
@modelcontextprotocol/client 2.3.1 2.4.0
@modelcontextprotocol/server 2.3.1 2.4.0
@zip.js/zip.js 2.15.0 2.24.0
cborg 6.1.3 6.2.1
evmole 0.9.3 0.9.4
ignore 7.0.6 7.0.14
incur 0.6.1 0.7.1
isomorphic-git 1.38.7 1.44.10
lossless-json 4.3.1 4.3.3
parse5 8.0.1 8.1.0
semver 7.8.5 7.8.6
@types/semver 7.7.1 7.8.0
smol-toml 1.9.0 1.9.1
stream-chain 4.2.6 4.4.1
stream-json 3.7.0 3.8.0
ws 8.21.0 8.22.1
@types/ws 8.18.1 8.18.2
yaml 2.9.0 2.9.1
zod 4.6.6 4.6.7
@electron/asar 4.2.0 4.3.1
@stryker-mutator/core 10.0.0 10.1.1
@stryker-mutator/typescript-checker 10.0.0 10.1.1
@stryker-mutator/vitest-runner 10.0.0 10.1.1
@types/node 26.6.4 26.6.6
@types/semver 7.7.1 7.8.0
@types/ws 8.18.1 8.18.2
@vitest/coverage-v8 5.0.3 5.1.0
jscpd 5.0.12 5.4.2
knip 6.39.0 6.44.1
oxfmt 0.72.0 0.75.0
oxlint 1.87.0 1.90.0
release-please 17.3.0 17.11.2
rolldown 1.2.12 1.2.16
turbo 2.11.7 2.11.10
vitest 5.0.3 5.1.0
frida 17.23.2 17.25.2

Bumps the npm-minor-and-patch group with 1 update in the /scripts/verify-tools/skills directory: skills.

Updates @babel/parser from 8.0.4 to 8.1.0

Release notes

Sourced from @​babel/parser's releases.

v8.1.0 (2026-11-02)

NOTE: @babel/plugin-proposal-bytes-modules, @babel/plugin-proposal-filtered-namespaces, and @babel/plugin-proposal-text-modules were accidentally excluded from this release. We're working on re-publishing the as 8.1.1.

Thanks @​Kjubikstronk for your first PR!

🚀 New Feature

  • babel-helper-module-transforms, babel-helper-transform-fixture-test-runner, babel-helpers, babel-plugin-proposal-bytes-modules, babel-plugin-proposal-filtered-namespaces, babel-plugin-proposal-import-wasm-source, babel-plugin-proposal-text-modules, babel-plugin-transform-dynamic-import, babel-plugin-transform-json-modules, babel-runtime-corejs3, babel-runtime, babel-standalone
  • babel-generator, babel-helper-import-to-platform-api, babel-helper-module-transforms, babel-parser, babel-plugin-transform-export-namespace-from, babel-plugin-transform-json-modules, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-plugin-transform-modules-umd, babel-traverse, babel-types
  • Other
  • babel-helper-import-to-platform-api, babel-helper-transform-fixture-test-runner, babel-helpers, babel-plugin-proposal-bytes-modules, babel-plugin-proposal-import-wasm-source, babel-plugin-proposal-text-modules, babel-plugin-transform-json-modules, babel-runtime-corejs3, babel-runtime
  • babel-generator, babel-parser, babel-traverse, babel-types
    • #17624 Add parse support for the "structs" proposal (only non-shared) (@​JLHwung)
  • babel-generator, babel-parser, babel-types
  • babel-generator, babel-helper-module-transforms, babel-parser, babel-plugin-transform-export-namespace-from, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-plugin-transform-modules-umd, babel-types
  • babel-cli, babel-core, babel-generator, babel-helper-transform-fixture-test-runner
  • babel-core
  • babel-core, babel-plugin-transform-classes

🐛 Bug Fix

  • babel-parser
  • babel-helper-skip-transparent-expression-wrappers, babel-plugin-transform-optional-chaining

🔬 Output optimization

  • babel-helpers, babel-runtime-corejs3

Committers: 4

v8.0.10 (2026-10-29)

Thanks @​dagemawinegash, @​nyan-left, @​saiyam-jain-dev, and @​yulman2207 for your first PRs!

... (truncated)

Changelog

Sourced from @​babel/parser's changelog.

v8.1.0 (2026-11-02)

🚀 New Feature

  • babel-helper-module-transforms, babel-helper-transform-fixture-test-runner, babel-helpers, babel-plugin-proposal-bytes-modules, babel-plugin-proposal-filtered-namespaces, babel-plugin-proposal-import-wasm-source, babel-plugin-proposal-text-modules, babel-plugin-transform-dynamic-import, babel-plugin-transform-json-modules, babel-runtime-corejs3, babel-runtime, babel-standalone
  • babel-generator, babel-helper-import-to-platform-api, babel-helper-module-transforms, babel-parser, babel-plugin-transform-export-namespace-from, babel-plugin-transform-json-modules, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-plugin-transform-modules-umd, babel-traverse, babel-types
  • Other
  • babel-helper-import-to-platform-api, babel-helper-transform-fixture-test-runner, babel-helpers, babel-plugin-proposal-bytes-modules, babel-plugin-proposal-import-wasm-source, babel-plugin-proposal-text-modules, babel-plugin-transform-json-modules, babel-runtime-corejs3, babel-runtime
  • babel-generator, babel-parser, babel-traverse, babel-types
    • #17624 Add parse support for the "structs" proposal (only non-shared) (@​JLHwung)
  • babel-generator, babel-parser, babel-types
  • babel-generator, babel-helper-module-transforms, babel-parser, babel-plugin-transform-export-namespace-from, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-plugin-transform-modules-umd, babel-types
  • babel-cli, babel-core, babel-generator, babel-helper-transform-fixture-test-runner
  • babel-core
  • babel-core, babel-plugin-transform-classes

🐛 Bug Fix

  • babel-parser
  • babel-helper-skip-transparent-expression-wrappers, babel-plugin-transform-optional-chaining

🔬 Output optimization

  • babel-helpers, babel-runtime-corejs3

v8.0.10 (2026-10-29)

🐛 Bug Fix

  • babel-parser
  • babel-plugin-transform-block-scoping

... (truncated)

Commits

Updates @babel/types from 8.0.4 to 8.1.0

Release notes

Sourced from @​babel/types's releases.

v8.1.0 (2026-11-02)

NOTE: @babel/plugin-proposal-bytes-modules, @babel/plugin-proposal-filtered-namespaces, and @babel/plugin-proposal-text-modules were accidentally excluded from this release. We're working on re-publishing the as 8.1.1.

Thanks @​Kjubikstronk for your first PR!

🚀 New Feature

  • babel-helper-module-transforms, babel-helper-transform-fixture-test-runner, babel-helpers, babel-plugin-proposal-bytes-modules, babel-plugin-proposal-filtered-namespaces, babel-plugin-proposal-import-wasm-source, babel-plugin-proposal-text-modules, babel-plugin-transform-dynamic-import, babel-plugin-transform-json-modules, babel-runtime-corejs3, babel-runtime, babel-standalone
  • babel-generator, babel-helper-import-to-platform-api, babel-helper-module-transforms, babel-parser, babel-plugin-transform-export-namespace-from, babel-plugin-transform-json-modules, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-plugin-transform-modules-umd, babel-traverse, babel-types
  • Other
  • babel-helper-import-to-platform-api, babel-helper-transform-fixture-test-runner, babel-helpers, babel-plugin-proposal-bytes-modules, babel-plugin-proposal-import-wasm-source, babel-plugin-proposal-text-modules, babel-plugin-transform-json-modules, babel-runtime-corejs3, babel-runtime
  • babel-generator, babel-parser, babel-traverse, babel-types
    • #17624 Add parse support for the "structs" proposal (only non-shared) (@​JLHwung)
  • babel-generator, babel-parser, babel-types
  • babel-generator, babel-helper-module-transforms, babel-parser, babel-plugin-transform-export-namespace-from, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-plugin-transform-modules-umd, babel-types
  • babel-cli, babel-core, babel-generator, babel-helper-transform-fixture-test-runner
  • babel-core
  • babel-core, babel-plugin-transform-classes

🐛 Bug Fix

  • babel-parser
  • babel-helper-skip-transparent-expression-wrappers, babel-plugin-transform-optional-chaining

🔬 Output optimization

  • babel-helpers, babel-runtime-corejs3

Committers: 4

v8.0.10 (2026-10-29)

Thanks @​dagemawinegash, @​nyan-left, @​saiyam-jain-dev, and @​yulman2207 for your first PRs!

... (truncated)

Changelog

Sourced from @​babel/types's changelog.

v8.1.0 (2026-11-02)

🚀 New Feature

  • babel-helper-module-transforms, babel-helper-transform-fixture-test-runner, babel-helpers, babel-plugin-proposal-bytes-modules, babel-plugin-proposal-filtered-namespaces, babel-plugin-proposal-import-wasm-source, babel-plugin-proposal-text-modules, babel-plugin-transform-dynamic-import, babel-plugin-transform-json-modules, babel-runtime-corejs3, babel-runtime, babel-standalone
  • babel-generator, babel-helper-import-to-platform-api, babel-helper-module-transforms, babel-parser, babel-plugin-transform-export-namespace-from, babel-plugin-transform-json-modules, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-plugin-transform-modules-umd, babel-traverse, babel-types
  • Other
  • babel-helper-import-to-platform-api, babel-helper-transform-fixture-test-runner, babel-helpers, babel-plugin-proposal-bytes-modules, babel-plugin-proposal-import-wasm-source, babel-plugin-proposal-text-modules, babel-plugin-transform-json-modules, babel-runtime-corejs3, babel-runtime
  • babel-generator, babel-parser, babel-traverse, babel-types
    • #17624 Add parse support for the "structs" proposal (only non-shared) (@​JLHwung)
  • babel-generator, babel-parser, babel-types
  • babel-generator, babel-helper-module-transforms, babel-parser, babel-plugin-transform-export-namespace-from, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-plugin-transform-modules-umd, babel-types
  • babel-cli, babel-core, babel-generator, babel-helper-transform-fixture-test-runner
  • babel-core
  • babel-core, babel-plugin-transform-classes

🐛 Bug Fix

  • babel-parser
  • babel-helper-skip-transparent-expression-wrappers, babel-plugin-transform-optional-chaining

🔬 Output optimization

  • babel-helpers, babel-runtime-corejs3

v8.0.10 (2026-10-29)

🐛 Bug Fix

  • babel-parser
  • babel-plugin-transform-block-scoping

... (truncated)

Commits

Updates @clack/prompts from 1.7.0 to 1.8.1

Release notes

Sourced from @​clack/prompts's releases.

@​clack/prompts@​1.8.1

Patch Changes

  • 8bd9129 Thanks @​gameroman! - Return type for prompts now correctly specifies CANCEL_SYMBOL instead of symbol

  • Updated dependencies [8bd9129]:

    • @​clack/core@​1.5.1

@​clack/prompts@​1.8.0

Minor Changes

  • #592 caa32e8 Thanks @​gameroman! - Export CANCEL_SYMBOL constant from @clack/core and @clack/prompts

  • #594 37fca4e Thanks @​dreyfus92! - Add tab-completion to the path prompt: pressing Tab fills the input with the focused suggestion, so you can quickly descend into deep directories (type / and Tab again). Powered by a new opt-in completeOnTab option on autocomplete, which also shows a Tab: complete hint in the instructions footer. Default autocomplete behavior is unchanged.

  • #583 ae636dd Thanks @​43081j! - Add async validation support to prompts, and validation state rendering to text prompts.

Patch Changes

Changelog

Sourced from @​clack/prompts's changelog.

1.8.1

Patch Changes

  • 8bd9129 Thanks @​gameroman! - Return type for prompts now correctly specifies CANCEL_SYMBOL instead of symbol

  • Updated dependencies [8bd9129]:

    • @​clack/core@​1.5.1

1.8.0

Minor Changes

  • #592 caa32e8 Thanks @​gameroman! - Export CANCEL_SYMBOL constant from @clack/core and @clack/prompts

  • #594 37fca4e Thanks @​dreyfus92! - Add tab-completion to the path prompt: pressing Tab fills the input with the focused suggestion, so you can quickly descend into deep directories (type / and Tab again). Powered by a new opt-in completeOnTab option on autocomplete, which also shows a Tab: complete hint in the instructions footer. Default autocomplete behavior is unchanged.

  • #583 ae636dd Thanks @​43081j! - Add async validation support to prompts, and validation state rendering to text prompts.

Patch Changes

Commits

Updates @modelcontextprotocol/client from 2.3.1 to 2.4.0

Release notes

Sourced from @​modelcontextprotocol/client's releases.

@​modelcontextprotocol/client@​2.4.0

Minor Changes

  • #3085 a633756 Thanks @​claude! - Add an opt-in for sending scope on refresh-token requests, for authorization servers that reject a refresh without it (Microsoft Entra ID answers AADSTS90009 when the client and the resource are the same app registration, #2718). OAuthClientProvider gains an optional scopeForRefresh(tokens): auth(), and so the transports and withOAuth, sends the string it returns. refreshAuthorization() gains an optional scope. When a scope is sent and the response has none, the sent scope is kept on the returned tokens. Without either option the refresh request and the saved tokens are unchanged.

  • #3047 46d9c99 Thanks @​KKonstantinov, @​tobi-oye, @​mattzcarey! - Add the Skills extension (SEP-2640), reachable through new ext/skills subpaths; package root exports are unchanged.

    • @modelcontextprotocol/server/ext/skills: SkillsExtension (attach(server) serves skills/list, skills/get, resources/directory/read and a skill://{+path} resource template), SkillsExtension.load(files) returning a SkillCatalog with entries and reload(), the SkillFiles storage adapter with memorySkillFiles, SkillSource for generated catalogs, skillEntry, and SkillCatalogError. Invalid skills are skipped with a warning (onWarning), or fail under strict. A file whose bytes are valid UTF-8 is served as text, whatever its MIME type; any other file as a base64 blob.
    • @modelcontextprotocol/server/ext/skills/node: loadSkills(folder) and nodeSkillFiles(folder).
    • @modelcontextprotocol/client/ext/skills: SkillsClient with list() (throws on an invalid entry; skipInvalid: true keeps the valid ones and returns the rest in invalid), get(), read(skill, path?) (size, digest and SKILL.md frontmatter verified, SkillVerificationError on a mismatch; a copy from the response cache that fails a check is fetched once more with cacheMode: 'refresh' first) and readDirectory().
    • @modelcontextprotocol/core/ext/skills: schemas, types and constants, including SKILL_LIMITS. The result schemas follow the stable spec, so ttlMs and cacheScope are required.

    SkillsExtension.attach is @experimental: how an extension is wired to a server may change in a minor release. The rest of the Skills API is stable.

    Works on 2025-11-25 and 2026-07-28. On 2026-07-28 only, the server sends the caching fields (ttlMs, cacheScope), and SkillsClient requires them and returns them from list(), get() and readDirectory().

Patch Changes

  • #3083 ef38c67 Thanks @​claude! - The bundled Ajv validator is now built with fast-uri 3.1.8 (was 3.1.0). fast-uri 3.1.6 and later reject a $id or $ref whose text before the first colon is not a valid URI scheme (my_tool:output), or whose URN namespace is not valid (urn:my_tool:output): a schema that uses one no longer compiles, and a tool that carries it fails with an invalid-schema error. An underscore without a colon (my_tool_output) and a $ref into #/$defs/... or #/definitions/... are not affected.

  • #2762 b022522 Thanks @​pcarleton! - x-mcp-header on a number-typed tool parameter is now rejected, matching the 2026-07-28 spec ("Parameters with type number are not permitted"; clients MUST exclude such tools from tools/list). Previously number was accepted only to satisfy an older conformance fixture that has since been corrected. integer, string and boolean are unaffected.

  • Updated dependencies [46d9c99]:

    • @​modelcontextprotocol/core@​2.4.0
Commits
  • 951fe56 Version Packages (#2959)
  • 895007f fix(server): set Allow: POST on stateless legacy 405 responses (#3002)
  • 28124db fix(docs): use relative POSIX package entry globs (#3016)
  • f7289b3 docs: say that a spec handler's params drop members the spec does not define ...
  • a633756 feat(client): add an opt-in for sending scope on token refresh (#3085)
  • 10c26b0 chore(node): accept @​hono/node-server 1.x or 2.x (#3084)
  • ef38c67 chore(deps): build the bundled ajv with fast-uri 3.1.8 (#3083)
  • 5820f79 fix(server): treat an outputSchema root $ref to an object definition as an ob...
  • a513cfe docs: close the v1 to v2 quick path with the 2026-07-28 serving decision (#3086)
  • c822443 docs(server): mark SkillsExtension.attach as experimental (#3080)
  • Additional commits viewable in compare view

Updates @modelcontextprotocol/server from 2.3.1 to 2.4.0

Release notes

Sourced from @​modelcontextprotocol/server's releases.

@​modelcontextprotocol/server-legacy@​2.4.0

Patch Changes

  • Updated dependencies [46d9c99]:
    • @​modelcontextprotocol/core@​2.4.0

@​modelcontextprotocol/server@​2.4.0

Minor Changes

  • #3057 c05225a Thanks @​steipete! - ServerEvent takes optional params, which the subscriptions/listen router delivers with its own subscription ID, so a gateway can forward change notifications with their _meta and extension params.

  • #3047 46d9c99 Thanks @​KKonstantinov, @​tobi-oye, @​mattzcarey! - Add the Skills extension (SEP-2640), reachable through new ext/skills subpaths; package root exports are unchanged.

    • @modelcontextprotocol/server/ext/skills: SkillsExtension (attach(server) serves skills/list, skills/get, resources/directory/read and a skill://{+path} resource template), SkillsExtension.load(files) returning a SkillCatalog with entries and reload(), the SkillFiles storage adapter with memorySkillFiles, SkillSource for generated catalogs, skillEntry, and SkillCatalogError. Invalid skills are skipped with a warning (onWarning), or fail under strict. A file whose bytes are valid UTF-8 is served as text, whatever its MIME type; any other file as a base64 blob.
    • @modelcontextprotocol/server/ext/skills/node: loadSkills(folder) and nodeSkillFiles(folder).
    • @modelcontextprotocol/client/ext/skills: SkillsClient with list() (throws on an invalid entry; skipInvalid: true keeps the valid ones and returns the rest in invalid), get(), read(skill, path?) (size, digest and SKILL.md frontmatter verified, SkillVerificationError on a mismatch; a copy from the response cache that fails a check is fet...

      Description has been truncated

@dependabot
build(deps): bump the npm-minor-and-patch group across 2 directories …
41d4081 
…with 38 updates

Bumps the npm-minor-and-patch group with 37 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@babel/parser](https://github.com/babel/babel/tree/HEAD/packages/babel-parser) | `8.0.4` | `8.1.0` |
| [@babel/types](https://github.com/babel/babel/tree/HEAD/packages/babel-types) | `8.0.4` | `8.1.0` |
| [@clack/prompts](https://github.com/bombshell-dev/clack/tree/HEAD/packages/prompts) | `1.7.0` | `1.8.1` |
| [@modelcontextprotocol/client](https://github.com/modelcontextprotocol/typescript-sdk) | `2.3.1` | `2.4.0` |
| [@modelcontextprotocol/server](https://github.com/modelcontextprotocol/typescript-sdk) | `2.3.1` | `2.4.0` |
| [@zip.js/zip.js](https://github.com/gildas-lormeau/zip.js) | `2.15.0` | `2.24.0` |
| [cborg](https://github.com/rvagg/cborg) | `6.1.3` | `6.2.1` |
| [evmole](https://github.com/cdump/evmole/tree/HEAD/javascript) | `0.9.3` | `0.9.4` |
| [ignore](https://github.com/kaelzhang/node-ignore) | `7.0.6` | `7.0.14` |
| [incur](https://github.com/wevm/incur) | `0.6.1` | `0.7.1` |
| [isomorphic-git](https://github.com/isomorphic-git/isomorphic-git) | `1.38.7` | `1.44.10` |
| [lossless-json](https://github.com/josdejong/lossless-json) | `4.3.1` | `4.3.3` |
| [parse5](https://github.com/inikulin/parse5) | `8.0.1` | `8.1.0` |
| [semver](https://github.com/npm/node-semver) | `7.8.5` | `7.8.6` |
| [@types/semver](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/semver) | `7.7.1` | `7.8.0` |
| [smol-toml](https://github.com/squirrelchat/smol-toml) | `1.9.0` | `1.9.1` |
| [stream-chain](https://github.com/uhop/stream-chain) | `4.2.6` | `4.4.1` |
| [stream-json](https://github.com/uhop/stream-json) | `3.7.0` | `3.8.0` |
| [ws](https://github.com/websockets/ws) | `8.21.0` | `8.22.1` |
| [@types/ws](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/ws) | `8.18.1` | `8.18.2` |
| [yaml](https://github.com/eemeli/yaml) | `2.9.0` | `2.9.1` |
| [zod](https://github.com/colinhacks/zod) | `4.6.6` | `4.6.7` |
| [@electron/asar](https://github.com/electron/asar) | `4.2.0` | `4.3.1` |
| [@stryker-mutator/core](https://github.com/stryker-mutator/stryker-js/tree/HEAD/packages/core) | `10.0.0` | `10.1.1` |
| [@stryker-mutator/typescript-checker](https://github.com/stryker-mutator/stryker-js/tree/HEAD/packages/typescript-checker) | `10.0.0` | `10.1.1` |
| [@stryker-mutator/vitest-runner](https://github.com/stryker-mutator/stryker-js/tree/HEAD/packages/vitest-runner) | `10.0.0` | `10.1.1` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.4` | `26.6.6` |
| [@types/semver](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/semver) | `7.7.1` | `7.8.0` |
| [@types/ws](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/ws) | `8.18.1` | `8.18.2` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `5.0.3` | `5.1.0` |
| [jscpd](https://github.com/kucherenko/jscpd/tree/HEAD/rust/jscpd) | `5.0.12` | `5.4.2` |
| [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) | `6.39.0` | `6.44.1` |
| [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) | `0.72.0` | `0.75.0` |
| [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.87.0` | `1.90.0` |
| [release-please](https://github.com/googleapis/release-please) | `17.3.0` | `17.11.2` |
| [rolldown](https://github.com/rolldown/rolldown/tree/HEAD/packages/rolldown) | `1.2.12` | `1.2.16` |
| [turbo](https://github.com/vercel/turborepo) | `2.11.7` | `2.11.10` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.3` | `5.1.0` |
| [frida](https://github.com/frida/frida-node) | `17.23.2` | `17.25.2` |

Bumps the npm-minor-and-patch group with 1 update in the /scripts/verify-tools/skills directory: [skills](https://github.com/vercel-labs/skills).


Updates `@babel/parser` from 8.0.4 to 8.1.0
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v8.1.0/packages/babel-parser)

Updates `@babel/types` from 8.0.4 to 8.1.0
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v8.1.0/packages/babel-types)

Updates `@clack/prompts` from 1.7.0 to 1.8.1
- [Release notes](https://github.com/bombshell-dev/clack/releases)
- [Changelog](https://github.com/bombshell-dev/clack/blob/main/packages/prompts/CHANGELOG.md)
- [Commits](https://github.com/bombshell-dev/clack/commits/@clack/prompts@1.8.1/packages/prompts)

Updates `@modelcontextprotocol/client` from 2.3.1 to 2.4.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/client@2.3.1...@modelcontextprotocol/client@2.4.0)

Updates `@modelcontextprotocol/server` from 2.3.1 to 2.4.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/server@2.3.1...@modelcontextprotocol/server@2.4.0)

Updates `@zip.js/zip.js` from 2.15.0 to 2.24.0
- [Release notes](https://github.com/gildas-lormeau/zip.js/releases)
- [Commits](gildas-lormeau/zip.js@v2.15.0...v2.24.0)

Updates `cborg` from 6.1.3 to 6.2.1
- [Release notes](https://github.com/rvagg/cborg/releases)
- [Changelog](https://github.com/rvagg/cborg/blob/master/CHANGELOG.md)
- [Commits](rvagg/cborg@v6.1.3...v6.2.1)

Updates `evmole` from 0.9.3 to 0.9.4
- [Release notes](https://github.com/cdump/evmole/releases)
- [Commits](https://github.com/cdump/evmole/commits/0.9.4/javascript)

Updates `ignore` from 7.0.6 to 7.0.14
- [Release notes](https://github.com/kaelzhang/node-ignore/releases)
- [Commits](kaelzhang/node-ignore@7.0.6...7.0.14)

Updates `incur` from 0.6.1 to 0.7.1
- [Release notes](https://github.com/wevm/incur/releases)
- [Changelog](https://github.com/wevm/incur/blob/main/CHANGELOG.md)
- [Commits](https://github.com/wevm/incur/compare/incur@0.6.1...incur@0.7.1)

Updates `isomorphic-git` from 1.38.7 to 1.44.10
- [Release notes](https://github.com/isomorphic-git/isomorphic-git/releases)
- [Commits](isomorphic-git/isomorphic-git@v1.38.7...v1.44.10)

Updates `lossless-json` from 4.3.1 to 4.3.3
- [Changelog](https://github.com/josdejong/lossless-json/blob/main/CHANGELOG.md)
- [Commits](josdejong/lossless-json@v4.3.1...v4.3.3)

Updates `parse5` from 8.0.1 to 8.1.0
- [Release notes](https://github.com/inikulin/parse5/releases)
- [Commits](inikulin/parse5@v8.0.1...v8.1.0)

Updates `semver` from 7.8.5 to 7.8.6
- [Release notes](https://github.com/npm/node-semver/releases)
- [Changelog](https://github.com/npm/node-semver/blob/main/CHANGELOG.md)
- [Commits](npm/node-semver@v7.8.5...v7.8.6)

Updates `@types/semver` from 7.7.1 to 7.8.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/semver)

Updates `smol-toml` from 1.9.0 to 1.9.1
- [Release notes](https://github.com/squirrelchat/smol-toml/releases)
- [Commits](squirrelchat/smol-toml@v1.9.0...v1.9.1)

Updates `stream-chain` from 4.2.6 to 4.4.1
- [Commits](uhop/stream-chain@4.2.6...4.4.1)

Updates `stream-json` from 3.7.0 to 3.8.0
- [Commits](uhop/stream-json@3.7.0...3.8.0)

Updates `ws` from 8.21.0 to 8.22.1
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.21.0...8.22.1)

Updates `@types/ws` from 8.18.1 to 8.18.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/ws)

Updates `yaml` from 2.9.0 to 2.9.1
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.9.0...v2.9.1)

Updates `zod` from 4.6.6 to 4.6.7
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.6.6...v4.6.7)

Updates `@electron/asar` from 4.2.0 to 4.3.1
- [Release notes](https://github.com/electron/asar/releases)
- [Changelog](https://github.com/electron/asar/blob/main/CHANGELOG.md)
- [Commits](electron/asar@v4.2.0...v4.3.1)

Updates `@stryker-mutator/core` from 10.0.0 to 10.1.1
- [Release notes](https://github.com/stryker-mutator/stryker-js/releases)
- [Changelog](https://github.com/stryker-mutator/stryker-js/blob/master/packages/core/CHANGELOG.md)
- [Commits](https://github.com/stryker-mutator/stryker-js/commits/v10.1.1/packages/core)

Updates `@stryker-mutator/typescript-checker` from 10.0.0 to 10.1.1
- [Release notes](https://github.com/stryker-mutator/stryker-js/releases)
- [Changelog](https://github.com/stryker-mutator/stryker-js/blob/master/packages/typescript-checker/CHANGELOG.md)
- [Commits](https://github.com/stryker-mutator/stryker-js/commits/v10.1.1/packages/typescript-checker)

Updates `@stryker-mutator/vitest-runner` from 10.0.0 to 10.1.1
- [Release notes](https://github.com/stryker-mutator/stryker-js/releases)
- [Changelog](https://github.com/stryker-mutator/stryker-js/blob/master/packages/vitest-runner/CHANGELOG.md)
- [Commits](https://github.com/stryker-mutator/stryker-js/commits/v10.1.1/packages/vitest-runner)

Updates `@types/node` from 26.6.4 to 26.6.6
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/semver` from 7.7.1 to 7.8.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/semver)

Updates `@types/ws` from 8.18.1 to 8.18.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/ws)

Updates `@vitest/coverage-v8` from 5.0.3 to 5.1.0
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.1.0/packages/coverage-v8)

Updates `jscpd` from 5.0.12 to 5.4.2
- [Release notes](https://github.com/kucherenko/jscpd/releases)
- [Commits](https://github.com/kucherenko/jscpd/commits/v5.4.2/rust/jscpd)

Updates `knip` from 6.39.0 to 6.44.1
- [Release notes](https://github.com/webpro-nl/knip/releases)
- [Commits](https://github.com/webpro-nl/knip/commits/knip@6.44.1/packages/knip)

Updates `oxfmt` from 0.72.0 to 0.75.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxfmt/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxfmt_v0.75.0/npm/oxfmt)

Updates `oxlint` from 1.87.0 to 1.90.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.90.0/npm/oxlint)

Updates `release-please` from 17.3.0 to 17.11.2
- [Release notes](https://github.com/googleapis/release-please/releases)
- [Changelog](https://github.com/googleapis/release-please/blob/main/CHANGELOG.md)
- [Commits](googleapis/release-please@v17.3.0...v17.11.2)

Updates `rolldown` from 1.2.12 to 1.2.16
- [Release notes](https://github.com/rolldown/rolldown/releases)
- [Changelog](https://github.com/rolldown/rolldown/blob/main/CHANGELOG.md)
- [Commits](https://github.com/rolldown/rolldown/commits/v1.2.16/packages/rolldown)

Updates `turbo` from 2.11.7 to 2.11.10
- [Release notes](https://github.com/vercel/turborepo/releases)
- [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md)
- [Commits](vercel/turborepo@v2.11.7...v2.11.10)

Updates `vitest` from 5.0.3 to 5.1.0
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.1.0/packages/vitest)

Updates `frida` from 17.23.2 to 17.25.2
- [Commits](frida/frida-node@17.23.2...17.25.2)

Updates `skills` from 1.7.2 to 1.7.6
- [Release notes](https://github.com/vercel-labs/skills/releases)
- [Commits](vercel-labs/skills@v1.7.2...v1.7.6)

---
updated-dependencies:
- dependency-name: "@babel/parser"
  dependency-version: 8.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@babel/types"
  dependency-version: 8.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@clack/prompts"
  dependency-version: 1.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@modelcontextprotocol/client"
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@modelcontextprotocol/server"
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@zip.js/zip.js"
  dependency-version: 2.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: cborg
  dependency-version: 6.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: evmole
  dependency-version: 0.9.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: ignore
  dependency-version: 7.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: incur
  dependency-version: 0.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: isomorphic-git
  dependency-version: 1.44.10
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: lossless-json
  dependency-version: 4.3.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: parse5
  dependency-version: 8.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: semver
  dependency-version: 7.8.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@types/semver"
  dependency-version: 7.8.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: smol-toml
  dependency-version: 1.9.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: stream-chain
  dependency-version: 4.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: stream-json
  dependency-version: 3.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: ws
  dependency-version: 8.22.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@types/ws"
  dependency-version: 8.18.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: yaml
  dependency-version: 2.9.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: zod
  dependency-version: 4.6.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@electron/asar"
  dependency-version: 4.3.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@stryker-mutator/core"
  dependency-version: 10.1.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@stryker-mutator/typescript-checker"
  dependency-version: 10.1.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@stryker-mutator/vitest-runner"
  dependency-version: 10.1.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@types/node"
  dependency-version: 26.6.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@types/semver"
  dependency-version: 7.8.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@types/ws"
  dependency-version: 8.18.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 5.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: jscpd
  dependency-version: 5.4.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: knip
  dependency-version: 6.44.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: oxfmt
  dependency-version: 0.75.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: oxlint
  dependency-version: 1.90.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: release-please
  dependency-version: 17.11.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: rolldown
  dependency-version: 1.2.16
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: turbo
  dependency-version: 2.11.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: vitest
  dependency-version: 5.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: frida
  dependency-version: 17.25.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: skills
  dependency-version: 1.7.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 10, 2026
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-11-10T01:31:42.003345Z 41d4081 PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@ShuaixinHuang ShuaixinHuang mentioned this pull request Nov 10, 2026
Closed
3 tasks done
chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Nov 10, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 41d408107f

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread package.json
},
"optionalDependencies": {
"frida": "17.23.2"
"frida": "17.25.2"

@chatgpt-codex-connector chatgpt-codex-connector Bot Nov 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Update the Frida install-script allowlist

When dependencies are installed with the repository's pinned npm toolchain, the new frida@17.25.2 package still has an install script, but allowScripts authorizes only frida@17.23.2. Consequently the upgraded optional native dependency is no longer authorized to install its binding, leaving Frida commands unavailable on a fresh install; update the exact allowlist entry together with this version bump.

Useful? React with 👍 / 👎.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments
@morluto morluto Awaiting requested review from morluto morluto is a code owner
@kaoru0822-kitauji kaoru0822-kitauji Awaiting requested review from kaoru0822-kitauji kaoru0822-kitauji is a code owner
@N0zoM1z0 N0zoM1z0 Awaiting requested review from N0zoM1z0 N0zoM1z0 is a code owner
@gensokyo-dev gensokyo-dev Awaiting requested review from gensokyo-dev gensokyo-dev is a code owner

At least 0 approving reviews are required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants