chore(deps): bump the npm_and_yarn group across 1 directory with 9 updates by dependabot[bot] · Pull Request #21 · datisthq/fairspec-python

dependabot · 2026-09-28T23:38:35Z

Bumps the npm_and_yarn group with 9 updates in the / directory:

Package	From	To
@babel/core	`7.29.0`	`7.29.7`
@hono/node-server	`1.19.14`	`1.19.17`
brace-expansion	`5.0.5`	`5.0.12`
fast-uri	`3.1.2`	`3.1.8`
ip-address	`10.2.0`	`10.7.2`
js-yaml	`3.14.2`	`3.15.2`
mermaid	`11.15.0`	`11.17.2`
qs	`6.15.1`	`6.16.0`
shell-quote	`1.8.3`	`1.10.0`

Updates @babel/core from 7.29.0 to 7.29.7

Release notes

Sourced from @babel/core's releases.

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

v7.29.6 (2026-05-25)

🐛 Bug Fix

babel-generator

#18014 Catchup source map position in preserveFormat (@nicolo-ribaudo)

babel-core

#18001 [7.x packport]Improve input source map handling (@JLHwung)

babel-core, babel-generator

#17998 Preserve original identifier names from input sourcemaps (#17992) (@Andarist)

Committers: 3

Huáng Jùnliàng (@JLHwung)

Mateusz Burzyński (@Andarist)

Nicolò Ribaudo (@nicolo-ribaudo)

v7.29.5 (2026-05-05)

🏠 Internal

babel-preset-env

Update @babel/* dependencies

v7.29.4 (2026-05-05)

🐛 Bug Fix

babel-plugin-transform-modules-systemjs

#17974 [7.x backport]fix(systemjs): improve module string name support (@JLHwung)

Committers: 1

Huáng Jùnliàng (@JLHwung)

v7.29.3 (2026-04-30)

👓 Spec Compliance

babel-parser

#17923 Support flow extends bound (@JLHwung)

🐛 Bug Fix

babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators

#17931 fix(decorators): replace super within all removed static elements (@JLHwung)

babel-register

#17915 Fix thread synchronization issues in @babel/register (@liuxingbaoyu)

babel-compat-data, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-preset-env

#17788 Add bugfix plugin for Safari array rest destructuring bug (@JLHwung)

💅 Polish

babel-parser

... (truncated)

Commits

4fba754 v7.29.7
04ea6b2 v7.29.6
99f498a [7.x packport]Improve input source map handling (#18001)
feba0a3 Preserve original identifier names from input sourcemaps (#17992) (#17998)
See full diff in compare view

Updates @hono/node-server from 1.19.14 to 1.19.17

Commits

71941da 1.19.17
0208500 ci: add stage option for publishing (#386)
cbdf713 1.19.16
86e96c2 ci: add an action for trusted publisher (#385)
99c1a1a ci: run on v1.x branch pushes
84cb2ee Merge commit from fork
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @hono/node-server since your current version.

Updates brace-expansion from 5.0.5 to 5.0.12

Commits

f341015 5.0.12
33a5ef1 Merge commit from fork
8247927 5.0.11
935d78f Merge commit from fork
df7682f 5.0.10
1ade9de npm run format
6735c94 Merge commit from fork
4e70465 chore: ensure prettier formatting (#154)
fd7a5e3 Bump ip-address from 10.2.0 to 10.4.0 (#152)
1790143 Bump uuid and @tapjs/processinfo (#120)
Additional commits viewable in compare view

Updates fast-uri from 3.1.2 to 3.1.8

Release notes

Sourced from fast-uri's releases.

v3.1.8

⚠️ Security Warning

This security release fixes the following medium-severity security advisory:

GHSA-hrr3-gc8f-f4qj — inconsistent host case normalization via percent-encoded octets

Users of the v3.x release line should upgrade to v3.1.8.

Full Changelog: fastify/fast-uri@v3.1.7...v3.1.8

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

GHSA-qw65-cvwx-89v3 — authority injection via an unvalidated port in serialize()

GHSA-58mr-gqgx-xq4g — host confusion via unbalanced or misplaced IP-literal brackets

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

v3.1.6

⚠️ Security Warning

This release addresses the following high-severity security advisories:

GHSA-5jgf-p345-68v8 — host confusion via skipped IDN canonicalization on scheme-relative references

GHSA-fph4-wmhf-6fwf — server-side request forgery via repeated hostname percent-decoding

GHSA-f65p-4m7j-42xc — server-side request forgery via malformed IPv6 normalization

GHSA-jqff-g426-hqxp — host confusion via percent-encoded scheme normalization

Users of the v3.x release line should upgrade to v3.1.6.

Full Changelog: fastify/fast-uri@v3.1.5...v3.1.6

v3.1.5

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

... (truncated)

Commits

ead3ab7 Bumped v3.1.8
c88b59e fix: normalize decoded reg-name case
412e40a Bumped v3.1.7
9f4c943 fix: backport port and IP-literal validation to v3.x (#216)
1eb3ce4 fix: treat unterminated bracket hosts as reg-names again (#214)
6f970b2 Bumped v3.1.6
d941579 fix: never run IDN canonicalization on bracketed IP literals
c0f0279 test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)
37f3417 Merge commit from fork
607bfbe Merge commit from fork
Additional commits viewable in compare view

Updates ip-address from 10.2.0 to 10.7.2

Release notes

Sourced from ip-address's releases.

v10.7.2

What's Changed

Accept an arpa suffix in any case and without the root dot in fromArpa by @beaugunderson in beaugunderson/ip-address#227

Full Changelog: beaugunderson/ip-address@v10.7.1...v10.7.2

v10.7.1

What's Changed

Bump js-yaml and brace-expansion in the lockfile by @beaugunderson in beaugunderson/ip-address#226

Full Changelog: beaugunderson/ip-address@v10.7.0...v10.7.1

v10.7.0

What's Changed

Add offset() and nextNetwork(), accept prefix-length ip6.arpa names, correct the IPv6 end-address docs by @beaugunderson in beaugunderson/ip-address#225

Full Changelog: beaugunderson/ip-address@v10.6.0...v10.7.0

v10.6.0

What's Changed

Add isGlobal() and pin the classifiers to the IANA special-purpose registries by @beaugunderson in beaugunderson/ip-address#224

Full Changelog: beaugunderson/ip-address@v10.5.1...v10.6.0

v10.5.1

Full Changelog: beaugunderson/ip-address@v10.5.0...v10.5.1

v10.5.0

What's Changed

Honor the fromURL graceful-failure contract for non-IPv6 hosts by @beaugunderson in beaugunderson/ip-address#218

Correct the documentation where it disagreed with the library by @beaugunderson in beaugunderson/ip-address#219

Full Changelog: beaugunderson/ip-address@v10.4.0...v10.5.0

v10.4.0

What's Changed

Add GitHub Actions CI by @beaugunderson in beaugunderson/ip-address#213

Keep the package loadable on node 12, and enforce it by @beaugunderson in beaugunderson/ip-address#216

Validate the byte arrays Address6 is given by @beaugunderson in beaugunderson/ip-address#217

Full Changelog: beaugunderson/ip-address@v10.3.1...v10.4.0

v10.3.1

Full Changelog: beaugunderson/ip-address@v10.3.0...v10.3.1

... (truncated)

Commits

974b48d 10.7.2
4dfe8e5 Accept an arpa suffix in any case and without the root dot in fromArpa (#227)
f0c25df 10.7.1
8b34a21 Merge commit from fork
13b6155 Merge commit from fork
469ead1 Reject an address longer than the family allows before parsing it
1343629 Report an address of the other family as not contained
4c2184a Bump js-yaml and brace-expansion in the lockfile (#226)
2b7cab5 10.7.0
87fae23 Add offset() and nextNetwork(), accept prefix-length ip6.arpa names, correct ...
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for ip-address since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates js-yaml from 3.14.2 to 3.15.2

Changelog

Sourced from js-yaml's changelog.

3.15.2 - 2026-08-26

Changed

[backport] Hard-limit merge sequence size to 100.

Security

[backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

3.15.1 - 2026-07-31

Security

[backport] Remove quadratic complexity from !!omap duplicate key detection.

3.15.0 - 2026-06-27

Added

Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one safeLoad() / safeLoadAll() call.

Commits

5c45bd6 3.15.2 released
5a708f9 dist rebuild
3485bc0 Backport merge limits from v5.4.1
f34812f Update .gitignore
ab85ae2 3.15.1 released
30a5e76 dist rebuild
22a8071 Backport quadratic complexity fix for !!omap
c34b6c4 3.15.0 released
21e13d3 dist rebuild
4165c62 Add v3-legacy tag for publish
Additional commits viewable in compare view

Updates mermaid from 11.15.0 to 11.17.2

Release notes

Sourced from mermaid's releases.

mermaid@11.17.2

Patch Changes

#8125 178d7c7 Thanks @knsv-bot! - fix: restore the edgePaths class on the edge group in rendered SVG, and point the flowchart, block and user journey stylesheets at it

mermaid@11.17.1

Patch Changes

#8092 31ce60a Thanks @pbrolin47! - fix(c4): wrap element labels to c4.width again

C4 element labels (System, Container, Component, Person and their _Ext variants) stopped wrapping in 11.17.0, so long descriptions rendered on one unbroken line and the shape grew sideways well past the configured c4.width. The unified-shapes label helper gated wrapping on the root-level wrap option, which has no schema default and is therefore undefined; it now gates on c4.wrap (default true), which is what the legacy renderer used.

#8088 c66200b Thanks @ashishjain0512! - fix: neo-look arrowheads and crow's-foot markers no longer fall back to default theme colours/stroke widths on the first render with layout: elk. State diagram arrowheads stayed dark on dark themes, and ER / requirement markers were drawn at the default stroke width, because markers were created from the layout package's own bundled copy of mermaid, whose config had not been initialized yet.

#8079 281cd7b Thanks @ashishjain0512! - fix(class): class diagram relation markers (composition, aggregation, extension, dependency, lollipop) no longer scale with the edge stroke width, so they stay outside the class box boundary in themes that set strokeWidth: 2 (redux, redux-dark, redux-color, redux-dark-color, neo, neo-dark) with the default classic look.

mermaid@11.17.0

Minor Changes

#7842 3670b4e Thanks @filipsajdak! - feat(c4): render C4 elements through the unified shape system, using the new person shape

#7812 cdfc0ea Thanks @knsv-bot! - feat(class): route classDiagram to the unified (v2) renderer by default

Set class: { defaultRenderer: 'dagre-d3' } in the config to restore the legacy renderer.

#7785 c45cde9 Thanks @knsv-bot! - feat(flowchart): add collapsible flowchart subgraphs via subgraphId@{ view: collapsed }

#7828 8eb3afc Thanks @knsv-bot! - feat(elk): add elk.keepEntryNodeOnTop config option to keep a recursive flow's entry node on top

#7803 74e44eb Thanks @knsv-bot! - feat(elk): add elk.nodePlacementAlignment config option

#7792 ea55b31 Thanks @RodrigojndSantos! - feat(er): add subgraph support to ER diagrams.

#7970 a2c0fb6 Thanks @filipsajdak! - feat(flowchart): add folder, bucket, console (terminal window) and browser shapes

#7842 ae3e115 Thanks @filipsajdak! - feat(flowchart): add person shape (circular head above a rounded body), usable in flowcharts via A@{ shape: person }

#7724 0fd7a9f Thanks @xdumaine! - feat(xyChart): add legends for named line and bar series

Patch Changes

#7847 215fe89 Thanks @filipsajdak! - fix(c4): named attributes such as $tags, $link and $sprite are no longer clobbered to undefined when they arrive in an earlier positional slot of Person/System/Container/Component/Boundary/Rel statements.

#7871 8d874c4 Thanks @knsv-bot! - fix(flowchart): stop dagre layout from spamming warn-level logs on every node/edge/cluster

#8071 b3d1f63 Thanks @pbrolin47! - fix(block): sibling blocks overlapping in block diagrams when one has a label wider than 200px

#7870 71b8843 Thanks @knsv-bot! - fix: a RangeError: Invalid array length crash when rendering certain edges.

#7924 9cbef5d Thanks @nightt5879! - fix(treeView): icons disappearing after strict security sanitization.

... (truncated)

Commits

dcb694d Version Packages (#8130)
178d7c7 fix: restore edgePaths class on the edge group (#8125)
569f46e Version Packages (#8114)
3054836 Version Packages
5b17e0a Merge pull request #8092 from mermaid-js/hotfix/11.17.1
655211a Reverted change of wrap-options
8a23480 Updated doc from feedback
412c80a Update doc and consistent handlig in c4 as for seq diags
b433a9a Updated changeset to describe specifik diagram affected
6bae15e Updated tests to Playwright API
Additional commits viewable in compare view

Updates qs from 6.15.1 to 6.16.0

Changelog

Sourced from qs's changelog.

6.16.0

[New] stringify: add a depth option to bound recursion depth (default Infinity)

[Fix] stringify: serialize Date values when a filter is provided

[Fix] parse: enforce arrayLimit on comma groups under []= when throwOnLimitExceeded is set

[Fix] parse: flatten a collection appended to an overflowed array (#571)

[Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer

[Fix] stringify: do not let allowEmptyArrays skip cycle detection (or drop own keys) on an empty array with own properties

[Fix] stringify: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)

[Docs] threat model: clarify stringify deep-nesting DoS is caller-bounded

[Docs] clarify arrayLimit is a representation threshold, not an element-count cap

[Tests] parse: remove a test that pinned []= comma groups escaping arrayLimit

[Tests] stringify: pin current encodeDotInKeys separator-dot behavior

[Dev Deps] update @ljharb/eslint-config, eslint

[Dev Deps] update eslint, evalmd

6.15.3

[Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via combine/merge

[Fix] utils: respect encoding of surrogate pairs across chunks (#559)

[Robustness] parse: throw the arrayLimit error before splitting oversized comma values

[Robustness] utils.merge / utils.assign: avoid invoking __proto__ setter when copying own properties

[Robustness] utils: enforce arrayLimit consistently across merge's array paths

[Perf] utils: make compact O(n) via a side-channel visited-set instead of Array.indexOf

[Deps] update side-channel

[Dev Deps] update eslint, mock-property, tape

[Tests] parse: characterize current lenient handling of unbalanced bracket keys (#558)

6.15.2

[Fix] stringify: skip null/undefined entries in arrayFormat: 'comma' + encodeValuesOnly instead of crashing in encoder

[Fix] stringify: use configured delimiter after charsetSentinel (#555)

[Fix] stringify: apply formatter to encoded key under strictNullHandling (#554)

[Fix] stringify: skip null/undefined filter-array entries instead of crashing in encoder (#551)

[Fix] parse: handle nested bracket groups and add regression tests (#530); changes output for some unbalanced bracket keys (see #558)

[readme] fix grammar (#550)

[Dev Deps] update @ljharb/eslint-config

[Tests] add regression tests for keys containing percent-encoded bracket text

Commits

bb9379e v6.16.0
62fd254 [Fix] stringify: serialize Date values when a filter is provided
8859c37 [Fix] parse: enforce arrayLimit on comma groups under []= when `throwOn...
8079adc [Tests] parse: remove a test that pinned []= comma groups escaping `array...
d56f48c [Fix] parse: flatten a collection appended to an overflowed array
e83d321 [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
7e87a07 [Dev Deps] update @ljharb/eslint-config, eslint
9a76af2 [Dev Deps] update eslint, evalmd
3a890d4 [Dev Deps] update eslint, evalmd
b433a9b [Fix] stringify: do not let allowEmptyArrays skip cycle detection (or dro...
Additional commits viewable in compare view

Updates shell-quote from 1.8.3 to 1.10.0

Changelog

Sourced from shell-quote's changelog.

v1.10.0 - 2026-07-10

Merged

[New] parse: add opt-in splitUnquoted option for shell field-splitting of unquoted expansions [#1](https://github.com/ljharb/shell-quote/issues/1)

Commits

[Fix] parse: match nested ${...} braces so nested parameter expansion is consumed as one substitution c0842c8

[Tests] parse: pin single-quote literalness and unmatched-quote handling a0d03e3

[readme] remove the space in js code fences so evalmd evaluates them 2116fa3

[Tests] quote: pin conservative escaping of =, @, ^, ,, :, ! (#11) 1c36f3f

[readme] document that quote outputs POSIX quoting, not cmd.exe/PowerShell 100e96e

[readme] document parse's supported parameter-expansion subset e1c75cd

[Fix] parse: a backslash inside single quotes must not escape the closing quote 5d460a3

[readme] fix stale example outputs 2de86f5

[Tests] quote: pin that a backslash with whitespace is not doubled in single quotes (#14) 190e236

[readme] quote: use output verbatim; do not re-quote it (#11) 1b36468

[Refactor] parse: fix swapped SINGLE_QUOTE/DOUBLE_QUOTE variable names 801af5c

[types] fix an error TS v6 ignores but v7 fails on 59bbf8b

[Dev Deps] update @arethetypeswrong/cli, evalmd a04d475

[Dev Deps] update @arethetypeswrong/ci, eslint d390f9a

[Tests] quote: the tilde test escapes every ~, not just a leading one (#9) 617d119

v1.9.0 - 2026-06-24

Commits

[New] add types dca6e21

[Dev Deps] update eslint 9aa9e8f

[Fix] parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv) 7ff5488

[actions] update workflows 75e8497

[actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3 cannot stage eslint 10@types/esrecurse 3fb739d

[actions] retry npm install on Windows to survive npm 2/3 staging-rename flake abe0163

[actions] Windows + node 5/7: install deps with a modern node b4bafa2

[Fix] quote: escape leading ~ to prevent shell tilde-expansion 7a76c1a

[Dev Deps] update auto-changelog, tape 7184b44

[Dev Deps] apparently jackspeak is no longer in the graph 9ba368a

v1.8.4 - 2026-05-22

Commits

[Fix] quote: validate object-token shapes 4378a6e

[Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, npmignore 22ebec0

[Tests] increase coverage 9f3caa3

[readme] replace runkit CI badge with shields.io check-runs badge 3344a04

[Dev Deps] update @ljharb/eslint-config 699c511

Commits

64988d9 v1.10.0
617d119 [Tests] quote: the tilde test escapes every ~, not just a leading one (#9)
59bbf8b [types] fix an error TS v6 ignores but v7 fails on
190e236 [Tests] quote: pin that a backslash with whitespace is not doubled in singl...
a04d475 [Dev Deps] update @arethetypeswrong/cli, evalmd
b9545b3 [New] parse: add opt-in splitUnquoted option for shell field-splitting of...
1b36468 [readme] quote: use output verbatim; do not re-quote it (#11)
1c36f3f [Tests] quote: pin conservative escaping of =, @, ^, ,, :, ! (#11)
e1c75cd [readme] document parse's supported parameter-expansion subset
c0842c8 [Fix] parse: match nested ${...} braces so nested parameter expansion is ...
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

…dates Bumps the npm_and_yarn group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) | `7.29.0` | `7.29.7` | | [@hono/node-server](https://github.com/honojs/node-server) | `1.19.14` | `1.19.17` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `5.0.5` | `5.0.12` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.2` | `3.1.8` | | [ip-address](https://github.com/beaugunderson/ip-address) | `10.2.0` | `10.7.2` | | [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.2` | `3.15.2` | | [mermaid](https://github.com/mermaid-js/mermaid) | `11.15.0` | `11.17.2` | | [qs](https://github.com/ljharb/qs) | `6.15.1` | `6.16.0` | | [shell-quote](https://github.com/ljharb/shell-quote) | `1.8.3` | `1.10.0` | Updates `@babel/core` from 7.29.0 to 7.29.7 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.7/packages/babel-core) Updates `@hono/node-server` from 1.19.14 to 1.19.17 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v1.19.14...v1.19.17) Updates `brace-expansion` from 5.0.5 to 5.0.12 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v5.0.5...v5.0.12) Updates `fast-uri` from 3.1.2 to 3.1.8 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.2...v3.1.8) Updates `ip-address` from 10.2.0 to 10.7.2 - [Release notes](https://github.com/beaugunderson/ip-address/releases) - [Commits](beaugunderson/ip-address@v10.2.0...v10.7.2) Updates `js-yaml` from 3.14.2 to 3.15.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.14.2...3.15.2) Updates `mermaid` from 11.15.0 to 11.17.2 - [Release notes](https://github.com/mermaid-js/mermaid/releases) - [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.15.0...mermaid@11.17.2) Updates `qs` from 6.15.1 to 6.16.0 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.15.1...v6.16.0) Updates `shell-quote` from 1.8.3 to 1.10.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.8.3...v1.10.0) --- updated-dependencies: - dependency-name: "@babel/core" dependency-version: 7.29.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@hono/node-server" dependency-version: 1.19.17 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 5.0.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ip-address dependency-version: 10.7.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 3.15.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: mermaid dependency-version: 11.17.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: shell-quote dependency-version: 1.10.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

claude · 2026-09-28T23:38:52Z

Claude finished @dependabot[bot]'s task in 30s —— View job

Reviewing PR #21

Gather context (dependabot lockfile bump, single file changed)
Review the diff against project/skills/review-changes/SKILL.md
Post findings

Review

This PR only touches pnpm-lock.yaml (+296/-153) — no package.json changes, and none of the nine bumped packages (@babel/core, @hono/node-server, brace-expansion, fast-uri, ip-address, js-yaml, mermaid, qs, shell-quote) are direct dependencies anywhere in the repo's package.json files; they're all transitive. There's no application or repo logic in the diff to review for correctness, security, or convention violations — it's an auto-generated lockfile update.

A few of the bumps are worth taking for their own sake:

fast-uri 3.1.2 → 3.1.8 rolls up several GHSA fixes (host-confusion / SSRF via percent-encoding and IPv6 normalization issues).
js-yaml 3.14.2 → 3.15.2 includes DoS-hardening backports (merge-key limits).
shell-quote 1.8.3 → 1.10.0 includes a linear-time parsing fix for GHSA-395f-4hp3-45gv.

Note (informational, not a blocker): Dependabot flags that the new ip-address@10.7.2 adds a prepare script that runs on install, where the previous version had none. Worth a glance if anyone wants to eyeball the package contents, but this is standard for a transitive dep bump and not something this repo's tooling would normally gate on.

No issues found — safe to merge as a routine dependency update.

cloudflare-workers-and-pages · 2026-09-28T23:38:53Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	fairspec-python	`4d89933`	Commit Preview URL Branch Preview URL	Sep 28 2026, 11:40 PM

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 28, 2026

github-project-automation Bot added this to fairspec Sep 28, 2026

Navigation Menu

chore(deps): bump the npm_and_yarn group across 1 directory with 9 updates - #21

chore(deps): bump the npm_and_yarn group across 1 directory with 9 updates#21
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-f8c982fbd8

dependabot Bot commented on behalf of github Sep 28, 2026

Uh oh!

claude Bot commented Sep 28, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages Bot commented Sep 28, 2026 •

edited

Loading

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Sep 28, 2026

v7.29.7 (2026-05-25)

v7.29.6 (2026-05-25)

🐛 Bug Fix

Committers: 3

v7.29.5 (2026-05-05)

🏠 Internal

v7.29.4 (2026-05-05)

🐛 Bug Fix

Committers: 1

v7.29.3 (2026-04-30)

👓 Spec Compliance

🐛 Bug Fix

💅 Polish

v3.1.8

⚠️ Security Warning

v3.1.7

⚠️ Security Warning

v3.1.6

⚠️ Security Warning

v3.1.5

⚠️ Security Warning

v3.1.4

⚠️ Security Release

v10.7.2

What's Changed

v10.7.1

What's Changed

v10.7.0

What's Changed

v10.6.0

What's Changed

v10.5.1

v10.5.0

What's Changed

v10.4.0

What's Changed

v10.3.1

3.15.2 - 2026-08-26

Changed

Security

3.15.1 - 2026-07-31

Security

3.15.0 - 2026-06-27

Added

mermaid@11.17.2

Patch Changes

mermaid@11.17.1

Patch Changes

mermaid@11.17.0

Minor Changes

Patch Changes

6.16.0

6.15.3

6.15.2

v1.10.0 - 2026-07-10

Merged

Commits

v1.9.0 - 2026-06-24

Commits

v1.8.4 - 2026-05-22

Commits

Uh oh!

claude Bot commented Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviewing PR #21

Review

Uh oh!

cloudflare-workers-and-pages Bot commented Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

claude Bot commented Sep 28, 2026 •

edited

Loading

cloudflare-workers-and-pages Bot commented Sep 28, 2026 •

edited

Loading