chore(deps): bump the npm-production group across 1 directory with 26 updates

[dependabot]

Bumps the npm-production group with 26 updates in the / directory:

Package	From	To
@codemirror/legacy-modes	6.5.4	6.5.5
@tauri-apps/api	2.12.1	2.12.3
@tauri-apps/plugin-clipboard-manager	2.4.1	2.4.2
@tauri-apps/plugin-dialog	2.8.1	2.8.2
@tauri-apps/plugin-fs	2.6.0	2.7.0
@tauri-apps/plugin-opener	2.7.0	2.7.1
@hono/node-server	2.1.3	2.1.4
@modelcontextprotocol/sdk	1.31.0	1.32.1
hono	4.13.12	4.13.13
zod	4.6.5	4.6.6
@readme/httpsnippet	11.4.0	11.4.1
jsonpath-plus	11.0.0	11.2.0
uuid	14.0.2	14.0.3
xpath	0.0.34	0.0.35
@codemirror/language	6.12.4	6.13.1
@lezer/lr	1.4.10	1.4.11
@tanstack/react-query	5.104.0	5.104.2
@tanstack/react-router	1.170.41	1.170.42
@tanstack/react-virtual	3.14.13	3.14.17
@tauri-apps/plugin-log	2.10.0	2.10.1
@tauri-apps/plugin-shell	2.4.0	2.5.0
lucide-react	1.49.0	1.55.0
mime	4.1.0	4.1.1
motion	14.0.0	14.1.0
nanoid	6.0.1	6.0.2
react-syntax-highlighter	16.1.1	16.1.2

Updates @codemirror/legacy-modes from 6.5.4 to 6.5.5

Commits

• See full diff in compare view

Updates @tauri-apps/api from 2.12.1 to 2.12.3

Release notes

Sourced from @​tauri-apps/api's releases.

@​tauri-apps/api v2.12.3

All found vulnerabilities were already reviewed and decided to be ignored
3 ignored: 3 high

[2.12.3]

Bug Fixes

• 0204f6f3a (#16244) Keep delivering Channel messages after the onmessage handler throws. The error is rethrown asynchronously so it is still reported as uncaught, instead of leaving every later message queued.

$ pnpm build && cd ./dist && pnpm publish --access public --loglevel debug --no-git-checks
$ rollup -c --configPlugin typescript
�[36m
�[1m./src/app.ts, ./src/core.ts, ./src/dpi.ts, ./src/event.ts, ./src/image.ts, ./src/index.ts, ./src/menu.ts, ./src/mocks.ts, ./src/path.ts, ./src/tray.ts, ./src/webview.ts, ./src/webviewWindow.ts, ./src/window.ts�[22m → �[1m./dist, ./dist�[22m...�[39m
�[32mcreated �[1m./dist, ./dist�[22m in �[1m911ms�[22m�[39m
�[36m
�[1msrc/index.ts�[22m → �[1m../../crates/tauri/scripts/bundle.global.js�[22m...�[39m
�[32mcreated �[1m../../crates/tauri/scripts/bundle.global.js�[22m in �[1m1.3s�[22m�[39m
GET https://run-actions-3-azure-eastus.actions.githubusercontent.com/173//idtoken/7aa7f391-8187-8dab-bf55-bf43b72d0bd0/62377c8c-1199-5374-9168-2a108b628dd5?api-version=2.0&audience=npm%3Aregistry.npmjs.org 200 239ms
📦 @tauri-apps/api@2.12.3 → https://registry.npmjs.org/
GET https://run-actions-3-azure-eastus.actions.githubusercontent.com/173//idtoken/7aa7f391-8187-8dab-bf55-bf43b72d0bd0/62377c8c-1199-5374-9168-2a108b628dd5?api-version=2.0&audience=sigstore 200 81ms
Signed provenance statement with source and build information
✅ Published package @tauri-apps/api@2.12.3

@​tauri-apps/api v2.12.2

All found vulnerabilities were already reviewed and decided to be ignored
3 ignored: 3 high

[2.12.2]

... (truncated)

Commits

• 5b23c82 apply version updates (#16243)
• 05354a8 chore(deps): update swift-rs to 1.0.9
• c48e1ca fix(ios): make @_cdecl entry points public so release builds link on Xcode ...
• eeeaa0f fix(nsis): block downgrades in silent, passive and update modes (#16230)
• 0204f6f fix(api): keep Channel messages flowing after the handler throws (#16244)
• 7fcd8a7 fix(ci): retry switching to the Android webview context in e2e (#16239)
• fd319dd chore(deps): update base64 to 0.23
• 413cbdb Apply Version Updates From Current Changes (#16213)
• 587ae48 chore: disable CODEOWNERS file (#16236)
• a98038e fix: menu append doesn't take options like MenuItemOptions (#16235)
• Additional commits viewable in compare view

Updates @tauri-apps/plugin-clipboard-manager from 2.4.1 to 2.4.2

Release notes

Sourced from @​tauri-apps/plugin-clipboard-manager's releases.

geolocation-js v2.4.2

[2.4.2]

• 42ae8b45 (#3684) On iOS, mark the plugin's init_plugin_* entry point public so release builds made with Xcode 27 keep it global and link.

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-geolocation@2.4.2
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 4.8kB README.md
npm notice 3.9kB dist-js/index.cjs
npm notice 6.3kB dist-js/index.d.ts
npm notice 3.7kB dist-js/index.js
npm notice 662B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-geolocation
npm notice version: 2.4.2
npm notice filename: tauri-apps-plugin-geolocation-2.4.2.tgz
npm notice package size: 4.8 kB
npm notice unpacked size: 20.2 kB
npm notice shasum: 6d73ce4b1a0c3ffa8f19a7294fe68fa1768fe6dd
npm notice integrity: sha512-JLuLHiAyXMu24[...]FMhrjZh89m88w==
npm notice total files: 6
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3189612489
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-geolocation@2.4.2

geolocation v2.4.2

[2.4.2]

• 42ae8b45 (#3684) On iOS, mark the plugin's init_plugin_* entry point public so release builds made with Xcode 27 keep it global and link.

... (truncated)

Commits

• 2371804 publish new versions (#2888)
• 90f9b93 chore: fix cli version in deep-link package.json
• 1c58f33 chore(deps): update dependency rollup to v4.46.4 (v2) (#2935)
• 75617a6 fix(mobile): deeplinks (#2870)
• 5a963a0 chore(deps): update dependency @​tauri-apps/cli to v2.8.1 (#2930)
• 76f4e7b chore(deps): update eslint monorepo to v9.33.0 (#2903)
• 670ac1d chore(deps): update dependency typescript-eslint to v8.40.0 (#2923)
• ed0deef chore(deps): update dependency @​tauri-apps/api to v2.8.0 (#2929)
• 50cebdb chore(deps): update to tauri 2.8.0 (#2925)
• dd2ea9c chore(deps): update dependency rollup to v4.46.3 (#2920)
• Additional commits viewable in compare view

Updates @tauri-apps/plugin-dialog from 2.8.1 to 2.8.2

Release notes

Sourced from @​tauri-apps/plugin-dialog's releases.

http-js v2.8.2

[2.8.2]

Dependencies

• Upgraded to fs-js@2.7.0

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-http@2.8.2
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 2.6kB README.md
npm notice 7.7kB dist-js/index.cjs
npm notice 3.4kB dist-js/index.d.ts
npm notice 7.7kB dist-js/index.js
npm notice 655B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-http
npm notice version: 2.8.2
npm notice filename: tauri-apps-plugin-http-2.8.2.tgz
npm notice package size: 5.5 kB
npm notice unpacked size: 23.0 kB
npm notice shasum: 2c9d8f56a25f10bcf19fc3ceca2acd40457487b2
npm notice integrity: sha512-xVHnZdIkPY9+/[...]BWzSjWEVAvvUA==
npm notice total files: 6
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3189625257
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-http@2.8.2

http v2.8.2

[2.8.2]

Dependencies

• Upgraded to fs-js@2.7.0

... (truncated)

Commits

• 6bbd44d publish new versions (#3675)
• fc18d05 fix(global-shortcut): release the shortcuts lock before running handlers (#3683)
• 42ae8b4 fix(ios): make init_plugin_* entry points public so release builds link on ...
• 818d2e0 fix(single-instance): limit second instance's wait on Windows (#3645)
• 323fe80 fix(single-instance): forward non-Unicode arguments and cwd (#3644)
• 6772581 test(e2e): fix __name usage on FS test
• 46f7c87 chore: fmt
• a8acd17 feat(shell): add process group spawn option (fix #1332) (#3351)
• e03dca6 fix(fs): accept absolute paths in the iOS security-scope commands (#3628)
• 3a90001 fix(fs): resolve symlinks of missing paths before checking the scope (#3627)
• Additional commits viewable in compare view

Updates @tauri-apps/plugin-fs from 2.6.0 to 2.7.0

Release notes

Sourced from @​tauri-apps/plugin-fs's releases.

fs-js v2.7.0

[2.7.0]

• a934743b (#3637) Added the scopeDroppedPaths plugin config option (plugins > fs > scopeDroppedPaths in tauri.conf.json). Set it to false to stop adding the paths dropped onto any window to the fs scope, which otherwise gives every webview with an fs permission access to them (directories recursively). Defaults to true, the current behaviour.
• 085a0283 (#3636) Fixed a panic on Android when a content provider returns no file descriptor for a content:// URI (e.g. virtual files). The fs command now fails with an error instead.
• f81f0447 (#3635) Fixed reading uncompressed Android assets ($RESOURCE files such as images or audio that are stored uncompressed in the APK) returning the bytes of the APK instead of the asset. Assets are now always read from a copy in the app cache, like compressed ones.
• e03dca60 (#3628) startAccessingSecurityScopedResource and stopAccessingSecurityScopedResource now accept absolute paths on iOS, as documented, instead of silently doing nothing unless given a file:// URL.
• 5de7ebfc (#3634) Security: the open command no longer accepts a customFlags option from the webview. It was not part of the JavaScript types and let the webview pass arbitrary open(2) flags (e.g. O_TRUNC) to files it may only read. OpenOptionsExt::custom_flags still works from Rust.
• 5e6c023a (#3626) FileHandle.read no longer allocates a buffer of the requested size up front: the length is capped to the rest of the file (64 MiB for files of unknown size), an allocation failure is reported as an error instead of aborting the app, and only the bytes that were read are sent back to the webview.
• 3a900017 (#3627) Security: the fs scope check now resolves symlinks in the ancestors of paths that do not exist yet, and resolves relative symlink targets against the link's directory instead of the process working directory. Previously a new file created below a symlinked directory inside the scope (writeFile, mkdir, create, rename, copyFile, ...) was written outside of the scope. Deny patterns now also apply to the path as given, so they can name a symlink, and a path whose symlinks cannot be resolved (e.g. a loop) is rejected.
• 77d00a4f (#3633) FileHandle.seek now rejects a negative offset with SeekMode.Start instead of seeking to a huge position.
• 5c144e74 (#3631) Fixed readTextFileLines with a UTF-16 encoding splitting lines on a 0x0A 0x00 (LE) or 0x00 0x0A (BE) byte sequence that is not aligned on a code unit, e.g. ਗĀ, which garbled every following line.
• dcc8cb03 (#3629) Fixed writeFile with a ReadableStream leaving the end of the previous contents in place when the new data is shorter. The file is now truncated first unless append is set, like when writing a buffer.

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-fs@2.7.0
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 2.4kB README.md
npm notice 39.9kB dist-js/index.cjs
npm notice 41.1kB dist-js/index.d.ts
npm notice 39.2kB dist-js/index.js
npm notice 697B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-fs
npm notice version: 2.7.0
npm notice filename: tauri-apps-plugin-fs-2.7.0.tgz
npm notice package size: 25.6 kB
npm notice unpacked size: 124.3 kB
npm notice shasum: e76d4d07b05063de6911fd1c42948ab0264ac20e
npm notice integrity: sha512-8RQbPkuYuLZ2r[...]GdKJVqDokyDgQ==
npm notice total files: 6
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3189606635
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-fs@2.7.0

... (truncated)

Commits

• 6bbd44d publish new versions (#3675)
• fc18d05 fix(global-shortcut): release the shortcuts lock before running handlers (#3683)
• 42ae8b4 fix(ios): make init_plugin_* entry points public so release builds link on ...
• 818d2e0 fix(single-instance): limit second instance's wait on Windows (#3645)
• 323fe80 fix(single-instance): forward non-Unicode arguments and cwd (#3644)
• 6772581 test(e2e): fix __name usage on FS test
• 46f7c87 chore: fmt
• a8acd17 feat(shell): add process group spawn option (fix #1332) (#3351)
• e03dca6 fix(fs): accept absolute paths in the iOS security-scope commands (#3628)
• 3a90001 fix(fs): resolve symlinks of missing paths before checking the scope (#3627)
• Additional commits viewable in compare view

Updates @tauri-apps/plugin-opener from 2.7.0 to 2.7.1

Release notes

Sourced from @​tauri-apps/plugin-opener's releases.

opener-js v2.7.1

[2.7.1]

• 42ae8b45 (#3684) On iOS, mark the plugin's init_plugin_* entry point public so release builds made with Xcode 27 keep it global and link.

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-opener@2.7.1
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 4.2kB README.md
npm notice 3.1kB dist-js/index.cjs
npm notice 2.0kB dist-js/index.d.ts
npm notice 3.1kB dist-js/index.js
npm notice 11B dist-js/init.d.ts
npm notice 730B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-opener
npm notice version: 2.7.1
npm notice filename: tauri-apps-plugin-opener-2.7.1.tgz
npm notice package size: 3.5 kB
npm notice unpacked size: 14.1 kB
npm notice shasum: e8719fb7c89a681460f6b5b42a6b7d71746b4c92
npm notice integrity: sha512-XkXdt30rontti[...]F1sFsmu6uyywQ==
npm notice total files: 7
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3189619091
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-opener@2.7.1

opener v2.7.1

[2.7.1]

• 42ae8b45 (#3684) On iOS, mark the plugin's init_plugin_* entry point public so release builds made with Xcode 27 keep it global and link.

... (truncated)

Commits

• 44293a5 Publish New Versions (v2) (#3689)
• 7550f7c chore(deps): bump rustls to 0.23.46
• 36d8e40 feat(geolocation): support for non-GMS devices (#3377)
• 57297f3 feat(clipboard-manager): add support for writing secrets (#3376)
• 1ab9304 fix(opener): avoid blocking-runtime panic in reveal_item_in_dir (#3565)
• 0e17675 fix(http): decode header values as ISO-8859-1 (#3586)
• 62b3565 chore(deps): update quinn-proto (lockfile-only) (#3707)
• d80b1be feat: add torch plugin for iOS and Android (#3551)
• c91a9e6 feat(sql): add autoCreate option to Database.load (#3702)
• 0374bec [feat] [biometric] Adding the capability of encrypting/decrypting data using ...
• Additional commits viewable in compare view

Updates @hono/node-server from 2.1.3 to 2.1.4

Release notes

Sourced from @​hono/node-server's releases.

v2.1.4

What's Changed

• chore: allow hono v5 as a peer dependency by @​yusukebe in honojs/node-server#406

Full Changelog: honojs/node-server@v2.1.3...v2.1.4

Commits

• d57ed9b 2.1.4
• 92b014c chore: allow hono v5 as a peer dependency (#406)
• See full diff in compare view

Updates @modelcontextprotocol/sdk from 1.31.0 to 1.32.1

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.32.1

What's Changed

• [v1.x] docs: state the principles in CLAUDE.md by @​claude[bot] in modelcontextprotocol/typescript-sdk#2939
• [v1.x] docs: point the README at v2 and say what v1.x supports by @​claude[bot] in modelcontextprotocol/typescript-sdk#2942
• chore: bump version to 1.32.1 by @​claude[bot] in modelcontextprotocol/typescript-sdk#2954

Full Changelog: modelcontextprotocol/typescript-sdk@1.32.0...1.32.1

1.32.0

Upgrade notes

• Redirects: the HTTP client transports now follow a redirect only when it stays on the same origin (same scheme, host and port; http to https on the same host is allowed). A deployment whose endpoint redirects to another host or port either configures the final URL or sets redirectPolicy: 'follow' on StreamableHTTPClientTransport or SSEClientTransport. In browsers, a redirected request fails unless that option is set.
• New options, both off unless you set them: maxToolInputElements on McpServer limits the number of array elements and object members in a tool call's arguments. expectedResource on requireBearerAuth accepts only tokens issued for this server (the token's audience).

What's Changed

• [v1.x] fix(client): follow redirects only within the endpoint's origin by @​claude[bot] in modelcontextprotocol/typescript-sdk#2902
• docs: point SECURITY.md at GitHub Security Advisories (v1.x) by @​claude[bot] in modelcontextprotocol/typescript-sdk#2910
• [v1.x] examples: close idle sessions and cap the session map by @​maxisbey in modelcontextprotocol/typescript-sdk#2914
• [v1.x] fix(tasks): keep tasks of the in-memory task store within the session that created them by @​claude[bot] in modelcontextprotocol/typescript-sdk#2925
• [v1.x] feat(server): add maxToolInputElements option to limit the number of elements in tool-call arguments by @​claude[bot] in modelcontextprotocol/typescript-sdk#2927
• [v1.x] fix(server): accept tools/call and prompts/get requests that omit arguments by @​raashish1601 in modelcontextprotocol/typescript-sdk#2045
• [v1.x] feat(auth): add expectedResource to requireBearerAuth by @​claude[bot] in modelcontextprotocol/typescript-sdk#2930
• [v1.x] test(e2e): cover tools/call and prompts/get without arguments by @​claude[bot] in modelcontextprotocol/typescript-sdk#2931
• chore: bump version to 1.32.0 by @​claude[bot] in modelcontextprotocol/typescript-sdk#2935

New Contributors

• @​raashish1601 made their first contribution in modelcontextprotocol/typescript-sdk#2045

Full Changelog: modelcontextprotocol/typescript-sdk@1.31.0...1.32.0

Commits

• ff07b00 chore: bump version to 1.32.1 (#2954)
• 8a74d50 [v1.x] docs: point the README at v2 and say what v1.x supports (#2942)
• a8cf503 [v1.x] docs: state the principles in CLAUDE.md (#2939)
• 32549b0 chore: bump version to 1.32.0 (#2935)
• 588d51d [v1.x] test(e2e): cover tools/call and prompts/get without arguments (#2931)
• 5a0724d [v1.x] feat(auth): add expectedResource to requireBearerAuth (#2930)
• 0ca0b62 [v1.x] fix(server): accept tools/call and prompts/get requests that omit argu...
• fd26801 [v1.x] feat(server): add maxToolInputElements option to limit the number of e...
• 727075b [v1.x] fix(tasks): keep tasks of the in-memory task store within the session ...
• 0ff6377 [v1.x] examples: close idle sessions and cap the session map (#2914)
• Additional commits viewable in compare view

Updates hono from 4.13.12 to 4.13.13

Release notes

Sourced from hono's releases.

v4.13.13

Mount Middleware

app.mount() is now available as the Mount Middleware, hono/mount. It is just a handler, so you register it with app.all():

import { Router as IttyRouter } from 'itty-router'
import { Hono } from 'hono'
import { mount } from 'hono/mount'
const ittyRouter = IttyRouter()
ittyRouter.get('/hello', () => new Response('Hello from itty-router'))
const app = new Hono()
app.all('/itty-router/*', mount(ittyRouter.handle))

app.mount() still works in v4 but is deprecated and will be removed in v5. Migrating is a one-line change:

- app.mount('/itty-router', ittyRouter.handle)
+ app.all('/itty-router/*', mount(ittyRouter.handle))

What's Changed

• test(client): simulate network error for undefined route in parseResponse test in honojs/hono#5439
• docs(request): fix jsdoc comments for some getters in honojs/hono#5445
• fix(jsx): allow JSXNode function component results in honojs/hono#5476
• feat(mount): introduce Mount Middleware and deprecate app.mount in honojs/hono#5221

Full Changelog: honojs/hono@v4.13.12...v4.13.13

Commits

• 08a023c 4.13.13
• ae595de feat(mount): introduce Mount Middleware and deprecate app.mount (#5221)
• f23b146 fix(jsx): allow JSXNode function component results (#5476)
• 6d73a74 docs(request): fix jsdoc comments for some getters (#5445)
• deff529 test(client): simulate network error for undefined route in parseResponse tes...
• See full diff in compare view

Updates zod from 4.6.5 to 4.6.6

Release notes

Sourced from zod's releases.

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

• 0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini
• 9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales
• 34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note
• 74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)
• b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors
• 8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze
• bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles
• c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)
• a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)
• a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)
• 529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6
• 9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why

Commits

• 9c21983 ci: stage at verbose so a failed OIDC token exchange says why
• 529f78d 4.6.6
• a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
• a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
• c42596b release: hold the run on the release-approval environment until the staged ve...
• bacad51 docs: square the Code for Japan logo to match the other bronze tiles
• 8fb2faf docs: crop the Code for Japan logo and list it first in bronze
• b2ef983 docs: add Code for Japan to bronze sponsors
• 74304ce release: stage npm versions instead of publishing them (#6622)
• 34a626f docs: tighten the z.locales tree-shaking note
• Additional commits viewable in compare view

Updates @readme/httpsnippet from 11.4.0 to 11.4.1

Release notes

Sourced from @​readme/httpsnippet's releases.

11.4.1

What's Changed

• chore(deps-dev): bump postcss from 8.5.16 to 8.5.23 by @​dependabot[bot] in readmeio/httpsnippet#344
• chore(deps): bump type-fest from 5.7.0 to 5.8.0 in the minor-production-deps group by @​dependabot[bot] in readmeio/httpsnippet#348
• chore(deps): bump actions/setup-node from 6 to 7 by @​dependabot[bot] in readmeio/httpsnippet#347
• chore(deps-dev): bump the minor-development-deps group with 6 updates by @​dependabot[bot] in readmeio/httpsnippet#346
• chore(deps): bump github/codeql-action from 4 to 4.37.3 by @​dependabot[bot] in readmeio/httpsnippet#345
• chore(deps-dev): bump js-yaml from 4.2.0 to 4.3.1 by @​dependabot[bot] in readmeio/httpsnippet#350
• chore(deps): bump github/codeql-action from 4.37.3 to 4.37.9 by @​dependabot[bot] in readmeio/httpsnippet#351
• chore(deps-dev): bump the minor-development-deps group with 6 updates by @​dependabot[bot] in readmeio/httpsnippet#352
• chore(deps): bump brace-expansion by @​dependabot[bot] in readmeio/httpsnippet#353
• chore(deps): bump qs from 6.15.3 to 6.16.0 by @​dependabot[bot] in readmeio/httpsnippet#354
• chore(deps-dev): bump js-yaml from 4.3.1 to 4.3.2 by @​dependabot[bot] in readmeio/httpsnippet#355
• chore(deps-dev): bump vitest from 4.1.11 to 5.0.2 by @​dependabot[bot] in readmeio/httpsnippet#360
• chore(deps): bump github/codeql-action from 4.37.9 to 4.38.2 by @​dependabot[bot] in readmeio/httpsnippet#356
• chore(deps): bump type-fest from 5.8.0 to 5.10.0 in the minor-production-deps group by @​dependabot[bot] in readmeio/httpsnippet#358
• chore(deps-dev): bump the minor-development-deps group with 5 updates by @​dependabot[bot] in readmeio/httpsnippet#357

Full Changelog: readmeio/httpsnippet@11.4.0...11.4.1

Commits

• d5b8cb5 build: 11.4.1 release
• 9b0b108 chore(deps): update brace-expansion
• 2f4a716 chore(deps-dev): bump the minor-development-deps group with 5 updates (#357)
• 1134653 chore(deps): bump type-fest from 5.8.0 to 5.10.0 in the minor-production-deps...
• b0bb745 chore(deps): bump github/codeql-action from 4.37.9 to 4.38.2 (#356)
• ea4ef11 chore(deps-dev): bump vitest from 4.1.11 to 5.0.2 (#360)
• 6111db7 chore(deps-dev): bump js-yaml from 4.3.1 to 4.3.2 (#355)
• e939e55 chore(deps): bump qs from 6.15.3 to 6.16.0 (#354)
• 70882db chore(deps): bump brace-expansion (#353)
• a67f99b chore(deps-dev): bump the minor-development-deps group with 6 updates (#352)
• Additional commits viewable in compare view

Updates jsonpath-plus from 11.0.0 to 11.2.0

Changelog

Sourced from jsonpath-plus's changelog.

11.2.0

• feat: allow arg to other type callbacks
• feat: add @​symbol, @​Promise, @​jsonReference other types
• feat: add separate optional imports for structuredCloning and extra javascript types

11.1.1

• fix: avoid treating at sign within regex as current context; fixes #280

11.1.0

• fix: allow bare @ in any position (e.g., $[?(@>1)], $[?(@)], $[?(!@)]) and stop rewriting @ inside quoted string literals (@​spokodev)
• fix: support unions of quoted property names (e.g., $['x','y'], $["a,b",'c.d']) as literal names (fixes #159; see #268)
• fix: support quoted property names containing commas (e.g., $['a,b'])
• fix: support \', \", and \\ escapes within quoted property names and escape ' and \ in toPathString output so paths round-trip

11.0.1

• fix(security) nested filter bypass exploit (@​andrewmacheret)

Commits

• c9fe7b5 chore: update docs
• e857a3c chore: pnpm lock upgrade/dedupe
• 41f4532 chore: update devDeps.
• 72dc3b4 feat: allow arg to other type callbacks
• ed83f1f fix(at signs): tighter regex (with lookbehind)
• e91b6b6 build(deps): bump markdown-it from 14.3.0 to 14.3.2
• 9c3dbc4 build(deps): bump undici from 6.28.0 to 6.29.0
• fc12b59 chore(typedoc): use config file (to specify highlight languages)
• 81abdd8 docs: point to upstream
• 60a521b chore: update docs
• Additional commits viewable in compare view

Updates uuid from 14.0.2 to 14.0.3

Release notes

Sourced from uuid's releases.

v14.0.3

14.0.3 (2026-10-09)

Bug Fixes

• fix CITGM #1154 (#981) (b44f159)

Changelog

Sourced from uuid's changelog.

14.0.3 (2026-10-09)

Bug Fixes

• fix CITGM #1154 (#981) (b44f159)

Commits

• 993ff7b chore(main): release 14.0.3 (#982)
• f7d19b9 chore: update workflow actions (#983)
• b44f159 fix: fix CITGM #1154 (#981)
• dd8c173 chore: update deps (#975)
• See full diff in compare view

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates xpath from 0.0.34 to 0.0.35

Commits

• See full diff in compare view

Updates @codemirror/language from 6.12.4 to 6.13.1

Commits

• See full diff in

[gschier]

Superseded by pull request create failed: GraphQL: Head sha can't be blank, Base sha can't be blank, No commits between main and deps/npm-production-2026-10, Head ref must be a branch (createPullRequest), which carries the same group plus the lockfile dedupe that fixes CI.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

[gschier]

Superseded by #760, which carries the same group plus the lockfile dedupe that fixes CI.