Skip to content

Bump the npm-minor-and-patch group across 1 directory with 8 updates - #184

Merged
andrewkoltsov merged 1 commit into
masterfrom
dependabot/npm_and_yarn/npm-minor-and-patch-ae8e7d7a9b
Sep 20, 2026
Merged

Bump the npm-minor-and-patch group across 1 directory with 8 updates#184
andrewkoltsov merged 1 commit into
masterfrom
dependabot/npm_and_yarn/npm-minor-and-patch-ae8e7d7a9b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 19, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-minor-and-patch group with 8 updates in the / directory:

Package From To
@valibot/to-json-schema 1.7.1 1.8.0
valibot 1.4.2 1.5.0
@types/node 26.5.0 26.6.1
@vitest/coverage-v8 5.0.0 5.0.1
fast-check 4.9.0 4.10.1
lint-staged 17.5.0 17.5.1
vite 8.2.2 8.3.0
vitest 5.0.0 5.0.1

Updates @valibot/to-json-schema from 1.7.1 to 1.8.0

Release notes

Sourced from @​valibot/to-json-schema's releases.

v1.8.0 (to-json-schema)

Many thanks to @​dylanpulver, @​dzhu-amplify, @​francisjohnjohnston-web, @​idleberg, @​jagregory, @​lazerg, @​LeSingh1, @​MathurAditya724, @​maximilliangrand, @​MFA-G, @​mrlubos, @​rajanpanth, @​sanjibani, @​spokodev, @​ysknsid25, and @​yslpn for contributing to this release.

  • Add support for ksuid action (pull request #1370)
  • Add passthrough of other metadata action properties to support custom annotations and standard keywords like format, which take precedence over generated properties (pull request #1591)
  • Fix overlapping values, notValue and notValues actions to preserve all restrictions, including value actions for OpenAPI 3.0 (pull request #1613)
  • Fix value actions to report conflicting constant restrictions by default (pull request #1613)
  • Fix empty and duplicate requirements of values and notValues actions to produce valid enum restrictions or an impossible schema (pull request #1613)
  • Fix overlapping numeric, length, and object entry bounds to preserve the stricter constraints, including combinations with nonEmpty and safeInteger actions (pull request #1611)
  • Fix minValue, maxValue, gtValue and ltValue actions to reject NaN and infinite requirements by default and skip them in warn and ignore error modes (pull request #1611)
  • Fix length, minLength, maxLength, entries, minEntries and maxEntries actions to require non-negative integers by default and skip invalid requirements in warn and ignore error modes (pull request #1611)
  • Fix examples property type of JsonSchema to always be an array (pull request #1607)
  • Fix JSON compatibility validation of literal schemas to reject NaN and infinite numbers by default (pull request #1573)
  • Fix JSON compatibility validation of enum and picklist schemas to reject NaN and infinite numbers by default (pull request #1612)
  • Fix literal, enum and picklist schemas to skip unsupported values in warn and ignore error modes (pull request #1612)
  • Fix minValue, maxValue, gtValue and ltValue actions to skip numeric constraints on unsupported types in warn and ignore error modes (pull request #1595)
  • Fix generation of reference IDs for lazy schemas to produce consistent output and avoid collisions with existing definitions (pull request #1604)
  • Change ConversionContext.referenceMap type from Map to its ReferenceMap subclass (pull request #1604)
  • Change Valibot peer dependency to v1.5.0
Commits

Updates valibot from 1.4.2 to 1.5.0

Release notes

Sourced from valibot's releases.

v1.5.0

Many thanks to @​tats-u, @​idleberg, @​yslpn, @​francisjohnjohnston-web, @​MaxFreedomPollard, @​mahirhir, @​ItzXynx, @​LeSingh1, @​maxtaran2010, @​ysknsid25, @​cyyynthia, @​spokodev and @​sanjibani for contributing to this release.

  • Add codePoints, maxCodePoints, minCodePoints and notCodePoints validation actions to validate the number of Unicode code points (pull request #888)
  • Add ksuid validation action to validate KSUIDs (pull request #1370)
  • Change Standard Schema properties to use eager initialization for faster schema construction and replace internal _getStandardProps utility with _standardSchema (pull request #1534)
  • Change url action to use URL.canParse when available to avoid constructing URL objects (pull request #1608)
  • Fix stringifyJson action to preserve the dataset value when JSON.stringify returns undefined (pull request #1476)
  • Fix literal schema and value, values, notValue and notValues actions to treat NaN as equal to itself (pull request #1573)
  • Fix intersect schema to merge matching NaN values and invalid dates (pull request #1573)
  • Fix cache and cacheAsync methods to clone the issues of a cached dataset, preventing parent schemas from adding their path item to the same issue on every cache hit (pull request #1620)
  • Fix strictObject, looseObject, objectWithRest and their async variants to correctly handle unknown input keys that collide with Object.prototype members (pull request #1523)
  • Fix intersect and intersectAsync schemas to ignore inherited properties when merging objects and preserve own properties without invoking inherited setters or changing the output prototype (pull request #1621)
  • Fix ulid action to reject ULIDs that exceed the maximum 128-bit value (pull request #1498)
  • Fix email action to reject non-ASCII characters accepted by Unicode case folding (pull request #1075)

v1.5.0 (to-json-schema)

  • Add support for JSON Schema draft-2020-12 and OpenAPI 3.0 Schema Object format
  • Add propertyNames support to record schemas for key validation constraints
  • Add support for toBigint, toBoolean, toDate, toNumber and toString actions for typeMode: 'input'
  • Add new toStandardJsonSchema function to convert Valibot schemas to Standard JSON Schema format
  • Change return type from JSONSchema7 to a custom JsonSchema type
Commits
  • 5016198 chore: prepare Valibot v1.5.0 release (#1627)
  • 1ffb038 fix(intersect): skip inherited prototype props in _merge (#1621)
  • 1c4983f fix(ulid): restrict first character to 0-7 per ULID spec (#1498)
  • 5e449cd perf(url): use URL.canParse for validation (#1608)
  • 4acda1b Make sure that email validators don't match unintentional non-ASCII local par...
  • 95943ab fix: handle object keys that collide with Object.prototype in object schemas ...
  • d65438c fix(cache): clone cached issues to stop issue paths from accumulating (#1620)
  • 3ed804a dependabot: bump the github-actions group across 1 directory with 2 updates (...
  • 0681f43 fix: use SameValueZero equality for special numeric values (#1573)
  • 98ef8b4 Improve perf by changing ~standard implementation (#1534)
  • Additional commits viewable in compare view

Updates @types/node from 26.5.0 to 26.6.1

Commits

Updates @vitest/coverage-v8 from 5.0.0 to 5.0.1

Release notes

Sourced from @​vitest/coverage-v8's releases.

v5.0.1

   🚀 Features

   🐞 Bug Fixes

    View changes on GitHub
Commits

Updates fast-check from 4.9.0 to 4.10.1

Release notes

Sourced from fast-check's releases.

Fix fake-timer compatibility in timeout and interrupt plugins

[Code][Diff]

Fixes

  • (PR#7293) Bug: Capture timers for interruptAfterTimeLimit plugin
  • (PR#7282) CI: Temporarily disable documentation updates until v5
  • (PR#7279) Doc: Release note for 4.10.0

New plugin API and deprecations ahead of v5

[Code][Diff]

Features

  • (PR#7216) Introduce a plugin API
  • (PR#7221) Refine plugin API
  • (PR#7222) Add ability to configure plugins globally
  • (PR#7224) Add the beforeEach plugin to hook in life-cycle
  • (PR#7227) Create an afterEach plugin
  • (PR#7232) Deprecate life-cycle methods
  • (PR#7235) Support teardown of beforeEach plugin
  • (PR#7228) Add timeout plugin to stop long running predicates
  • (PR#7237) Deprecate timeout from parameters
  • (PR#7238) Pass a store to plugins
  • (PR#7239) Add extra plugin's method called onAllRunsComplete
  • (PR#7240) Deprecate reporter and asyncReporter from parameters
  • (PR#7229) Add plugin to interrupt after time limit
  • (PR#7245) Support failOnInterrupt on the plugin
  • (PR#7230) Add plugins to drop runs on already covered cases
  • (PR#7259) Add ability to decorate generate via Plugins
  • (PR#7231) Add the unbiased plugin to generate without bias
  • (PR#7260) Deprecate parameters superseded by plugins
  • (PR#7261) Deprecate v5 removals

Fixes

  • (PR#7225) Bug: Proper ordering between plugins
  • (PR#7127) CI: Announce on Bluesky when drafting the release
  • (PR#7217) CI: Dedupe packages for pnpm
  • (PR#7137) Doc: Release note for 4.9.0
  • (PR#7226) Doc: Fix admonition titles on the website
  • (PR#7246) Doc: Add jkomyno as code contributor
  • (PR#7251) Performance: Single timer for interruptAfterTimeLimit
Changelog

Sourced from fast-check's changelog.

4.10.1

Fix fake-timer compatibility in timeout and interrupt plugins [Code][Diff]

Fixes

  • (PR#7293) Bug: Capture timers for interruptAfterTimeLimit plugin
  • (PR#7282) CI: Temporarily disable documentation updates until v5
  • (PR#7279) Doc: Release note for 4.10.0

4.10.0

New plugin API and deprecations ahead of v5 [Code][Diff]

Features

  • (PR#7216) Introduce a plugin API
  • (PR#7221) Refine plugin API
  • (PR#7222) Add ability to configure plugins globally
  • (PR#7224) Add the beforeEach plugin to hook in life-cycle
  • (PR#7227) Create an afterEach plugin
  • (PR#7232) Deprecate life-cycle methods
  • (PR#7235) Support teardown of beforeEach plugin
  • (PR#7228) Add timeout plugin to stop long running predicates
  • (PR#7237) Deprecate timeout from parameters
  • (PR#7238) Pass a store to plugins
  • (PR#7239) Add extra plugin's method called onAllRunsComplete
  • (PR#7240) Deprecate reporter and asyncReporter from parameters
  • (PR#7229) Add plugin to interrupt after time limit
  • (PR#7245) Support failOnInterrupt on the plugin
  • (PR#7230) Add plugins to drop runs on already covered cases
  • (PR#7259) Add ability to decorate generate via Plugins
  • (PR#7231) Add the unbiased plugin to generate without bias
  • (PR#7260) Deprecate parameters superseded by plugins
  • (PR#7261) Deprecate v5 removals

Fixes

  • (PR#7225) Bug: Proper ordering between plugins
  • (PR#7127) CI: Announce on Bluesky when drafting the release
  • (PR#7217) CI: Dedupe packages for pnpm
  • (PR#7137) Doc: Release note for 4.9.0
  • (PR#7226) Doc: Fix admonition titles on the website
  • (PR#7246) Doc: Add jkomyno as code contributor
  • (PR#7251) Performance: Single timer for interruptAfterTimeLimit
Commits
  • e93c6a8 🔖 Update CHANGELOG.md for fast-check@4.10.1 (#7294)
  • 15744d0 🐛 Capture timers for interruptAfterTimeLimit plugin (#7293)
  • fb2ea50 🐛 Capture timer globals for timeout plugin (#7292)
  • 4fba17d 🔖 Update CHANGELOG.md for fast-check@4.10.0, @​fast-check/jest@​2.3.0, @​fast-ch...
  • a433d8b ⬆️ Update dependency @​types/node to ^24.13.4 (#7263)
  • 8470c46 ⬆️ Update dependency @​microsoft/api-extractor to ^7.59.1 (#7255)
  • 5382221 🗑️ Deprecate v5 removals (#7261)
  • 3cc3696 🗑️ Deprecate parameters superseded by plugins (#7260)
  • a93374d ✨ Add the unbiased plugin to generate without bias (#7231)
  • 0f1bf99 ✨ Add ability to decorate generate via Plugins (#7259)
  • Additional commits viewable in compare view

Updates lint-staged from 17.5.0 to 17.5.1

Release notes

Sourced from lint-staged's releases.

v17.5.1

Patch Changes

  • #1852 bfcca94 - Fix TypeScript issue TS1254 from defineConfig() by changing the signature from const to a function:

    A 'const' initializer in an ambient context must be a string or numeric literal or literal enum reference.

Changelog

Sourced from lint-staged's changelog.

17.5.1

Patch Changes

  • #1852 bfcca94 - Fix TypeScript issue TS1254 from defineConfig() by changing the signature from const to a function:

    A 'const' initializer in an ambient context must be a string or numeric literal or literal enum reference.

Commits
  • f8b1ab1 Merge pull request #1853 from lint-staged/changeset-release/main
  • 3b54961 chore(changeset): release
  • 09317ff Merge pull request #1852 from lint-staged/fix-ambient-declaration
  • bfcca94 fix: change defineConfig signature from const to a function
  • See full diff in compare view

Updates vite from 8.2.2 to 8.3.0

Release notes

Sourced from vite's releases.

create-vite@8.3.0

Please refer to CHANGELOG.md for details.

v8.3.0

Features

  • build: avoid settling seen preload dependencies for performance (#23446) (e6f6b3e)

Bug Fixes

  • handle CRLF line endings in code frame positions (#23219) (9913672)
  • only treat whole node_modules path segments as dependencies (fix #17467) (#23437) (ef0dc17)

Performance Improvements

  • proxy: pre-compile context matchers at server creation (#23263) (8abf700)

v8.3.0-beta.1

Features

Bug Fixes

  • build: keep hash placeholders as-is in resolveFileUrl hook (#23422) (e8d6a4d)
  • bundled-dev: mark payload delivered on client report (#23373) (a6d43bc)
  • deps: update all non-major dependencies (#23445) (fc7c104)
  • html: don't inline preload link targets (fix #13355) (#23387) (12e709c)
  • resolve the actual package root in findNearestMainPackageData for nested package.json (#23356) (8492422)
  • shortcuts extend error (#23447) (4ec58d1)

Miscellaneous Chores

v8.3.0-beta.0

Features

  • accept Rolldown watch options in server.watch (#23133) (1b5cfe3)
  • add closeServer and closePreviewServer hooks (#23110) (e17d2d5)
  • add top-level tsconfig option (#23310) (93164c3)
  • add warning for unsupported hooks in plugin returned from applyToEnvironment hook (#23191) (fdef04f)
  • cli: support naming the CPU profile via --profile [name] (#23042) (a500dee)
  • config: warn on named imports from JSON modules (#23378) (472385e)
  • css: minify style tag (#23183) (8156684)
  • searched params attached to workers are now preserved (#22280) (517b97f)
  • support subpath imports in dynamic import statements (#23185) (b78e2f1)
  • use import.meta.ROLLDOWN_FILE_URL_* for assets in JS (#22888) (4366ac4)
  • use import.meta.ROLLDOWN_FILE_URL_* for other plugins (#22894) (e38f29e)

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.0 (2026-09-10)

Features

  • build: avoid settling seen preload dependencies for performance (#23446) (e6f6b3e)
  • devtools: enable dev server integration (#23333) (68aeb8a)
  • accept Rolldown watch options in server.watch (#23133) (1b5cfe3)
  • add closeServer and closePreviewServer hooks (#23110) (e17d2d5)
  • add top-level tsconfig option (#23310) (93164c3)
  • add warning for unsupported hooks in plugin returned from applyToEnvironment hook (#23191) (fdef04f)
  • cli: support naming the CPU profile via --profile [name] (#23042) (a500dee)
  • config: warn on named imports from JSON modules (#23378) (472385e)
  • css: minify style tag (#23183) (8156684)
  • searched params attached to workers are now preserved (#22280) (517b97f)
  • support subpath imports in dynamic import statements (#23185) (b78e2f1)
  • use import.meta.ROLLDOWN_FILE_URL_* for assets in JS (#22888) (4366ac4)
  • use import.meta.ROLLDOWN_FILE_URL_* for other plugins (#22894) (e38f29e)
  • worker: remove worker chunk if it's detected that it's not referenced (#22473) (924997a)

Bug Fixes

  • handle CRLF line endings in code frame positions (#23219) (9913672)
  • only treat whole node_modules path segments as dependencies (fix #17467) (#23437) (ef0dc17)
  • build: keep hash placeholders as-is in resolveFileUrl hook (#23422) (e8d6a4d)
  • bundled-dev: mark payload delivered on client report (#23373) (a6d43bc)
  • deps: update all non-major dependencies (#23445) (fc7c104)
  • html: don't inline preload link targets (fix #13355) (#23387) (12e709c)
  • resolve the actual package root in findNearestMainPackageData for nested package.json (#23356) (8492422)
  • shortcuts extend error (#23447) (4ec58d1)
  • config: close bundles when generation fails (#23256) (6bacc95)
  • css: keep newline-separated srcset candidates intact (#23265) (4f9d2f4)
  • deps: update all non-major dependencies (#23337) (d550815)
  • deps: update all non-major dependencies (#23404) (238ad81)
  • deps: update rolldown-related dependencies (#23338) (76e8082)
  • deps: update rolldown-related dependencies (#23405) (b882566)
  • dev: run closeBundle after buildEnd failure (#23165) (8cb872e)
  • hmr: handle import.meta.hot.invalidate in virtual module (#23171) (6162968)
  • utils: handle dot in srcset density descriptor (#23346) (b50e1b4)
  • utils: match timestamp query parameter with proper delimiters (#23364) (41f3c6f)

Performance Improvements

  • proxy: pre-compile context matchers at server creation (#23263) (8abf700)

Miscellaneous Chores

... (truncated)

Commits

Updates vitest from 5.0.0 to 5.0.1

Release notes

Sourced from vitest's releases.

v5.0.1

   🚀 Features

   🐞 Bug Fixes

@dependabot
Bump the npm-minor-and-patch group across 1 directory with 8 updates
83738be 
Bumps the npm-minor-and-patch group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@valibot/to-json-schema](https://github.com/open-circle/valibot) | `1.7.1` | `1.8.0` |
| [valibot](https://github.com/open-circle/valibot) | `1.4.2` | `1.5.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.5.0` | `26.6.1` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `5.0.0` | `5.0.1` |
| [fast-check](https://github.com/dubzzz/fast-check/tree/HEAD/packages/fast-check) | `4.9.0` | `4.10.1` |
| [lint-staged](https://github.com/lint-staged/lint-staged) | `17.5.0` | `17.5.1` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.2` | `8.3.0` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.0` | `5.0.1` |



Updates `@valibot/to-json-schema` from 1.7.1 to 1.8.0
- [Release notes](https://github.com/open-circle/valibot/releases)
- [Commits](https://github.com/open-circle/valibot/commits)

Updates `valibot` from 1.4.2 to 1.5.0
- [Release notes](https://github.com/open-circle/valibot/releases)
- [Commits](open-circle/valibot@v1.4.2...v1.5.0)

Updates `@types/node` from 26.5.0 to 26.6.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@vitest/coverage-v8` from 5.0.0 to 5.0.1
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.1/packages/coverage-v8)

Updates `fast-check` from 4.9.0 to 4.10.1
- [Release notes](https://github.com/dubzzz/fast-check/releases)
- [Changelog](https://github.com/dubzzz/fast-check/blob/main/packages/fast-check/CHANGELOG.md)
- [Commits](https://github.com/dubzzz/fast-check/commits/v4.10.1/packages/fast-check)

Updates `lint-staged` from 17.5.0 to 17.5.1
- [Release notes](https://github.com/lint-staged/lint-staged/releases)
- [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md)
- [Commits](lint-staged/lint-staged@v17.5.0...v17.5.1)

Updates `vite` from 8.2.2 to 8.3.0
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/create-vite@8.3.0/packages/vite)

Updates `vitest` from 5.0.0 to 5.0.1
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.1/packages/vitest)

---
updated-dependencies:
- dependency-name: "@valibot/to-json-schema"
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: valibot
  dependency-version: 1.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@types/node"
  dependency-version: 26.6.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 5.0.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: fast-check
  dependency-version: 4.10.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: lint-staged
  dependency-version: 17.5.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: vite
  dependency-version: 8.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: vitest
  dependency-version: 5.0.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Dependency updates label Sep 19, 2026
@dependabot
dependabot Bot requested a review from andrewkoltsov as a code owner September 19, 2026 07:03
@socket-security

socket-security Bot commented Sep 19, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updated@​vitest/​coverage-v8@​5.0.0 ⏵ 5.0.1991007998 -1100
Updatedvitest@​5.0.0 ⏵ 5.0.198 +110079 +199100
Updated@​types/​node@​26.5.0 ⏵ 26.6.1100 +110081 +196 +1100
Updatedvite@​8.2.2 ⏵ 8.3.099 +110082 +196 +1100
Updated@​valibot/​to-json-schema@​1.7.1 ⏵ 1.8.0100 +110010089100
Updatedvalibot@​1.4.2 ⏵ 1.5.01001009989 +2100
Updatedfast-check@​4.9.0 ⏵ 4.10.1100 +1100100 +192 +1100
Updatedlint-staged@​17.5.0 ⏵ 17.5.1100 +110010097 +2100

View full report

@andrewkoltsov
andrewkoltsov merged commit 1418326 into master Sep 20, 2026
11 checks passed
@andrewkoltsov
andrewkoltsov deleted the dependabot/npm_and_yarn/npm-minor-and-patch-ae8e7d7a9b branch September 20, 2026 08:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@andrewkoltsov andrewkoltsov Awaiting requested review from andrewkoltsov andrewkoltsov is a code owner

Assignees

No one assigned

Labels

dependencies Dependency updates

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@andrewkoltsov