chore(deps): bump the production-minor-patch group with 3 updates by dependabot[bot] · Pull Request #95 · corespeed-io/lore

dependabot · 2026-08-31T04:34:13Z

Bumps the production-minor-patch group with 3 updates: @ast-grep/napi, jose and next.

Updates @ast-grep/napi from 0.45.1 to 0.45.2

Release notes

Sourced from @ast-grep/napi's releases.

0.45.2

chore(deps): update astral-sh/setup-uv action to v10 [#2892](https://github.com/ast-grep/ast-grep/issues/2892)

chore(deps): update rust crate terminal-light to v1.9.1 [#2905](https://github.com/ast-grep/ast-grep/issues/2905)

chore(deps): update dependency web-tree-sitter to v0.26.13 [#2903](https://github.com/ast-grep/ast-grep/issues/2903)

chore(deps): update rust crate tree-sitter to v0.26.13 [#2904](https://github.com/ast-grep/ast-grep/issues/2904)

chore(deps): update dependency dprint to v0.56.1 [#2901](https://github.com/ast-grep/ast-grep/issues/2901)

chore(deps): update dependency @napi-rs/cli to v3.8.6 [#2882](https://github.com/ast-grep/ast-grep/issues/2882)

fix(deps): update rust-wasm-bindgen monorepo [#2878](https://github.com/ast-grep/ast-grep/issues/2878)

chore(deps): update dependency dprint to v0.56.0 [#2896](https://github.com/ast-grep/ast-grep/issues/2896)

chore(deps): update dependency oxlint to v1.79.0 [#2897](https://github.com/ast-grep/ast-grep/issues/2897)

chore(deps): update dependency @ast-grep/napi to v0.45.1 [#2876](https://github.com/ast-grep/ast-grep/issues/2876)

chore(deps): update dependency web-tree-sitter to v0.26.12 [#2880](https://github.com/ast-grep/ast-grep/issues/2880)

fix: exit quietly on broken pipe instead of erroring [#2887](https://github.com/ast-grep/ast-grep/issues/2887)

feat(outline): extract embedded language symbols [#2883](https://github.com/ast-grep/ast-grep/issues/2883)

chore(deps): update dependency oxlint to v1.78.0 [#2888](https://github.com/ast-grep/ast-grep/issues/2888)

feat: add namedChildren support to wasm [#2893](https://github.com/ast-grep/ast-grep/issues/2893)

feat: add namedChildren to napi [#2893](https://github.com/ast-grep/ast-grep/issues/2893)

feat: add named_children to pyo3 4dc0d36

fix: bump down napi 61f1b98

chore: bump deps 912da32

Changelog

Sourced from @ast-grep/napi's changelog.

0.45.2

23 August 2026

chore(deps): update astral-sh/setup-uv action to v10 [#2892](https://github.com/ast-grep/ast-grep/issues/2892)

chore(deps): update rust crate terminal-light to v1.9.1 [#2905](https://github.com/ast-grep/ast-grep/issues/2905)

chore(deps): update dependency web-tree-sitter to v0.26.13 [#2903](https://github.com/ast-grep/ast-grep/issues/2903)

chore(deps): update rust crate tree-sitter to v0.26.13 [#2904](https://github.com/ast-grep/ast-grep/issues/2904)

chore(deps): update dependency dprint to v0.56.1 [#2901](https://github.com/ast-grep/ast-grep/issues/2901)

chore(deps): update dependency @napi-rs/cli to v3.8.6 [#2882](https://github.com/ast-grep/ast-grep/issues/2882)

fix(deps): update rust-wasm-bindgen monorepo [#2878](https://github.com/ast-grep/ast-grep/issues/2878)

chore(deps): update dependency dprint to v0.56.0 [#2896](https://github.com/ast-grep/ast-grep/issues/2896)

chore(deps): update dependency oxlint to v1.79.0 [#2897](https://github.com/ast-grep/ast-grep/issues/2897)

chore(deps): update dependency @ast-grep/napi to v0.45.1 [#2876](https://github.com/ast-grep/ast-grep/issues/2876)

chore(deps): update dependency web-tree-sitter to v0.26.12 [#2880](https://github.com/ast-grep/ast-grep/issues/2880)

fix: exit quietly on broken pipe instead of erroring [#2887](https://github.com/ast-grep/ast-grep/issues/2887)

feat(outline): extract embedded language symbols [#2883](https://github.com/ast-grep/ast-grep/issues/2883)

chore(deps): update dependency oxlint to v1.78.0 [#2888](https://github.com/ast-grep/ast-grep/issues/2888)

feat: add namedChildren support to wasm [#2893](https://github.com/ast-grep/ast-grep/issues/2893)

feat: add namedChildren to napi [#2893](https://github.com/ast-grep/ast-grep/issues/2893)

feat: add named_children to pyo3 4dc0d36

fix: bump down napi 61f1b98

chore: bump deps 912da32

Commits

c41e023 0.45.2
ca4c005 fix: change default test arch for macos
354492b chore(deps): update astral-sh/setup-uv action to v10 (#2892)
2da70f8 chore(deps): update rust crate terminal-light to v1.9.1 (#2905)
d018191 chore(deps): update dependency web-tree-sitter to v0.26.13 (#2903)
038264c chore(deps): update rust crate tree-sitter to v0.26.13 (#2904)
777b9ba chore(deps): update dependency dprint to v0.56.1 (#2901)
91d249b chore(deps): update dependency @napi-rs/cli to v3.8.6 (#2882)
e2f6308 fix: fix linting
e01da36 fix: address pyo3 deprecation
Additional commits viewable in compare view

Updates jose from 6.2.9 to 6.2.10

Release notes

Sourced from jose's releases.

v6.2.10

Fixes

jose: consume serialization members once (9bee285)

jose: reject empty protected and JWE AAD members (8da4145)

jose: validate serialized header values (b711d8f)

jwe: conceal invalid decrypted CEK lengths (41fafe0)

jwe: enforce AES-GCM tag boundaries (9a5b744)

jwe: validate explicit encryption parameters (7a02697)

jwk: accept empty octet-sequence keys (3f871e7)

jwk: normalize key resolution inputs (f54ee7b)

jwks: enforce verification key metadata (f9ba510)

jwks: order overlapping remote reloads (9a1a913)

jwks: reject invalid remote duration values (7bdb9e5)

jwk: validate ext and key_ops parameters (4d91c37)

jws: reject mixed payload encoding modes (dc69713)

jws: validate unencoded payload strings (541f282)

jwt: enforce explicit verification policies (b347182)

jwt: prevent replacing protected headers (ae07d09)

jwt: reject invalid duration inputs (282f9aa)

jwt: validate builder claim values (ea03f83)

jwt: validate unsecured protected headers (230c14e)

key: validate generation and import options (15d880e)

reject mixed b64 modes for empty General JWS payloads (61a2ef7)

x509: reject DER truncated past its outer length (d8db9f6)

Documentation

jwks: correct cache timestamp units (01a44d9)

Refactor

jose: share binary input validation (eedb124)

jose: share compact token processing internals (85e30ed)

jwe: consolidate CBC decryption failures (1ee6f61)

jwe: specialize compact processing (a998927)

jwe: streamline single-recipient encryption (290aaa6)

jwks: compact JWK Set shape validation (930c7df), references Array#every

jwks: compact local key selection (4cb5ae5)

jwks: compact remote resolver state (ef5eaf4)

jws: specialize compact processing (021abf4)

jwt: compact claim validation helpers (f390683)

jwt: consolidate replicated claim checks (7dd5591)

jwt: share producer claim state (52ba159)

key: compact JWK algorithm selection (a6b29da)

key: compact secret length parsing (cc03be8)

Changelog

Sourced from jose's changelog.

6.2.10 (2026-08-21)

Fixes

jose: consume serialization members once (9bee285)

jose: reject empty protected and JWE AAD members (8da4145)

jose: validate serialized header values (b711d8f)

jwe: conceal invalid decrypted CEK lengths (41fafe0)

jwe: enforce AES-GCM tag boundaries (9a5b744)

jwe: validate explicit encryption parameters (7a02697)

jwk: accept empty octet-sequence keys (3f871e7)

jwk: normalize key resolution inputs (f54ee7b)

jwks: enforce verification key metadata (f9ba510)

jwks: order overlapping remote reloads (9a1a913)

jwks: reject invalid remote duration values (7bdb9e5)

jwk: validate ext and key_ops parameters (4d91c37)

jws: reject mixed payload encoding modes (dc69713)

jws: validate unencoded payload strings (541f282)

jwt: enforce explicit verification policies (b347182)

jwt: prevent replacing protected headers (ae07d09)

jwt: reject invalid duration inputs (282f9aa)

jwt: validate builder claim values (ea03f83)

jwt: validate unsecured protected headers (230c14e)

key: validate generation and import options (15d880e)

reject mixed b64 modes for empty General JWS payloads (61a2ef7)

x509: reject DER truncated past its outer length (d8db9f6)

Documentation

jwks: correct cache timestamp units (01a44d9)

Refactor

jose: share binary input validation (eedb124)

jose: share compact token processing internals (85e30ed)

jwe: consolidate CBC decryption failures (1ee6f61)

jwe: specialize compact processing (a998927)

jwe: streamline single-recipient encryption (290aaa6)

jwks: compact JWK Set shape validation (930c7df), references Array#every

jwks: compact local key selection (4cb5ae5)

jwks: compact remote resolver state (ef5eaf4)

jws: specialize compact processing (021abf4)

jwt: compact claim validation helpers (f390683)

jwt: consolidate replicated claim checks (7dd5591)

jwt: share producer claim state (52ba159)

key: compact JWK algorithm selection (a6b29da)

key: compact secret length parsing (cc03be8)

Commits

3eab152 chore(release): 6.2.10
021abf4 refactor(jws): specialize compact processing
a998927 refactor(jwe): specialize compact processing
eedb124 refactor(jose): share binary input validation
52ba159 refactor(jwt): share producer claim state
85e30ed refactor(jose): share compact token processing internals
0bd81d2 test(jose): cover hidden critical-header options
9cf7876 test(jose): reject callable object impostors
f23cafd test(jose): preserve resolved key data properties
1ee6f61 refactor(jwe): consolidate CBC decryption failures
Additional commits viewable in compare view

Updates next from 16.3.1 to 16.3.3

Release notes

Sourced from next's releases.

v16.3.3

This release contains security fixes for the following advisories:

Critical:

Unauthenticated Remote Code Execution on windows-hosted servers

Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

[backport] Scope app-entry export validation to files inside the app directory (#97357)

[backport] Fix catch-all index page being served for every other slug (#97416)

[16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)

[16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)

[16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)

[16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @lubieowoce, @unstubbable, @timneutkens, @mischnic, and @eps1lon for helping!

Commits

a9a1cb7 v16.3.3
968b9fc [16.3.x] Fix ISR misses with backslashes in segments when deployed on Windows
3a15b4a [16.3.x] [next/image]: disable avif image optimization
7378b51 Backport/docs fixes 16.3 (#97649)
528c1cd [16.3.x] Stop generating error codes (#97780)
d0ac882 v16.3.2
81deb92 [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static ...
cd714d9 [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
5ac2327 [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
0ccb3e7 [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the production-minor-patch group with 3 updates: [@ast-grep/napi](https://github.com/ast-grep/ast-grep), [jose](https://github.com/panva/jose) and [next](https://github.com/vercel/next.js). Updates `@ast-grep/napi` from 0.45.1 to 0.45.2 - [Release notes](https://github.com/ast-grep/ast-grep/releases) - [Changelog](https://github.com/ast-grep/ast-grep/blob/main/CHANGELOG.md) - [Commits](ast-grep/ast-grep@0.45.1...0.45.2) Updates `jose` from 6.2.9 to 6.2.10 - [Release notes](https://github.com/panva/jose/releases) - [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md) - [Commits](panva/jose@v6.2.9...v6.2.10) Updates `next` from 16.3.1 to 16.3.3 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.3.1...v16.3.3) --- updated-dependencies: - dependency-name: "@ast-grep/napi" dependency-version: 0.45.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: jose dependency-version: 6.2.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: next dependency-version: 16.3.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 31, 2026

Navigation Menu

Uh oh!

chore(deps): bump the production-minor-patch group with 3 updates - #95

chore(deps): bump the production-minor-patch group with 3 updates#95
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/production-minor-patch-21ac1022d4

dependabot Bot commented on behalf of github Aug 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 31, 2026

0.45.2

0.45.2

v6.2.10

Fixes

Documentation

Refactor

6.2.10 (2026-08-21)

Fixes

Documentation

Refactor

v16.3.3

v16.3.2

Core Changes

Credits

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants