Skip to content

Bump the npm_and_yarn group across 3 directories with 8 updates - #206

Merged
josealekhine merged 1 commit into
mainfrom
dependabot/npm_and_yarn/ctx-desktop/npm_and_yarn-4d9d746f08
Nov 7, 2026
Merged

Bump the npm_and_yarn group across 3 directories with 8 updates#206
josealekhine merged 1 commit into
mainfrom
dependabot/npm_and_yarn/ctx-desktop/npm_and_yarn-4d9d746f08

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 7, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 1 update in the /ctx-desktop directory: vite.
Bumps the npm_and_yarn group with 6 updates in the /editors/vscode directory:

Package From To
@azure/msal-node 5.1.5 7.2.1
@vitest/mocker 5.0.0 5.1.0
fast-uri 3.1.7 3.1.9
markdown-it 14.3.2 14.3.3
qs 6.15.2 6.17.1
undici 7.30.0 7.30.2

Bumps the npm_and_yarn group with 2 updates in the /tools/typecheck/pi directory: minimatch and undici.

Updates vite from 7.3.6 to 7.3.7

Release notes

Sourced from vite's releases.

v7.3.7

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

7.3.7 (2026-10-06)

Bug Fixes

  • deps: update launch-editor to v2.14.2 (#23654) (a0a3339)
  • html: filename passed to transformIndexHtml should not include queries (#23653) (8d479f9)
  • server: store ids to safeModulePaths rather than URLs (#23656) (f0d76c7)
Commits
  • 284f6b5 release: v7.3.7
  • f0d76c7 fix(server): store ids to safeModulePaths rather than URLs (#23656)
  • a0a3339 fix(deps): update launch-editor to v2.14.2 (#23654)
  • 8d479f9 fix(html): filename passed to transformIndexHtml should not include queries (...
  • See full diff in compare view

Updates @azure/msal-node from 5.1.5 to 7.2.1

Release notes

Sourced from @​azure/msal-node's releases.

@​azure/msal-node v7.2.1

7.2.1

Fri, 06 Nov 2026 23:13:16 GMT

Patches

  • Bump @​azure/msal-common to v16.16.1 (beachball)

@​azure/msal-node v7.2.0

7.2.0

Thu, 05 Nov 2026 01:03:50 GMT

Minor changes

  • Bump @​azure/msal-common to v16.16.0 (beachball)

Patches

  • Bind interactive browser authorization responses to per-request state #8952 (undefined)

@​azure/msal-node v7.1.2

7.1.2

Tue, 27 Oct 2026 18:15:10 GMT

Patches

  • Bump @​azure/msal-common to v16.15.0 (beachball)

@​azure/msal-node v7.1.1

7.1.1

Wed, 21 Oct 2026 18:37:17 GMT

Patches

  • Bump @​azure/msal-common to v16.14.3 (beachball)

@​azure/msal-node v7.1.0

7.1.0

Tue, 13 Oct 2026 22:26:37 GMT

Minor changes

  • Sanitize authorization code payloads and reject unsupported instance-aware inputs for confidential clients. #8901 (hemoral@microsoft.com)

@​azure/msal-node v7.0.2

... (truncated)

Commits
  • 5901161 Update Angular and Vite tooling dependencies (#8976)
  • f0dfcc4 Update Azure Identity in E2E tooling (#8972)
  • 1fbbf4f Fix native token-cache isolation for brokered child requests (#8971)
  • ae17990 Defer sign-in after reset MFA and sign-up/reset JIT (#8973)
  • 9b79aa4 Fix Native Auth V2 error classification (#8961)
  • e1616ab Add Native Auth V2 password reset MFA support (#8963)
  • 403efba Align Native Auth V2 sign-up start with API (#8940)
  • a47ebbf Native Auth V2: add experimental warnings and remove upfront sign-in password...
  • 0d0a031 Post-release PR (#8969)
  • a8a8141 Upgrade compatible dependencies to address security advisories (#8965)
  • Additional commits viewable in compare view

Updates @vitest/mocker from 5.0.0 to 5.1.0

Release notes

Sourced from @​vitest/mocker's releases.

v5.1.0

   🚀 Features

   🐞 Bug Fixes

... (truncated)

Commits

Updates fast-uri from 3.1.7 to 3.1.9

Release notes

Sourced from fast-uri's releases.

v3.1.9

Security

This security release fixes four URI parsing and normalization vulnerabilities in fast-uri 3.x. Applications that process untrusted URI input should upgrade to v3.1.9.

  • Medium — URI scheme spoofing through percent-encoded schemes (GHSA-w74x-v6f9-j3xg, CVE-2026-110306): percent-encoded scheme input is now rejected instead of being decoded into a live scheme.
  • Medium — Host confusion during domain-host canonicalization (GHSA-wjr9-j795-jxcr, CVE-2026-110180): malformed domain hosts containing ambiguous delimiters or stripped control characters are now rejected instead of being silently rewritten.
  • Low — Incorrect relative-reference normalization (GHSA-xhq7-xmqj-769h, CVE-2026-110095): dot-segment removal now preserves the resolution semantics of relative references.
  • Low — Scheme injection in suffix references (GHSA-333x-w4r6-6crp, CVE-2026-110725): first-segment colons in path-only suffix references are now escaped so the output is not reparsed as a scheme.

Upgrade with:

npm install fast-uri@3.1.9

Thanks to @​zekth for reporting the scheme, host, and relative-reference issues, and to @​UlisesGascon for finding the suffix-reference issue and reviewing the remediations.

What's Changed

Full Changelog: fastify/fast-uri@v3.1.8...v3.1.9

v3.1.8

⚠️ Security Warning

This security release fixes the following medium-severity security advisory:

Users of the v3.x release line should upgrade to v3.1.8.

Full Changelog: fastify/fast-uri@v3.1.7...v3.1.8

Commits
  • 0def703 Bumped v3.1.9
  • a1d0da2 test: generate only relative path references
  • 9eb8759 fix: preserve relative paths in suffix and relative resolution
  • 54c30f7 docs: note suffix-reference authority ambiguity
  • 39e6493 fix: escape a first-segment colon in suffix references
  • 745183c test: cover first-segment colon in suffix references
  • ddfc6a5 fix(SEC-03): reject non reg-name characters in domain hosts
  • d86a8d2 fix: keep a colon-first segment behind "./" in relative normalization
  • eb483b5 test: cover colon-first relative references in normalization
  • b110a35 fix(SEC-02): preserve meaning of relative references during normalization
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for fast-uri since your current version.


Updates markdown-it from 14.3.2 to 14.3.3

Changelog

Sourced from markdown-it's changelog.

[14.3.3] - 2026-10-16

Security

  • Backported 15.0.3 fixes.
Commits

Updates qs from 6.15.2 to 6.17.1

Changelog

Sourced from qs's changelog.

6.17.1

  • [Fix] parse: interpretNumericEntities: decode code points above U+FFFF as surrogate pairs (#640)
  • [Fix] parse: respect plainObjects for [] with parseArrays: false (#639)
  • [Fix] utils: merge: count the elements of a sparse array against arrayLimit, not its holes
  • [Fix] parse: guard bracket-wrapped prototype keys at depth 0 (#638)
  • [Refactor] parse: extract wrapping-bracket stripping helper
  • [readme] document that depth: 0 and depth: false keep keys flat
  • [Tests] parse: pin depth-0 bracket stripping and prototype keys kept by allowPrototypes/plainObjects

6.17.0

  • [New] stringify: add WHATWG format (#623)
  • [Fix] stringify: do not sort the caller's filter array in place (#637)
  • [Fix] parse: copy an own __proto__ key as data (#636)
  • [Fix] parse: decode percent-encoded dots case-insensitively (#635)
  • [Fix] stringify: encode keys when allowEmptyArrays is set (#561)
  • [Fix] parse: preserve comma arrays when interpreting numeric entities (#630)
  • [Fix] parse: allow scalar fields with a zero array limit (#627)
  • [Fix] parse: do not count an existing comma array toward arrayLimit when duplicates discards or replaces it
  • [Fix] utils: encode: encode lone surrogates as U+FFFD instead of consuming the next code unit (#624)
  • [eslint] fix indentation
  • [readme] document the encoder's format argument
  • [meta] add changelog acknowledgement
  • [meta] fix changelog indents
  • [Dev Deps] update eslint, evalmd, npmignore
  • [Tests] stringify: pin allowEmptyArrays output for keys that need no encoding
  • [Tests] stringify: pin sort order for nested keys selected by an array filter
  • [Tests] parse: cover interpretNumericEntities across value shapes, keys, and the charset sentinel
  • [Tests] parse: cover more input that builds no array at a zero or negative arrayLimit
  • [Tests] parse: cover comma with a zero or negative arrayLimit, and combining a full comma array
  • [Tests] parse: pin the behavior of a zero or negative arrayLimit
  • [Tests] utils/stringify: pin ~, *, and parens encoding in RFC3986 and RFC1738

6.16.2

  • [Fix] stringify: encode keys when allowEmptyArrays is set (#561)
  • [meta] use double quotes for better OS support
  • [Dev Deps] update evalmd, npmignore
  • [Tests] stringify: pin allowEmptyArrays output for keys that need no encoding

6.16.1

  • [Fix] parse: do not mutate an object input
  • [Fix] stringify: stop re-encoding structural separator dots when encodeDotInKeys is set (#564)
  • [Fix] stringify: arrayFormat: 'comma': pass the full encoder arguments with encodeValuesOnly
  • [Fix] utils: encode + as %2B in iso-8859-1 mode so values round-trip (#565)
  • [Fix] parse: only convert top-level dots to brackets when allowDots is on (#621)
  • [Fix] stringify: ignore inherited array format names (#622)
  • [Fix] stringify: arrayFormat: 'comma': do not throw on elements with no callable toString
  • [Fix] utils: merge: seed an overflow container's index from its own keys, not just the source
  • [Fix] utils: merge: keep a strictMerge conflict container's index and arrayLimit correct
  • [Fix] parse: only treat [] as array syntax when it ends the key
  • [Perf] decode: skip decoders when there is no percent sign (#583)

... (truncated)

Commits
  • 43baea4 v6.17.1
  • 54623b6 [Fix] parse: interpretNumericEntities: decode code points above U+FFFF as...
  • 7924b65 [Fix] parse: respect plainObjects for [] with parseArrays: false
  • 7d4b440 [readme] document that depth: 0 and depth: false keep keys flat
  • 101492a [Fix] utils: merge: count the elements of a sparse array against `arrayLi...
  • 42eccf0 [Fix] parse: guard bracket-wrapped prototype keys at depth 0
  • ae0b5c7 [Refactor] parse: extract wrapping-bracket stripping helper
  • 6459f9f [Tests] parse: pin depth-0 bracket stripping and prototype keys kept by `al...
  • cb6855c Merge backport release tags v6.12.6–v6.16.2 into main
  • 136912a v6.16.2
  • Additional commits viewable in compare view

Updates undici from 7.30.0 to 7.30.2

Release notes

Sourced from undici's releases.

v7.30.2

⚠️ Security Fixes

This release fixes six vulnerabilities.

CVE-2026-116592 / GHSA-mqg3-3v4r-cm32 (high)

Undici 7.30.1 could cache the final response from a redirect chain under the original request key without applying the origin, cache policy, freshness, or Vary requirements of every intermediate hop. This could poison a cache or expose one user's response to another user. The fix validates every redirect hop, combines their Vary fields, limits freshness and stale serving to the most restrictive hop, and invalidates persistent SQLite entries written by vulnerable releases.

CVE-2026-120474 / GHSA-7xg3-fphp-28hg (medium)

In Undici 7.x, a shared cache used with compose(redirect(), cache()) could store a credential-dependent response from a same-origin redirect under the original URL. A later authenticated or unauthenticated request could then receive another user's response. Redirected requests carrying Authorization, Cookie, or Proxy-Authorization are no longer stored under the original alias key.

CVE-2026-116630 / GHSA-5rm8-gv32-r954 (medium)

In Undici 7.x, a cross-origin redirect during cache revalidation could let a 304 Not Modified response from the redirect target validate a cached response from the original origin. Undici now checks that the revalidation target matches the cached URL and that any returned validator matches the stored representation before replaying the cached body.

CVE-2026-120415 / GHSA-9v6h-8rgp-m69f (medium)

In Undici 7.x, the redirect interceptor did not strip credentials correctly when request headers were supplied as an array of [name, value] pairs. With a header-normalizing interceptor outside redirect(), credentials could be sent to a cross-origin redirect target. Undici now handles both tuple arrays and flat header arrays when removing sensitive headers.

CVE-2026-120222 / GHSA-3g9m-rv3r-w5w2 (medium)

In Undici 7.x, a downstream handler exception during cache replay could escape as an uncaught exception or unhandled promise rejection and terminate the process. This included dump size-limit failures, excessive Content-Encoding values in decompress, asynchronous cache-store failures, and cached-body replay after a 304. These failures are now reported as request errors.

CVE-2026-120423 / GHSA-r4pc-4jcp-7pqc (medium)

Undici 7.15.0 through 7.30.1 could skip Subresource Integrity verification when valid integrity metadata was separated or surrounded by ASCII whitespace other than a space, including a horizontal tab. Integrity metadata is now split on all ASCII whitespace before SHA-256, SHA-384, or SHA-512 verification.

What's Changed

Full Changelog: nodejs/undici@v7.30.1...v7.30.2

v7.30.1

Security fixes

High severity

Denial of service via TLS 1.2 certificate-changing renegotiation

CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm

A malicious or compromised HTTPS server could crash the Node.js process by initiating TLS 1.2 renegotiation and presenting a different, CA-trusted certificate whose hostname did not match the requested host. The resulting socket error reached an assertion in undici's HTTP/1.1 and HTTP/2 connection handling. This release handles post-connect certificate errors without terminating the process.

... (truncated)

Commits
  • 6be5720 Bumped v7.30.2 (#6163)
  • 4bca0ab test: support Node.js 20 in cache replay tests
  • 520d95b docs: add v7.30.2 security release notes
  • bcba54b fix(redirect): normalize tuple headers on v7
  • faba415 fix(cache): adapt security fixes to v7 lifecycle
  • 3df9ff5 test(cache): align redirect caching with hop policy
  • 4d54152 fix(cache): detect an actual redirect, not a plain revalidation
  • c363766 test(cache): cover credentialed revalidation refresh
  • b790905 fix(cache): treat proxy-authorization as a credential when caching redirects
  • 95a17aa test(cache): cover proxy-authorization credential on same-origin redirect
  • Additional commits viewable in compare view

Updates minimatch from 10.2.6 to 11.0.3

Changelog

Sourced from minimatch's changelog.

change log

11.0

  • Match each path portion with Matcher from @isaacs/nonrecursive-glob-match, in place of a RegExp. Items in Minimatch.set are now strings, Matcher objects, or GLOBSTAR.
  • Remove makeRe(), Minimatch#regexp, and the MMRegExp type.
  • Remove the AST class.
  • Remove the maxExtglobRecursion option.
  • An empty path portion, such as the last one in a/b/, only matches an empty pattern portion. So a/b/ no longer matches a/b/?(x) or a/b/*(x), the same as a/b/*.
  • Add the normalize option, to normalize unicode in the pattern and in each portion of the tested path.
  • Remove the debug option and the debug() method.
  • Remove the matchOne(), slashSplit(), and levelTwoFileOptimize() methods. They are internal now.
  • Fix patterns with more than one ** and sections of different lengths between them, such as **/a/b/c/**/d/**, which failed to match some paths since 10.2.3.
  • Fix partial matching of patterns with **, which since 10.2.3 matched some paths under a dot portion that ** can not walk, and did not match some paths that end in the pattern's last portion.
  • partial matching of patterns with many ** no longer takes exponential time.
  • On Windows, a .. no longer removes the drive letter, or the host and share of a UNC path, at the start of a pattern or (at optimization level 2) a path. So C:/a/../../x no longer matches x or /x.
  • On Windows, compare the host and share of UNC paths like //host/share/... case-insensitively, the same as drive letters.
  • On Windows, long UNC paths like //?/UNC/host/share/... match //host/share/... and vice versa, the same as //?/c:/... and c:/....
  • At optimization level 2, throw a RangeError if splitting **/.. portions would make more than braceExpandMax patterns, or add more than 1,000,000 path portions. Before, a short pattern could take minutes to compile.
  • At optimization level 2, dedupe patterns without comparing each pair, so that a large set is deduped in about linear time. Fix {**/x,x/y}, which was deduped to **/x, so x/y did not match.
  • Match a numeric brace range of 100 or more values, such as {0..999}, as one pattern portion, in place of one pattern for each value. For a glob walk, this is one directory read, in place of a stat for each value. hasMagic() is true for these

... (truncated)

Commits

Updates undici from 8.10.2 to 8.12.3

Release notes

Sourced from undici's releases.

v7.30.2

⚠️ Security Fixes

This release fixes six vulnerabilities.

CVE-2026-116592 / GHSA-mqg3-3v4r-cm32 (high)

Undici 7.30.1 could cache the final response from a redirect chain under the original request key without applying the origin, cache policy, freshness, or Vary requirements of every intermediate hop. This could poison a cache or expose one user's response to another user. The fix validates every redirect hop, combines their Vary fields, limits freshness and stale serving to the most restrictive hop, and invalidates persistent SQLite entries written by vulnerable releases.

CVE-2026-120474 / GHSA-7xg3-fphp-28hg (medium)

In Undici 7.x, a shared cache used with compose(redirect(), cache()) could store a credential-dependent response from a same-origin redirect under the original URL. A later authenticated or unauthenticated request could then receive another user's response. Redirected requests carrying Authorization, Cookie, or Proxy-Authorization are no longer stored under the original alias key.

CVE-2026-116630 / GHSA-5rm8-gv32-r954 (medium)

In Undici 7.x, a cross-origin redirect during cache revalidation could let a 304 Not Modified response from the redirect target validate a cached response from the original origin. Undici now checks that the revalidation target matches the cached URL and that any returned validator matches the stored representation before replaying the cached body.

CVE-2026-120415 / GHSA-9v6h-8rgp-m69f (medium)

In Undici 7.x, the redirect interceptor did not strip credentials correctly when request headers were supplied as an array of [name, value] pairs. With a header-normalizing interceptor outside redirect(), credentials could be sent to a cross-origin redirect target. Undici now handles both tuple arrays and flat header arrays when removing sensitive headers.

CVE-2026-120222 / GHSA-3g9m-rv3r-w5w2 (medium)

In Undici 7.x, a downstream handler exception during cache replay could escape as an uncaught exception or unhandled promise rejection and terminate the process. This included dump size-limit failures, excessive Content-Encoding values in decompress, asynchronous cache-store failures, and cached-body replay after a 304. These failures are now reported as request errors.

CVE-2026-120423 / GHSA-r4pc-4jcp-7pqc (medium)

Undici 7.15.0 through 7.30.1 could skip Subresource Integrity verification when valid integrity metadata was separated or surrounded by ASCII whitespace other than a space, including a horizontal tab. Integrity metadata is now split on all ASCII whitespace before SHA-256, SHA-384, or SHA-512 verification.

What's Changed

Full Changelog: nodejs/undici@v7.30.1...v7.30.2

v7.30.1

Security fixes

High severity

Denial of service via TLS 1.2 certificate-changing renegotiation

CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm

A malicious or compromised HTTPS server could crash the Node.js process by initiating TLS 1.2 renegotiation and presenting a different, CA-trusted certificate whose hostname did not match the requested host. The resulting socket error reached an assertion in undici's HTTP/1.1 and HTTP/2 connection handling. This release handles post-connect certificate errors without terminating the process.

... (truncated)

Commits
  • 6be5720 Bumped v7.30.2 (#6163)
  • 4bca0ab test: support Node.js 20 in cache replay tests
  • 520d95b docs: add v7.30.2 security release notes
  • bcba54b fix(redirect): normalize tuple headers on v7
  • faba415 fix(cache): adapt security fixes to v7 lifecycle
  • 3df9ff5 test(cache): align redirect caching with hop policy
  • 4d54152 fix(cache): detect an actual redirect, not a plain revalidation
  • c363766 test(cache): cover credentialed revalidation refresh
  • b790905 fix(cache): treat proxy-authorization as a credential when caching redirects
  • 95a17aa test(cache): cover proxy-authorization credential on same-origin redirect
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the npm_and_yarn group across 3 directories with 8 updates
477b5b1 
Bumps the npm_and_yarn group with 1 update in the /ctx-desktop directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).
Bumps the npm_and_yarn group with 6 updates in the /editors/vscode directory:

| Package | From | To |
| --- | --- | --- |
| [@azure/msal-node](https://github.com/AzureAD/microsoft-authentication-library-for-js) | `5.1.5` | `7.2.1` |
| [@vitest/mocker](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker) | `5.0.0` | `5.1.0` |
| [fast-uri](https://github.com/fastify/fast-uri) | `3.1.7` | `3.1.9` |
| [markdown-it](https://github.com/markdown-it/markdown-it) | `14.3.2` | `14.3.3` |
| [qs](https://github.com/ljharb/qs) | `6.15.2` | `6.17.1` |
| [undici](https://github.com/nodejs/undici) | `7.30.0` | `7.30.2` |

Bumps the npm_and_yarn group with 2 updates in the /tools/typecheck/pi directory: [minimatch](https://github.com/isaacs/minimatch) and [undici](https://github.com/nodejs/undici).


Updates `vite` from 7.3.6 to 7.3.7
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v7.3.7/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v7.3.7/packages/vite)

Updates `@azure/msal-node` from 5.1.5 to 7.2.1
- [Release notes](https://github.com/AzureAD/microsoft-authentication-library-for-js/releases)
- [Commits](AzureAD/microsoft-authentication-library-for-js@msal-node-v5.1.5...msal-node-v7.2.1)

Updates `@vitest/mocker` from 5.0.0 to 5.1.0
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.1.0/packages/mocker)

Updates `fast-uri` from 3.1.7 to 3.1.9
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.7...v3.1.9)

Updates `markdown-it` from 14.3.2 to 14.3.3
- [Changelog](https://github.com/markdown-it/markdown-it/blob/14.3.3/CHANGELOG.md)
- [Commits](markdown-it/markdown-it@14.3.2...14.3.3)

Updates `qs` from 6.15.2 to 6.17.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.15.2...v6.17.1)

Updates `undici` from 7.30.0 to 7.30.2
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.30.0...v7.30.2)

Updates `minimatch` from 10.2.6 to 11.0.3
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v10.2.6...v11.0.3)

Updates `undici` from 8.10.2 to 8.12.3
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.30.0...v7.30.2)

---
updated-dependencies:
- dependency-name: vite
  dependency-version: 7.3.7
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: "@azure/msal-node"
  dependency-version: 7.2.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@vitest/mocker"
  dependency-version: 5.1.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-uri
  dependency-version: 3.1.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: markdown-it
  dependency-version: 14.3.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.17.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 7.30.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 11.0.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 8.12.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Nov 7, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying ctx with  Cloudflare Pages  Cloudflare Pages

Latest commit: 477b5b1
Status: ✅  Deploy successful!
Preview URL: https://3b284f22.ctx-bhl.pages.dev
Branch Preview URL: https://dependabot-npm-and-yarn-ctx-xenr.ctx-bhl.pages.dev

View logs

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 7, 2026
@josealekhine
josealekhine merged commit a0058ea into main Nov 7, 2026
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@josealekhine josealekhine Awaiting requested review from josealekhine josealekhine is a code owner
@parlakisik parlakisik Awaiting requested review from parlakisik parlakisik is a code owner
@CoderMungan CoderMungan Awaiting requested review from CoderMungan CoderMungan is a code owner
@hamzaerbay hamzaerbay Awaiting requested review from hamzaerbay hamzaerbay is a code owner
@bilersan bilersan Awaiting requested review from bilersan bilersan is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@josealekhine