Skip to content

chore(deps): bump the production-dependencies group with 9 updates#324

Merged
gitstream-cm[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-15d1c97300
May 19, 2026
Merged

chore(deps): bump the production-dependencies group with 9 updates#324
gitstream-cm[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-15d1c97300

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 19, 2026

Bumps the production-dependencies group with 9 updates:

Package From To
@kubb/cli 4.37.5 4.37.7
@kubb/core 4.37.5 4.37.7
@kubb/plugin-client 4.37.5 4.37.7
@kubb/plugin-faker 4.37.5 4.37.7
@kubb/plugin-oas 4.37.5 4.37.7
@kubb/plugin-ts 4.37.5 4.37.7
@kubb/plugin-zod 4.37.5 4.37.7
@sentry/node 10.53.0 10.53.1
axios 1.16.0 1.16.1

Updates @kubb/cli from 4.37.5 to 4.37.7

Commits
Attestation changes

This version has no provenance attestation, while the previous version (4.37.5) was attested. Review the package versions before updating.


Updates @kubb/core from 4.37.5 to 4.37.7

Commits
Attestation changes

This version has no provenance attestation, while the previous version (4.37.5) was attested. Review the package versions before updating.


Updates @kubb/plugin-client from 4.37.5 to 4.37.7

Commits
Attestation changes

This version has no provenance attestation, while the previous version (4.37.5) was attested. Review the package versions before updating.


Updates @kubb/plugin-faker from 4.37.5 to 4.37.7

Commits
Attestation changes

This version has no provenance attestation, while the previous version (4.37.5) was attested. Review the package versions before updating.


Updates @kubb/plugin-oas from 4.37.5 to 4.37.7

Commits
Maintainer changes

This version was pushed to npm by stijnvanhulle, a new releaser for @​kubb/plugin-oas since your current version.


Updates @kubb/plugin-ts from 4.37.5 to 4.37.7

Commits
Attestation changes

This version has no provenance attestation, while the previous version (4.37.5) was attested. Review the package versions before updating.


Updates @kubb/plugin-zod from 4.37.5 to 4.37.7

Commits
Attestation changes

This version has no provenance attestation, while the previous version (4.37.5) was attested. Review the package versions before updating.


Updates @sentry/node from 10.53.0 to 10.53.1

Release notes

Sourced from @​sentry/node's releases.

10.53.1

  • fix(core): Don't gate user data for streamed spans at scope read time (#20827)
  • fix(core): Include subpath type shims in published package (#20835)
  • ref(hono): Consolidate route patching and add clarification comments (#20829)
  • chore(deps): Bump next from 15.5.15 to 15.5.18 in /dev-packages/e2e-tests/test-applications/nextjs-15-intl (#20821)

Bundle size 📦

Path Size
@​sentry/browser 26.22 KB
@​sentry/browser - with treeshaking flags 24.69 KB
@​sentry/browser (incl. Tracing) 43.69 KB
@​sentry/browser (incl. Tracing + Span Streaming) 45.62 KB
@​sentry/browser (incl. Tracing, Profiling) 48.56 KB
@​sentry/browser (incl. Tracing, Replay) 82.4 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags 72.08 KB
@​sentry/browser (incl. Tracing, Replay with Canvas) 86.99 KB
@​sentry/browser (incl. Tracing, Replay, Feedback) 99.33 KB
@​sentry/browser (incl. Feedback) 43 KB
@​sentry/browser (incl. sendFeedback) 30.92 KB
@​sentry/browser (incl. FeedbackAsync) 35.91 KB
@​sentry/browser (incl. Metrics) 27.27 KB
@​sentry/browser (incl. Logs) 27.42 KB
@​sentry/browser (incl. Metrics & Logs) 28.08 KB
@​sentry/react 27.92 KB
@​sentry/react (incl. Tracing) 45.9 KB
@​sentry/vue 31.01 KB
@​sentry/vue (incl. Tracing) 45.5 KB
@​sentry/svelte 26.24 KB
CDN Bundle 28.55 KB
CDN Bundle (incl. Tracing) 46.04 KB
CDN Bundle (incl. Logs, Metrics) 29.89 KB
CDN Bundle (incl. Tracing, Logs, Metrics) 47.14 KB
CDN Bundle (incl. Replay, Logs, Metrics) 68.3 KB
CDN Bundle (incl. Tracing, Replay) 82.55 KB
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) 83.6 KB
CDN Bundle (incl. Tracing, Replay, Feedback) 88.23 KB
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) 89.3 KB
CDN Bundle - uncompressed 83.97 KB
CDN Bundle (incl. Tracing) - uncompressed 138.12 KB
CDN Bundle (incl. Logs, Metrics) - uncompressed 88.07 KB
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed 141.5 KB
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed 209.97 KB

... (truncated)

Changelog

Sourced from @​sentry/node's changelog.

10.53.1

  • fix(core): Don't gate user data for streamed spans at scope read time (#20827)
  • fix(core): Include subpath type shims in published package (#20835)
  • ref(hono): Consolidate route patching and add clarification comments (#20829)
  • chore(deps): Bump next from 15.5.15 to 15.5.18 in /dev-packages/e2e-tests/test-applications/nextjs-15-intl (#20821)
Commits
  • cd97408 release: 10.53.1
  • 66cfb25 Merge pull request #20838 from getsentry/prepare-release/10.53.1
  • df8fd38 meta(changelog): Update changelog for 10.53.1
  • 5881009 fix(core): Include subpath type shims in published package (#20835)
  • 6a7d179 fix(core): Don't gate user data for streamed spans at scope read time (#20827)
  • ad47c3c ref(hono): Consolidate route patching and add clarification comments (#20829)
  • 28d6fe5 Merge pull request #20826 from getsentry/master
  • 46aca45 Merge branch 'release/10.53.0'
  • b5cbc9c chore(deps): Bump next from 15.5.15 to 15.5.18 in /dev-packages/e2e-tests/tes...
  • See full diff in compare view

Updates axios from 1.16.0 to 1.16.1

Release notes

Sourced from axios's releases.

v1.16.1 — May 13, 2026

This release ships a defence-in-depth fix for prototype pollution in formDataToJSON, hardens proxy and CI workflows, restores Webpack 4 compatibility for the fetch adapter, and includes several small bug fixes and maintenance improvements.

🔒 Security Fixes

  • Prototype Pollution Defence-in-Depth: Hardened formDataToJSON against already-polluted Object.prototype by walking own properties only, so attacker-controlled keys inherited from a poisoned prototype cannot propagate through deserialization. (#7413)
  • Proxy Cleartext Leak: Fixed an issue where HTTPS request data could be transmitted in cleartext to an HTTP proxy under certain configurations. (#10858)
  • CI Cache Removal: Removed all GitHub Actions caches as a defence-in-depth measure against cache poisoning vectors in the build pipeline. (#10882)

🐛 Bug Fixes

  • Data URI Parsing: Updated the fromDataURI regex to match RFC 2397 more strictly, fixing edge cases in data: URL handling. (#10829)
  • Unicode Headers: Preserved Unicode header values when running through request interceptors, so non-ASCII header content is no longer corrupted before dispatch. (#10850)
  • XHR Upload Progress: Guarded against malformed ProgressEvent payloads emitted by some environments during XHR upload, preventing crashes when loaded / total are missing or invalid. (#10868)
  • Webpack 4 Fetch Adapter: Fixed an "unexpected token" error caused by syntax in the fetch adapter that Webpack 4 could not parse, restoring compatibility for legacy bundler users. (#10864)
  • Type Definitions: Made parseReviver context.source optional in the type definitions to align with the ES2023 specification. (#10837)
  • URL Object Support Reverted: Reverted the change that allowed passing a URL object as config.url (originally #10866) due to regressions; this support will be reintroduced in a later release once the underlying issues are addressed. (#10874)

🔧 Maintenance & Chores

  • Cycle Detection Refactor: Replaced the array-based cycle tracker in toJSONObject with a WeakSet, improving performance and memory behaviour on large nested structures. (#10832)
  • composeSignals Cleanup: Refactored composeSignals to use a clearer early-return structure, simplifying the cancellation/abort composition path. (#10844)
  • AI Readiness & Repo Docs: Added AGENTS.md and related contributor-guide updates for both human and AI agents, plus post-release documentation improvements. (#10835, #10841)
  • Docs Improvements: Clarified the GET request example, fixed the interceptor eject example to reference the correct instance, and corrected the Buzzoid sponsor description in the README. (#10836, #10853, #10856)
  • Sponsorship Tooling: Fixed empty sponsor arrays in the sponsor processing script, added the ability to inject additional sponsors, updated the sponsorship link, and added a Twicsy advertisement entry. (#10843, #10859, #10869)
  • Dependencies: Bumped @commitlint/cli from 20.5.0 to 20.5.2. (#10846)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog

Changelog

Sourced from axios's changelog.

v1.16.1 — May 13, 2026

This release ships a defence-in-depth fix for prototype pollution in formDataToJSON, hardens proxy and CI workflows, restores Webpack 4 compatibility for the fetch adapter, and includes several small bug fixes and maintenance improvements.

🔒 Security Fixes

  • Prototype Pollution Defence-in-Depth: Hardened formDataToJSON against already-polluted Object.prototype by walking own properties only, so attacker-controlled keys inherited from a poisoned prototype cannot propagate through deserialization. (#7413)
  • Proxy Cleartext Leak: Fixed an issue where HTTPS request data could be transmitted in cleartext to an HTTP proxy under certain configurations. (#10858)
  • CI Cache Removal: Removed all GitHub Actions caches as a defence-in-depth measure against cache poisoning vectors in the build pipeline. (#10882)

🐛 Bug Fixes

  • Data URI Parsing: Updated the fromDataURI regex to match RFC 2397 more strictly, fixing edge cases in data: URL handling. (#10829)
  • Unicode Headers: Preserved Unicode header values when running through request interceptors, so non-ASCII header content is no longer corrupted before dispatch. (#10850)
  • XHR Upload Progress: Guarded against malformed ProgressEvent payloads emitted by some environments during XHR upload, preventing crashes when loaded / total are missing or invalid. (#10868)
  • Webpack 4 Fetch Adapter: Fixed an "unexpected token" error caused by syntax in the fetch adapter that Webpack 4 could not parse, restoring compatibility for legacy bundler users. (#10864)
  • Type Definitions: Made parseReviver context.source optional in the type definitions to align with the ES2023 specification. (#10837)
  • URL Object Support Reverted: Reverted the change that allowed passing a URL object as config.url (originally #10866) due to regressions; this support will be reintroduced in a later release once the underlying issues are addressed. (#10874)

🔧 Maintenance & Chores

  • Cycle Detection Refactor: Replaced the array-based cycle tracker in toJSONObject with a WeakSet, improving performance and memory behaviour on large nested structures. (#10832)
  • composeSignals Cleanup: Refactored composeSignals to use a clearer early-return structure, simplifying the cancellation/abort composition path. (#10844)
  • AI Readiness & Repo Docs: Added AGENTS.md and related contributor-guide updates for both human and AI agents, plus post-release documentation improvements. (#10835, #10841)
  • Docs Improvements: Clarified the GET request example, fixed the interceptor eject example to reference the correct instance, and corrected the Buzzoid sponsor description in the README. (#10836, #10853, #10856)
  • Sponsorship Tooling: Fixed empty sponsor arrays in the sponsor processing script, added the ability to inject additional sponsors, updated the sponsorship link, and added a Twicsy advertisement entry. (#10843, #10859, #10869)
  • Dependencies: Bumped @commitlint/cli from 20.5.0 to 20.5.2. (#10846)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog

Commits
  • 1337d6b chore(release): prepare release 1.16.1 (#10877)
  • 858a790 fix: remove all caches (#10882)
  • 34adfd9 revert: "fix: support URL object as config.url input (#10866)" (#10874)
  • 847d89b fix: support URL object as config.url input (#10866)
  • 4094886 fix(progress): guard malformed XHR upload events (#10868)
  • 44f0c5b chore: change sponsorship link and add Twicsy advertisement (#10869)
  • 64e1095 chore: update PR and issue template to use h2 (#10865)
  • 3e6b4e1 fix: error unexpected token in fetch JS compatibility issue with Webpack 4 (#...
  • c4453ba fix: add the ability to add additional sponsors to the process sponsors scrip...
  • caa00a9 fix: https data in cleartext to proxy (#10858)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the production-dependencies group with 9 updates:

| Package | From | To |
| --- | --- | --- |
| [@kubb/cli](https://github.com/kubb-labs/kubb/tree/HEAD/packages/cli) | `4.37.5` | `4.37.7` |
| [@kubb/core](https://github.com/kubb-labs/kubb/tree/HEAD/packages/core) | `4.37.5` | `4.37.7` |
| [@kubb/plugin-client](https://github.com/kubb-labs/kubb/tree/HEAD/packages/plugin-client) | `4.37.5` | `4.37.7` |
| [@kubb/plugin-faker](https://github.com/kubb-labs/kubb/tree/HEAD/packages/plugin-faker) | `4.37.5` | `4.37.7` |
| [@kubb/plugin-oas](https://github.com/kubb-labs/kubb/tree/HEAD/packages/plugin-oas) | `4.37.5` | `4.37.7` |
| [@kubb/plugin-ts](https://github.com/kubb-labs/kubb/tree/HEAD/packages/plugin-ts) | `4.37.5` | `4.37.7` |
| [@kubb/plugin-zod](https://github.com/kubb-labs/kubb/tree/HEAD/packages/plugin-zod) | `4.37.5` | `4.37.7` |
| [@sentry/node](https://github.com/getsentry/sentry-javascript) | `10.53.0` | `10.53.1` |
| [axios](https://github.com/axios/axios) | `1.16.0` | `1.16.1` |


Updates `@kubb/cli` from 4.37.5 to 4.37.7
- [Release notes](https://github.com/kubb-labs/kubb/releases)
- [Changelog](https://github.com/kubb-labs/kubb/blob/main/CHANGELOG.md)
- [Commits](https://github.com/kubb-labs/kubb/commits/HEAD/packages/cli)

Updates `@kubb/core` from 4.37.5 to 4.37.7
- [Release notes](https://github.com/kubb-labs/kubb/releases)
- [Changelog](https://github.com/kubb-labs/kubb/blob/main/CHANGELOG.md)
- [Commits](https://github.com/kubb-labs/kubb/commits/HEAD/packages/core)

Updates `@kubb/plugin-client` from 4.37.5 to 4.37.7
- [Release notes](https://github.com/kubb-labs/kubb/releases)
- [Commits](https://github.com/kubb-labs/kubb/commits/HEAD/packages/plugin-client)

Updates `@kubb/plugin-faker` from 4.37.5 to 4.37.7
- [Release notes](https://github.com/kubb-labs/kubb/releases)
- [Commits](https://github.com/kubb-labs/kubb/commits/HEAD/packages/plugin-faker)

Updates `@kubb/plugin-oas` from 4.37.5 to 4.37.7
- [Release notes](https://github.com/kubb-labs/kubb/releases)
- [Commits](https://github.com/kubb-labs/kubb/commits/HEAD/packages/plugin-oas)

Updates `@kubb/plugin-ts` from 4.37.5 to 4.37.7
- [Release notes](https://github.com/kubb-labs/kubb/releases)
- [Commits](https://github.com/kubb-labs/kubb/commits/HEAD/packages/plugin-ts)

Updates `@kubb/plugin-zod` from 4.37.5 to 4.37.7
- [Release notes](https://github.com/kubb-labs/kubb/releases)
- [Commits](https://github.com/kubb-labs/kubb/commits/HEAD/packages/plugin-zod)

Updates `@sentry/node` from 10.53.0 to 10.53.1
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.53.0...10.53.1)

Updates `axios` from 1.16.0 to 1.16.1
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.16.0...v1.16.1)

---
updated-dependencies:
- dependency-name: "@kubb/cli"
  dependency-version: 4.37.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@kubb/core"
  dependency-version: 4.37.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@kubb/plugin-client"
  dependency-version: 4.37.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@kubb/plugin-faker"
  dependency-version: 4.37.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@kubb/plugin-oas"
  dependency-version: 4.37.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@kubb/plugin-ts"
  dependency-version: 4.37.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@kubb/plugin-zod"
  dependency-version: 4.37.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@sentry/node"
  dependency-version: 10.53.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: axios
  dependency-version: 1.16.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 19, 2026
@gitstream-cm gitstream-cm Bot merged commit 824c0d9 into main May 19, 2026
11 checks passed
@gitstream-cm
Copy link
Copy Markdown
Contributor

gitstream-cm Bot commented May 19, 2026

🤖 Dependabot PR automatically approved and merged by GitStream.

This PR has been automatically:

  • ✅ Approved
  • 🏷️ Labeled as approved-dependabot
  • 🔀 Merged (squash merge)

All status checks were required to pass before merging.

@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-15d1c97300 branch May 19, 2026 19:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

1 min review approved-dependabot dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code safe-changes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants