Skip to content

chore(deps): Bump the minor-and-patch group across 1 directory with 9 updates - #223

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/bun/minor-and-patch-bbbeabe011
Closed

chore(deps): Bump the minor-and-patch group across 1 directory with 9 updates#223
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/bun/minor-and-patch-bbbeabe011

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 9 updates in the / directory:

Package From To
zod 4.4.3 4.6.5
@types/node 26.5.1 26.6.4
three 0.186.0 0.186.1
@modelcontextprotocol/sdk 1.30.0 1.31.0
@sveltejs/vite-plugin-svelte 7.3.0 7.3.1
svelte 5.57.0 5.57.1
@vue/test-utils 2.5.0 2.5.1
vue 3.5.42 3.5.43
@modelcontextprotocol/ext-apps 2.0.0 2.0.3

Updates zod from 4.4.3 to 4.6.5

Release notes

Sourced from zod's releases.

v4.6.5

Commits:

  • d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post
  • f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
  • de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)
  • 56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)
  • ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"
  • cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""
  • 0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5
  • 59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

  • d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)
  • ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)
  • 2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
  • f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

  • 413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged
  • 75d63ee1 docs: show only the .properties() method form in the 4.6 post
  • 46da9572 docs: match the error-message examples to what the parsers emit

v4.6.2

A patch on top of 4.6.1.

v4.6.1

A patch on top of 4.6.0.

v4.6.0

Zod 4.6 is now available.

npm install zod@latest

At a glance:

... (truncated)

Commits
  • 59bbc03 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump
  • 0f3f5ee 4.6.5
  • cc4cd4e Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, ref...
  • ca0229a Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed w...
  • 56222cd feat(instanceof): key the .properties() shape off the instance type (#6600)
  • de65a5c docs: lead the properties section with the check and add a Zod Mini tab (#6598)
  • f1448f7 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
  • d2b135c docs: add the 4.6.x patch highlights to the 4.6 post
  • 2bb0871 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
  • 743aedb 4.6.4
  • Additional commits viewable in compare view

Updates @types/node from 26.5.1 to 26.6.4

Commits

Updates three from 0.186.0 to 0.186.1

Commits

Updates @modelcontextprotocol/sdk from 1.30.0 to 1.31.0

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.31.0

Upgrade notes

  • Stored OAuth tokens and client information now include an issuer field. Storage that rejects unknown fields needs to allow it.
  • Pass expectedIssuer when constructing ClientCredentialsProvider, PrivateKeyJwtProvider or StaticPrivateKeyJwtProvider. Constructing them without it is deprecated.

What's Changed

Full Changelog: modelcontextprotocol/typescript-sdk@1.30.1...1.31.0

1.30.1

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@1.30.0...1.30.1

Commits
  • 4b0051f chore: bump version to 1.31.0 (#2890)
  • 51ad4f0 [v1.x] Bind stored OAuth credentials to the authorization server that issued ...
  • 289ac2c chore: bump version to 1.30.1 (#2848)
  • 12b4256 fix(auth): preserve resource URI without trailing slash (#1968) (#1972)
  • a9f6eb7 [v1.x] fix(server): read HTTP request bodies with a size limit and bound JSON...
  • See full diff in compare view

Updates @sveltejs/vite-plugin-svelte from 7.3.0 to 7.3.1

Release notes

Sourced from @​sveltejs/vite-plugin-svelte's releases.

@​sveltejs/vite-plugin-svelte@​7.3.1

Patch Changes

  • fix: inject the inspector into the client under Vite+ on pnpm, where the realpathed client module has no vite/ segment before dist/ (#1373)
Changelog

Sourced from @​sveltejs/vite-plugin-svelte's changelog.

7.3.1

Patch Changes

  • fix: inject the inspector into the client under Vite+ on pnpm, where the realpathed client module has no vite/ segment before dist/ (#1373)
Commits

Updates svelte from 5.57.0 to 5.57.1

Release notes

Sourced from svelte's releases.

svelte@5.57.1

Patch Changes

  • fix: cancel deferred event listeners during cleanup (#18749)

  • fix: preserve global CSS in components without scopable elements (#18793)

  • fix: reduce SSR render result garbage collection (#18798)

  • fix: resolve the fallback of an each block in the enclosing scope (#18803)

  • perf: speed up parser interactions with Acorn or avoid them where possible (#18740)

  • fix: prevent effect tree of batches from interfering with each other (#18508)

  • fix: serialize input default values during server rendering (#18733)

  • fix: remove WAS_MARKED flag in favor of Set (#18127)

  • fix: throw set_context_after_init when setContext is called after an await during SSR (#18739)

  • fix: make Object.hasOwn reactive for state proxy ownership changes (#18838)

  • fix: keep $state.eager when used as a variable initializer (#18809)

  • perf: avoid regex matching in parser where possible (#18736)

  • fix: in non-async mode, only push variable to current_sources when active_reaction is updating (#18550)

  • fix: recognise aria-braillelabel and aria-brailleroledescription as known ARIA attributes (#18765)

Changelog

Sourced from svelte's changelog.

5.57.1

Patch Changes

  • fix: cancel deferred event listeners during cleanup (#18749)

  • fix: preserve global CSS in components without scopable elements (#18793)

  • fix: reduce SSR render result garbage collection (#18798)

  • fix: resolve the fallback of an each block in the enclosing scope (#18803)

  • perf: speed up parser interactions with Acorn or avoid them where possible (#18740)

  • fix: prevent effect tree of batches from interfering with each other (#18508)

  • fix: serialize input default values during server rendering (#18733)

  • fix: remove WAS_MARKED flag in favor of Set (#18127)

  • fix: throw set_context_after_init when setContext is called after an await during SSR (#18739)

  • fix: make Object.hasOwn reactive for state proxy ownership changes (#18838)

  • fix: keep $state.eager when used as a variable initializer (#18809)

  • perf: avoid regex matching in parser where possible (#18736)

  • fix: in non-async mode, only push variable to current_sources when active_reaction is updating (#18550)

  • fix: recognise aria-braillelabel and aria-brailleroledescription as known ARIA attributes (#18765)

Commits
  • 636eaaa Version Packages (#18750)
  • 8030ff2 fix: remove incorrect special handling of :export pseudo-selectors (#18839)
  • a72dc8e fix: make Object.hasOwn reactive for state proxies (#18838)
  • 6eb720a chore: scope.js stops importing from the analysis visitors (#18787)
  • e6ae460 chore: analysis and transform stop importing each other (#18786)
  • 5981c06 chore: move parser helpers next to their users (#18785)
  • f2ad10e fix: preserve global CSS without scopable elements (#18793)
  • a8a9b02 fix: reduce SSR render result garbage collection (#18798)
  • 6be176d fix: resolve the fallback of an each block in the enclosing scope (#18803)
  • 34b13ac fix: keep $state.eager when used as a variable initializer (#18809)
  • Additional commits viewable in compare view

Updates @vue/test-utils from 2.5.0 to 2.5.1

Release notes

Sourced from @​vue/test-utils's releases.

v2.5.1

What's Changed

New Contributors

Full Changelog: vuejs/test-utils@v2.5.0...v2.5.1

Commits

Updates vue from 3.5.42 to 3.5.43

Release notes

Sourced from vue's releases.

v3.5.43

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Changelog

Sourced from vue's changelog.

3.5.43 (2026-09-17)

Bug Fixes

  • compiler-sfc: ignore comment delimiters inside strings and url() when parsing css vars (#15548) (2fde323)
  • compiler-sfc: prepend semicolon for await in switch case (#15498) (9a1df69), closes #15495
  • compiler-sfc: restore await scope when leaving nested blocks (5409708), closes #15465
  • compiler-sfc: reuse parsed parent configs across tsconfig walks (fix #15478) (#15480) (d6febaa)
  • hydration: run leave hooks for hydration placeholders (#15431) (5dda192)
  • reactivity: preserve readonly wrappers in array copy methods (#15469) (599f35b)
  • runtime-core: unmount v-once children after parent rerenders (#15435) (d720338)
  • shared: handle circular references in looseEqual (#15499) (718f782), closes #15496
  • shared: preserve comment-like text in style values (#15471) (b9456cb)
  • suspense: don't drop nested suspense patches during hydration (#15429) (76d42dc)
  • suspense: keep the boundary pending while its branch is patched (#15411) (bfcfe9e), closes #7506
  • suspense: patch a hydrating boundary's pending branch in place (#15432) (2cde6f7)
  • suspense: unmount the DOM an interrupted async component claimed (#15430) (fb9b45c)
  • types: keep optional props when a runtime prop uses a generic PropType (#15523) (243aabc), closes #9546
Commits
  • 5be58b4 release: v3.5.43
  • a0b61aa chore: remove and ignore generated git hooks
  • 2fde323 fix(compiler-sfc): ignore comment delimiters inside strings and url() when pa...
  • 599f35b fix(reactivity): preserve readonly wrappers in array copy methods (#15469)
  • 55a2b45 chore(deps): update pnpm to v12 (#15439)
  • 243aabc fix(types): keep optional props when a runtime prop uses a generic PropType (...
  • 718f782 fix(shared): handle circular references in looseEqual (#15499)
  • 9a1df69 fix(compiler-sfc): prepend semicolon for await in switch case (#15498)
  • d6febaa fix(compiler-sfc): reuse parsed parent configs across tsconfig walks (fix #15...
  • b9456cb fix(shared): preserve comment-like text in style values (#15471)
  • Additional commits viewable in compare view

Updates @modelcontextprotocol/ext-apps from 2.0.0 to 2.0.3

Release notes

Sourced from @​modelcontextprotocol/ext-apps's releases.

v2.0.3

What's Changed

Patch release. No changes to the @modelcontextprotocol/ext-apps library itself; the fixes are in the example packages, so that a fresh install of each published package resolves a dependency tree that passes vulnerability and supply-chain scans.

Security

  • @modelcontextprotocol/server-basic-solid now depends on solid-js 1.9.15 instead of the exact 1.9.10, which pulled in seroval 1.3 (open advisories, fixed in 1.5.3). The root overrides that pinned seroval are removed, and the lockfile is refreshed with npm audit fix (patch and minor updates only, npm audit reports 0 vulnerabilities). by @​ochafik in #793
  • @modelcontextprotocol/server-pdf now depends on the exact @cantoo/pdf-lib 2.6.5 instead of ^2.6.5. The range resolved to 2.11.x, which the repository never tests and which added dependencies with open-ended ranges (culori, node-html-better-parser) that supply-chain scanners flag. by @​ochafik in #792

2.0.2 already pinned pdfjs-dist to 5.4.530 for server-pdf (#789).

Full Changelog: modelcontextprotocol/ext-apps@v2.0.2...v2.0.3

v2.0.2

What's Changed

Patch release. No changes to the @modelcontextprotocol/ext-apps library itself; the fix is in the @modelcontextprotocol/server-pdf example package.

Security

  • @modelcontextprotocol/server-pdf now depends on the exact pdfjs-dist 5.4.530 instead of ^5.0.0. The range let a fresh install resolve pdfjs-dist 5.6.83 or later (currently 5.7.284), which is affected by GHSA-hq66-cqwq-w95j (arbitrary JavaScript execution when opening a crafted PDF). 5.4.530 is outside the affected range and is the version the repository already tests against. Node support is unchanged. by @​ochafik in #789

Full Changelog: modelcontextprotocol/ext-apps@v2.0.1...v2.0.2

v2.0.1

What's Changed

Patch release. No changes to the @modelcontextprotocol/ext-apps library itself; the fixes are in the example servers, which are published as their own packages (including @modelcontextprotocol/server-pdf).

Bug fixes

  • Example servers no longer crash at startup on Node older than 20.11. They computed their dist directory from import.meta.filename / import.meta.dirname, which only exist from Node 20.11, so on Node 18 and 20.0 to 20.10 the module threw TypeError: Cannot read properties of undefined (reading 'endsWith') at load, before the server could answer initialize. All 21 affected servers and the quickstart now derive the path from import.meta.url with fileURLToPath. No behaviour change on Node 20.11+. Affected the published @modelcontextprotocol/server-pdf 1.7.5 and 2.0.0. by @​ochafik in #787
  • engines.node: ">=20" is now declared on the 21 published example packages, matching the root package and the README.

CI

  • The build now also runs the pdf-server MCPB bundle on Node 20.0.0, so this regression fails the build. #787
  • The dependency isolation check adds the ES2022.Error lib to its consumer projects. @modelcontextprotocol/client 2.1.0's typings reference ErrorOptions, so a project compiling with skipLibCheck: false and a lib older than ES2022 needs the same. #788

Packaging

  • repository.url uses the canonical git+https://github.com/modelcontextprotocol/ext-apps.git form in all manifests, which removes the "repository.url" was normalized warning from every publish job. by @​ochafik in #773

Full Changelog: modelcontextprotocol/ext-apps@v2.0.0...v2.0.1

Commits
  • 82221c0 Bump version to 2.0.3 (#794)
  • f20a1ff Update dependencies to clear npm audit findings (#793)
  • c9e00bd Pin @​cantoo/pdf-lib to 2.6.5 in pdf-server (#792)
  • fe9a9f1 Bump version to 2.0.2
  • 7bc2c5c Pin pdfjs-dist to 5.4.530 in pdf-server
  • a523ab3 Fix dependency isolation check against @​modelcontextprotocol/client 2.1
  • b0ddf50 Bump version to 2.0.1
  • 8e1b3bd Fix example servers crashing at startup on Node older than 20.11
  • 6d9bdc7 Merge pull request #773 from modelcontextprotocol/repo-url-fix
  • 2be172d Use the canonical git+https form for repository.url
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): Bump the minor-and-patch group across 1 directory with 9…
2ffd63b 
… updates

Bumps the minor-and-patch group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.6.5` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.5.1` | `26.6.4` |
| [three](https://github.com/mrdoob/three.js) | `0.186.0` | `0.186.1` |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.30.0` | `1.31.0` |
| [@sveltejs/vite-plugin-svelte](https://github.com/sveltejs/vite-plugin-svelte/tree/HEAD/packages/vite-plugin-svelte) | `7.3.0` | `7.3.1` |
| [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) | `5.57.0` | `5.57.1` |
| [@vue/test-utils](https://github.com/vuejs/test-utils) | `2.5.0` | `2.5.1` |
| [vue](https://github.com/vuejs/core) | `3.5.42` | `3.5.43` |
| [@modelcontextprotocol/ext-apps](https://github.com/modelcontextprotocol/ext-apps) | `2.0.0` | `2.0.3` |



Updates `zod` from 4.4.3 to 4.6.5
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.4.3...v4.6.5)

Updates `@types/node` from 26.5.1 to 26.6.4
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `three` from 0.186.0 to 0.186.1
- [Release notes](https://github.com/mrdoob/three.js/releases)
- [Commits](https://github.com/mrdoob/three.js/commits)

Updates `@modelcontextprotocol/sdk` from 1.30.0 to 1.31.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@1.30.0...1.31.0)

Updates `@sveltejs/vite-plugin-svelte` from 7.3.0 to 7.3.1
- [Release notes](https://github.com/sveltejs/vite-plugin-svelte/releases)
- [Changelog](https://github.com/sveltejs/vite-plugin-svelte/blob/main/packages/vite-plugin-svelte/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/vite-plugin-svelte/commits/@sveltejs/vite-plugin-svelte@7.3.1/packages/vite-plugin-svelte)

Updates `svelte` from 5.57.0 to 5.57.1
- [Release notes](https://github.com/sveltejs/svelte/releases)
- [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/svelte/commits/svelte@5.57.1/packages/svelte)

Updates `@vue/test-utils` from 2.5.0 to 2.5.1
- [Release notes](https://github.com/vuejs/test-utils/releases)
- [Commits](vuejs/test-utils@v2.5.0...v2.5.1)

Updates `vue` from 3.5.42 to 3.5.43
- [Release notes](https://github.com/vuejs/core/releases)
- [Changelog](https://github.com/vuejs/core/blob/main/CHANGELOG.md)
- [Commits](vuejs/core@v3.5.42...v3.5.43)

Updates `@modelcontextprotocol/ext-apps` from 2.0.0 to 2.0.3
- [Release notes](https://github.com/modelcontextprotocol/ext-apps/releases)
- [Changelog](https://github.com/modelcontextprotocol/ext-apps/blob/main/RELEASES.md)
- [Commits](modelcontextprotocol/ext-apps@v2.0.0...v2.0.3)

---
updated-dependencies:
- dependency-name: zod
  dependency-version: 4.6.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@types/node"
  dependency-version: 26.6.4
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: three
  dependency-version: 0.186.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@sveltejs/vite-plugin-svelte"
  dependency-version: 7.3.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: svelte
  dependency-version: 5.57.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@vue/test-utils"
  dependency-version: 2.5.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: vue
  dependency-version: 3.5.43
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@modelcontextprotocol/ext-apps"
  dependency-version: 2.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 5, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 12, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 12, 2026
@dependabot
dependabot Bot deleted the dependabot/bun/minor-and-patch-bbbeabe011 branch October 12, 2026 06:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants