Skip to content

build(deps): bump the npm_and_yarn group across 2 directories with 10 updates - #56

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-24c198a14e
Open

build(deps): bump the npm_and_yarn group across 2 directories with 10 updates#56
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-24c198a14e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 11, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 3 updates in the / directory: shell-quote, ip-address and undici.
Bumps the npm_and_yarn group with 6 updates in the /skills/diataxis-docs-site/assets/aoj-starlight directory:

Package From To
astro 7.0.9 7.3.2
fast-uri 3.1.3 3.1.7
js-yaml 4.3.0 4.3.2
nanoid 3.3.16 3.3.19
postcss 8.5.19 8.5.28
svgo 4.0.2 4.1.0

Updates shell-quote from 1.8.4 to 1.9.0

Changelog

Sourced from shell-quote's changelog.

v1.9.0 - 2026-06-24

Commits

  • [New] add types dca6e21
  • [Dev Deps] update eslint 9aa9e8f
  • [Fix] parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv) 7ff5488
  • [actions] update workflows 75e8497
  • [actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3 cannot stage eslint 10@types/esrecurse 3fb739d
  • [actions] retry npm install on Windows to survive npm 2/3 staging-rename flake abe0163
  • [actions] Windows + node 5/7: install deps with a modern node b4bafa2
  • [Fix] quote: escape leading ~ to prevent shell tilde-expansion 7a76c1a
  • [Dev Deps] update auto-changelog, tape 7184b44
  • [Dev Deps] apparently jackspeak is no longer in the graph 9ba368a
Commits
  • db09fc7 v1.9.0
  • 7ff5488 [Fix] parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv)
  • b4bafa2 [actions] Windows + node 5/7: install deps with a modern node
  • 3fb739d [actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3...
  • abe0163 [actions] retry npm install on Windows to survive npm 2/3 staging-rename flake
  • 7a76c1a [Fix] quote: escape leading ~ to prevent shell tilde-expansion
  • 75e8497 [actions] update workflows
  • dca6e21 [New] add types
  • 9aa9e8f [Dev Deps] update eslint
  • 9ba368a [Dev Deps] apparently jackspeak is no longer in the graph
  • Additional commits viewable in compare view

Updates ip-address from 10.2.0 to 10.7.0

Release notes

Sourced from ip-address's releases.

v10.7.0

What's Changed

Full Changelog: beaugunderson/ip-address@v10.6.0...v10.7.0

v10.6.0

What's Changed

Full Changelog: beaugunderson/ip-address@v10.5.1...v10.6.0

v10.5.1

Full Changelog: beaugunderson/ip-address@v10.5.0...v10.5.1

v10.5.0

What's Changed

Full Changelog: beaugunderson/ip-address@v10.4.0...v10.5.0

v10.4.0

What's Changed

Full Changelog: beaugunderson/ip-address@v10.3.1...v10.4.0

v10.3.1

Full Changelog: beaugunderson/ip-address@v10.3.0...v10.3.1

v10.3.0

Full Changelog: beaugunderson/ip-address@v10.2.2...v10.3.0

v10.2.2

Full Changelog: beaugunderson/ip-address@v10.2.1...v10.2.2

v10.2.1

Full Changelog: beaugunderson/ip-address@v10.2.0...v10.2.1

Commits
  • 2b7cab5 10.7.0
  • 87fae23 Add offset() and nextNetwork(), accept prefix-length ip6.arpa names, correct ...
  • 42c1f8b 10.6.0
  • fb12583 Add isGlobal() and pin the classifiers to the IANA special-purpose registries...
  • 38b02d7 10.5.1
  • d03e960 Merge commit from fork
  • ab3dc88 Merge commit from fork
  • ef98e0a 10.5.0
  • 9fd1110 Correct the documentation where it disagreed with the library (#219)
  • d478737 Honor the fromURL graceful-failure contract for non-IPv6 hosts (#218)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for ip-address since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates undici from 7.28.0 to 7.29.1

Release notes

Sourced from undici's releases.

v7.29.1

⚠️ Security fixes

High severity

  • GHSA-w293-vg96-wgc3: BalancedPool could drop function-valued connection options while cloning its configuration, including custom TLS certificate validation callbacks. Undici now preserves connect and legacy tls options when creating upstreams. Fixed by f690157d.
  • GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught TypeError that could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 6615e017.

Medium severity

  • GHSA-3wwx-pv8p-q78v: a malformed permessage-deflate payload exceeding the configured decompression limit could emit an unhandled zlib error and terminate the process. Undici now destroys the inflater after reaching the limit. Fixed by 63cf698b.
  • GHSA-rx4f-c7p8-82vq: an unclean WebSocketStream close could create an unobserved rejected promise when its writable stream was locked, potentially terminating the process. Undici now propagates the failure through the retained writable stream controller. Fixed by 1858656e.
  • GHSA-2jfj-6hjv-fm6j: shared caches could store and replay responses containing Set-Cookie, disclosing one user's cookies to another caller. Undici now excludes these responses from shared caches, including existing entries and revalidation paths. Fixed by b6c5a002.
  • GHSA-3xpg-4rpp-hhhm: the decompression interceptor did not bound decoded output, allowing compressed responses to consume excessive memory. Undici now limits every decompression stage to 64 MiB by default and supports a configurable maxSize. Fixed by 2c7d7e12.
  • GHSA-pmjh-fq2x-6v4x: a terminal retry failure after response headers were exposed could orphan the original response body, causing consumers to hang indefinitely. Undici now propagates the terminal error to the exposed body. Fixed by 3c672659.

Low severity

  • GHSA-8436-99hf-9mmv: cache interceptors could store and replay responses to unsafe HTTP methods such as POST or DELETE. Undici now restricts cache reads and writes to safe methods while preserving invalidation by successful unsafe requests. Fixed by b61d9432.
  • GHSA-2gqq-gqf2-x968: the dump interceptor could treat an oversized chunked response as successfully truncated when no Content-Length was present. Undici now enforces maxSize against received bytes and aborts oversized responses. Fixed by 21693f40.
  • GHSA-r53p-7pc4-xj5r: the retry interceptor could concatenate a resumed response with inconsistent framing into downstream output, enabling response splitting or corruption. Undici now validates Content-Range against the original response framing before resuming. Fixed by cd8af90b.

What's Changed

Full Changelog: nodejs/undici@v7.29.0...v7.29.1

v7.29.0

⚠️ Security fixes

High severity

  • GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 9f10f1e9, with regression coverage in 466e99d1.

Medium severity

  • GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 33928bc2.
  • GHSA-jr45-8vmc-qm54: optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by 98011a86.
  • GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by 1b5a5312, with corrected fixtures in 4a9dafb1.
  • GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by 3bf91ddb.

... (truncated)

Commits
  • d39a83e Bumped v7.29.1 (#5772)
  • 0d88464 fix(test): remove unused EventEmitter import
  • f57411b perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#5707) (#5769)
  • 3c67265 fix(retry): settle exposed body on terminal failure
  • cd8af90 fix(retry): validate resumed response framing
  • 6615e01 fix(websocket): reject unrequested subprotocols
  • 2c7d7e1 fix(decompress): limit decompressed response size
  • b6c5a00 fix(cache): do not cache Set-Cookie in shared caches
  • 21693f4 fix(interceptor/dump): abort oversized chunked responses
  • f690157 fix: preserve BalancedPool connection options
  • Additional commits viewable in compare view

Updates astro from 7.0.9 to 7.3.2

Release notes

Sourced from astro's releases.

astro@7.3.2

Patch Changes

  • #17896 a548223 Thanks @​matthewp! - Fixes <script>/<style> rendering in MDX so that only literal content (including content injected by remark/rehype plugins) is treated as trusted markup. A dynamic value passed as a <script>/<style> child (e.g. <script>{value}</script>) is now escaped like any other element's content instead of being rendered raw. Use set:html to explicitly opt a dynamic value back into raw rendering.

  • #17931 c1a6a89 Thanks @​astro-factory! - Fixes the dev toolbar returning a 504 "Outdated Optimize Dep" error when a workspace-linked package imports a dependency that Vite's initial scan did not discover

  • #17908 42e9188 Thanks @​astro-factory! - Fixes i18n fallback routing replacing the first substring match instead of the actual locale segment, which mangled paths like /energy/en/about into /esergy/en/about

  • #17936 4b92ddc Thanks @​astro-factory! - Fixes sessions breaking in dev mode with the Cloudflare adapter when middleware is present

  • Updated dependencies [a548223]:

    • @​astrojs/markdown-satteri@​0.4.1

astro@7.3.1

Patch Changes

astro@7.3.0

Minor Changes

  • #17767 ce7c91f Thanks @​astro-factory! - Adds --ignore-lock flag to astro preview, allowing multiple preview servers to run simultaneously on different ports. This is useful for E2E testing workflows (e.g., Playwright) that need to run several preview servers at once.

  • #17818 c0b6581 Thanks @​florian-lefebvre! - Adds a logger parameter to image services hooks

    Custom image services now receive Astro's runtime logger as an extra argument. Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

    import type { LocalImageService } from 'astro';
const service: LocalImageService = {
// ...
async transform(inputBuffer, transform, imageConfig, logger) {
logger.warn(Could not optimize &quot;${transform.src}&quot;. Passing it through unchanged.);
return { data: inputBuffer, format: 'png' };
},
};

    Astro's built-in Sharp service now uses this logger for the warnings it emits when it encounters an unexpected or unsupported source format.

  • #17818 c0b6581 Thanks @​florian-lefebvre! - Adds logger to the context object passed to cache providers

    Custom cache providers now receive Astro's runtime logger on the context passed to onRequest(). Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

    import type { CacheProvider } from 'astro';
const provider: CacheProvider = {

... (truncated)

Changelog

Sourced from astro's changelog.

7.3.2

Patch Changes

  • #17896 a548223 Thanks @​matthewp! - Fixes <script>/<style> rendering in MDX so that only literal content (including content injected by remark/rehype plugins) is treated as trusted markup. A dynamic value passed as a <script>/<style> child (e.g. <script>{value}</script>) is now escaped like any other element's content instead of being rendered raw. Use set:html to explicitly opt a dynamic value back into raw rendering.

  • #17931 c1a6a89 Thanks @​astro-factory! - Fixes the dev toolbar returning a 504 "Outdated Optimize Dep" error when a workspace-linked package imports a dependency that Vite's initial scan did not discover

  • #17908 42e9188 Thanks @​astro-factory! - Fixes i18n fallback routing replacing the first substring match instead of the actual locale segment, which mangled paths like /energy/en/about into /esergy/en/about

  • #17936 4b92ddc Thanks @​astro-factory! - Fixes sessions breaking in dev mode with the Cloudflare adapter when middleware is present

  • Updated dependencies [a548223]:

    • @​astrojs/markdown-satteri@​0.4.1

7.3.1

Patch Changes

7.3.0

Minor Changes

  • #17767 ce7c91f Thanks @​astro-factory! - Adds --ignore-lock flag to astro preview, allowing multiple preview servers to run simultaneously on different ports. This is useful for E2E testing workflows (e.g., Playwright) that need to run several preview servers at once.

  • #17818 c0b6581 Thanks @​florian-lefebvre! - Adds a logger parameter to image services hooks

    Custom image services now receive Astro's runtime logger as an extra argument. Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

    import type { LocalImageService } from 'astro';
const service: LocalImageService = {
// ...
async transform(inputBuffer, transform, imageConfig, logger) {
logger.warn(Could not optimize &quot;${transform.src}&quot;. Passing it through unchanged.);
return { data: inputBuffer, format: 'png' };
},
};

    Astro's built-in Sharp service now uses this logger for the warnings it emits when it encounters an unexpected or unsupported source format.

  • #17818 c0b6581 Thanks @​florian-lefebvre! - Adds logger to the context object passed to cache providers

    Custom cache providers now receive Astro's runtime logger on the context passed to onRequest(). Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

    

    • 






... (truncated)





Commits






Updates fast-uri from 3.1.3 to 3.1.7



Release notes

Sourced from fast-uri's releases.




v3.1.7


⚠️ Security Warning


This is a security release that fixes the following high-severity security advisories:



Users of the v3.x release line should upgrade to v3.1.7.


Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7


v3.1.6


⚠️ Security Warning


This release addresses the following high-severity security advisories:



Users of the v3.x release line should upgrade to v3.1.6.


Full Changelog: fastify/fast-uri@v3.1.5...v3.1.6


v3.1.5


⚠️ Security Warning


Fix for GHSA-7p8r-x3mc-p8w7


Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5


v3.1.4


⚠️ Security Release


Fix for GHSA-v2hh-gcrm-f6hx


Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4







Commits

    

  • 412e40a Bumped v3.1.7
    • 

  • 9f4c943 fix: backport port and IP-literal validation to v3.x (#216)
    • 

  • 1eb3ce4 fix: treat unterminated bracket hosts as reg-names again (#214)
    • 

  • 6f970b2 Bumped v3.1.6
    • 

  • d941579 fix: never run IDN canonicalization on bracketed IP literals
    • 

  • c0f0279 test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)
    • 

  • 37f3417 Merge commit from fork
    • 

  • 607bfbe Merge commit from fork
    • 

  • ae92a4c Merge commit from fork
    • 

  • 444ecda Merge commit from fork
    • 

  • Additional commits viewable in compare view
    • 







Updates js-yaml from 4.3.0 to 4.3.2



Changelog

Sourced from js-yaml's changelog.




4.3.2 - 2026-08-26


Changed


    

  • [backport] Hard-limit merge sequence size to 100.
    • 



Security


    

  • [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys
to limit CPU usage, #797.
    • 



4.3.1 - 2026-07-31


Security


    

  • [backport] Remove quadratic complexity from !!omap duplicate key detection.
    • 








Commits






Updates nanoid from 3.3.16 to 3.3.19



Release notes

Sourced from nanoid's releases.




3.3.19


    

  • Fixed killing the app by setting huge user ID.
    • 



3.3.18



3.3.17


    

  • Fixed infinite loop on zero size.
    • 








Changelog

Sourced from nanoid's changelog.




3.3.19



3.3.18



3.3.17


    

  • Fixed infinite loop on zero size.
    • 








Commits






Updates postcss from 8.5.19 to 8.5.28



Release notes

Sourced from postcss's releases.




8.5.28


    

  • Fixes types regression.
    • 



8.5.27



8.5.26


    

  • Fixed list.split() regression (by @​lazerg).
    • 

  • Track symlinks in path protection in source map loading (by @​drengir1).
    • 



8.5.25


    

  • Fixed 8.5.17 visitor regression.
    • 

  • Fixed list.split() for non-string values (by @​amir-rezaei).
    • 



8.5.24


    

  • Preserve the BOM after the processing (by @​hdimer).
    • 



8.5.23


    

  • Do not load source map without opts.from for security reasons.
    • 



8.5.22



8.5.21



8.5.20








Changelog

Sourced from postcss's changelog.




8.5.28


    

  • Fixes types regression.
    • 



8.5.27



8.5.26


    

  • Fixed list.split() regression (by @​lazerg).
    • 

  • Track symlinks in path protection in source map loading (by @​drengir1).
    • 



8.5.25


    

  • Fixed 8.5.17 visitor regression.
    • 

  • Fixed list.split() for non-string values (by @​amir-rezaei).
    • 



8.5.24


    

  • Preserve the BOM after the processing (by @​hdimer).
    • 



8.5.23


    

  • Do not load source map without opts.from for security reasons.
    • 



8.5.22



8.5.21



8.5.20








Commits






Updates sharp from 0.35.3 to 0.35.4



Release notes

Sourced from sharp's releases.




v0.35.4


https://github.com/lovell/sharp-libvips/releases/tag/v1.3.3



v0.35.4-rc.0








Commits

    

  • 7f1a0a2 Release v0.35.4
    • 

  • f927818 Upgrade to sharp-libvips v1.3.3
    • 

  • e802092 Prerelease v0.35.4-rc.0
    • 

  • e13eb2f CI: Fix wasm32 build (#4589)
    • 

  • a82a0b3 Upgrade to libvips v8.18.6
    • 

  • 8044fe4 Bound resize dimensions to coordinate limit
    • 

  • 147f859 Docs: changelog entries for #4578 #4584
    • 

  • ee5bfb8 Tests: use yauzl directly rather than via extract-zip wrapper
    • 

  • 7a77889 Bump uraimo/run-on-arch-action from 3.1.0 to 3.2.0 (#4588)
    • 

  • ea5bef2 Improve support for input Streams finishing before output is requested (#4584)
    • 

  • Additional commits viewable in compare view
    • 







Updates svgo from 4.0.2 to 4.1.0



Release notes

Sourced from svgo's releases.




v4.1.0


This minor release upgrades the SAX parser and introduces stricter XML validation. It also includes important security hardening for removeScripts, dependency updates, and improvements to the test and regression infrastructure.


Support SVGO


If SVGO is valuable to you or your organization, please consider supporting the project on OpenCollective. Your sponsorship helps fund ongoing maintenance and security work.


Stricter XML validation


SVGO now uses sax 1.6.1, upgraded from 1.5.0 (#2257).


The new parser version validates numeric character references against the ranges permitted by XML. Invalid references are now rejected in both text and attributes, including:


    

  • disallowed control characters such as &[#1](https://github.com/svg/svgo/issues/1);, &#xB;, and &#x1F;;
    • 

  • UTF-16 surrogate code points such as &#xD800;;
    • 

  • invalid XML code points such as &#xFFFF;.
    • 



Valid boundary values—including U+0020, U+D7FF, U+E000, U+FFFD, and characters through U+10FFFF—remain supported.


Parser failures are consistently exposed as SvgoParserError errors with an Invalid character entity reason.


This is an intentional behavior change: malformed SVGs that were previously accepted may now produce a parser error, while valid XML documents are unaffected.


Security


The removeScripts plugin has been hardened against several script-execution bypasses:


    

  • Filters executable data: URLs containing HTML, XHTML, or SVG documents while preserving inert data such as PNG images, and filters legacy vbscript: URLs (#2263).
    • 

  • Sanitizes content inside SVG <foreignObject> elements by removing HTML event-handler attributes, srcdoc, and executable URLs from action, data, formaction, href, and src, while preserving non-executable HTML and visual content (#2264).
    • 

  • Recognizes namespace-prefixed SVG <a> elements and removes ASCII tabs and newlines before checking URL schemes, preventing values such as java&[#9](https://github.com/svg/svgo/issues/9);script: from bypassing detection while preserving elements in unrelated custom namespaces (#2268).
    • 



These changes address:



Dependencies


    

  • Upgraded css-select to v6 and css-what to v7, and updated SVGO's custom selector adapter for css-select v6 (#2244).
    • 



Project maintenance


@​TrySound is back as an active SVGO maintainer.


Many thanks to @​KTibow, @​SethFalco, and @​XhmikosR for maintaining and improving SVGO over the past several years.


Full Changelog: svg/svgo@v4.0.2...v4.1.0







Commits

    

  • 5765cbe chore: prepare v4.1.0 release (#2275)
    • 

  • 3db3ef3 fix(removeScripts): handle anchor URL bypasses (#2268)
    • 

  • 4e9b9ae chore: cache regression screenshots (#2267)
    • 

  • d55270c chore(regression): migrate comparison workers to Tinypool (#2266)
    • 

  • fd51e47 fix(removeScripts): sanitize foreignObject content (#2264)
    • 

  • dcaf957 chore: optimize fixtures in a bounded worker pool (#2265)
    • 

  • a354293 fix(removeScripts): filter executable data URLs (#2263)
    • 

  • 4e0d2ac ci...

    Description has been truncated

    

  
  



      


          

          
  
  

    
  
    
    

  

  

  



                    

          
        





  





    



      

  
        

  

      

  
  

  
          

  

    

      


  

        
          @dependabot
  




      

        
          build(deps): bump the npm_and_yarn group across 2 directories with 10…
        

          
                        
      


      

        

    
    
    

  

    


      


      

        

          

    
    
    

  

  

    
  



        

      


      

        
          5e6ab3c
        
      

    

  

    

      
… updates

Bumps the npm_and_yarn group with 3 updates in the / directory: [shell-quote](https://github.com/ljharb/shell-quote), [ip-address](https://github.com/beaugunderson/ip-address) and [undici](https://github.com/nodejs/undici).
Bumps the npm_and_yarn group with 6 updates in the /skills/diataxis-docs-site/assets/aoj-starlight directory:

| Package | From | To |
| --- | --- | --- |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.0.9` | `7.3.2` |
| [fast-uri](https://github.com/fastify/fast-uri) | `3.1.3` | `3.1.7` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.3.0` | `4.3.2` |
| [nanoid](https://github.com/ai/nanoid) | `3.3.16` | `3.3.19` |
| [postcss](https://github.com/postcss/postcss) | `8.5.19` | `8.5.28` |
| [svgo](https://github.com/svg/svgo) | `4.0.2` | `4.1.0` |



Updates `shell-quote` from 1.8.4 to 1.9.0
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.8.4...v1.9.0)

Updates `ip-address` from 10.2.0 to 10.7.0
- [Release notes](https://github.com/beaugunderson/ip-address/releases)
- [Commits](beaugunderson/ip-address@v10.2.0...v10.7.0)

Updates `undici` from 7.28.0 to 7.29.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.28.0...v7.29.1)

Updates `astro` from 7.0.9 to 7.3.2
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.3.2/packages/astro)

Updates `fast-uri` from 3.1.3 to 3.1.7
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.3...v3.1.7)

Updates `js-yaml` from 4.3.0 to 4.3.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.3.0...4.3.2)

Updates `nanoid` from 3.3.16 to 3.3.19
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md)
- [Commits](ai/nanoid@3.3.16...3.3.19)

Updates `postcss` from 8.5.19 to 8.5.28
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.19...8.5.28)

Updates `sharp` from 0.35.3 to 0.35.4
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.35.3...v0.35.4)

Updates `svgo` from 4.0.2 to 4.1.0
- [Release notes](https://github.com/svg/svgo/releases)
- [Commits](svg/svgo@v4.0.2...v4.1.0)

---
updated-dependencies:
- dependency-name: shell-quote
  dependency-version: 1.9.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: ip-address
  dependency-version: 10.7.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 7.29.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: astro
  dependency-version: 7.3.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: fast-uri
  dependency-version: 3.1.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: nanoid
  dependency-version: 3.3.19
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: postcss
  dependency-version: 8.5.28
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: sharp
  dependency-version: 0.35.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: svgo
  dependency-version: 4.1.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>

    







  








      

  
            

    

      
    

    


      


          @dependabot
dependabot
Bot



            added
      
  dependencies

  Pull requests that update a dependency file

      
  javascript

  Pull requests that update javascript code

  labels


      Sep 11, 2026

    

  








      

  
      



  

  @coderabbitai






  



    

      

  

    

      
          
      

      
            coderabbitai
    Bot

      

      

      commented


        Sep 11, 2026



      
    


  


  

    

      

          
    
    

  


        
            
  
      
              Copy link

  

            
  
      
              Copy Markdown

  

        
      

    


    

        



        

    

  





      


        



  
    

      
          


Important


Review skipped


Bot user detected.


To trigger a single review, invoke the @coderabbitai review command.



⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml


Review profile: CHILL


Plan: Advanced


Run ID: 348898bc-54f6-44ca-9101-9ef12facccae




You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.


Use the checkbox below for a quick retry:


    

  •   🔍 Trigger review
    • 









Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.



❤️ Share




Comment @coderabbitai help to get the list of available commands.



      		
    

  





        

            

            

              
            

        

      


      

            
  
  

    
  
    
    

  

  

  


    
















  
  

    

      

  










  








  
      

  
    Sign up for free
    to join this conversation on GitHub.
    Already have an account?
    Sign in to comment


  










    
        

  

    
    

    

  

    Reviewers
  


    

    No reviews







  
      

  


      
  

    Assignees
  



        


    No one assigned







  
        


  


  

    Labels
  



    

      
    dependencies

  Pull requests that update a dependency file
  
    javascript

  Pull requests that update javascript code








  
        

  

    

        

    Projects
  


        




    None yet




  



  
        


  

    
  

    Milestone
  


      No milestone





    
      
          


  

    

      
        

          
  

    Development
  



            


Successfully merging this pull request may close these issues.





  
  



      
    

  




      

  
  
        

  

    

      0 participants