Skip to content

chore(deps)(deps): bump the production-dependencies group across 1 directory with 42 updates#52

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-f979135f3d
Closed

chore(deps)(deps): bump the production-dependencies group across 1 directory with 42 updates#52
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-f979135f3d

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot Bot commented on behalf of github Mar 30, 2026 •
edited
Loading

Bumps the production-dependencies group with 34 updates in the / directory:

Package From To
cosmiconfig 9.0.0 9.0.1
handlebars 4.7.8 4.7.9
@anthropic-ai/claude-code 2.1.50 2.1.87
@babel/runtime 7.28.6 7.29.2
@borewit/text-codec 0.2.1 0.2.2
@google/genai 1.42.0 1.47.0
@hono/node-server 1.19.9 1.19.12
@modelcontextprotocol/sdk 1.26.0 1.28.0
@supabase/supabase-js 2.97.0 2.100.1
fastmcp 3.33.0 3.34.0
axios 1.13.5 1.14.0
bare-fs 4.5.4 4.5.6
bare-os 3.6.2 3.8.4
bare-stream 2.8.0 2.11.0
bare-url 2.3.2 2.4.0
express-rate-limit 8.2.1 8.3.1
figlet 1.10.0 1.11.0
file-type 21.3.0 21.3.4
fs-extra 11.3.3 11.3.4
gaxios 7.1.3 7.1.4
google-auth-library 10.5.0 10.6.2
hono 4.12.1 4.12.9
koa 3.1.1 3.2.0
mcp-proxy 6.4.0 6.4.4
nan 2.25.0 2.26.2
node-abi 3.87.0 3.89.0
path-to-regexp 8.3.0 8.4.0
pump 3.0.3 3.0.4
sql.js 1.14.0 1.14.1
strtok3 10.3.4 10.3.5
undici 7.22.0 7.24.6
ws 8.19.0 8.20.0
yaml 2.8.2 2.8.3
zod-to-json-schema 3.25.1 3.25.2

Updates cosmiconfig from 9.0.0 to 9.0.1

Changelog

Sourced from cosmiconfig's changelog.

9.0.1

  • Fixed a race condition where multiple instances existing simultaneously could cause cosmiconfig to fail to load TypeScript config files.
  • Fixed an issue on Windows where CWD being a short path (e.g. C:\Users\USERNA~1) would cause cosmiconfig to fail to load ESM config files.
Commits
  • 9a5cda3 9.0.1
  • 2174017 update changelog
  • 536d4a0 Prevent race conditions when running multiple instances of cosmiconfig and ...
  • 4b48611 remove debug log
  • 53d1745 remove more EOL node versions
  • 7c1a1e3 replace resolve with realpath
  • fcc9084 add additional path.resolve for windows short paths
  • 7e995c8 debug
  • 52b6b1c drop node 14 build as it seems to fail for unreachable reasons
  • db45e38 fix tests on windows (3)
  • Additional commits viewable in compare view

Updates handlebars from 4.7.8 to 4.7.9

Release notes

Sourced from handlebars's releases.

v4.7.9

Commits

Changelog

Sourced from handlebars's changelog.

v4.7.9 - March 26th, 2026

  • fix: enable shell mode for spawn to resolve Windows EINVAL issue - e0137c2
  • fix type "RuntimeOptions" also accepting string partials - eab1d14
  • feat(types): set hash to be a Record<string, any> - de4414d
  • fix non-contiguous program indices - 4512766
  • refactor: rename i to startPartIndex - e497a35
  • security: fix security issues - 68d8df5

Commits

Commits
  • dce542c v4.7.9
  • 8a41389 Update release notes
  • 68d8df5 Fix security issues
  • b2a0831 Fix browser tests
  • 9f98c16 Fix release script
  • 45443b4 Revert "Improve partial indenting performance"
  • 8841a5f Fix CI errors with linting
  • e0137c2 fix: enable shell mode for spawn to resolve Windows EINVAL issue
  • e914d60 Improve rendering performance
  • 7de4b41 Upgrade GitHub Actions checkout and setup-node on 4.x branch
  • Additional commits viewable in compare view

Updates @anthropic-ai/claude-code from 2.1.50 to 2.1.87

Release notes

Sourced from @​anthropic-ai/claude-code's releases.

v2.1.87

What's changed

  • Fixed messages in Cowork Dispatch not getting delivered

v2.1.86

What's changed

  • Added X-Claude-Code-Session-Id header to API requests so proxies can aggregate requests by session without parsing the body
  • Added .jj and .sl to VCS directory exclusion lists so Grep and file autocomplete don't descend into Jujutsu or Sapling metadata
  • Fixed --resume failing with "tool_use ids were found without tool_result blocks" on sessions created before v2.1.85
  • Fixed Write/Edit/Read failing on files outside the project root (e.g., ~/.claude/CLAUDE.md) when conditional skills or rules are configured
  • Fixed unnecessary config disk writes on every skill invocation that could cause performance issues and config corruption on Windows
  • Fixed potential out-of-memory crash when using /feedback on very long sessions with large transcript files
  • Fixed --bare mode dropping MCP tools in interactive sessions and silently discarding messages enqueued mid-turn
  • Fixed the c shortcut copying only ~20 characters of the OAuth login URL instead of the full URL
  • Fixed masked input (e.g., OAuth code paste) leaking the start of the token when wrapping across multiple lines on narrow terminals
  • Fixed official marketplace plugin scripts failing with "Permission denied" on macOS/Linux since v2.1.83
  • Fixed statusline showing another session's model when running multiple Claude Code instances and using /model in one of them
  • Fixed scroll not following new messages after wheel scroll or click-to-select at the bottom of a long conversation
  • Fixed /plugin uninstall dialog: pressing n now correctly uninstalls the plugin while preserving its data directory
  • Fixed a regression where pressing Enter after clicking could leave the transcript blank until the response arrived
  • Fixed ultrathink hint lingering after deleting the keyword
  • Fixed memory growth in long sessions from markdown/highlight render caches retaining full content strings
  • Reduced startup event-loop stalls when many claude.ai MCP connectors are configured (macOS keychain cache extended from 5s to 30s)
  • Reduced token overhead when mentioning files with @ — raw string content no longer JSON-escaped
  • Improved prompt cache hit rate for Bedrock, Vertex, and Foundry users by removing dynamic content from tool descriptions
  • Memory filenames in the "Saved N memories" notice now highlight on hover and open on click
  • Skill descriptions in the /skills listing are now capped at 250 characters to reduce context usage
  • Changed /skills menu to sort alphabetically for easier scanning
  • Auto mode now shows "unavailable for your plan" when disabled by plan restrictions (was "temporarily unavailable")
  • [VSCode] Fixed extension incorrectly showing "Not responding" during long-running operations
  • [VSCode] Fixed extension defaulting Max plan users to Sonnet after the OAuth token refreshes (8 hours after login)
  • Read tool now uses compact line-number format and deduplicates unchanged re-reads, reducing token usage

v2.1.85

What's changed

  • Added CLAUDE_CODE_MCP_SERVER_NAME and CLAUDE_CODE_MCP_SERVER_URL environment variables to MCP headersHelper scripts, allowing one helper to serve multiple servers
  • Added conditional if field for hooks using permission rule syntax (e.g., Bash(git *)) to filter when they run, reducing process spawning overhead
  • Added timestamp markers in transcripts when scheduled tasks (/loop, CronCreate) fire
  • Added trailing space after [Image #N] placeholder when pasting images
  • Deep link queries (claude-cli://open?q=…) now support up to 5,000 characters, with a "scroll to review" warning for long pre-filled prompts
  • MCP OAuth now follows RFC 9728 Protected Resource Metadata discovery to find the authorization server
  • Plugins blocked by organization policy (managed-settings.json) can no longer be installed or enabled, and are hidden from marketplace views
  • PreToolUse hooks can now satisfy AskUserQuestion by returning updatedInput alongside permissionDecision: "allow", enabling headless integrations that collect answers via their own UI
  • tool_parameters in OpenTelemetry tool_result events are now gated behind OTEL_LOG_TOOL_DETAILS=1
  • Fixed /compact failing with "context exceeded" when the conversation has grown too large for the compact request itself to fit
  • Fixed /plugin enable and /plugin disable failing when a plugin's install location differs from where it's declared in settings
  • Fixed --worktree exiting with an error in non-git repositories before the WorktreeCreate hook could run

... (truncated)

Changelog

Sourced from @​anthropic-ai/claude-code's changelog.

2.1.87

  • Fixed messages in Cowork Dispatch not getting delivered

2.1.86

  • Added X-Claude-Code-Session-Id header to API requests so proxies can aggregate requests by session without parsing the body
  • Added .jj and .sl to VCS directory exclusion lists so Grep and file autocomplete don't descend into Jujutsu or Sapling metadata
  • Fixed --resume failing with "tool_use ids were found without tool_result blocks" on sessions created before v2.1.85
  • Fixed Write/Edit/Read failing on files outside the project root (e.g., ~/.claude/CLAUDE.md) when conditional skills or rules are configured
  • Fixed unnecessary config disk writes on every skill invocation that could cause performance issues and config corruption on Windows
  • Fixed potential out-of-memory crash when using /feedback on very long sessions with large transcript files
  • Fixed --bare mode dropping MCP tools in interactive sessions and silently discarding messages enqueued mid-turn
  • Fixed the c shortcut copying only ~20 characters of the OAuth login URL instead of the full URL
  • Fixed masked input (e.g., OAuth code paste) leaking the start of the token when wrapping across multiple lines on narrow terminals
  • Fixed official marketplace plugin scripts failing with "Permission denied" on macOS/Linux since v2.1.83
  • Fixed statusline showing another session's model when running multiple Claude Code instances and using /model in one of them
  • Fixed scroll not following new messages after wheel scroll or click-to-select at the bottom of a long conversation
  • Fixed /plugin uninstall dialog: pressing n now correctly uninstalls the plugin while preserving its data directory
  • Fixed a regression where pressing Enter after clicking could leave the transcript blank until the response arrived
  • Fixed ultrathink hint lingering after deleting the keyword
  • Fixed memory growth in long sessions from markdown/highlight render caches retaining full content strings
  • Reduced startup event-loop stalls when many claude.ai MCP connectors are configured (macOS keychain cache extended from 5s to 30s)
  • Reduced token overhead when mentioning files with @ — raw string content no longer JSON-escaped
  • Improved prompt cache hit rate for Bedrock, Vertex, and Foundry users by removing dynamic content from tool descriptions
  • Memory filenames in the "Saved N memories" notice now highlight on hover and open on click
  • Skill descriptions in the /skills listing are now capped at 250 characters to reduce context usage
  • Changed /skills menu to sort alphabetically for easier scanning
  • Auto mode now shows "unavailable for your plan" when disabled by plan restrictions (was "temporarily unavailable")
  • [VSCode] Fixed extension incorrectly showing "Not responding" during long-running operations
  • [VSCode] Fixed extension defaulting Max plan users to Sonnet after the OAuth token refreshes (8 hours after login)
  • Read tool now uses compact line-number format and deduplicates unchanged re-reads, reducing token usage

2.1.85

  • Added CLAUDE_CODE_MCP_SERVER_NAME and CLAUDE_CODE_MCP_SERVER_URL environment variables to MCP headersHelper scripts, allowing one helper to serve multiple servers
  • Added conditional if field for hooks using permission rule syntax (e.g., Bash(git *)) to filter when they run, reducing process spawning overhead
  • Added timestamp markers in transcripts when scheduled tasks (/loop, CronCreate) fire
  • Added trailing space after [Image #N] placeholder when pasting images
  • Deep link queries (claude-cli://open?q=…) now support up to 5,000 characters, with a "scroll to review" warning for long pre-filled prompts
  • MCP OAuth now follows RFC 9728 Protected Resource Metadata discovery to find the authorization server
  • Plugins blocked by organization policy (managed-settings.json) can no longer be installed or enabled, and are hidden from marketplace views
  • PreToolUse hooks can now satisfy AskUserQuestion by returning updatedInput alongside permissionDecision: "allow", enabling headless integrations that collect answers via their own UI
  • tool_parameters in OpenTelemetry tool_result events are now gated behind OTEL_LOG_TOOL_DETAILS=1
  • Fixed /compact failing with "context exceeded" when the conversation has grown too large for the compact request itself to fit
  • Fixed /plugin enable and /plugin disable failing when a plugin's install location differs from where it's declared in settings
  • Fixed --worktree exiting with an error in non-git repositories before the WorktreeCreate hook could run
  • Fixed deniedMcpServers setting not blocking claude.ai MCP servers
  • Fixed switch_display in the computer-use tool returning "not available in this session" on multi-monitor setups
  • Fixed crash when OTEL_LOGS_EXPORTER, OTEL_METRICS_EXPORTER, or OTEL_TRACES_EXPORTER is set to none

... (truncated)

Commits

Updates @babel/runtime from 7.28.6 to 7.29.2

Release notes

Sourced from @​babel/runtime's releases.

v7.29.2 (2026-03-16)

👓 Spec Compliance

  • babel-parser

🐛 Bug Fix

  • babel-helpers, babel-plugin-transform-async-generator-functions, babel-preset-env, babel-runtime-corejs3
  • babel-preset-env
    • #17789 [7.x backport] preset-env include/exclude should accept bugfix plugins (@​JLHwung)

🏠 Internal

Committers: 2

v7.29.1 (2026-02-04)

🐛 Bug Fix

Committers: 2

v7.29.0 (2026-01-31)

Thanks @​simbahax for your first PR!

🚀 New Feature

  • babel-types
  • babel-standalone

🐛 Bug Fix

  • babel-parser
  • babel-traverse
    • #17708 fix(traverse): provide a hub when traversing a File or Program and no parentPath is given (@​simbahax)
  • babel-plugin-transform-block-scoping, babel-traverse
    • #17737 [7.x backport] fix: Rename switch discriminant references when body creates shadowing variable (@​magic-akari)

... (truncated)

Commits

Updates @borewit/text-codec from 0.2.1 to 0.2.2

Release notes

Sourced from @​borewit/text-codec's releases.

v0.2.2

Changes

🐛 Bug Fixes

  • fix: improve encoding correctness and update README @​Borewit (#36)

NPM release

NPM release: @​borewit/text-codec@​0.2.2

Commits
  • c2ce9c5 0.2.2
  • e2f0705 Merge pull request #23 from Borewit/dependabot/npm_and_yarn/master/chai-6.2.2
  • 5e58cb8 Bump chai from 5.2.1 to 6.2.2
  • bc315b8 Merge pull request #37 from Borewit/update-biome
  • f32adfc Update biome to 2.4.6
  • 7776373 Merge pull request #36 from Borewit/fix-most-issue-exodus
  • 068d7d4 fix: improve encoding correctness and update README
  • See full diff in compare view

Updates @google/genai from 1.42.0 to 1.47.0

Release notes

Sourced from @​google/genai's releases.

v1.47.0

1.47.0 (2026-03-27)

Features

  • Add custom_metadata to FileSearchResult. (083a1e3)
  • Add labels field to Veo configs (930c9c3)
  • Add mime type for Audio content (1ad80c6)
  • Add model_status to GenerateContentResponse (Gemini API only) (5e1110d)
  • Add part_metadata in Part (Gemini API only) (5e1110d)
  • Add service tier for interactions. (406de38)
  • Add service tier to GenerateContent. (0bfe800)
  • Add support for more image and audio MIME types in Interactions content (baadbfd)
  • Add supported models to the ModelOptions (94642b6)
  • genai: add TURN_INCLUDES_AUDIO_ACTIVITY_AND_ALL_VIDEO to TurnCoverage (fdacac2)
  • support hyperparameters in distillation tuning (716e021)
  • Support rendered_parts in GroundingSupport (5e1110d)

Bug Fixes

  • support us region routing (d391cff)

v1.46.0

1.46.0 (2026-03-17)

Breaking changes

  • [Interactions] Breaking change to Interactions API to refactor TextContent annotations to use specific citation types (9fa8b1d)
  • [Interactions] Breaking change for Interactions, rename ContentDelta unions. (917f24f)
  • [Interactions] Breaking change to Interactions API to rename rendered_content to search_suggestions (cc6bd38)

Features

  • [Interactions] Add and update 'signature' fields for tool call/result content types. (e73ca5b)
  • [Interactions] Support Google Maps in Interactions (d0593e3)
  • Support include_server_side_tool_invocations for genai. (c627d6f)

Bug Fixes

  • Quote functionResponses key in LiveClientMessage (9740426)

v1.45.0

1.45.0 (2026-03-12)

Features

... (truncated)

Changelog

Sourced from @​google/genai's changelog.

1.47.0 (2026-03-27)

Features

  • Add custom_metadata to FileSearchResult. (083a1e3)
  • Add labels field to Veo configs (930c9c3)
  • Add mime type for Audio content (1ad80c6)
  • Add model_status to GenerateContentResponse (Gemini API only) (5e1110d)
  • Add part_metadata in Part (Gemini API only) (5e1110d)
  • Add service tier for interactions. (406de38)
  • Add service tier to GenerateContent. (0bfe800)
  • Add support for more image and audio MIME types in Interactions content (baadbfd)
  • Add supported models to the ModelOptions (94642b6)
  • genai: add TURN_INCLUDES_AUDIO_ACTIVITY_AND_ALL_VIDEO to TurnCoverage (fdacac2)
  • support hyperparameters in distillation tuning (716e021)
  • Support rendered_parts in GroundingSupport (5e1110d)

Bug Fixes

  • support us region routing (d391cff)

1.46.0 (2026-03-17)

Breaking changes

  • [Interactions] Breaking change to Interactions API to refactor TextContent annotations to use specific citation types (9fa8b1d)
  • [Interactions] Breaking change for Interactions, rename ContentDelta unions. (917f24f)
  • [Interactions] Breaking change to Interactions API to rename rendered_content to search_suggestions (cc6bd38)

Features

  • [Interactions] Add and update 'signature' fields for tool call/result content types. (e73ca5b)
  • [Interactions] Support Google Maps in Interactions (d0593e3)
  • Support include_server_side_tool_invocations for genai. (c627d6f)

Bug Fixes

  • Quote functionResponses key in LiveClientMessage (9740426)

1.45.0 (2026-03-12)

Features

  • Add inference_generation_config to EvaluationConfig for Tuning (b4ac722)

... (truncated)

Commits
  • 585c177 chore(main): release 1.47.0 (#1423)
  • 0bfe800 feat: Add service tier to GenerateContent.
  • 406de38 feat: Add service tier for interactions.
  • 716e021 feat: support hyperparameters in distillation tuning
  • 8f3373e chore: Remove TYPE_JPG from ImageContent.MimeType enums
  • 94642b6 feat: Add supported models to the ModelOptions
  • fbe5ad2 chore: update comments
  • fdacac2 feat(genai): add TURN_INCLUDES_AUDIO_ACTIVITY_AND_ALL_VIDEO to TurnCoverage
  • d391cff fix: support us region routing
  • 930c9c3 feat: Add labels field to Veo configs
  • Additional commits viewable in compare view

Updates @hono/node-server from 1.19.9 to 1.19.12

Release notes

Sourced from @​hono/node-server's releases.

v1.19.12

What's Changed

Full Changelog: honojs/node-server@v1.19.11...v1.19.12

v1.19.11

What's Changed

Full Changelog: honojs/node-server@v1.19.10...v1.19.11

v1.19.10

Security Fix

Fixed an authorization bypass in Serve Static Middleware caused by inconsistent URL decoding (%2F handling) between the router and static file resolution. Users of Serve Static Middleware are encouraged to upgrade to this version.

See GHSA-wc8c-qw6v-h7f6 for details.

Commits

Updates @modelcontextprotocol/sdk from 1.26.0 to 1.28.0

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

v1.28.0

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@v1.27.1...v1.28.0

v1.27.1

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@v1.27.0...v1.27.1

v1.27.0

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@v1.26.0...v1.27.0

Commits
  • a056569 chore: bump version to 1.28.0 (#1746)
  • 897bc25 fix(server/auth): RFC 8252 loopback port relaxation (#1738)
  • 398dc70 fix: clear _timeoutInfo in _onclose() and scope .finally() abort controller c...
  • 93640d3 fix: reject plain JSON Schema objects passed as inputSchema (#1596)
  • 4cbcec0 [v1.x backport] Default to client_secret_basic when server omits token_endpoi...
  • c9b58d1 feat: use scopes_supported from resource metadata by default (fixes #580) (#757)
  • 351e124 docs: add links to hosted V1 and V2 API reference docs
  • 4faa8c8 chore: bump version to 1.27.1 (#1581)
  • 09a85a8 fix: call onerror for silently swallowed transport errors (#1580)
  • e79d14a fix: prevent command injection in example URL opening (v1.x backport) (#1579)
  • Additional commits viewable in compare view

Updates @supabase/supabase-js from 2.97.0 to 2.100.1

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.100.1

2.100.1 (2026-03-26)

🩹 Fixes

  • postgrest: add type safety for eq() and neq() column names (#2175)
  • postgrest: fix maybeSingle for all request methods by removing Accept header override (#2182)
  • postgrest: narrow tstyche testFileMatch to only type test files (#2193)
  • postgrest: prevent Args: never functions from being classified as computed fields (#2195)
  • storage: spread all DEFAULT_FILE_OPTIONS in uploadToSignedUrl (#2194)

❤️ Thank You

v2.100.0

2.100.0 (2026-03-23)

🚀 Features

  • realtime: use phoenix's js lib inside realtime-js (#2119)

🩹 Fixes

  • auth: guard navigator lock steal against cascade when lock is stolen by another request (#2178)
  • realtime: revert vsn type to string (#2170)
  • storage: structural detection on json() to detect Response-like errors (#2179)

❤️ Thank You

v2.100.0-rc.0

2.100.0-rc.0 (2026-03-16)

This was a version bump only, there were no code changes.

v2.100.0-canary.7

2.100.0-canary.7 (2026-03-26)

🩹 Fixes

  • storage: spread all DEFAULT_FILE_OPTIONS in uploadToSignedUrl (#2194)

❤️ Thank You

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.100.1 (2026-03-26)

🩹 Fixes

  • postgrest: narrow tstyche testFileMatch to only type test files (#2193)

❤️ Thank You

2.100.0 (2026-03-23)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.99.2 (2026-03-16)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.99.1 (2026-03-11)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.99.0 (2026-03-09)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.98.0 (2026-02-26)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

Commits
  • cd6335e docs(repo): enrich docs comment for remaining packages (#2165)
  • 9f487bd fix(postgrest): narrow tstyche testFileMatch to only type test files (#2193)
  • 379ce05 chore(release): version 2.100.0 changelogs (#2185)
  • bc435b3 chore(release): version 2.99.2 changelogs (#2168)
  • b85174f chore(release): version 2.99.1 changelogs (#2161)
  • 280e453 docs(repo): enrich tsdoc with examples and notes (#2152)
  • 749aaa9 chore(release): version 2.99.0 changelogs (#2156)
  • fab1655 chore(deps): update supabase ssr (#2147)
  • e6bdfe2 test(ci): add e2e tests for example apps (#2138)
  • 8451cc0 chore(release): version 2.98.0 changelogs (#2141)
  • Additional commits viewable in compare view

Updates fastmcp from 3.33.0 to 3.34.0

Commits

Updates xsschema from 0.4.0-beta.5 to 0.4.4

Release notes

Sourced from xsschema's releases.

v0.4.4

   🐞 Bug Fixes

@dependabot
chore(deps)(deps): bump the production-dependencies group across 1 di…
12a4997 
…rectory with 42 updates

Bumps the production-dependencies group with 34 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [cosmiconfig](https://github.com/cosmiconfig/cosmiconfig) | `9.0.0` | `9.0.1` |
| [handlebars](https://github.com/handlebars-lang/handlebars.js) | `4.7.8` | `4.7.9` |
| [@anthropic-ai/claude-code](https://github.com/anthropics/claude-code) | `2.1.50` | `2.1.87` |
| [@babel/runtime](https://github.com/babel/babel/tree/HEAD/packages/babel-runtime) | `7.28.6` | `7.29.2` |
| [@borewit/text-codec](https://github.com/Borewit/text-codec) | `0.2.1` | `0.2.2` |
| [@google/genai](https://github.com/googleapis/js-genai) | `1.42.0` | `1.47.0` |
| [@hono/node-server](https://github.com/honojs/node-server) | `1.19.9` | `1.19.12` |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.26.0` | `1.28.0` |
| [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.97.0` | `2.100.1` |
| [fastmcp](https://github.com/punkpeye/fastmcp) | `3.33.0` | `3.34.0` |
| [axios](https://github.com/axios/axios) | `1.13.5` | `1.14.0` |
| [bare-fs](https://github.com/holepunchto/bare-fs) | `4.5.4` | `4.5.6` |
| [bare-os](https://github.com/holepunchto/bare-os) | `3.6.2` | `3.8.4` |
| [bare-stream](https://github.com/holepunchto/bare-stream) | `2.8.0` | `2.11.0` |
| [bare-url](https://github.com/holepunchto/bare-url) | `2.3.2` | `2.4.0` |
| [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `8.2.1` | `8.3.1` |
| [figlet](https://github.com/patorjk/figlet.js) | `1.10.0` | `1.11.0` |
| [file-type](https://github.com/sindresorhus/file-type) | `21.3.0` | `21.3.4` |
| [fs-extra](https://github.com/jprichardson/node-fs-extra) | `11.3.3` | `11.3.4` |
| [gaxios](https://github.com/googleapis/google-cloud-node-core/tree/HEAD/packages/gaxios) | `7.1.3` | `7.1.4` |
| [google-auth-library](https://github.com/googleapis/google-cloud-node-core/tree/HEAD/packages/google-auth-library-nodejs) | `10.5.0` | `10.6.2` |
| [hono](https://github.com/honojs/hono) | `4.12.1` | `4.12.9` |
| [koa](https://github.com/koajs/koa) | `3.1.1` | `3.2.0` |
| [mcp-proxy](https://github.com/punkpeye/mcp-proxy) | `6.4.0` | `6.4.4` |
| [nan](https://github.com/nodejs/nan) | `2.25.0` | `2.26.2` |
| [node-abi](https://github.com/electron/node-abi) | `3.87.0` | `3.89.0` |
| [path-to-regexp](https://github.com/pillarjs/path-to-regexp) | `8.3.0` | `8.4.0` |
| [pump](https://github.com/mafintosh/pump) | `3.0.3` | `3.0.4` |
| [sql.js](https://github.com/sql-js/sql.js) | `1.14.0` | `1.14.1` |
| [strtok3](https://github.com/Borewit/strtok3) | `10.3.4` | `10.3.5` |
| [undici](https://github.com/nodejs/undici) | `7.22.0` | `7.24.6` |
| [ws](https://github.com/websockets/ws) | `8.19.0` | `8.20.0` |
| [yaml](https://github.com/eemeli/yaml) | `2.8.2` | `2.8.3` |
| [zod-to-json-schema](https://github.com/StefanTerdell/zod-to-json-schema) | `3.25.1` | `3.25.2` |



Updates `cosmiconfig` from 9.0.0 to 9.0.1
- [Release notes](https://github.com/cosmiconfig/cosmiconfig/releases)
- [Changelog](https://github.com/cosmiconfig/cosmiconfig/blob/main/CHANGELOG.md)
- [Commits](cosmiconfig/cosmiconfig@v9.0.0...v9.0.1)

Updates `handlebars` from 4.7.8 to 4.7.9
- [Release notes](https://github.com/handlebars-lang/handlebars.js/releases)
- [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.9/release-notes.md)
- [Commits](handlebars-lang/handlebars.js@v4.7.8...v4.7.9)

Updates `@anthropic-ai/claude-code` from 2.1.50 to 2.1.87
- [Release notes](https://github.com/anthropics/claude-code/releases)
- [Changelog](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md)
- [Commits](anthropics/claude-code@v2.1.50...v2.1.87)

Updates `@babel/runtime` from 7.28.6 to 7.29.2
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.2/packages/babel-runtime)

Updates `@borewit/text-codec` from 0.2.1 to 0.2.2
- [Release notes](https://github.com/Borewit/text-codec/releases)
- [Commits](Borewit/text-codec@v0.2.1...v0.2.2)

Updates `@google/genai` from 1.42.0 to 1.47.0
- [Release notes](https://github.com/googleapis/js-genai/releases)
- [Changelog](https://github.com/googleapis/js-genai/blob/main/CHANGELOG.md)
- [Commits](googleapis/js-genai@v1.42.0...v1.47.0)

Updates `@hono/node-server` from 1.19.9 to 1.19.12
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v1.19.9...v1.19.12)

Updates `@modelcontextprotocol/sdk` from 1.26.0 to 1.28.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@v1.26.0...v1.28.0)

Updates `@supabase/supabase-js` from 2.97.0 to 2.100.1
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.100.1/packages/core/supabase-js)

Updates `fastmcp` from 3.33.0 to 3.34.0
- [Commits](https://github.com/punkpeye/fastmcp/commits)

Updates `xsschema` from 0.4.0-beta.5 to 0.4.4
- [Release notes](https://github.com/moeru-ai/xsai/releases)
- [Commits](https://github.com/moeru-ai/xsai/commits/v0.4.4/packages-top/xsschema)

Updates `jose` from 5.10.0 to 6.1.3
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v5.10.0...v6.1.3)

Updates `axios` from 1.13.5 to 1.14.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.13.5...v1.14.0)

Updates `bare-fs` from 4.5.4 to 4.5.6
- [Commits](holepunchto/bare-fs@v4.5.4...v4.5.6)

Updates `bare-os` from 3.6.2 to 3.8.4
- [Commits](holepunchto/bare-os@v3.6.2...v3.8.4)

Updates `bare-stream` from 2.8.0 to 2.11.0
- [Commits](holepunchto/bare-stream@v2.8.0...v2.11.0)

Updates `bare-url` from 2.3.2 to 2.4.0
- [Commits](holepunchto/bare-url@v2.3.2...v2.4.0)

Updates `express-rate-limit` from 8.2.1 to 8.3.1
- [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases)
- [Commits](express-rate-limit/express-rate-limit@v8.2.1...v8.3.1)

Updates `figlet` from 1.10.0 to 1.11.0
- [Release notes](https://github.com/patorjk/figlet.js/releases)
- [Commits](patorjk/figlet.js@v1.10.0...v1.11.0)

Updates `file-type` from 21.3.0 to 21.3.4
- [Release notes](https://github.com/sindresorhus/file-type/releases)
- [Commits](sindresorhus/file-type@v21.3.0...v21.3.4)

Updates `fs-extra` from 11.3.3 to 11.3.4
- [Changelog](https://github.com/jprichardson/node-fs-extra/blob/master/CHANGELOG.md)
- [Commits](jprichardson/node-fs-extra@11.3.3...11.3.4)

Updates `gaxios` from 7.1.3 to 7.1.4
- [Release notes](https://github.com/googleapis/google-cloud-node-core/releases)
- [Changelog](https://github.com/googleapis/google-cloud-node-core/blob/main/packages/gaxios/CHANGELOG.md)
- [Commits](https://github.com/googleapis/google-cloud-node-core/commits/gaxios-v7.1.4/packages/gaxios)

Updates `jackspeak` from 3.4.3 to 4.2.3
- [Changelog](https://github.com/isaacs/jackspeak/blob/main/changelog.md)
- [Commits](isaacs/jackspeak@v3.4.3...v4.2.3)

Updates `lru-cache` from 10.4.3 to 11.2.6
- [Changelog](https://github.com/isaacs/node-lru-cache/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-lru-cache@v10.4.3...v11.2.6)

Updates `path-scurry` from 1.11.1 to 2.0.2
- [Changelog](https://github.com/isaacs/path-scurry/blob/main/CHANGELOG.md)
- [Commits](isaacs/path-scurry@v1.11.1...v2.0.2)

Updates `google-auth-library` from 10.5.0 to 10.6.2
- [Release notes](https://github.com/googleapis/google-cloud-node-core/releases)
- [Changelog](https://github.com/googleapis/google-cloud-node-core/blob/main/packages/google-auth-library-nodejs/CHANGELOG.md)
- [Commits](https://github.com/googleapis/google-cloud-node-core/commits/google-auth-library-v10.6.2/packages/google-auth-library-nodejs)

Updates `hono` from 4.12.1 to 4.12.9
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.1...v4.12.9)

Updates `ip-address` from 10.0.1 to 10.1.0
- [Commits](https://github.com/beaugunderson/ip-address/commits)

Updates `koa` from 3.1.1 to 3.2.0
- [Release notes](https://github.com/koajs/koa/releases)
- [Changelog](https://github.com/koajs/koa/blob/master/History.md)
- [Commits](koajs/koa@v3.1.1...v3.2.0)

Updates `mcp-proxy` from 6.4.0 to 6.4.4
- [Commits](https://github.com/punkpeye/mcp-proxy/commits)

Updates `nan` from 2.25.0 to 2.26.2
- [Changelog](https://github.com/nodejs/nan/blob/main/CHANGELOG.md)
- [Commits](nodejs/nan@v2.25.0...v2.26.2)

Updates `node-abi` from 3.87.0 to 3.89.0
- [Release notes](https://github.com/electron/node-abi/releases)
- [Commits](electron/node-abi@v3.87.0...v3.89.0)

Updates `path-to-regexp` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0)

Updates `proxy-from-env` from 1.1.0 to 2.1.0
- [Release notes](https://github.com/Rob--W/proxy-from-env/releases)
- [Commits](Rob--W/proxy-from-env@v1.1.0...v2.1.0)

Updates `pump` from 3.0.3 to 3.0.4
- [Commits](mafintosh/pump@v3.0.3...v3.0.4)

Updates `sql.js` from 1.14.0 to 1.14.1
- [Release notes](https://github.com/sql-js/sql.js/releases)
- [Commits](sql-js/sql.js@v1.14.0...v1.14.1)

Updates `streamx` from 2.23.0 to 2.25.0
- [Commits](mafintosh/streamx@v2.23.0...v2.25.0)

Updates `strtok3` from 10.3.4 to 10.3.5
- [Release notes](https://github.com/Borewit/strtok3/releases)
- [Commits](Borewit/strtok3@v10.3.4...v10.3.5)

Updates `undici` from 7.22.0 to 7.24.6
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.22.0...v7.24.6)

Updates `ws` from 8.19.0 to 8.20.0
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.19.0...8.20.0)

Updates `yaml` from 2.8.2 to 2.8.3
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.8.2...v2.8.3)

Updates `zod-to-json-schema` from 3.25.1 to 3.25.2
- [Release notes](https://github.com/StefanTerdell/zod-to-json-schema/releases)
- [Changelog](https://github.com/StefanTerdell/zod-to-json-schema/blob/master/changelog.md)
- [Commits](https://github.com/StefanTerdell/zod-to-json-schema/commits)

---
updated-dependencies:
- dependency-name: cosmiconfig
  dependency-version: 9.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: handlebars
  dependency-version: 4.7.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@anthropic-ai/claude-code"
  dependency-version: 2.1.87
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@babel/runtime"
  dependency-version: 7.29.2
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@borewit/text-codec"
  dependency-version: 0.2.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@google/genai"
  dependency-version: 1.47.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@hono/node-server"
  dependency-version: 1.19.12
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.28.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@supabase/supabase-js"
  dependency-version: 2.100.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: fastmcp
  dependency-version: 3.34.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: xsschema
  dependency-version: 0.4.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: jose
  dependency-version: 6.1.3
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: axios
  dependency-version: 1.14.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: bare-fs
  dependency-version: 4.5.6
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: bare-os
  dependency-version: 3.8.4
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: bare-stream
  dependency-version: 2.11.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: bare-url
  dependency-version: 2.4.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: express-rate-limit
  dependency-version: 8.3.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: figlet
  dependency-version: 1.11.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: file-type
  dependency-version: 21.3.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: fs-extra
  dependency-version: 11.3.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: gaxios
  dependency-version: 7.1.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: jackspeak
  dependency-version: 4.2.3
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: lru-cache
  dependency-version: 11.2.6
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: path-scurry
  dependency-version: 2.0.2
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: google-auth-library
  dependency-version: 10.6.2
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: hono
  dependency-version: 4.12.9
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: ip-address
  dependency-version: 10.1.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: koa
  dependency-version: 3.2.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: mcp-proxy
  dependency-version: 6.4.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: nan
  dependency-version: 2.26.2
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: node-abi
  dependency-version: 3.89.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: path-to-regexp
  dependency-version: 8.4.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: proxy-from-env
  dependency-version: 2.1.0
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: pump
  dependency-version: 3.0.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: sql.js
  dependency-version: 1.14.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: streamx
  dependency-version: 2.25.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: strtok3
  dependency-version: 10.3.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: undici
  dependency-version: 7.24.6
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: ws
  dependency-version: 8.20.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: yaml
  dependency-version: 2.8.3
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: zod-to-json-schema
  dependency-version: 3.25.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github
Copy link
Copy Markdown
Author

dependabot Bot commented on behalf of github Mar 30, 2026

Assignees

The following users could not be added as assignees: llm-dev-ops/maintainers. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Mar 30, 2026

🔒 Security Scan Results

Scan Type Status
Dependency Scan ⚠️ failure
CodeQL Analysis ✅ success
Secret Scan ✅ success
License Check ⚠️ failure
SAST ⚠️ failure

⚠️ Some security scans have warnings or failed. Please review the details.

Automated security scanning by GitHub Actions

@dependabot @github
Copy link
Copy Markdown
Author

dependabot Bot commented on behalf of github Apr 6, 2026

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Apr 6, 2026
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-f979135f3d branch April 6, 2026 09:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants