npm(deps): bump the npm-minor-and-patch group across 1 directory with 8 updates by dependabot[bot] · Pull Request #233 · documentdb/documentdb.github.io

dependabot · 2026-10-26T23:57:02Z

Bumps the npm-minor-and-patch group with 8 updates in the / directory:

Package	From	To
js-yaml	`5.4.3`	`5.5.0`
next	`16.4.0`	`16.4.3`
react	`19.3.0`	`19.3.1`
react-dom	`19.3.0`	`19.3.1`
@next/eslint-plugin-next	`16.4.0`	`16.4.3`
eslint	`10.12.0`	`10.13.0`
eslint-config-next	`16.4.0`	`16.4.3`
vitest	`5.0.3`	`5.0.5`

Updates js-yaml from 5.4.3 to 5.5.0

Changelog

Sourced from js-yaml's changelog.

[5.5.0] - 2026-10-16

Changed

Updated argparse to v3.

Updated development dependencies.

Fixed

Correct percent-encoding of shorthand and verbatim tags.

Reject ,, ], and } at the start of block plain scalars, #801.

Report the exact position of non-printable characters in errors, #801.

Commits

cb62b2d 5.5.0 released
87aed90 Deps bump
3aec511 Fix error positions for non-printable characters, #801
11aa483 Reject flow indicators at the start of block plain scalars, #801
339d8e0 Refactor tag encoder and decoder to match the YAML specification
See full diff in compare view

Updates next from 16.4.0 to 16.4.3

Release notes

Sourced from next's releases.

v16.4.3

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

v16.4.2

[lts-active] Fix extensionless Google font URLs in both bundlers (#100277)

[lts-active] Don't load the app-page runtime in proxy.ts (#100423)

[lts-active] Revert "Turbopack: loader change invalidation (#95732)" (#100438)

[lts-active][cd] Gate release bot credentials behind GitHub environments (#100123)

[lts-active] test: Pin react-virtualized (#100545)

[lts-active][cd] Move release un-draft to a follow-up job in bot-autonomous (#100572)

[lts-active] Keep OpenTelemetry request traces together (#100349, #100294, #100324, #100350, #100552, #100583) (#100542)

[lts-active] Avoid loading standalone React in server bootstrap (#100610)

Credits

Huge thanks to @mischnic, @lukesandberg, @acdlite, @eps1lon, and @sokra for helping!

v16.4.2

What's Changed

[lts-active] turbo-tasks snapshot consistency fixes (#99644, #99732, #99649) by @lukesandberg in vercel/next.js#100002

[lts-active] Turbopack: backport Pages Router dev module graph chaining (#98823, #99910, #100091) by @sokra in vercel/next.js#100008

[lts-active] fix(next-code-frame): snap visible window to char boundaries by @lukesandberg in vercel/next.js#100212

[lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependency edges by @lukesandberg in vercel/next.js#100209

[lts-active] Turbopack: Ignore realpath errors during module resolution, matching node's behavior by @lukesandberg in vercel/next.js#100217

[lts-active] Backport docs fixes since v16.4.0 by @icyJoseph in vercel/next.js#100246

[lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions by @lukesandberg in vercel/next.js#100211

[lts-active] Backport additional documentation fixes since v16.4.0 by @aurorascharff in vercel/next.js#100262

Full Changelog: vercel/next.js@v16.4.1...v16.4.2

v16.4.1

This release contains security fixes for the following advisories:

Critical:

Unauthenticated Remote Code Execution in use cache functions returning typed arrays

Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

Denial of Service in App Router using Server Actions

Commits

29bbeab v16.4.3
5117201 [lts-active] Avoid loading standalone React in server bootstrap (#100610)
37d603b [lts-active] Keep OpenTelemetry request traces together (#100349, #100294, #1...
cf9d27d [lts-active][cd] Move release un-draft to a follow-up job in bot-autonomous (...
3f6a632 [lts-active] test: Pin react-virtualized (#100545)
f715bba [lts-active][cd] Gate release bot credentials behind GitHub environments (#10...
c864c78 [lts-active] Revert "Turbopack: loader change invalidation (#95732)" (#100438)
f3ff943 [lts-active] Don't load the app-page runtime in proxy.ts (#100423)
f697cf5 [lts-active] Fix extensionless Google font URLs in both bundlers (#100277)
2864b17 v16.4.2
Additional commits viewable in compare view

Updates react from 19.3.0 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

Improve transport protocol (#37845 by @unstubbable and @eps1lon)

Commits

61aa00d [19.3.x][Flight] Improve transport protocol (#37845)
See full diff in compare view

Updates react-dom from 19.3.0 to 19.3.1

Release notes

Sourced from react-dom's releases.

19.3.1 (October 14th, 2026)

React Server Components

Improve transport protocol (#37845 by @unstubbable and @eps1lon)

Commits

61aa00d [19.3.x][Flight] Improve transport protocol (#37845)
See full diff in compare view

Updates @next/eslint-plugin-next from 16.4.0 to 16.4.3

Release notes

Sourced from @next/eslint-plugin-next's releases.

v16.4.3

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

v16.4.2

[lts-active] Fix extensionless Google font URLs in both bundlers (#100277)

[lts-active] Don't load the app-page runtime in proxy.ts (#100423)

[lts-active] Revert "Turbopack: loader change invalidation (#95732)" (#100438)

[lts-active][cd] Gate release bot credentials behind GitHub environments (#100123)

[lts-active] test: Pin react-virtualized (#100545)

[lts-active][cd] Move release un-draft to a follow-up job in bot-autonomous (#100572)

[lts-active] Keep OpenTelemetry request traces together (#100349, #100294, #100324, #100350, #100552, #100583) (#100542)

[lts-active] Avoid loading standalone React in server bootstrap (#100610)

Credits

Huge thanks to @mischnic, @lukesandberg, @acdlite, @eps1lon, and @sokra for helping!

v16.4.2

What's Changed

[lts-active] turbo-tasks snapshot consistency fixes (#99644, #99732, #99649) by @lukesandberg in vercel/next.js#100002

[lts-active] Turbopack: backport Pages Router dev module graph chaining (#98823, #99910, #100091) by @sokra in vercel/next.js#100008

[lts-active] fix(next-code-frame): snap visible window to char boundaries by @lukesandberg in vercel/next.js#100212

[lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependency edges by @lukesandberg in vercel/next.js#100209

[lts-active] Turbopack: Ignore realpath errors during module resolution, matching node's behavior by @lukesandberg in vercel/next.js#100217

[lts-active] Backport docs fixes since v16.4.0 by @icyJoseph in vercel/next.js#100246

[lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions by @lukesandberg in vercel/next.js#100211

[lts-active] Backport additional documentation fixes since v16.4.0 by @aurorascharff in vercel/next.js#100262

Full Changelog: vercel/next.js@v16.4.1...v16.4.2

v16.4.1

This release contains security fixes for the following advisories:

Critical:

Unauthenticated Remote Code Execution in use cache functions returning typed arrays

Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

Denial of Service in App Router using Server Actions

Commits

29bbeab v16.4.3
2864b17 v16.4.2
7217011 v16.4.1
See full diff in compare view

Updates eslint from 10.12.0 to 10.13.0

Release notes

Sourced from eslint's releases.

v10.13.0

Features

48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238) (Irfan fandi)

a39d9fb feat: add globalThis to no-obj-calls (#21382) (synthex-byte)

66ac583 feat: check yield* expressions in no-unsafe-optional-chaining (#21399) (xbinaryx)

Bug Fixes

87bd2ce fix: avoid redeclared let when no-var and one-var fix together (#21389) (Daniel Pinto)

Documentation

4783a68 docs: Update README (GitHub Actions Bot)

43f0ac9 docs: clarify parameter description in getText (#21287) (lumir)

Chores

b59d889 chore: update github/codeql-action action to v4.38.3 (#21412) (renovate[bot])

95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410) (Francesco Trotta)

317fcb3 chore: update ecosystem plugins (#21409) (ESLint Bot)

b92decf perf: skip no-redeclare scan for single-declaration variables (#21365) (James Ross)

47b7063 chore: update dependency @eslint/json to ^2.1.1 (#21398) (renovate[bot])

e5aea41 chore: update ecosystem plugins (#21390) (ESLint Bot)

Commits

4637f98 10.13.0
96df05c Build: changelog update for 10.13.0
4783a68 docs: Update README
b59d889 chore: update github/codeql-action action to v4.38.3 (#21412)
95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410)
317fcb3 chore: update ecosystem plugins (#21409)
48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238)
43f0ac9 docs: clarify parameter description in getText (#21287)
a39d9fb feat: add globalThis to no-obj-calls (#21382)
b92decf perf: skip no-redeclare scan for single-declaration variables (#21365)
Additional commits viewable in compare view

Updates eslint-config-next from 16.4.0 to 16.4.3

Release notes

Sourced from eslint-config-next's releases.

v16.4.3

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

v16.4.2

[lts-active] Fix extensionless Google font URLs in both bundlers (#100277)

[lts-active] Don't load the app-page runtime in proxy.ts (#100423)

[lts-active] Revert "Turbopack: loader change invalidation (#95732)" (#100438)

[lts-active][cd] Gate release bot credentials behind GitHub environments (#100123)

[lts-active] test: Pin react-virtualized (#100545)

[lts-active][cd] Move release un-draft to a follow-up job in bot-autonomous (#100572)

[lts-active] Keep OpenTelemetry request traces together (#100349, #100294, #100324, #100350, #100552, #100583) (#100542)

[lts-active] Avoid loading standalone React in server bootstrap (#100610)

Credits

Huge thanks to @mischnic, @lukesandberg, @acdlite, @eps1lon, and @sokra for helping!

v16.4.2

What's Changed

[lts-active] turbo-tasks snapshot consistency fixes (#99644, #99732, #99649) by @lukesandberg in vercel/next.js#100002

[lts-active] Turbopack: backport Pages Router dev module graph chaining (#98823, #99910, #100091) by @sokra in vercel/next.js#100008

[lts-active] fix(next-code-frame): snap visible window to char boundaries by @lukesandberg in vercel/next.js#100212

[lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependency edges by @lukesandberg in vercel/next.js#100209

[lts-active] Turbopack: Ignore realpath errors during module resolution, matching node's behavior by @lukesandberg in vercel/next.js#100217

[lts-active] Backport docs fixes since v16.4.0 by @icyJoseph in vercel/next.js#100246

[lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions by @lukesandberg in vercel/next.js#100211

[lts-active] Backport additional documentation fixes since v16.4.0 by @aurorascharff in vercel/next.js#100262

Full Changelog: vercel/next.js@v16.4.1...v16.4.2

v16.4.1

This release contains security fixes for the following advisories:

Critical:

Unauthenticated Remote Code Execution in use cache functions returning typed arrays

Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

Denial of Service in App Router using Server Actions

Commits

29bbeab v16.4.3
2864b17 v16.4.2
7217011 v16.4.1
See full diff in compare view

Updates vitest from 5.0.3 to 5.0.5

Release notes

Sourced from vitest's releases.

v5.0.5

   🐞 Bug Fixes

Keep vite default fs.deny with api token file - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11578 (28dc1)

Handle quoted file names in --changed - by @sheremet-va in vitest-dev/vitest#11583 (14921)

Add data to the import.meta.hot stub - by @sheremet-va in vitest-dev/vitest#11590 (3a828)

Set skip in skipIf, ignore undefined options - by @sheremet-va in vitest-dev/vitest#11591 (d523a)

Skip builtin loading in async leak detector - by @sheremet-va in vitest-dev/vitest#11598 (fe86a)

Keep the import frame in native loader errors - by @sheremet-va in vitest-dev/vitest#11599 (9697b)

Run hook cleanups when a later hook fails - by @sheremet-va in vitest-dev/vitest#11605 (6c5a4)

Release mocks of finished test files - by @sheremet-va in vitest-dev/vitest#11607 (e9c3d)

Abort all running tests on cancel - by @sheremet-va in vitest-dev/vitest#11606 (6621a)

browser:

Ignore synthetic pagehide events - by @sheremet-va in vitest-dev/vitest#11582 (ca081)

Run plugin buildStart on server creation - by @sheremet-va in vitest-dev/vitest#11593 (ea611)

Drop late connections of closed sessions - by @sheremet-va in vitest-dev/vitest#11600 (f161e)

Wait 30s for the browser to close - by @sheremet-va in vitest-dev/vitest#11601 (6498b)

Run global setup once with instances - by @sheremet-va in vitest-dev/vitest#11596 (8dd67)

reporter:

End reason &[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/39);failed&[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/39); on worker crash - by @AriPerkkio in vitest-dev/vitest#11568 (6ae8e)

    View changes on GitHub

v5.0.4

   🚀 Features

experimental:

Tag cache directories with CACHEDIR.TAG - by @lifeiscontent in vitest-dev/vitest#11461 (a8ea3)

Support test.ui.theme option - by @sheremet-va in vitest-dev/vitest#11499 (1da66)

Highlight selector multiple matches in trace view - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11489 (5abba)

Print how many tests were affected and a total when running --changed - by @sheremet-va in vitest-dev/vitest#11424 (a2336)

Add an option to cache dependencies instead of statically parsing them - by @sheremet-va in vitest-dev/vitest#11515 (c0601)

Add fit and zoom controls to trace viewer - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11490 (f5dd9)

   🐞 Bug Fixes

Fail the run on git and location filter errors - by @sheremet-va in vitest-dev/vitest#11430 (30d03)

Enable fsModuleCache by default - by @sheremet-va in vitest-dev/vitest#11435 (ad208)

Track project files and mocks with --changed - by @sheremet-va in vitest-dev/vitest#11432 (b0f2b)

Refactor caching, fix : in project and change the shape of results cache - by @sheremet-va in vitest-dev/vitest#11453 (9673c)

Keep full $ string values when taskTitleValueFormatTruncate is 0 - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11485 (4f7e1)

Resolve node builtins in client environments - by @sheremet-va in vitest-dev/vitest#11417 (56b31)

Fix module graph builtin externals after #11421 - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11491 and vitest-dev/vitest#11421 (008e1)

Wrap module mocks during in-source testing - by @sheremet-va in vitest-dev/vitest#11505 (36d19)

Handle line endings in snapshot - by @sheremet-va in vitest-dev/vitest#11522 (4c468)

Respect root in projects - by @sheremet-va in vitest-dev/vitest#11521 (26642)

Resolve mocks in directories with spaces - by @sheremet-va in vitest-dev/vitest#11539 (caaef)

api:

Publish the api token atomically - by @umairnawaz333 in vitest-dev/vitest#11323 (6f990)

browser:

... (truncated)

Commits

7a825db chore: release v5.0.5 (#11609)
6621a72 fix: abort all running tests on cancel (#11606)
e9c3d72 fix: release mocks of finished test files (#11607)
8dd67c2 fix(browser): run global setup once with instances (#11596)
6c5a447 fix: run hook cleanups when a later hook fails (#11605)
9697b38 fix: keep the import frame in native loader errors (#11599)
6498b66 fix(browser): wait 30s for the browser to close (#11601)
f161e6d fix(browser): drop late connections of closed sessions (#11600)
fe86a64 fix: skip builtin loading in async leak detector (#11598)
6ae8e89 fix(reporter): end reason 'failed' on worker crash (#11568)
Additional commits viewable in compare view

… 8 updates Bumps the npm-minor-and-patch group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [js-yaml](https://github.com/nodeca/js-yaml) | `5.4.3` | `5.5.0` | | [next](https://github.com/vercel/next.js) | `16.4.0` | `16.4.3` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.3.0` | `19.3.1` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.3.0` | `19.3.1` | | [@next/eslint-plugin-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-plugin-next) | `16.4.0` | `16.4.3` | | [eslint](https://github.com/eslint/eslint) | `10.12.0` | `10.13.0` | | [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.4.0` | `16.4.3` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.3` | `5.0.5` | Updates `js-yaml` from 5.4.3 to 5.5.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@5.4.3...5.5.0) Updates `next` from 16.4.0 to 16.4.3 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.4.0...v16.4.3) Updates `react` from 19.3.0 to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react) Updates `react-dom` from 19.3.0 to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom) Updates `@next/eslint-plugin-next` from 16.4.0 to 16.4.3 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.4.3/packages/eslint-plugin-next) Updates `eslint` from 10.12.0 to 10.13.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.12.0...v10.13.0) Updates `eslint-config-next` from 16.4.0 to 16.4.3 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.4.3/packages/eslint-config-next) Updates `vitest` from 5.0.3 to 5.0.5 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/vitest) --- updated-dependencies: - dependency-name: "@next/eslint-plugin-next" dependency-version: 16.4.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-and-patch - dependency-name: eslint dependency-version: 10.13.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-and-patch - dependency-name: eslint-config-next dependency-version: 16.4.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-and-patch - dependency-name: js-yaml dependency-version: 5.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-and-patch - dependency-name: next dependency-version: 16.4.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor-and-patch - dependency-name: react dependency-version: 19.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor-and-patch - dependency-name: react-dom dependency-version: 19.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor-and-patch - dependency-name: vitest dependency-version: 5.0.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 26, 2026

dependabot Bot mentioned this pull request Oct 26, 2026

npm(deps-dev): bump the eslint group with 3 updates #229

Closed

dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-minor-and-patch-596771500d branch from 7ec8eda to 6771f35 Compare October 27, 2026 17:17

Navigation Menu

Repository navigation

npm(deps): bump the npm-minor-and-patch group across 1 directory with 8 updates - #233

npm(deps): bump the npm-minor-and-patch group across 1 directory with 8 updates#233
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-and-patch-596771500d

dependabot Bot commented on behalf of github Oct 26, 2026 •

edited

Loading

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

[5.5.0] - 2026-10-16

Changed

Fixed

v16.4.3

Core Changes

Credits

v16.4.2

What's Changed

v16.4.1

19.3.1 (October 14th, 2026)

React Server Components

19.3.1 (October 14th, 2026)

React Server Components

v16.4.3

Core Changes

Credits

v16.4.2

What's Changed

v16.4.1

v10.13.0

Features

Bug Fixes

Documentation

Chores

v16.4.3

Core Changes

Credits

v16.4.2

What's Changed

v16.4.1

v5.0.5

🐞 Bug Fixes

View changes on GitHub

v5.0.4

🚀 Features

🐞 Bug Fixes

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Oct 26, 2026 •

edited

Loading