Skip to content

chore(deps)(deps): bump the production-dependencies group across 1 directory with 44 updates#56

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-f6534a0250
Closed

chore(deps)(deps): bump the production-dependencies group across 1 directory with 44 updates#56
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-f6534a0250

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot Bot commented on behalf of github Apr 6, 2026 •
edited
Loading

Bumps the production-dependencies group with 36 updates in the / directory:

Package From To
cosmiconfig 9.0.0 9.0.1
handlebars 4.7.8 4.7.9
@anthropic-ai/claude-code 2.1.50 2.1.92
@babel/runtime 7.28.6 7.29.2
@borewit/text-codec 0.2.1 0.2.2
@google/genai 1.42.0 1.48.0
@hono/node-server 1.19.9 1.19.12
@modelcontextprotocol/sdk 1.26.0 1.29.0
@supabase/supabase-js 2.97.0 2.101.1
fastmcp 3.33.0 3.35.0
axios 1.13.5 1.14.0
bare-fs 4.5.4 4.6.0
bare-os 3.6.2 3.8.7
bare-stream 2.8.0 2.12.0
bare-url 2.3.2 2.4.0
express-rate-limit 8.2.1 8.3.2
figlet 1.10.0 1.11.0
file-type 21.3.0 21.3.4
fs-extra 11.3.3 11.3.4
fuse.js 7.1.0 7.3.0
gaxios 7.1.3 7.1.4
google-auth-library 10.5.0 10.6.2
hono 4.12.1 4.12.11
koa 3.1.1 3.2.0
mcp-proxy 6.4.0 6.4.4
nan 2.25.0 2.26.2
node-abi 3.87.0 3.89.0
path-to-regexp 8.3.0 8.4.2
pump 3.0.3 3.0.4
sql.js 1.14.0 1.14.1
strtok3 10.3.4 10.3.5
undici 7.22.0 7.24.7
validator 13.15.26 13.15.35
ws 8.19.0 8.20.0
yaml 2.8.2 2.8.3
zod-to-json-schema 3.25.1 3.25.2

Updates cosmiconfig from 9.0.0 to 9.0.1

Changelog

Sourced from cosmiconfig's changelog.

9.0.1

  • Fixed a race condition where multiple instances existing simultaneously could cause cosmiconfig to fail to load TypeScript config files.
  • Fixed an issue on Windows where CWD being a short path (e.g. C:\Users\USERNA~1) would cause cosmiconfig to fail to load ESM config files.
Commits
  • 9a5cda3 9.0.1
  • 2174017 update changelog
  • 536d4a0 Prevent race conditions when running multiple instances of cosmiconfig and ...
  • 4b48611 remove debug log
  • 53d1745 remove more EOL node versions
  • 7c1a1e3 replace resolve with realpath
  • fcc9084 add additional path.resolve for windows short paths
  • 7e995c8 debug
  • 52b6b1c drop node 14 build as it seems to fail for unreachable reasons
  • db45e38 fix tests on windows (3)
  • Additional commits viewable in compare view

Updates handlebars from 4.7.8 to 4.7.9

Release notes

Sourced from handlebars's releases.

v4.7.9

Commits

Changelog

Sourced from handlebars's changelog.

v4.7.9 - March 26th, 2026

  • fix: enable shell mode for spawn to resolve Windows EINVAL issue - e0137c2
  • fix type "RuntimeOptions" also accepting string partials - eab1d14
  • feat(types): set hash to be a Record<string, any> - de4414d
  • fix non-contiguous program indices - 4512766
  • refactor: rename i to startPartIndex - e497a35
  • security: fix security issues - 68d8df5

Commits

Commits
  • dce542c v4.7.9
  • 8a41389 Update release notes
  • 68d8df5 Fix security issues
  • b2a0831 Fix browser tests
  • 9f98c16 Fix release script
  • 45443b4 Revert "Improve partial indenting performance"
  • 8841a5f Fix CI errors with linting
  • e0137c2 fix: enable shell mode for spawn to resolve Windows EINVAL issue
  • e914d60 Improve rendering performance
  • 7de4b41 Upgrade GitHub Actions checkout and setup-node on 4.x branch
  • Additional commits viewable in compare view

Updates @anthropic-ai/claude-code from 2.1.50 to 2.1.92

Release notes

Sourced from @​anthropic-ai/claude-code's releases.

v2.1.92

What's changed

  • Added forceRemoteSettingsRefresh policy setting: when set, the CLI blocks startup until remote managed settings are freshly fetched, and exits if the fetch fails (fail-closed)
  • Added interactive Bedrock setup wizard accessible from the login screen when selecting "3rd-party platform" — guides you through AWS authentication, region configuration, credential verification, and model pinning
  • Added per-model and cache-hit breakdown to /cost for subscription users
  • /release-notes is now an interactive version picker
  • Remote Control session names now use your hostname as the default prefix (e.g. myhost-graceful-unicorn), overridable with --remote-control-session-name-prefix
  • Pro users now see a footer hint when returning to a session after the prompt cache has expired, showing roughly how many tokens the next turn will send uncached
  • Fixed subagent spawning permanently failing with "Could not determine pane count" after tmux windows are killed or renumbered during a long-running session
  • Fixed prompt-type Stop hooks incorrectly failing when the small fast model returns ok:false, and restored preventContinuation:true semantics for non-Stop prompt-type hooks
  • Fixed tool input validation failures when streaming emits array/object fields as JSON-encoded strings
  • Fixed an API 400 error that could occur when extended thinking produced a whitespace-only text block alongside real content
  • Fixed accidental feedback survey submissions from auto-pilot keypresses and consecutive-prompt digit collisions
  • Fixed misleading "esc to interrupt" hint appearing alongside "esc to clear" when a text selection exists in fullscreen mode during processing
  • Fixed Homebrew install update prompts to use the cask's release channel (claude-code → stable, claude-code@latest → latest)
  • Fixed ctrl+e jumping to the end of the next line when already at end of line in multiline prompts
  • Fixed an issue where the same message could appear at two positions when scrolling up in fullscreen mode (iTerm2, Ghostty, and other terminals with DEC 2026 support)
  • Fixed idle-return "/clear to save X tokens" hint showing cumulative session tokens instead of current context size
  • Fixed plugin MCP servers stuck "connecting" on session start when they duplicate a claude.ai connector that is unauthenticated
  • Improved Write tool diff computation speed for large files (60% faster on files with tabs/&/$)
  • Removed /tag command
  • Removed /vim command (toggle vim mode via /config → Editor mode)
  • Linux sandbox now ships the apply-seccomp helper in both npm and native builds, restoring unix-socket blocking for sandboxed commands

v2.1.91

What's changed

  • Added MCP tool result persistence override via _meta["anthropic/maxResultSizeChars"] annotation (up to 500K), allowing larger results like DB schemas to pass through without truncation
  • Added disableSkillShellExecution setting to disable inline shell execution in skills, custom slash commands, and plugin commands
  • Added support for multi-line prompts in claude-cli://open?q= deep links (encoded newlines %0A no longer rejected)
  • Plugins can now ship executables under bin/ and invoke them as bare commands from the Bash tool
  • Fixed transcript chain breaks on --resume that could lose conversation history when async transcript writes fail silently
  • Fixed cmd+delete not deleting to start of line on iTerm2, kitty, WezTerm, Ghostty, and Windows Terminal
  • Fixed plan mode in remote sessions losing track of the plan file after a container restart, which caused permission prompts on plan edits and an empty plan-approval modal
  • Fixed JSON schema validation for permissions.defaultMode: "auto" in settings.json
  • Fixed Windows version cleanup not protecting the active version's rollback copy
  • /feedback now explains why it's unavailable instead of disappearing from the slash menu
  • Improved /claude-api skill guidance for agent design patterns including tool surface decisions, context management, and caching strategy
  • Improved performance: faster stripAnsi on Bun by routing through Bun.stripANSI
  • Edit tool now uses shorter old_string anchors, reducing output tokens

v2.1.90

What's changed

  • Added /powerup — interactive lessons teaching Claude Code features with animated demos
  • Added CLAUDE_CODE_PLUGIN_KEEP_MARKETPLACE_ON_FAILURE env var to keep the existing marketplace cache when git pull fails, useful in offline environments
  • Added .husky to protected directories (acceptEdits mode)
  • Fixed an infinite loop where the rate-limit options dialog would repeatedly auto-open after hitting your usage limit, eventually crashing the session
  • Fixed --resume causing a full prompt-cache miss on the first request for users with deferred tools, MCP servers, or custom agents (regression since v2.1.69)

... (truncated)

Changelog

Sourced from @​anthropic-ai/claude-code's changelog.

2.1.92

  • Added forceRemoteSettingsRefresh policy setting: when set, the CLI blocks startup until remote managed settings are freshly fetched, and exits if the fetch fails (fail-closed)
  • Added interactive Bedrock setup wizard accessible from the login screen when selecting "3rd-party platform" — guides you through AWS authentication, region configuration, credential verification, and model pinning
  • Added per-model and cache-hit breakdown to /cost for subscription users
  • /release-notes is now an interactive version picker
  • Remote Control session names now use your hostname as the default prefix (e.g. myhost-graceful-unicorn), overridable with --remote-control-session-name-prefix
  • Pro users now see a footer hint when returning to a session after the prompt cache has expired, showing roughly how many tokens the next turn will send uncached
  • Fixed subagent spawning permanently failing with "Could not determine pane count" after tmux windows are killed or renumbered during a long-running session
  • Fixed prompt-type Stop hooks incorrectly failing when the small fast model returns ok:false, and restored preventContinuation:true semantics for non-Stop prompt-type hooks
  • Fixed tool input validation failures when streaming emits array/object fields as JSON-encoded strings
  • Fixed an API 400 error that could occur when extended thinking produced a whitespace-only text block alongside real content
  • Fixed accidental feedback survey submissions from auto-pilot keypresses and consecutive-prompt digit collisions
  • Fixed misleading "esc to interrupt" hint appearing alongside "esc to clear" when a text selection exists in fullscreen mode during processing
  • Fixed Homebrew install update prompts to use the cask's release channel (claude-code → stable, claude-code@latest → latest)
  • Fixed ctrl+e jumping to the end of the next line when already at end of line in multiline prompts
  • Fixed an issue where the same message could appear at two positions when scrolling up in fullscreen mode (iTerm2, Ghostty, and other terminals with DEC 2026 support)
  • Fixed idle-return "/clear to save X tokens" hint showing cumulative session tokens instead of current context size
  • Fixed plugin MCP servers stuck "connecting" on session start when they duplicate a claude.ai connector that is unauthenticated
  • Improved Write tool diff computation speed for large files (60% faster on files with tabs/&/$)
  • Removed /tag command
  • Removed /vim command (toggle vim mode via /config → Editor mode)
  • Linux sandbox now ships the apply-seccomp helper in both npm and native builds, restoring unix-socket blocking for sandboxed commands

2.1.91

  • Added MCP tool result persistence override via _meta["anthropic/maxResultSizeChars"] annotation (up to 500K), allowing larger results like DB schemas to pass through without truncation
  • Added disableSkillShellExecution setting to disable inline shell execution in skills, custom slash commands, and plugin commands
  • Added support for multi-line prompts in claude-cli://open?q= deep links (encoded newlines %0A no longer rejected)
  • Plugins can now ship executables under bin/ and invoke them as bare commands from the Bash tool
  • Fixed transcript chain breaks on --resume that could lose conversation history when async transcript writes fail silently
  • Fixed cmd+delete not deleting to start of line on iTerm2, kitty, WezTerm, Ghostty, and Windows Terminal
  • Fixed plan mode in remote sessions losing track of the plan file after a container restart, which caused permission prompts on plan edits and an empty plan-approval modal
  • Fixed JSON schema validation for permissions.defaultMode: "auto" in settings.json
  • Fixed Windows version cleanup not protecting the active version's rollback copy
  • /feedback now explains why it's unavailable instead of disappearing from the slash menu
  • Improved /claude-api skill guidance for agent design patterns including tool surface decisions, context management, and caching strategy
  • Improved performance: faster stripAnsi on Bun by routing through Bun.stripANSI
  • Edit tool now uses shorter old_string anchors, reducing output tokens

2.1.90

  • Added /powerup — interactive lessons teaching Claude Code features with animated demos
  • Added CLAUDE_CODE_PLUGIN_KEEP_MARKETPLACE_ON_FAILURE env var to keep the existing marketplace cache when git pull fails, useful in offline environments
  • Added .husky to protected directories (acceptEdits mode)
  • Fixed an infinite loop where the rate-limit options dialog would repeatedly auto-open after hitting your usage limit, eventually crashing the session
  • Fixed --resume causing a full prompt-cache miss on the first request for users with deferred tools, MCP servers, or custom agents (regression since v2.1.69)
  • Fixed Edit/Write failing with "File content has changed" when a PostToolUse format-on-save hook rewrites the file between consecutive edits
  • Fixed PreToolUse hooks that emit JSON to stdout and exit with code 2 not correctly blocking the tool call
  • Fixed collapsed search/read summary badge appearing multiple times in fullscreen scrollback when a CLAUDE.md file auto-loads during a tool call

... (truncated)

Commits

Updates @babel/runtime from 7.28.6 to 7.29.2

Release notes

Sourced from @​babel/runtime's releases.

v7.29.2 (2026-03-16)

👓 Spec Compliance

  • babel-parser

🐛 Bug Fix

  • babel-helpers, babel-plugin-transform-async-generator-functions, babel-preset-env, babel-runtime-corejs3
  • babel-preset-env
    • #17789 [7.x backport] preset-env include/exclude should accept bugfix plugins (@​JLHwung)

🏠 Internal

Committers: 2

v7.29.1 (2026-02-04)

🐛 Bug Fix

Committers: 2

v7.29.0 (2026-01-31)

Thanks @​simbahax for your first PR!

🚀 New Feature

  • babel-types
  • babel-standalone

🐛 Bug Fix

  • babel-parser
  • babel-traverse
    • #17708 fix(traverse): provide a hub when traversing a File or Program and no parentPath is given (@​simbahax)
  • babel-plugin-transform-block-scoping, babel-traverse
    • #17737 [7.x backport] fix: Rename switch discriminant references when body creates shadowing variable (@​magic-akari)

... (truncated)

Commits

Updates @borewit/text-codec from 0.2.1 to 0.2.2

Release notes

Sourced from @​borewit/text-codec's releases.

v0.2.2

Changes

🐛 Bug Fixes

  • fix: improve encoding correctness and update README @​Borewit (#36)

NPM release

NPM release: @​borewit/text-codec@​0.2.2

Commits
  • c2ce9c5 0.2.2
  • e2f0705 Merge pull request #23 from Borewit/dependabot/npm_and_yarn/master/chai-6.2.2
  • 5e58cb8 Bump chai from 5.2.1 to 6.2.2
  • bc315b8 Merge pull request #37 from Borewit/update-biome
  • f32adfc Update biome to 2.4.6
  • 7776373 Merge pull request #36 from Borewit/fix-most-issue-exodus
  • 068d7d4 fix: improve encoding correctness and update README
  • See full diff in compare view

Updates @google/genai from 1.42.0 to 1.48.0

Release notes

Sourced from @​google/genai's releases.

v1.48.0

1.48.0 (2026-03-31)

Features

  • Support dedicated TextAnnotationDelta for streaming tool responses (89552ba)

Bug Fixes

  • Fix service_tier enums. (9bdc2ae)

v1.47.0

1.47.0 (2026-03-27)

Features

  • Add custom_metadata to FileSearchResult. (083a1e3)
  • Add labels field to Veo configs (930c9c3)
  • Add mime type for Audio content (1ad80c6)
  • Add model_status to GenerateContentResponse (Gemini API only) (5e1110d)
  • Add part_metadata in Part (Gemini API only) (5e1110d)
  • Add service tier for interactions. (406de38)
  • Add service tier to GenerateContent. (0bfe800)
  • Add support for more image and audio MIME types in Interactions content (baadbfd)
  • Add supported models to the ModelOptions (94642b6)
  • genai: add TURN_INCLUDES_AUDIO_ACTIVITY_AND_ALL_VIDEO to TurnCoverage (fdacac2)
  • support hyperparameters in distillation tuning (716e021)
  • Support rendered_parts in GroundingSupport (5e1110d)

Bug Fixes

  • support us region routing (d391cff)

v1.46.0

1.46.0 (2026-03-17)

Breaking changes

  • [Interactions] Breaking change to Interactions API to refactor TextContent annotations to use specific citation types (9fa8b1d)
  • [Interactions] Breaking change for Interactions, rename ContentDelta unions. (917f24f)
  • [Interactions] Breaking change to Interactions API to rename rendered_content to search_suggestions (cc6bd38)

Features

  • [Interactions] Add and update 'signature' fields for tool call/result content types. (e73ca5b)

... (truncated)

Changelog

Sourced from @​google/genai's changelog.

1.48.0 (2026-03-31)

Features

  • Support dedicated TextAnnotationDelta for streaming tool responses (89552ba)

Bug Fixes

  • Fix service_tier enums. (9bdc2ae)

1.47.0 (2026-03-27)

Features

  • Add custom_metadata to FileSearchResult. (083a1e3)
  • Add labels field to Veo configs (930c9c3)
  • Add mime type for Audio content (1ad80c6)
  • Add model_status to GenerateContentResponse (Gemini API only) (5e1110d)
  • Add part_metadata in Part (Gemini API only) (5e1110d)
  • Add service tier for interactions. (406de38)
  • Add service tier to GenerateContent. (0bfe800)
  • Add support for more image and audio MIME types in Interactions content (baadbfd)
  • Add supported models to the ModelOptions (94642b6)
  • genai: add TURN_INCLUDES_AUDIO_ACTIVITY_AND_ALL_VIDEO to TurnCoverage (fdacac2)
  • support hyperparameters in distillation tuning (716e021)
  • Support rendered_parts in GroundingSupport (5e1110d)

Bug Fixes

  • support us region routing (d391cff)

1.46.0 (2026-03-17)

Breaking changes

  • [Interactions] Breaking change to Interactions API to refactor TextContent annotations to use specific citation types (9fa8b1d)
  • [Interactions] Breaking change for Interactions, rename ContentDelta unions. (917f24f)
  • [Interactions] Breaking change to Interactions API to rename rendered_content to search_suggestions (cc6bd38)

Features

  • [Interactions] Add and update 'signature' fields for tool call/result content types. (e73ca5b)
  • [Interactions] Support Google Maps in Interactions (d0593e3)
  • Support include_server_side_tool_invocations for genai. (c627d6f)

... (truncated)

Commits
  • ef91dab chore(main): release 1.48.0 (#1454)
  • 9bdc2ae fix: Fix service_tier enums.
  • 89552ba feat: Support dedicated TextAnnotationDelta for streaming tool responses
  • 585c177 chore(main): release 1.47.0 (#1423)
  • 0bfe800 feat: Add service tier to GenerateContent.
  • 406de38 feat: Add service tier for interactions.
  • 716e021 feat: support hyperparameters in distillation tuning
  • 8f3373e chore: Remove TYPE_JPG from ImageContent.MimeType enums
  • 94642b6 feat: Add supported models to the ModelOptions
  • fbe5ad2 chore: update comments
  • Additional commits viewable in compare view

Updates @hono/node-server from 1.19.9 to 1.19.12

Release notes

Sourced from @​hono/node-server's releases.

v1.19.12

What's Changed

Full Changelog: honojs/node-server@v1.19.11...v1.19.12

v1.19.11

What's Changed

Full Changelog: honojs/node-server@v1.19.10...v1.19.11

v1.19.10

Security Fix

Fixed an authorization bypass in Serve Static Middleware caused by inconsistent URL decoding (%2F handling) between the router and static file resolution. Users of Serve Static Middleware are encouraged to upgrade to this version.

See GHSA-wc8c-qw6v-h7f6 for details.

Commits

Updates @modelcontextprotocol/sdk from 1.26.0 to 1.29.0

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

v1.29.0

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@v1.28.0...v1.29.0

v1.28.0

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@v1.27.1...v1.28.0

v1.27.1

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@v1.27.0...v1.27.1

v1.27.0

What's Changed

... (truncated)

Commits

Updates @supabase/supabase-js from 2.97.0 to 2.101.1

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.101.1

2.101.1 (2026-03-31)

🩹 Fixes

  • storage: support exactOptionalPropertyTypes (#2200)

❤️ Thank You

v2.101.1-canary.0

2.101.1-canary.0 (2026-03-31)

🩹 Fixes

  • storage: support exactOptionalPropertyTypes (#2200)

❤️ Thank You

v2.101.0

2.101.0 (2026-03-30)

🚀 Features

  • realtime: add copyBindings functionality (#2197)
  • realtime: block setting postgres_changes event listener after joining (#2201)

❤️ Thank You

v2.101.0-canary.0

2.101.0-canary.0 (2026-03-30)

This was a version bump only, there were no code changes.

v2.100.1

2.100.1 (2026-03-26)

🩹 Fixes

  • postgrest: add type safety for eq() and neq() column names (#2175)
  • postgrest: fix maybeSingle for all request methods by removing Accept header override (#2182)
  • postgrest: narrow tstyche testFileMatch to only type test files (#2193)
  • postgrest: prevent Args: never functions from being classified as computed fields (#2195)
  • storage: spread all DEFAULT_FILE_OPTIONS in uploadToSignedUrl (#2194)

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.101.1 (2026-03-31)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.101.0 (2026-03-30)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.100.1 (2026-03-26)

🩹 Fixes

  • postgrest: narrow tstyche testFileMatch to only type test files (#2193)

❤️ Thank You

2.100.0 (2026-03-23)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.99.2 (2026-03-16)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.99.1 (2026-03-11)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.99.0 (2026-03-09)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.98.0 (2026-02-26)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

Commits
  • 79d1a08 chore(release): version 2.101.0 changelogs (#2203)
  • 5053334 chore(release): version 2.100.1 changelogs (#2196)
  • cd6335e docs(repo): enrich docs comment for remaining packages (#2165)
  • 9f487bd fix(postgrest): narrow tstyche testFileMatch to only type test files (#2193)
  • 379ce05 chore(release): version 2.100.0 changelogs (#2185)
  • bc435b3 chore(release): version 2.99.2 changelogs (#2168)
  • b85174f chore(release): version 2.99.1 changelogs (Description has been truncated

@dependabot
chore(deps)(deps): bump the production-dependencies group across 1 di…
bf16d8d 
…rectory with 44 updates

Bumps the production-dependencies group with 36 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [cosmiconfig](https://github.com/cosmiconfig/cosmiconfig) | `9.0.0` | `9.0.1` |
| [handlebars](https://github.com/handlebars-lang/handlebars.js) | `4.7.8` | `4.7.9` |
| [@anthropic-ai/claude-code](https://github.com/anthropics/claude-code) | `2.1.50` | `2.1.92` |
| [@babel/runtime](https://github.com/babel/babel/tree/HEAD/packages/babel-runtime) | `7.28.6` | `7.29.2` |
| [@borewit/text-codec](https://github.com/Borewit/text-codec) | `0.2.1` | `0.2.2` |
| [@google/genai](https://github.com/googleapis/js-genai) | `1.42.0` | `1.48.0` |
| [@hono/node-server](https://github.com/honojs/node-server) | `1.19.9` | `1.19.12` |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.26.0` | `1.29.0` |
| [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.97.0` | `2.101.1` |
| [fastmcp](https://github.com/punkpeye/fastmcp) | `3.33.0` | `3.35.0` |
| [axios](https://github.com/axios/axios) | `1.13.5` | `1.14.0` |
| [bare-fs](https://github.com/holepunchto/bare-fs) | `4.5.4` | `4.6.0` |
| [bare-os](https://github.com/holepunchto/bare-os) | `3.6.2` | `3.8.7` |
| [bare-stream](https://github.com/holepunchto/bare-stream) | `2.8.0` | `2.12.0` |
| [bare-url](https://github.com/holepunchto/bare-url) | `2.3.2` | `2.4.0` |
| [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `8.2.1` | `8.3.2` |
| [figlet](https://github.com/patorjk/figlet.js) | `1.10.0` | `1.11.0` |
| [file-type](https://github.com/sindresorhus/file-type) | `21.3.0` | `21.3.4` |
| [fs-extra](https://github.com/jprichardson/node-fs-extra) | `11.3.3` | `11.3.4` |
| [fuse.js](https://github.com/krisk/Fuse) | `7.1.0` | `7.3.0` |
| [gaxios](https://github.com/googleapis/google-cloud-node-core/tree/HEAD/packages/gaxios) | `7.1.3` | `7.1.4` |
| [google-auth-library](https://github.com/googleapis/google-cloud-node-core/tree/HEAD/packages/google-auth-library-nodejs) | `10.5.0` | `10.6.2` |
| [hono](https://github.com/honojs/hono) | `4.12.1` | `4.12.11` |
| [koa](https://github.com/koajs/koa) | `3.1.1` | `3.2.0` |
| [mcp-proxy](https://github.com/punkpeye/mcp-proxy) | `6.4.0` | `6.4.4` |
| [nan](https://github.com/nodejs/nan) | `2.25.0` | `2.26.2` |
| [node-abi](https://github.com/electron/node-abi) | `3.87.0` | `3.89.0` |
| [path-to-regexp](https://github.com/pillarjs/path-to-regexp) | `8.3.0` | `8.4.2` |
| [pump](https://github.com/mafintosh/pump) | `3.0.3` | `3.0.4` |
| [sql.js](https://github.com/sql-js/sql.js) | `1.14.0` | `1.14.1` |
| [strtok3](https://github.com/Borewit/strtok3) | `10.3.4` | `10.3.5` |
| [undici](https://github.com/nodejs/undici) | `7.22.0` | `7.24.7` |
| [validator](https://github.com/validatorjs/validator.js) | `13.15.26` | `13.15.35` |
| [ws](https://github.com/websockets/ws) | `8.19.0` | `8.20.0` |
| [yaml](https://github.com/eemeli/yaml) | `2.8.2` | `2.8.3` |
| [zod-to-json-schema](https://github.com/StefanTerdell/zod-to-json-schema) | `3.25.1` | `3.25.2` |



Updates `cosmiconfig` from 9.0.0 to 9.0.1
- [Release notes](https://github.com/cosmiconfig/cosmiconfig/releases)
- [Changelog](https://github.com/cosmiconfig/cosmiconfig/blob/main/CHANGELOG.md)
- [Commits](cosmiconfig/cosmiconfig@v9.0.0...v9.0.1)

Updates `handlebars` from 4.7.8 to 4.7.9
- [Release notes](https://github.com/handlebars-lang/handlebars.js/releases)
- [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.9/release-notes.md)
- [Commits](handlebars-lang/handlebars.js@v4.7.8...v4.7.9)

Updates `@anthropic-ai/claude-code` from 2.1.50 to 2.1.92
- [Release notes](https://github.com/anthropics/claude-code/releases)
- [Changelog](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md)
- [Commits](anthropics/claude-code@v2.1.50...v2.1.92)

Updates `@babel/runtime` from 7.28.6 to 7.29.2
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.2/packages/babel-runtime)

Updates `@borewit/text-codec` from 0.2.1 to 0.2.2
- [Release notes](https://github.com/Borewit/text-codec/releases)
- [Commits](Borewit/text-codec@v0.2.1...v0.2.2)

Updates `@google/genai` from 1.42.0 to 1.48.0
- [Release notes](https://github.com/googleapis/js-genai/releases)
- [Changelog](https://github.com/googleapis/js-genai/blob/main/CHANGELOG.md)
- [Commits](googleapis/js-genai@v1.42.0...v1.48.0)

Updates `@hono/node-server` from 1.19.9 to 1.19.12
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v1.19.9...v1.19.12)

Updates `@modelcontextprotocol/sdk` from 1.26.0 to 1.29.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@v1.26.0...v1.29.0)

Updates `@supabase/supabase-js` from 2.97.0 to 2.101.1
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.101.1/packages/core/supabase-js)

Updates `fastmcp` from 3.33.0 to 3.35.0
- [Release notes](https://github.com/punkpeye/fastmcp/releases)
- [Commits](punkpeye/fastmcp@v3.33.0...v3.35.0)

Updates `xsschema` from 0.4.0-beta.5 to 0.4.4
- [Release notes](https://github.com/moeru-ai/xsai/releases)
- [Commits](https://github.com/moeru-ai/xsai/commits/v0.4.4/packages-top/xsschema)

Updates `jose` from 5.10.0 to 6.1.3
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v5.10.0...v6.1.3)

Updates `axios` from 1.13.5 to 1.14.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.13.5...v1.14.0)

Updates `bare-fs` from 4.5.4 to 4.6.0
- [Release notes](https://github.com/holepunchto/bare-fs/releases)
- [Commits](holepunchto/bare-fs@v4.5.4...v4.6.0)

Updates `bare-os` from 3.6.2 to 3.8.7
- [Release notes](https://github.com/holepunchto/bare-os/releases)
- [Commits](holepunchto/bare-os@v3.6.2...v3.8.7)

Updates `bare-stream` from 2.8.0 to 2.12.0
- [Commits](holepunchto/bare-stream@v2.8.0...v2.12.0)

Updates `bare-url` from 2.3.2 to 2.4.0
- [Commits](holepunchto/bare-url@v2.3.2...v2.4.0)

Updates `express-rate-limit` from 8.2.1 to 8.3.2
- [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases)
- [Commits](express-rate-limit/express-rate-limit@v8.2.1...v8.3.2)

Updates `figlet` from 1.10.0 to 1.11.0
- [Release notes](https://github.com/patorjk/figlet.js/releases)
- [Commits](patorjk/figlet.js@v1.10.0...v1.11.0)

Updates `file-type` from 21.3.0 to 21.3.4
- [Release notes](https://github.com/sindresorhus/file-type/releases)
- [Commits](sindresorhus/file-type@v21.3.0...v21.3.4)

Updates `fs-extra` from 11.3.3 to 11.3.4
- [Changelog](https://github.com/jprichardson/node-fs-extra/blob/master/CHANGELOG.md)
- [Commits](jprichardson/node-fs-extra@11.3.3...11.3.4)

Updates `fuse.js` from 7.1.0 to 7.3.0
- [Release notes](https://github.com/krisk/Fuse/releases)
- [Changelog](https://github.com/krisk/Fuse/blob/main/CHANGELOG.md)
- [Commits](krisk/Fuse@v7.1.0...v7.3.0)

Updates `gaxios` from 7.1.3 to 7.1.4
- [Release notes](https://github.com/googleapis/google-cloud-node-core/releases)
- [Changelog](https://github.com/googleapis/google-cloud-node-core/blob/main/packages/gaxios/CHANGELOG.md)
- [Commits](https://github.com/googleapis/google-cloud-node-core/commits/gaxios-v7.1.4/packages/gaxios)

Updates `jackspeak` from 3.4.3 to 4.2.3
- [Changelog](https://github.com/isaacs/jackspeak/blob/main/changelog.md)
- [Commits](isaacs/jackspeak@v3.4.3...v4.2.3)

Updates `lru-cache` from 10.4.3 to 11.2.6
- [Changelog](https://github.com/isaacs/node-lru-cache/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-lru-cache@v10.4.3...v11.2.6)

Updates `path-scurry` from 1.11.1 to 2.0.2
- [Changelog](https://github.com/isaacs/path-scurry/blob/main/CHANGELOG.md)
- [Commits](isaacs/path-scurry@v1.11.1...v2.0.2)

Updates `google-auth-library` from 10.5.0 to 10.6.2
- [Release notes](https://github.com/googleapis/google-cloud-node-core/releases)
- [Changelog](https://github.com/googleapis/google-cloud-node-core/blob/main/packages/google-auth-library-nodejs/CHANGELOG.md)
- [Commits](https://github.com/googleapis/google-cloud-node-core/commits/google-auth-library-v10.6.2/packages/google-auth-library-nodejs)

Updates `hono` from 4.12.1 to 4.12.11
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.1...v4.12.11)

Updates `ip-address` from 10.0.1 to 10.1.0
- [Commits](https://github.com/beaugunderson/ip-address/commits)

Updates `koa` from 3.1.1 to 3.2.0
- [Release notes](https://github.com/koajs/koa/releases)
- [Changelog](https://github.com/koajs/koa/blob/master/History.md)
- [Commits](koajs/koa@v3.1.1...v3.2.0)

Updates `mcp-proxy` from 6.4.0 to 6.4.4
- [Release notes](https://github.com/punkpeye/mcp-proxy/releases)
- [Commits](punkpeye/mcp-proxy@v6.4.0...v6.4.4)

Updates `nan` from 2.25.0 to 2.26.2
- [Changelog](https://github.com/nodejs/nan/blob/main/CHANGELOG.md)
- [Commits](nodejs/nan@v2.25.0...v2.26.2)

Updates `node-abi` from 3.87.0 to 3.89.0
- [Release notes](https://github.com/electron/node-abi/releases)
- [Commits](electron/node-abi@v3.87.0...v3.89.0)

Updates `path-to-regexp` from 8.3.0 to 8.4.2
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.2)

Updates `proxy-from-env` from 1.1.0 to 2.1.0
- [Release notes](https://github.com/Rob--W/proxy-from-env/releases)
- [Commits](Rob--W/proxy-from-env@v1.1.0...v2.1.0)

Updates `pump` from 3.0.3 to 3.0.4
- [Commits](mafintosh/pump@v3.0.3...v3.0.4)

Updates `sql.js` from 1.14.0 to 1.14.1
- [Release notes](https://github.com/sql-js/sql.js/releases)
- [Commits](sql-js/sql.js@v1.14.0...v1.14.1)

Updates `streamx` from 2.23.0 to 2.25.0
- [Commits](mafintosh/streamx@v2.23.0...v2.25.0)

Updates `strtok3` from 10.3.4 to 10.3.5
- [Release notes](https://github.com/Borewit/strtok3/releases)
- [Commits](Borewit/strtok3@v10.3.4...v10.3.5)

Updates `undici` from 7.22.0 to 7.24.7
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.22.0...v7.24.7)

Updates `validator` from 13.15.26 to 13.15.35
- [Release notes](https://github.com/validatorjs/validator.js/releases)
- [Changelog](https://github.com/validatorjs/validator.js/blob/master/CHANGELOG.md)
- [Commits](validatorjs/validator.js@13.15.26...13.15.35)

Updates `ws` from 8.19.0 to 8.20.0
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.19.0...8.20.0)

Updates `yaml` from 2.8.2 to 2.8.3
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.8.2...v2.8.3)

Updates `zod-to-json-schema` from 3.25.1 to 3.25.2
- [Release notes](https://github.com/StefanTerdell/zod-to-json-schema/releases)
- [Changelog](https://github.com/StefanTerdell/zod-to-json-schema/blob/master/changelog.md)
- [Commits](https://github.com/StefanTerdell/zod-to-json-schema/commits)

---
updated-dependencies:
- dependency-name: cosmiconfig
  dependency-version: 9.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: handlebars
  dependency-version: 4.7.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@anthropic-ai/claude-code"
  dependency-version: 2.1.92
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@babel/runtime"
  dependency-version: 7.29.2
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@borewit/text-codec"
  dependency-version: 0.2.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@google/genai"
  dependency-version: 1.48.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@hono/node-server"
  dependency-version: 1.19.12
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.29.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@supabase/supabase-js"
  dependency-version: 2.101.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: fastmcp
  dependency-version: 3.35.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: xsschema
  dependency-version: 0.4.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: jose
  dependency-version: 6.1.3
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: axios
  dependency-version: 1.14.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: bare-fs
  dependency-version: 4.6.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: bare-os
  dependency-version: 3.8.7
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: bare-stream
  dependency-version: 2.12.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: bare-url
  dependency-version: 2.4.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: express-rate-limit
  dependency-version: 8.3.2
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: figlet
  dependency-version: 1.11.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: file-type
  dependency-version: 21.3.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: fs-extra
  dependency-version: 11.3.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: fuse.js
  dependency-version: 7.3.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: gaxios
  dependency-version: 7.1.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: jackspeak
  dependency-version: 4.2.3
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: lru-cache
  dependency-version: 11.2.6
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: path-scurry
  dependency-version: 2.0.2
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: google-auth-library
  dependency-version: 10.6.2
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: hono
  dependency-version: 4.12.11
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: ip-address
  dependency-version: 10.1.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: koa
  dependency-version: 3.2.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: mcp-proxy
  dependency-version: 6.4.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: nan
  dependency-version: 2.26.2
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: node-abi
  dependency-version: 3.89.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: path-to-regexp
  dependency-version: 8.4.2
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: proxy-from-env
  dependency-version: 2.1.0
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: pump
  dependency-version: 3.0.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: sql.js
  dependency-version: 1.14.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: streamx
  dependency-version: 2.25.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: strtok3
  dependency-version: 10.3.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: undici
  dependency-version: 7.24.7
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: validator
  dependency-version: 13.15.35
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: ws
  dependency-version: 8.20.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: yaml
  dependency-version: 2.8.3
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: zod-to-json-schema
  dependency-version: 3.25.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github
Copy link
Copy Markdown
Author

dependabot Bot commented on behalf of github Apr 6, 2026

Assignees

The following users could not be added as assignees: llm-dev-ops/maintainers. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 6, 2026

🔒 Security Scan Results

Scan Type Status
Dependency Scan ⚠️ failure
CodeQL Analysis ✅ success
Secret Scan ✅ success
License Check ⚠️ failure
SAST ⚠️ failure

⚠️ Some security scans have warnings or failed. Please review the details.

Automated security scanning by GitHub Actions

@dependabot @github
Copy link
Copy Markdown
Author

dependabot Bot commented on behalf of github Apr 13, 2026

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Apr 13, 2026
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-f6534a0250 branch April 13, 2026 09:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants